From bbf23757667f732c16c3aaf169e3b5ebc00785cc Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Mon, 14 Aug 2000 02:55:24 +0000
Subject: [PATCH 001/868] package build for OpenBSD

---
 Build/build-openbsd/pkg/COMMENT | 1 +
 Build/build-openbsd/pkg/DESCR   | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 Build/build-openbsd/pkg/COMMENT
 create mode 100644 Build/build-openbsd/pkg/DESCR

diff --git a/Build/build-openbsd/pkg/COMMENT b/Build/build-openbsd/pkg/COMMENT
new file mode 100644
index 0000000..61e03fc
--- /dev/null
+++ b/Build/build-openbsd/pkg/COMMENT
@@ -0,0 +1 @@
+Python interface to LDAP
diff --git a/Build/build-openbsd/pkg/DESCR b/Build/build-openbsd/pkg/DESCR
new file mode 100644
index 0000000..d3cf0cc
--- /dev/null
+++ b/Build/build-openbsd/pkg/DESCR
@@ -0,0 +1,2 @@
+This Python library provides access to the LDAP (Lightweight Directory Access 
+Protocol) RFC1823 C interface.

From 4e58d8da7d934d53ba27256897656dacae001896 Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Sun, 20 Aug 2000 15:04:23 +0000
Subject: [PATCH 002/868] use the filelist

---
 Build/build-openbsd/Makefile  | 31 +++++++++++++++++++++++++++++++
 Build/build-openbsd/pkg/PLIST |  3 +++
 2 files changed, 34 insertions(+)
 create mode 100644 Build/build-openbsd/Makefile
 create mode 100644 Build/build-openbsd/pkg/PLIST

diff --git a/Build/build-openbsd/Makefile b/Build/build-openbsd/Makefile
new file mode 100644
index 0000000..fac650f
--- /dev/null
+++ b/Build/build-openbsd/Makefile
@@ -0,0 +1,31 @@
+# $Id: Makefile,v 1.3 2000/08/20 15:04:23 leonard Exp $
+
+WRKDIST=		${.CURDIR}/../..
+VERSION!=		sh ${WRKDIST}/Build/version.sh
+
+PKGNAME=		python-ldap-${VERSION}
+RUN_DEPENDS=		python:lang/python
+CATEGORIES=		misc
+MAINATINER=		leonard@users.sourceforge.net
+HOMEPAGE=		http://python-ldap.sourceforge.net/
+
+FAKE=			Yes
+CONFIGURE_STYLE=	gnu
+SEPARATE_BUILD=		Yes
+EXTRACT_ONLY=	
+
+CONFIGURE_ARGS+=	--with-ldap=${LOCALBASE}
+
+do-fetch:;
+
+#-- put package on sourceforge ftp server
+export-ftp: ${PKGFILE}
+	scp ${PKGFILE} python-ldap.sourceforge.net:/home/groups/ftp/pub/python-ldap/${PKGNAME}-${OPSYS}-${ARCH}${PKG_SUFX}
+
+post-build:
+	sed -e 's,^${PREFIX}/,,' <${WRKBUILD}/filelist >${WRKBUILD}/filelist2
+
+SED_PLIST+=	|sed -e '/^%%filelist/r${WRKBUILD}/filelist2' -e '//d'
+ALL_TARGET=	build filelist
+
+.include <bsd.port.mk>
diff --git a/Build/build-openbsd/pkg/PLIST b/Build/build-openbsd/pkg/PLIST
new file mode 100644
index 0000000..e2fa811
--- /dev/null
+++ b/Build/build-openbsd/pkg/PLIST
@@ -0,0 +1,3 @@
+@comment $OpenBSD$
+%%filelist
+@dirrm lib/python1.6/site-packages/python-ldap

From 6a6b43f5521ce6567a61556e026ec4cd5f275dca Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Dec 2001 22:04:49 +0000
Subject: [PATCH 003/868] New parameter process_url_scheme for
 LDIFParser.__init__() specifies which URL schemes are processed in URL input.

---
 Demo/Lib/ldif/ldifcopy.py | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 Demo/Lib/ldif/ldifcopy.py

diff --git a/Demo/Lib/ldif/ldifcopy.py b/Demo/Lib/ldif/ldifcopy.py
new file mode 100644
index 0000000..28c8e6e
--- /dev/null
+++ b/Demo/Lib/ldif/ldifcopy.py
@@ -0,0 +1,28 @@
+"""
+ldifcopy - reads LDIF from stdin, retrieve values by URL and
+           write resulting LDIF to stdout
+
+Written by Michael Stroeder <michael@stroeder.com>
+
+$Id: ldifcopy.py,v 1.2 2001/12/12 22:04:49 stroeder Exp $
+
+This example translates the naming context of data read from
+input, sanitizes some attributes, maps/removes object classes,
+maps/removes attributes., etc. It's far from being complete though.
+
+Python compability note:
+Tested on Python 2.0+, should run on Python 1.5.x.
+"""
+
+import sys,ldif
+
+infile = sys.stdin
+outfile = sys.stdout
+
+ldif_collector = ldif.LDIFCopy(
+  infile,
+  outfile,
+  process_url_schemes=['file','ftp','http']
+)
+ldif_collector.parse()
+

From 690068eb9bc0a8f643520852ff55b675003e49c3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 19 Dec 2001 15:24:57 +0000
Subject: [PATCH 004/868] Use ldap.explode_dn() instead of string.split() for
 breaking dn into components

---
 Demo/simplebrowse.py | 128 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 Demo/simplebrowse.py

diff --git a/Demo/simplebrowse.py b/Demo/simplebrowse.py
new file mode 100644
index 0000000..f8e7182
--- /dev/null
+++ b/Demo/simplebrowse.py
@@ -0,0 +1,128 @@
+#! python
+
+#
+# simple LDAP server browsing example
+#
+
+import ldap
+import string
+from traceback import print_exc
+
+url = "ldap://ldap.openldap.org/"
+dn = "dc=openldap,dc=org"
+
+print "Connecting to", url
+
+l = ldap.initialize(url)
+l.bind_s("", "", ldap.AUTH_SIMPLE);
+
+lastdn = dn
+dnlist = None
+
+while 1:
+
+    #-- read a command
+    try:
+        cmd = raw_input(dn + "> ")
+    except EOFError:
+	print
+	break
+
+    try:
+
+	if cmd == "?":
+		print  "cd <dn>	- change DN to <dn>"
+		print  "cd <n>	- change DN to number <n> of last 'ls'"
+		print  "cd -	- change to previous DN"
+		print  "cd ..	- change to one-level higher DN"
+		print  "cd 	- change to root DN"
+		print  "ls	- list children of crrent DN"
+		print  ".	- show attributes of current DN"
+		print  "/<expr>	- list descendents matching filter <expr>"
+		print  "?	- show this help"
+
+	elif cmd == "ls":
+		print "Children of", `dn`, ":"
+		dnlist = []
+		#
+		# List the children at one level down from the current dn
+		# We use the filter 'objectclass=*' to match everything.
+		# We're not interested in attributes at this stage, so
+		# we specify [] as the list of attribute names to retreive.
+		#
+		for name,attrs in l.search_s(dn, ldap.SCOPE_ONELEVEL, 
+		    "objectclass=*", []):
+			#-- shorten resulting dns for output brevity
+			if name.startswith(dn+", "):
+				shortname = "+ "+name[len(dn)+2:]
+			elif name.endswith(", "+dn):
+				shortname = name[:-len(dn)-2]+" +"
+			else:
+				shortname = name
+			print " %3d. %s" % (len(dnlist), shortname)
+			dnlist.append(name)
+
+	elif cmd == "cd":
+		dn = ""
+		dnlist = None
+
+	elif cmd.startswith("cd "):
+		arg = cmd[3:]
+		if arg == '-':
+			lastdn,dn = dn,lastdn
+		elif arg == '..':
+			dn = string.join(ldap.explode_dn(dn)[1:], ",")
+			dn = string.strip(dn)
+                else:
+		        try:
+			        i = int(arg)
+		        except:
+			        godn = arg
+                        else:
+			        if dnlist is None:
+				        print "do an ls first"
+                                else:
+			                godn = dnlist[i]
+		                lastdn = dn
+		                dn = godn
+
+	elif cmd == ".":
+		#
+		# Retrieve all the attributes for the current dn.
+		# We construct a search using SCOPE_BASE (ie just the
+		# given DN) and again filter with "objectclass=*".
+		# No attributes are listed, so the default is for
+		# the client to receive all attributes on the DN.
+		#
+		print "Attributes of", `dn`, ":"
+		for name,attrs in l.search_s(dn, ldap.SCOPE_BASE,
+		    "objectclass=*"):
+			print "  %-24s" % name
+			for k,vals in attrs.items():
+			    for v in vals:
+				if len(v) > 200: 
+					v = `v[:200]` + \
+						("... (%d bytes)" % len(v))
+				else:
+					v = `v`
+				print "      %-12s: %s" % (k, v)
+
+	elif cmd.startswith("/"):
+		#
+		# Search descendent objects to match a given filter.
+		# We use SCOPE_SUBTREE to indicate descendents, and
+		# again specify an empty attribute list to indicate
+		# that we're not interested in them.
+		#
+		expr = cmd[1:]
+		print "Descendents matching filter", `expr`, ":"
+		for name,attrs in l.search_s(dn, ldap.SCOPE_SUBTREE,
+		    expr, []):
+			print "  %24s", name
+
+	else:
+		print "unknown command - try '?' for help"
+
+    except:
+	print_exc()
+

From 202bbedd81fdc2099ef2d03d39878fd1ffe1e1d1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 1 Feb 2002 11:41:02 +0000
Subject: [PATCH 005/868] Use ldap.initialize() instead of deprecated
 ldap.open() in all demos.

---
 Demo/rename.py |  52 ++++++++++++++++++++++++
 Demo/simple.py | 106 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 158 insertions(+)
 create mode 100644 Demo/rename.py
 create mode 100644 Demo/simple.py

diff --git a/Demo/rename.py b/Demo/rename.py
new file mode 100644
index 0000000..1bb6fd7
--- /dev/null
+++ b/Demo/rename.py
@@ -0,0 +1,52 @@
+import ldap
+from getpass import getpass
+
+# Create LDAPObject instance
+l = ldap.initialize('ldap://localhost:1389',trace_level=1)
+
+print 'Password:'
+cred = getpass()
+
+try:
+
+  # Set LDAP protocol version used
+  l.set_option(ldap.OPT_PROTOCOL_VERSION,3)
+
+  # Try a bind to provoke failure if protocol version is not supported
+  l.bind_s('cn=root,dc=stroeder,dc=com',cred,ldap.AUTH_SIMPLE)
+
+  print 'Using rename_s():'
+
+  l.rename_s(
+    'uid=fred,ou=Unstructured testing tree,dc=stroeder,dc=com',
+    'cn=Fred Feuerstein',
+    'dc=stroeder,dc=com',
+    0
+  )
+
+  l.rename_s(
+    'cn=Fred Feuerstein,dc=stroeder,dc=com',
+    'uid=fred',
+    'ou=Unstructured testing tree,dc=stroeder,dc=com',
+    0
+  )
+
+  m = l.rename(
+    'uid=fred,ou=Unstructured testing tree,dc=stroeder,dc=com',
+    'cn=Fred Feuerstein',
+    'dc=stroeder,dc=com',
+    0
+  )
+  r = l.result(m,1)
+
+  m = l.rename(
+    'cn=Fred Feuerstein,dc=stroeder,dc=com',
+    'uid=fred',
+    'ou=Unstructured testing tree,dc=stroeder,dc=com',
+    0
+  )
+  r = l.result(m,1)
+
+finally:
+
+  l.unbind_s()
diff --git a/Demo/simple.py b/Demo/simple.py
new file mode 100644
index 0000000..e4cf4d0
--- /dev/null
+++ b/Demo/simple.py
@@ -0,0 +1,106 @@
+import sys,getpass
+import ldap
+
+#l = ldap.open("localhost", 31001)
+l = ldap.open("marta.it.uq.edu.au")
+
+login_dn = "cn=root,ou=CSEE,o=UQ,c=AU"
+login_pw = getpass.getpass("Password for %s: " % login_dn)
+l.simple_bind_s(login_dn, login_pw)
+
+#
+# create a new sub organisation
+#
+
+try:
+    dn = "ou=CSEE,o=UQ,c=AU"
+    print "Adding", repr(dn)
+    l.add_s(dn,
+	 [
+	    ("objectclass",["organizationalUnit"]),
+	    ("ou", ["CSEE"]),
+	    ("description", [
+		    "Department of Computer Science and Electrical Engineering"]),
+	 ]
+       )
+
+except _ldap.LDAPError:
+    pass
+
+#
+# create an entry for me
+#
+
+dn = "cn=David Leonard,ou=CSEE,o=UQ,c=AU"
+print "Updating", repr(dn)
+
+try:
+	l.delete_s(dn)
+except:
+	pass
+
+l.add_s(dn,
+     [
+	("objectclass",			["organizationalPerson"]),
+	("sn",				["Leonard"]),
+	("cn",				["David Leonard"]),
+	("description",			["Ph.D. student"]),
+	("display-name",		["David Leonard"]),
+	#("commonname",			["David Leonard"]),
+	("mail",			["david.leonard@csee.uq.edu.au"]),
+	("othermailbox",		["d@openbsd.org"]),
+	("givenname",			["David"]),
+	("surname",			["Leonard"]),
+	("seeAlso",			["http://www.csee.uq.edu.au/~leonard/"]),
+	("url",				["http://www.csee.uq.edu.au/~leonard/"]),
+	#("homephone",			[]),
+	#("fax",			[]),
+	#("otherfacsimiletelephonenumber",[]),
+	#("officefax",			[]),
+	#("mobile",			[]),
+	#("otherpager",			[]),
+	#("officepager",		[]),
+	#("pager",			[]),
+	("info",			["info"]),
+	("title",			["Mr"]),
+	#("telephonenumber",		[]),
+	("l",				["Brisbane"]),
+	("st",				["Queensland"]),
+	("c",				["AU"]),
+	("co",				["co"]),
+	("o",				["UQ"]),
+	("ou",				["CSEE"]),
+	#("homepostaladdress",		[]),
+	#("postaladdress",		[]),
+	#("streetaddress",		[]),
+	#("street",			[]),
+	("department",			["CSEE"]),
+	("comment",			["comment"]),
+	#("postalcode",			[]),
+	("physicaldeliveryofficename",  ["Bldg 78, UQ, St Lucia"]),
+	("preferredDeliveryMethod",	["email"]),
+	("initials",			["DRL"]),
+	("conferenceinformation",	["MS-conferenceinformation"]),
+	#("usercertificate",		[]),
+	("labeleduri",			["labeleduri"]),
+	("manager",			["cn=Jaga Indulska"]),
+	("reports",			["reports"]),
+	("jpegPhoto",			[open("/www/leonard/leonard.jpg","r").read()]),
+	("uid",				["leonard"]),
+	("userPassword",		[""])
+
+    ])
+
+#
+# search beneath the CSEE/UQ/AU tree
+#
+
+res = l.search_s(
+	"ou=CSEE, o=UQ, c=AU", 
+	_ldap.SCOPE_SUBTREE, 
+	"objectclass=*",
+      )
+print res
+
+l.unbind()
+

From c2c11cb5d9e23344bf4c380eb157d33979d4a554 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 4 May 2002 18:39:58 +0000
Subject: [PATCH 006/868] Ignore non.CVS files

---
 Lib/.cvsignore      | 4 ++++
 Lib/ldap/.cvsignore | 4 ++++
 2 files changed, 8 insertions(+)
 create mode 100644 Lib/.cvsignore
 create mode 100644 Lib/ldap/.cvsignore

diff --git a/Lib/.cvsignore b/Lib/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Lib/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~
diff --git a/Lib/ldap/.cvsignore b/Lib/ldap/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Lib/ldap/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~

From c2c298491032ff946b941f1c94a0e91f2e440369 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 30 Jun 2002 21:07:56 +0000
Subject: [PATCH 007/868] *** empty log message ***

---
 .cvsignore | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 .cvsignore

diff --git a/.cvsignore b/.cvsignore
new file mode 100644
index 0000000..1a36453
--- /dev/null
+++ b/.cvsignore
@@ -0,0 +1,7 @@
+build
+dist
+MANIFEST
+*.pyc
+*.pyo
+*.bck
+*~

From ec40702fcdaaab99fd3bfb2b8f8b30255c10cdfb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 30 Jun 2002 21:09:47 +0000
Subject: [PATCH 008/868] Ignore editor backup files

---
 Modules/.cvsignore | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 Modules/.cvsignore

diff --git a/Modules/.cvsignore b/Modules/.cvsignore
new file mode 100644
index 0000000..244b105
--- /dev/null
+++ b/Modules/.cvsignore
@@ -0,0 +1,2 @@
+*.bck
+*~

From c95f7627c92760b1c6c95f70c04fdf34c181564f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 30 Jun 2002 21:13:47 +0000
Subject: [PATCH 009/868] Demo/Lib/ldap/async/.cvsignore

---
 Demo/.cvsignore          | 4 ++++
 Demo/Lib/.cvsignore      | 4 ++++
 Demo/Lib/ldap/.cvsignore | 4 ++++
 Demo/Lib/ldif/.cvsignore | 4 ++++
 4 files changed, 16 insertions(+)
 create mode 100644 Demo/.cvsignore
 create mode 100644 Demo/Lib/.cvsignore
 create mode 100644 Demo/Lib/ldap/.cvsignore
 create mode 100644 Demo/Lib/ldif/.cvsignore

diff --git a/Demo/.cvsignore b/Demo/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Demo/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~
diff --git a/Demo/Lib/.cvsignore b/Demo/Lib/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Demo/Lib/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~
diff --git a/Demo/Lib/ldap/.cvsignore b/Demo/Lib/ldap/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Demo/Lib/ldap/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~
diff --git a/Demo/Lib/ldif/.cvsignore b/Demo/Lib/ldif/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Demo/Lib/ldif/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~

From 96e2046dc5c66fcfa56517c4d3ff8b68a133d082 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 25 Jul 2002 15:15:17 +0000
Subject: [PATCH 010/868] *** empty log message ***

---
 Demo/Lib/ldap/async/.cvsignore | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 Demo/Lib/ldap/async/.cvsignore

diff --git a/Demo/Lib/ldap/async/.cvsignore b/Demo/Lib/ldap/async/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Demo/Lib/ldap/async/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~

From 51b9a697c18285d6d6944a49a11ae179ecafe921 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 7 Aug 2002 15:39:34 +0000
Subject: [PATCH 011/868] Demo for ldap.ldapobject.ReconnectLDAPObject

---
 Demo/reconnect.py | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 Demo/reconnect.py

diff --git a/Demo/reconnect.py b/Demo/reconnect.py
new file mode 100644
index 0000000..af3d875
--- /dev/null
+++ b/Demo/reconnect.py
@@ -0,0 +1,24 @@
+import sys,time,ldap,ldap.ldapobject,ldapurl
+
+from ldap.ldapobject import *
+
+ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+ldap_url.applyDefaults({
+  'who':'',
+  'cred':'',
+  'filterstr':'(objectClass=*)',
+  'scope':ldap.SCOPE_BASE
+})
+
+ldap.trace_level=1
+
+l = ldap.ldapobject.ReconnectLDAPObject(
+  ldap_url.initializeUrl(),trace_level=ldap.trace_level
+)
+l.protocol_version = ldap.VERSION3
+
+l.simple_bind_s(ldap_url.who,ldap_url.cred)
+
+while 1:
+  l.search_s(ldap_url.dn,ldap_url.scope,ldap_url.filterstr,ldap_url.attrs)
+  sys.stdin.readline()

From 217cd34e47bd15eb91b8bd14784487b0770ed202 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 8 Aug 2002 09:17:41 +0000
Subject: [PATCH 012/868] Fixed LDAPUrlExtensions.__eq__() and test suite

---
 Tests/Lib/test_ldapurl.py | 154 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 154 insertions(+)
 create mode 100644 Tests/Lib/test_ldapurl.py

diff --git a/Tests/Lib/test_ldapurl.py b/Tests/Lib/test_ldapurl.py
new file mode 100644
index 0000000..0016683
--- /dev/null
+++ b/Tests/Lib/test_ldapurl.py
@@ -0,0 +1,154 @@
+"""
+Performes various tests for module ldapurl
+"""
+
+import ldapurl
+from ldapurl import *
+
+print '\nTesting function isLDAPUrl():'
+is_ldap_url_tests = {
+  # Examples from RFC2255
+  'ldap:///o=University%20of%20Michigan,c=US':1,
+  'ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,c=US':1,
+  'ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,':1,
+  'ldap://host.com:6666/o=University%20of%20Michigan,':1,
+  'ldap://ldap.itd.umich.edu/c=GB?objectClass?one':1,
+  'ldap://ldap.question.com/o=Question%3f,c=US?mail':1,
+  'ldap://ldap.netscape.com/o=Babsco,c=US??(int=%5c00%5c00%5c00%5c04)':1,
+  'ldap:///??sub??bindname=cn=Manager%2co=Foo':1,
+  'ldap:///??sub??!bindname=cn=Manager%2co=Foo':1,
+  # More examples from various sources
+  'ldap://ldap.nameflow.net:1389/c%3dDE':1,
+  'ldap://root.openldap.org/dc=openldap,dc=org':1,
+  'ldap://root.openldap.org/dc=openldap,dc=org':1,
+  'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61':1,
+  'ldp://root.openldap.org/dc=openldap,dc=org':0,
+  'ldap://localhost:1389/ou%3DUnstructured%20testing%20tree%2Cdc%3Dstroeder%2Cdc%3Dcom??one':1,
+}
+for ldap_url in is_ldap_url_tests.keys():
+  result_is_ldap_url = isLDAPUrl(ldap_url)
+  if result_is_ldap_url !=is_ldap_url_tests[ldap_url]:
+    print 'isLDAPUrl("%s") returns %d instead of %d.' % (
+      repr(ldap_url),result_is_ldap_url,is_ldap_url_tests[ldap_url]
+    )
+
+print '\nTesting class LDAPUrl:'
+parse_ldap_url_tests = [
+  (
+    'ldap://root.openldap.org/dc=openldap,dc=org',
+    LDAPUrl(
+      hostport='root.openldap.org',
+      dn='dc=openldap,dc=org'
+    )
+  ),
+  (
+    'ldap://root.openldap.org/dc%3dboolean%2cdc%3dnet???%28objectClass%3d%2a%29',
+    LDAPUrl(
+      hostport='root.openldap.org',
+      dn='dc=boolean,dc=net',
+      filterstr='(objectClass=*)'
+    )
+  ),
+  (
+    'ldap://root.openldap.org/dc=openldap,dc=org??sub?',
+    LDAPUrl(
+      hostport='root.openldap.org',
+      dn='dc=openldap,dc=org',
+      scope=ldapurl.LDAP_SCOPE_SUBTREE
+    )
+  ),
+  (
+    'ldap://root.openldap.org/dc=openldap,dc=org??one?',
+    LDAPUrl(
+      hostport='root.openldap.org',
+      dn='dc=openldap,dc=org',
+      scope=ldapurl.LDAP_SCOPE_ONELEVEL
+    )
+  ),
+  (
+    'ldap://root.openldap.org/dc=openldap,dc=org??base?',
+    LDAPUrl(
+      hostport='root.openldap.org',
+      dn='dc=openldap,dc=org',
+      scope=ldapurl.LDAP_SCOPE_BASE
+    )
+  ),
+  (
+    'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61',
+    LDAPUrl(
+      hostport='x500.mh.se',
+      dn='o=Mitthogskolan,c=se',
+      extensions=LDAPUrlExtensions({
+        '1.2.752.58.10.2':ldapurl.LDAPUrlExtension(
+          critical=0,extype='1.2.752.58.10.2',exvalue='T.61'
+        )
+      })
+    )
+  ),
+  (
+    'ldap://localhost:12345/dc=stroeder,dc=com????!bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,!X-BINDPW=secretpassword',
+    LDAPUrl(
+      hostport='localhost:12345',
+      dn='dc=stroeder,dc=com',
+      extensions=LDAPUrlExtensions({
+        'bindname':LDAPUrlExtension(
+          critical=1,extype='bindname',exvalue='cn=Michael,dc=stroeder,dc=com'
+        ),
+        'X-BINDPW':LDAPUrlExtension(
+          critical=1,extype='X-BINDPW',exvalue='secretpassword'
+        ),
+      }),
+    )
+  ),
+  (
+    'ldap://localhost:54321/dc=stroeder,dc=com????bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,X-BINDPW=secretpassword',
+    LDAPUrl(
+      hostport='localhost:54321',
+      dn='dc=stroeder,dc=com',
+      who='cn=Michael,dc=stroeder,dc=com',
+      cred='secretpassword'
+    )
+  ),
+  (
+    'ldaps://localhost:12345/dc=stroeder,dc=com',
+    LDAPUrl(
+      urlscheme='ldaps',
+      hostport='localhost:12345',
+      dn='dc=stroeder,dc=com',
+    ),
+  ),
+  (
+    'ldapi://%2ftmp%2fopenldap2-1389/dc=stroeder,dc=com',
+    LDAPUrl(
+      urlscheme='ldapi',
+      hostport='/tmp/openldap2-1389',
+      dn='dc=stroeder,dc=com',
+    ),
+  ),
+]
+
+for ldap_url_str,test_ldap_url_obj in parse_ldap_url_tests:
+#  print '\nTesting LDAP URL:',repr(ldap_url)
+  ldap_url_obj = LDAPUrl(ldapUrl=ldap_url_str)
+  print '#'*72
+  print test_ldap_url_obj.unparse()
+  if ldap_url_obj.__ne__(test_ldap_url_obj):
+    print '-'*72
+    print 'Parsing error! Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
+      repr(ldap_url_str),
+      repr(ldap_url_obj),
+      repr(test_ldap_url_obj)
+    )
+  else:
+    print 'Parsing ok'
+    unparsed_ldap_url_str = test_ldap_url_obj.unparse()
+    unparsed_ldap_url_obj = LDAPUrl(ldapUrl=unparsed_ldap_url_str)
+    if unparsed_ldap_url_obj.__ne__(test_ldap_url_obj):
+      print '-'*72
+      print 'Unparsing error! Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
+        repr(unparsed_ldap_url_str),
+        repr(unparsed_ldap_url_obj),
+        repr(test_ldap_url_obj)
+      )
+    else:
+      print 'Unparsing ok'

From 8274be65d19cf5c66332cbfed7e9109b2f91d93c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 5 Sep 2002 21:51:56 +0000
Subject: [PATCH 013/868] Lib/ldap/schema/.cvsignore

---
 Lib/ldap/schema/.cvsignore | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 Lib/ldap/schema/.cvsignore

diff --git a/Lib/ldap/schema/.cvsignore b/Lib/ldap/schema/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Lib/ldap/schema/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~

From fe06432b1bb7c96b90e809f9ec935101467ed9ea Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 2 Feb 2003 22:31:24 +0000
Subject: [PATCH 014/868] Attribute charset not available in recent ldapurl
 anymore

---
 Demo/Lib/ldapurl/urlsearch.py | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 Demo/Lib/ldapurl/urlsearch.py

diff --git a/Demo/Lib/ldapurl/urlsearch.py b/Demo/Lib/ldapurl/urlsearch.py
new file mode 100644
index 0000000..996e6da
--- /dev/null
+++ b/Demo/Lib/ldapurl/urlsearch.py
@@ -0,0 +1,32 @@
+"""
+Do a search with the LDAP URL specified at command-line.
+
+No output of LDAP data is produced except trace output.
+"""
+
+import sys,getpass,ldap,ldapurl
+
+try:
+  ldapUrl = ldapurl.LDAPUrl(ldapUrl=sys.argv[1])
+except IndexError:
+  print 'Usage: %s [LDAP URL]' % (sys.argv[0])
+  sys.exit(1)
+
+for a in [
+  'urlscheme','hostport','dn','attrs','scope',
+  'filterstr','extensions','who','cred'
+]:
+  print a,repr(getattr(ldapUrl,a))
+
+l = ldap.initialize(ldapUrl.initializeUrl(),trace_level=1)
+if ldapUrl.who!=None:
+  if ldapUrl.cred!=None:
+    cred=ldapUrl.cred
+  else:
+    print 'Enter password for simple bind with',repr(ldapUrl.who)
+    cred=getpass.getpass()
+  l.simple_bind_s(ldapUrl.who,cred)
+
+res = l.search_s(ldapUrl.dn,ldapUrl.scope,ldapUrl.filterstr,ldapUrl.attrs)
+
+print len(res),'search results'

From 5ee9476e529bea93b4ee09d220396e41ccdacd28 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 2 Feb 2003 22:38:16 +0000
Subject: [PATCH 015/868] ...

---
 Demo/Lib/ldapurl/.cvsignore | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 Demo/Lib/ldapurl/.cvsignore

diff --git a/Demo/Lib/ldapurl/.cvsignore b/Demo/Lib/ldapurl/.cvsignore
new file mode 100644
index 0000000..f7c976a
--- /dev/null
+++ b/Demo/Lib/ldapurl/.cvsignore
@@ -0,0 +1,4 @@
+*.pyc
+*.pyo
+*.bck
+*~

From 93a3c8f2be6df08ebc74777dd1cfd9072f0ebc6b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 17 Mar 2003 14:19:32 +0000
Subject: [PATCH 016/868] Removed unused __doc__ string related symbols.

---
 Demo/options.py | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 Demo/options.py

diff --git a/Demo/options.py b/Demo/options.py
new file mode 100644
index 0000000..fb37209
--- /dev/null
+++ b/Demo/options.py
@@ -0,0 +1,29 @@
+
+import ldap
+
+host="localhost:1390"
+
+print "API info:",ldap.get_option(ldap.OPT_API_INFO)
+print "debug level:",ldap.get_option(ldap.OPT_DEBUG_LEVEL)
+#print "Setting debug level to 255..."
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+#print "debug level:",ldap.get_option(ldap.OPT_DEBUG_LEVEL)
+print "default size limit:",ldap.get_option(ldap.OPT_SIZELIMIT)
+print "Setting default size limit to 10..."
+ldap.set_option(ldap.OPT_SIZELIMIT,10)
+print "default size limit:",ldap.get_option(ldap.OPT_SIZELIMIT)
+print "Creating connection to",host,"..."
+l=ldap.init(host)
+print "size limit:",l.get_option(ldap.OPT_SIZELIMIT)
+print "Setting connection size limit to 20..."
+l.set_option(ldap.OPT_SIZELIMIT,20)
+print "size limit:",l.get_option(ldap.OPT_SIZELIMIT)
+#print "Setting time limit to 60 secs..."
+l.set_option(ldap.OPT_TIMELIMIT,60)
+#print "time limit:",l.get_option(ldap.OPT_TIMELIMIT)
+print "Binding..."
+l.simple_bind_s("","")
+
+
+
+

From 3b6d52fb1dff50f5fa057d5edc4456d970e7bb98 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 19 Apr 2003 02:10:25 +0000
Subject: [PATCH 017/868] Fixed __setstate__() and __getstate__() of
 ReconnectLDAPObject

---
 Demo/pickle_ldapobject.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 Demo/pickle_ldapobject.py

diff --git a/Demo/pickle_ldapobject.py b/Demo/pickle_ldapobject.py
new file mode 100644
index 0000000..3f7cab2
--- /dev/null
+++ b/Demo/pickle_ldapobject.py
@@ -0,0 +1,12 @@
+import os,ldap,pickle
+
+temp_file_name = os.path.join(os.environ.get('TMP','/tmp'),'pickle_ldap-%d' % (os.getpid()))
+
+l1 = ldap.ldapobject.ReconnectLDAPObject('ldap://localhost:1390',trace_level=1)
+l1.protocol_version = 3
+l1.search_s('',ldap.SCOPE_BASE,'(objectClass=*)')
+
+pickle.dump(l1,open(temp_file_name,'wb'))
+
+l2 = pickle.load(open(temp_file_name,'rb'))
+l2.search_s('',ldap.SCOPE_BASE,'(objectClass=*)')

From f8ac88ea0935e4bcbd0fa5f7b15cd9bff9c6c3f7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 20 Aug 2003 10:04:34 +0000
Subject: [PATCH 018/868] Added directory Build/ mainly intended for
 platform-specific examples of setup.cfg.

---
 Build/setup.cfg.suse-linux | 33 +++++++++++++++++++++++++++++++++
 Build/setup.cfg.win32      | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 Build/setup.cfg.suse-linux
 create mode 100644 Build/setup.cfg.win32

diff --git a/Build/setup.cfg.suse-linux b/Build/setup.cfg.suse-linux
new file mode 100644
index 0000000..884e57a
--- /dev/null
+++ b/Build/setup.cfg.suse-linux
@@ -0,0 +1,33 @@
+# Example for setup.cfg
+# You have to edit this file to reflect your system configuation
+# $Id: setup.cfg.suse-linux,v 1.1 2003/08/20 10:04:34 stroeder Exp $
+
+[_ldap]
+# Section for compiling the C extension module
+# for wrapping OpenLDAP 2 libs
+
+library_dirs = /usr/lib/sasl2
+include_dirs = /usr/include/sasl
+
+extra_compile_args = 
+extra_objects =
+
+# Example for full-featured SuSE build:
+# Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
+# This needs recent OpenLDAP 2.0.26+ or 2.1.3+ built with
+# ./configure --with-cyrus-sasl --with-tls
+libs = ldap_r lber sasl2 ssl crypto
+
+[install]
+# Installation options
+compile = 1
+optimize = 1
+
+# For SuSE Linux 8.2
+[bdist_rpm]
+provides = python-ldap
+requires = python openldap2-client openssl cyrus-sasl2
+distribution_name = SuSE Linux 8.2
+release = 1
+packager = Michael Stroeder <michael@stroeder.com>
+doc_files = CHANGES README INSTALL TODO Demo/
diff --git a/Build/setup.cfg.win32 b/Build/setup.cfg.win32
new file mode 100644
index 0000000..7c5270b
--- /dev/null
+++ b/Build/setup.cfg.win32
@@ -0,0 +1,33 @@
+# Section for compiling the C extension module
+# for wrapping OpenLDAP 2 libs
+
+# Platform: Win32
+# Compile environment: Microsoft Visual Studio .NET 2003
+[_ldap]
+class = OpenLDAP2
+defines = WIN32
+
+# Cannot have SSL/TLS support under Win32 for the moment
+# (OpenLDAP 2.x port is incomplete)
+libs = olber32 oldap_r ws2_32 libsasl
+
+# Set these to your correct Openldap and Cyrus-sasl paths
+library_dirs = ../openldap/openldap-2.1.22/Release ../openldap/cyrus-sasl/lib
+include_dirs = ../openldap/openldap-2.1.22/include ../openldap/cyrus-sasl/include
+
+# Needs to compile as /MT ("MS libs to use: multithreaded statically-linked")
+# instead of /MD ("MS libs to use: multithreaded DLL") which is distutils' default
+# because OpenLDAP libs compile that way, too
+# This may change, however
+extra_compile_args = /MT
+extra_link_args = /NODEFAULTLIB:msvcrt.lib
+
+# Pull in SASL DLL as a convenience to end-user (which almost never will have it)
+# Destination path is a rather crude hack, but site-packages would be created anyway
+# Set source path to your Cyrus-sasl lib path
+extra_files = Lib/site-packages:../openldap/cyrus-sasl/lib/libsasl.dll
+
+# Installation options
+[install]
+compile = 1
+record = python-ldap_install.log

From 037f470669c5bcb6ac83129783be645b138ffe00 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 26 Oct 2004 22:27:12 +0000
Subject: [PATCH 019/868] Simple example for extended passwort operation.

---
 Demo/passwd_ext_op.py | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 Demo/passwd_ext_op.py

diff --git a/Demo/passwd_ext_op.py b/Demo/passwd_ext_op.py
new file mode 100644
index 0000000..1030f0e
--- /dev/null
+++ b/Demo/passwd_ext_op.py
@@ -0,0 +1,32 @@
+"""
+Example showing the use of the password extended operation.
+"""
+
+import sys,ldap,ldapurl,getpass
+
+# Set debugging level
+ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 2
+ldapmodule_trace_file = sys.stderr
+
+lu = ldapurl.LDAPUrl(sys.argv[1])
+
+print 'Old password'
+oldpw = getpass.getpass()
+print 'New password'
+newpw = getpass.getpass()
+
+# Set path name of file containing all CA certificates
+# needed to validate server certificates
+ldap.set_option(ldap.OPT_X_TLS_CACERTFILE,'/etc/httpd/ssl.crt/myCA-cacerts.pem')
+
+# Create LDAPObject instance
+l = ldap.initialize(lu.initializeUrl(),trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
+
+l.protocol_version=ldap.VERSION3
+
+l.simple_bind_s(lu.dn,oldpw)
+
+l.passwd(lu.dn,oldpw,newpw)
+
+l.unbind_s()

From be71747f6eda7bafbd107ae101e77c93eb6ab27d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Jan 2005 18:54:46 +0000
Subject: [PATCH 020/868] Contributed by Mauro Cicognini via e-mail

---
 Build/setup.cfg.mingw | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 Build/setup.cfg.mingw

diff --git a/Build/setup.cfg.mingw b/Build/setup.cfg.mingw
new file mode 100644
index 0000000..b3ef5e0
--- /dev/null
+++ b/Build/setup.cfg.mingw
@@ -0,0 +1,35 @@
+# Win32 setup.cfg
+# You have to edit this file to reflect your system configuration
+#
+# $Id: setup.cfg.mingw,v 1.1 2005/01/25 18:54:46 stroeder Exp $
+
+# Section for compiling the C extension module
+# for wrapping OpenLDAP 2 libs
+
+# Platform: Win32
+# Compile environment: MinGW
+[_ldap]
+class = OpenLDAP2
+maintainer = Mauro Cicognini
+defines = WIN32
+
+# modify these to fit your local configuration
+library_dirs = C:/msys/1.0/home/mcicogni/openldap-mingw-build-4/openldap-2.2.18/libraries/libldap_r/.libs C:/msys/1.0/home/mcicogni/openldap-mingw-build-4/openldap-2.2.18/libraries/liblber/.libs C:\msys\1.0\home\mcicogni\openldap-mingw-build-4\openssl-0.9.7e
+include_dirs = C:/msys/1.0/home/mcicogni/openldap-mingw-build-4/openldap-2.2.18/include
+
+extra_compile_args = 
+extra_objects = 
+
+libs = ldap_r lber ssl crypto ws2_32 gdi32
+
+[build]
+compiler = mingw32
+
+# Installation options
+[install]
+compile = 1
+optimize = 1
+record = python-ldap_install.log
+
+[bdist_wininst]
+target_version = 2.4

From 645526a75e438247444f5896f8dbd067a2c7fcdf Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 21 Jun 2005 14:59:47 +0000
Subject: [PATCH 021/868] Finishing support for receiving controls

---
 Demo/ldapcontrols.py | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 Demo/ldapcontrols.py

diff --git a/Demo/ldapcontrols.py b/Demo/ldapcontrols.py
new file mode 100644
index 0000000..214042d
--- /dev/null
+++ b/Demo/ldapcontrols.py
@@ -0,0 +1,33 @@
+import ldap,ldapurl,pprint
+
+from ldap.controls import LDAPControl,BooleanControl
+
+l = ldap.initialize('ldap://localhost:1390',trace_level=2)
+
+print 60*'#'
+
+pprint.pprint(l.get_option(ldap.OPT_SERVER_CONTROLS))
+l.manage_dsa_it(1,1)
+pprint.pprint(l.get_option(ldap.OPT_SERVER_CONTROLS))
+print 60*'#'
+
+# Search with ManageDsaIT control (which has no value)
+pprint.pprint(l.search_ext_s(
+  'cn=Test-Referral,ou=Testing,dc=stroeder,dc=de',
+  ldap.SCOPE_BASE,
+  '(objectClass=*)',
+  ['*','+'],
+  serverctrls = [ LDAPControl('2.16.840.1.113730.3.4.2',1,None) ],
+))
+print 60*'#'
+
+# Search with Subentries control (which has boolean value)
+pprint.pprint(l.search_ext_s(
+  'dc=stroeder,dc=de',
+  ldap.SCOPE_SUBTREE,
+  '(objectClass=subentry)',
+  ['*','+'],
+  serverctrls = [ BooleanControl('1.3.6.1.4.1.4203.1.10.1',1,1) ],
+))
+
+print 60*'#'

From ea07b5fa9ee2e4118718a7b642cb91a8ab931769 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 21 Jun 2005 15:02:06 +0000
Subject: [PATCH 022/868] Start at 2.5.6.0

---
 Demo/schema_tree.py | 100 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 Demo/schema_tree.py

diff --git a/Demo/schema_tree.py b/Demo/schema_tree.py
new file mode 100644
index 0000000..3b3a091
--- /dev/null
+++ b/Demo/schema_tree.py
@@ -0,0 +1,100 @@
+"""
+Outputs the object class tree read from LDAPv3 schema
+of a given server
+
+Usage: schema_oc_tree.py [--html] [LDAP URL]
+"""
+
+import sys,getopt,ldap,ldap.schema
+
+
+ldap.trace_level = 1
+
+def PrintSchemaTree(schema,se_class,se_tree,se_oid,level):
+  """ASCII text output for console"""
+  se_obj = schema.get_obj(se_class,se_oid)
+  if se_obj!=None:
+    print '|    '*(level-1)+'+---'*(level>0), \
+          ', '.join(se_obj.names), \
+          '(%s)' % se_obj.oid
+  for sub_se_oid in se_tree[se_oid]:
+    print '|    '*(level+1)
+    PrintSchemaTree(schema,se_class,se_tree,sub_se_oid,level+1)
+
+
+def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
+  """HTML output for browser"""
+  se_obj = schema.get_obj(se_class,se_oid)
+  if se_obj!=None:
+    print """
+    <dt><strong>%s (%s)</strong></dt>
+    <dd>
+      %s
+    """ % (', '.join(se_obj.names),se_obj.oid,se_obj.desc)
+  if se_tree[se_oid]:
+    print '<dl>'
+    for sub_se_oid in se_tree[se_oid]:
+      HTMLSchemaTree(schema,se_class,se_tree,sub_se_oid,level+1)
+    print '</dl>'
+  print '</dd>'
+
+
+ldap.set_option(ldap.OPT_DEBUG_LEVEL,0)
+
+ldap._trace_level = 0
+
+subschemasubentry_dn,schema = ldap.schema.urlfetch(sys.argv[-1],ldap.trace_level)
+
+if subschemasubentry_dn is None:
+  print 'No sub schema sub entry found!'
+  sys.exit(1)
+
+try:
+  options,args=getopt.getopt(sys.argv[1:],'',['html'])
+except getopt.error,e:
+  print 'Error: %s\nUsage: schema_oc_tree.py [--html] [LDAP URL]'
+
+html_output = options and options[0][0]=='--html'
+
+oc_tree = schema.tree(ldap.schema.ObjectClass)
+at_tree = schema.tree(ldap.schema.AttributeType)
+
+#for k,v in oc_tree.items():
+#  print k,'->',v
+#for k,v in at_tree.items():
+#  print k,'->',v
+
+if html_output:
+
+  print """<html>
+<head>
+  <title>Object class tree</title>
+</head>
+<body bgcolor="#ffffff">
+<h1>Object class tree</h1>
+<dl>
+"""
+  HTMLSchemaTree(schema,ldap.schema.ObjectClass,oc_tree,'2.5.6.0',0)
+  print """</dl>
+<h1>Attribute type tree</h1>
+<dl>
+"""
+  for a in schema.listall(ldap.schema.AttributeType):
+    if at_tree[a]:
+      HTMLSchemaTree(schema,ldap.schema.AttributeType,at_tree,a,0)
+      print
+
+  print """</dl>
+</body>
+</html>
+"""
+
+else:
+
+  print '*** Object class tree ***\n'
+  print
+  PrintSchemaTree(schema,ldap.schema.ObjectClass,oc_tree,'2.5.6.0',0)
+
+  print '\n*** Attribute types tree ***\n'
+  PrintSchemaTree(schema,ldap.schema.AttributeType,at_tree,'_',0)
+

From 3ad1d243c5ac9abc11373b380bc87253e8f15e03 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 7 Nov 2005 11:24:25 +0000
Subject: [PATCH 023/868] New sub-module ldap.resiter which simply provides a
 mix-in class for ldap.ldapobject.LDAPObject with a generator method
 allresults().

Obviously this only works with Python 2.3+. And it's still experimental.
---
 Demo/resiter.py | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 Demo/resiter.py

diff --git a/Demo/resiter.py b/Demo/resiter.py
new file mode 100644
index 0000000..4b49fae
--- /dev/null
+++ b/Demo/resiter.py
@@ -0,0 +1,26 @@
+"""
+Demo for using ldap.resiter.ResultProcessor
+written by Michael Stroeder <michael@stroeder.com>
+
+See http://python-ldap.sourceforge.net for details.
+
+\$Id: resiter.py,v 1.1 2005/11/07 11:24:25 stroeder Exp $
+
+Python compability note:
+Requires Python 2.3+
+"""
+
+import ldap,ldap.resiter
+
+class LDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
+  pass
+
+l = LDAPObject('ldap://localhost:1390',trace_level=1)
+l.protocol_version = 3
+msgid = l.search('dc=stroeder,dc=de',ldap.SCOPE_SUBTREE,'(cn=m*)')
+
+result_iter = l.allresults(msgid)
+for result_type,result_list,result_msgid,result_serverctrls in result_iter:
+  print result_type,result_list,result_msgid,result_serverctrls
+
+l.unbind_s()

From 84c4043f6e775a95d2a458bda13898fdde795f0a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 26 Mar 2006 12:23:07 +0000
Subject: [PATCH 024/868] Examples for using ldap.async.

---
 Demo/Lib/ldap/async/ldifwriter.py | 42 +++++++++++++++++++++++++++++++
 Demo/Lib/ldap/async/sizelimit.py  | 42 +++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+)
 create mode 100644 Demo/Lib/ldap/async/ldifwriter.py
 create mode 100644 Demo/Lib/ldap/async/sizelimit.py

diff --git a/Demo/Lib/ldap/async/ldifwriter.py b/Demo/Lib/ldap/async/ldifwriter.py
new file mode 100644
index 0000000..f919cd9
--- /dev/null
+++ b/Demo/Lib/ldap/async/ldifwriter.py
@@ -0,0 +1,42 @@
+"""
+ldifwriter - using ldap.async module for output of LDIF stream
+             of LDAP search results
+
+Written by Michael Stroeder <michael@stroeder.com>
+
+$Id: ldifwriter.py,v 1.4 2006/03/26 12:23:07 stroeder Exp $
+
+This example translates the naming context of data read from
+input, sanitizes some attributes, maps/removes object classes,
+maps/removes attributes., etc. It's far from being complete though.
+
+Python compability note:
+Tested on Python 2.0+, should run on Python 1.5.x.
+"""
+
+import sys,ldap,ldap.async
+
+s = ldap.async.LDIFWriter(
+  ldap.initialize('ldap://localhost:1390'),
+  sys.stdout
+)
+
+s.startSearch(
+  'dc=stroeder,dc=de',
+  ldap.SCOPE_SUBTREE,
+  '(objectClass=*)',
+)
+
+try:
+  partial = s.processResults()
+except ldap.SIZELIMIT_EXCEEDED:
+  sys.stderr.write('Warning: Server-side size limit exceeded.\n')
+else:
+  if partial:
+    sys.stderr.write('Warning: Only partial results received.\n')
+
+sys.stderr.write(
+  '%d results received.\n' % (
+    s.endResultBreak-s.beginResultsDropped
+  )
+)
diff --git a/Demo/Lib/ldap/async/sizelimit.py b/Demo/Lib/ldap/async/sizelimit.py
new file mode 100644
index 0000000..9915909
--- /dev/null
+++ b/Demo/Lib/ldap/async/sizelimit.py
@@ -0,0 +1,42 @@
+"""
+ldifwriter - using ldap.async module for retrieving partial results
+             in a list even though the exception ldap.SIZELIMIT_EXCEEDED
+             was raised.output of LDIF stream
+
+Written by Michael Stroeder <michael@stroeder.com>
+
+$Id: sizelimit.py,v 1.4 2006/03/26 12:23:07 stroeder Exp $
+
+This example translates the naming context of data read from
+input, sanitizes some attributes, maps/removes object classes,
+maps/removes attributes., etc. It's far from being complete though.
+
+Python compability note:
+Tested on Python 2.0+, should run on Python 1.5.x.
+"""
+
+import sys,ldap,ldap.async
+
+s = ldap.async.List(
+  ldap.initialize('ldap://localhost:1390'),
+)
+
+s.startSearch(
+  'dc=stroeder,dc=de',
+  ldap.SCOPE_SUBTREE,
+  '(objectClass=*)',
+)
+
+try:
+  partial = s.processResults()
+except ldap.SIZELIMIT_EXCEEDED:
+  sys.stderr.write('Warning: Server-side size limit exceeded.\n')
+else:
+  if partial:
+    sys.stderr.write('Warning: Only partial results received.\n')
+
+sys.stderr.write(
+  '%d results received.\n' % (
+    len(s.allResults)
+  )
+)

From 12881e807e80c07f5e61323250341e1b54ca7764 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 6 Aug 2007 09:45:59 +0000
Subject: [PATCH 025/868] Demo script for Matched Values Control contributed by
 Andreas Hasenack

---
 Demo/matchedvalues.py | 63 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 Demo/matchedvalues.py

diff --git a/Demo/matchedvalues.py b/Demo/matchedvalues.py
new file mode 100644
index 0000000..4de3e8a
--- /dev/null
+++ b/Demo/matchedvalues.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python
+#
+# demo for matched values control (RFC 3876)
+#
+# suppose the uid=jsmith LDAP entry has two mail attributes:
+#
+# dn: uid=jsmith,ou=People,dc=example,dc=com
+# (...)
+# mail: jsmith@example.com
+# mail: jsmith@example.org
+#
+# Let's say you want to fetch only the example.org email. Without MV,
+# you would first fetch all mail attributes and then filter them further
+# on the client. With the MV control, the result can be given to the
+# client already filtered.
+#
+# Sample output:
+# $ ./matchedvalues.py
+# LDAP filter used: (&(objectClass=inetOrgPerson)(mail=*@example.org))
+# Requesting 'mail' attribute back
+#
+# No matched values control:
+# dn: uid=jsmith,ou=People,dc=example,dc=com
+# mail: jsmith@example.org
+# mail: john@example.com
+#
+# Matched values control: (mail=*@example.org)
+# dn: uid=jsmith,ou=People,dc=example,dc=com
+# mail: jsmith@example.org
+
+import ldap
+from ldap.controls import MatchedValuesControl
+
+def print_result(search_result):
+    for n in range(len(search_result)):
+        print "dn: %s" % search_result[n][0]
+        for attr in search_result[n][1].keys():
+            for i in range(len(search_result[n][1][attr])):
+                print "%s: %s" % (attr, search_result[n][1][attr][i])
+        print
+
+
+uri = "ldap://ldap.example.com"
+base = "dc=example,dc=com"
+scope = ldap.SCOPE_SUBTREE
+filter = "(&(objectClass=inetOrgPerson)(mail=*@example.org))"
+control_filter = "(mail=*@example.org)"
+
+ld = ldap.initialize(uri)
+
+mv = MatchedValuesControl(criticality=True, controlValue=control_filter)
+
+res = ld.search_ext_s(base, scope, filter, attrlist = ['mail'])
+print "LDAP filter used: %s" % filter
+print "Requesting 'mail' attribute back"
+print
+print "No matched values control:"
+print_result(res)
+
+res = ld.search_ext_s(base, scope, filter, attrlist = ['mail'], serverctrls = [mv])
+print "Matched values control: %s" % control_filter
+print_result(res)
+

From 305ec15c7233a8a0e867d6570ba2bdcaa819e8f8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Mar 2008 15:04:25 +0000
Subject: [PATCH 026/868] Simple search util also as a demo for using LDAP URLs
 with custom extension

---
 Tests/search.py | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 Tests/search.py

diff --git a/Tests/search.py b/Tests/search.py
new file mode 100644
index 0000000..2c63009
--- /dev/null
+++ b/Tests/search.py
@@ -0,0 +1,42 @@
+import sys,pprint,ldap
+
+from ldap.ldapobject import LDAPObject
+from ldapurl import LDAPUrl
+
+class MyLDAPUrl(LDAPUrl):
+  attr2extype = {
+    'who':'bindname',
+    'cred':'X-BINDPW',
+    'start_tls':'startTLS',
+    'trace_level':'trace',
+  }
+
+
+ldap_url = MyLDAPUrl(sys.argv[1])
+trace_level = int(ldap_url.trace_level or '0')
+
+print '***trace_level',trace_level
+
+ldap.trace_level = trace_level
+
+l = LDAPObject(
+  ldap_url.initializeUrl(),
+  trace_level=trace_level,
+)
+
+l.protocol_version = 3
+l.set_option(ldap.OPT_REFERRALS,0)
+l.simple_bind_s((ldap_url.who or ''),(ldap_url.cred or ''))
+
+result = l.search_s(
+  ldap_url.dn,
+  ldap_url.scope or ldap.SCOPE_SUBTREE,
+  ldap_url.filterstr or '(objectClass=*)',
+  ldap_url.attrs or ['*']
+)
+
+pprint.pprint(result)
+
+print '***DIAGNOSTIC_MESSAGE',repr(l.get_option(ldap.OPT_DIAGNOSTIC_MESSAGE))
+
+l.unbind_s()

From 8cf374c2cdb44691a8aa548917d2eb8f3533921f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 10 Apr 2008 11:08:43 +0000
Subject: [PATCH 027/868] Simplified Makefile

---
 Doc/Makefile | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 Doc/Makefile

diff --git a/Doc/Makefile b/Doc/Makefile
new file mode 100644
index 0000000..5c8c6f1
--- /dev/null
+++ b/Doc/Makefile
@@ -0,0 +1,68 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+PAPER         =
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d .build/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help clean html web htmlhelp latex changes linkcheck
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html      to make standalone HTML files"
+	@echo "  web       to make files usable by Sphinx.web"
+	@echo "  htmlhelp  to make HTML files and a HTML help project"
+	@echo "  latex     to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  changes   to make an overview over all changed/added/deprecated items"
+	@echo "  linkcheck to check all external links for integrity"
+
+clean:
+	-rm -rf .build/*
+
+html:
+	mkdir -p .build/html .build/doctrees
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) .build/html
+	@echo
+	@echo "Build finished. The HTML pages are in .build/html."
+
+web:
+	mkdir -p .build/web .build/doctrees
+	$(SPHINXBUILD) -b web $(ALLSPHINXOPTS) .build/web
+	@echo
+	@echo "Build finished; now you can run"
+	@echo "  python -m sphinx.web .build/web"
+	@echo "to start the server."
+
+htmlhelp:
+	mkdir -p .build/htmlhelp .build/doctrees
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) .build/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in .build/htmlhelp."
+
+latex:
+	mkdir -p .build/latex .build/doctrees
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) .build/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in .build/latex."
+	@echo "Run \`make all-pdf' or \`make all-ps' in that directory to" \
+	      "run these through (pdf)latex."
+
+changes:
+	mkdir -p .build/changes .build/doctrees
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) .build/changes
+	@echo
+	@echo "The overview file is in .build/changes."
+
+linkcheck:
+	mkdir -p .build/linkcheck .build/doctrees
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) .build/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in .build/linkcheck/output.txt."

From ea882a06e0eea9acc3ebe4205a76d9cff10bc311 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 24 Apr 2008 09:22:05 +0000
Subject: [PATCH 028/868] Other example for ldap_uri

---
 Demo/ms_ad_bind.py | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 Demo/ms_ad_bind.py

diff --git a/Demo/ms_ad_bind.py b/Demo/ms_ad_bind.py
new file mode 100644
index 0000000..6333652
--- /dev/null
+++ b/Demo/ms_ad_bind.py
@@ -0,0 +1,38 @@
+# How to bind to MS AD with python-ldap and various methods
+
+import ldap,ldap.sasl
+
+ldap_uri = "ldap://dc1.example.com"
+dn = "CN=Anna Blume,CN=Users,DC=addomain,DC=example,DC=com"
+sAMAccountName = "ABlume"
+userPrincipalName = "ablume@addomain.example.com"
+password = 'testsecret'
+
+trace_level = 2
+
+l = ldap.initialize(ldap_uri,trace_level=trace_level)
+
+# Normal LDAPv3 compliant simple bind
+l.simple_bind_s(dn,password)
+
+# This is AD-specific and not LDAPv3 compliant
+l.simple_bind_s(userPrincipalName,password)
+
+# This is AD-specific and not LDAPv3 compliant
+l.simple_bind_s(userPrincipalName,password)
+
+# SASL bind with mech DIGEST-MD5 with sAMAccountName as SASL user name
+sasl_auth = ldap.sasl.sasl(
+  {
+    ldap.sasl.CB_AUTHNAME:sAMAccountName,
+    ldap.sasl.CB_PASS    :password,
+  },
+  'DIGEST-MD5'
+)
+l.sasl_interactive_bind_s("", sasl_auth)
+
+# SASL bind with mech GSSAPI
+# with the help of Kerberos V TGT obtained before with command
+# kinit ablume@ADDOMAIN.EXAMPLE.COM
+sasl_auth = ldap.sasl.sasl({},'GSSAPI')
+l.sasl_interactive_bind_s("", sasl_auth)

From ee42183fd77d9b39c44a1f8da11cd97a2c6ae045 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 19 Jun 2008 08:50:26 +0000
Subject: [PATCH 029/868] Modification due to doc tool change

---
 Doc/.cvsignore | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 Doc/.cvsignore

diff --git a/Doc/.cvsignore b/Doc/.cvsignore
new file mode 100644
index 0000000..5557280
--- /dev/null
+++ b/Doc/.cvsignore
@@ -0,0 +1,4 @@
+python-ldap.pdf
+python-ldap.ps
+*.bck
+*~

From f0b197b2676cf3e73c433c39f39e775a4c64fd39 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 17 Apr 2009 12:19:09 +0000
Subject: [PATCH 030/868] Refer to new project home-page

---
 Modules/LDAPObject.h |  52 ++++++++
 Modules/common.c     |  19 +++
 Modules/common.h     |  39 ++++++
 Modules/constants.h  |  19 +++
 Modules/errors.h     |  16 +++
 Modules/functions.h  |  12 ++
 Modules/ldapmodule.c |  49 ++++++++
 Modules/options.h    |   8 ++
 Modules/schema.c     | 283 +++++++++++++++++++++++++++++++++++++++++++
 Modules/schema.h     |  14 +++
 Modules/version.c    |  20 +++
 Modules/version.h    |  12 ++
 12 files changed, 543 insertions(+)
 create mode 100644 Modules/LDAPObject.h
 create mode 100644 Modules/common.c
 create mode 100644 Modules/common.h
 create mode 100644 Modules/constants.h
 create mode 100644 Modules/errors.h
 create mode 100644 Modules/functions.h
 create mode 100644 Modules/ldapmodule.c
 create mode 100644 Modules/options.h
 create mode 100644 Modules/schema.c
 create mode 100644 Modules/schema.h
 create mode 100644 Modules/version.c
 create mode 100644 Modules/version.h

diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
new file mode 100644
index 0000000..b0ffbbe
--- /dev/null
+++ b/Modules/LDAPObject.h
@@ -0,0 +1,52 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: LDAPObject.h,v 1.10 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_LDAPObject 
+#define __h_LDAPObject 
+
+#include "common.h"
+
+#include "lber.h"
+#include "ldap.h"
+#if LDAP_API_VERSION < 2000
+#error Current python-ldap requires OpenLDAP 2.x
+#endif
+
+#if PYTHON_API_VERSION < 1007
+typedef PyObject*	_threadstate;
+#else
+typedef PyThreadState*	_threadstate;
+#endif
+
+typedef struct {
+        PyObject_HEAD
+	LDAP* ldap;
+	_threadstate	_save; /* for thread saving on referrals */
+	int valid;
+} LDAPObject;
+
+extern PyTypeObject LDAP_Type;
+#define LDAPObject_Check(v)     ((v)->ob_type == &LDAP_Type)
+
+extern LDAPObject *newLDAPObject( LDAP* );
+
+/* macros to allow thread saving in the context of an LDAP connection */
+
+#define LDAP_BEGIN_ALLOW_THREADS( l )                                   \
+	{                                                               \
+	  LDAPObject *lo = (l);                                         \
+	  if (lo->_save != NULL)                                        \
+	  	Py_FatalError( "saving thread twice?" );                \
+	  lo->_save = PyEval_SaveThread();                              \
+	}
+
+#define LDAP_END_ALLOW_THREADS( l )                                     \
+	{                                                               \
+	  LDAPObject *lo = (l);                                         \
+	  _threadstate _save = lo->_save;                               \
+	  lo->_save = NULL;                                             \
+	  PyEval_RestoreThread( _save );                                \
+	}
+
+#endif /* __h_LDAPObject */
+
diff --git a/Modules/common.c b/Modules/common.c
new file mode 100644
index 0000000..ff471f1
--- /dev/null
+++ b/Modules/common.c
@@ -0,0 +1,19 @@
+/* Miscellaneous common routines
+ * See http://www.python-ldap.org/ for details.
+ * $Id: common.c,v 1.3 2009/04/17 12:19:09 stroeder Exp $ */
+
+#include "common.h"
+
+/* dynamically add the methods into the module dictionary d */
+
+void
+LDAPadd_methods( PyObject* d, PyMethodDef* methods ) 
+{
+    PyMethodDef *meth;
+
+    for( meth = methods; meth->ml_meth; meth++ ) {
+        PyObject *f = PyCFunction_New( meth, NULL );
+        PyDict_SetItemString( d, meth->ml_name, f );
+        Py_DECREF(f);
+    }
+}
diff --git a/Modules/common.h b/Modules/common.h
new file mode 100644
index 0000000..a182a97
--- /dev/null
+++ b/Modules/common.h
@@ -0,0 +1,39 @@
+/* common utility macros
+ * See http://www.python-ldap.org/ for details.
+ * $Id: common.h,v 1.8 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_common 
+#define __h_common 
+
+#define PY_SSIZE_T_CLEAN
+
+#include "Python.h"
+
+#if defined(HAVE_CONFIG_H)
+#include "config.h"
+#endif
+
+#if defined(MS_WINDOWS)
+#include <winsock.h>
+#else /* unix */
+#include <netdb.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#endif
+
+/* Backwards compability with Python prior 2.5 */
+#if PY_VERSION_HEX < 0x02050000
+typedef int Py_ssize_t;
+#define PY_SSIZE_T_MAX INT_MAX
+#define PY_SSIZE_T_MIN INT_MIN
+#endif
+
+#include <string.h>
+#define streq( a, b ) \
+	( (*(a)==*(b)) && 0==strcmp(a,b) )
+
+void LDAPadd_methods( PyObject*d, PyMethodDef*methods );
+#define PyNone_Check(o) ((o) == Py_None)
+
+#endif /* __h_common_ */
+
diff --git a/Modules/constants.h b/Modules/constants.h
new file mode 100644
index 0000000..c77f269
--- /dev/null
+++ b/Modules/constants.h
@@ -0,0 +1,19 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: constants.h,v 1.6 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_constants_
+#define __h_constants_
+
+#include "common.h"
+extern void LDAPinit_constants( PyObject* d );
+extern PyObject* LDAPconstant( int );
+
+#ifndef LDAP_CONTROL_PAGE_OID
+#define LDAP_CONTROL_PAGE_OID "1.2.840.113556.1.4.319"
+#endif /* !LDAP_CONTROL_PAGE_OID */
+
+#ifndef LDAP_CONTROL_VALUESRETURNFILTER
+#define LDAP_CONTROL_VALUESRETURNFILTER "1.2.826.0.1.3344810.2.3" /* RFC 3876 */
+#endif /* !LDAP_CONTROL_VALUESRETURNFILTER */
+
+#endif /* __h_constants_ */
diff --git a/Modules/errors.h b/Modules/errors.h
new file mode 100644
index 0000000..9c672cd
--- /dev/null
+++ b/Modules/errors.h
@@ -0,0 +1,16 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: errors.h,v 1.6 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_errors_
+#define __h_errors_
+
+#include "common.h"
+#include "lber.h"
+#include "ldap.h"
+
+extern PyObject* LDAPexception_class;
+extern PyObject* LDAPerror( LDAP*, char*msg );
+extern void LDAPinit_errors( PyObject* );
+PyObject* LDAPerr(int errnum);
+
+#endif /* __h_errors */
diff --git a/Modules/functions.h b/Modules/functions.h
new file mode 100644
index 0000000..515af4d
--- /dev/null
+++ b/Modules/functions.h
@@ -0,0 +1,12 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: functions.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_functions_
+#define __h_functions_
+
+/* $Id: functions.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+
+#include "common.h"
+extern void LDAPinit_functions( PyObject* );
+
+#endif /* __h_functions_ */
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
new file mode 100644
index 0000000..77cd82b
--- /dev/null
+++ b/Modules/ldapmodule.c
@@ -0,0 +1,49 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: ldapmodule.c,v 1.9 2009/04/17 12:19:09 stroeder Exp $ */
+
+#include "common.h"
+#include "version.h"
+#include "constants.h"
+#include "errors.h"
+#include "functions.h"
+#include "schema.h"
+#include "ldapcontrol.h"
+
+#include "LDAPObject.h"
+
+DL_EXPORT(void) init_ldap(void);
+
+/* dummy module methods */
+
+static PyMethodDef methods[]  = {
+	{ NULL, NULL }
+};
+
+/* module initialisation */
+
+DL_EXPORT(void)
+init_ldap()
+{
+	PyObject *m, *d;
+
+#if defined(MS_WINDOWS) || defined(__CYGWIN__)
+	LDAP_Type.ob_type = &PyType_Type;
+#endif
+
+	/* Create the module and add the functions */
+	m = Py_InitModule("_ldap", methods);
+
+	/* Add some symbolic constants to the module */
+	d = PyModule_GetDict(m);
+
+	LDAPinit_version(d);
+	LDAPinit_constants(d);
+	LDAPinit_errors(d);
+	LDAPinit_functions(d);
+	LDAPinit_schema(d);
+	LDAPinit_control(d);
+
+	/* Check for errors */
+	if (PyErr_Occurred())
+		Py_FatalError("can't initialize module _ldap");
+}
diff --git a/Modules/options.h b/Modules/options.h
new file mode 100644
index 0000000..fb6e0a2
--- /dev/null
+++ b/Modules/options.h
@@ -0,0 +1,8 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: options.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+
+int	LDAP_optionval_by_name(const char *name);
+int	LDAP_set_option(LDAPObject *self, int option, PyObject *value);
+PyObject *LDAP_get_option(LDAPObject *self, int option);
+
+void set_timeval_from_double( struct timeval *tv, double d );
diff --git a/Modules/schema.c b/Modules/schema.c
new file mode 100644
index 0000000..5bfbfa4
--- /dev/null
+++ b/Modules/schema.c
@@ -0,0 +1,283 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: schema.c,v 1.8 2009/04/17 12:19:09 stroeder Exp $ */
+
+#include "common.h"
+
+#include "schema.h"
+#include "ldap_schema.h"
+
+/* 
+   This utility function takes a null delimited C array of (null
+   delimited) C strings, creates its python equivalent and returns a
+   new reference to it. If the array is empty or the pointer to it is
+   NULL, an empty python array is returned. 
+*/
+PyObject* c_string_array_to_python(char **string_array)
+{
+  Py_ssize_t count = 0;
+  char **s;
+  PyObject *py_list;
+  if (string_array) {
+    for (s=string_array; *s != 0; s++) count++;
+    py_list = PyList_New(count);
+    count = 0;
+    for (s=string_array; *s != 0; s++){
+      PyList_SetItem(py_list, count, PyString_FromString(*s));
+      count++;
+    }
+  } else py_list=PyList_New(0);
+  return py_list;
+}
+
+
+/*
+  This function returns a list of tuples. The first entry of each
+  tuple is a string (lsei_name), and the second is a lists built from
+  lsei_values.
+
+  Probably the C data structure is modeled along the lines of a
+  mapping "lsei_name -> (list of lsei_values)". However, there seems
+  to be no guarantee that a lsei_name is unique, so I dare not use a
+  python mapping for this beast...
+ */
+PyObject* schema_extension_to_python(LDAPSchemaExtensionItem **extensions)
+{
+  Py_ssize_t count = 0;
+  LDAPSchemaExtensionItem **e;
+  PyObject *py_list, *item_tuple;
+  if (extensions) {
+    for (e = extensions; *e !=0; e++) count++;
+    py_list = PyList_New(count);
+    count = 0;
+    for (e = extensions; *e !=0; e++) {
+      item_tuple = PyTuple_New(2);
+      PyTuple_SetItem(item_tuple, 0, 
+		      PyString_FromString((*e)->lsei_name));
+      PyTuple_SetItem(item_tuple, 1, 
+		      c_string_array_to_python((*e)->lsei_values));
+      PyList_SetItem(py_list, count, item_tuple);
+      count++;
+      }
+    }
+  else py_list=PyList_New(0);
+  return py_list;
+}
+
+
+/*
+  The following four functions do the boring job: they take a python
+  string, feed it into the respective parser functions provided by
+  openldap, and build a python list from the data structure returned
+  by the C function.
+ */
+
+static char doc_ldap_str2objectclass[] = 
+"";
+
+static PyObject*
+l_ldap_str2objectclass(PyObject* self, PyObject *args)
+{
+  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
+  char *oc_string;
+  const char *errp;
+  LDAPObjectClass *o;
+  PyObject *oc_names, *oc_sup_oids, *oc_at_oids_must, 
+    *oc_at_oids_may, *py_ret;
+ 
+
+  if (!PyArg_ParseTuple(args, "si", &oc_string, &flag))
+	return NULL;
+  o = ldap_str2objectclass( oc_string, &ret, &errp, flag);
+  if (ret) {
+    py_ret = PyInt_FromLong(ret);
+    return py_ret;
+  }
+
+  oc_sup_oids     = c_string_array_to_python(o->oc_sup_oids);
+  oc_names        = c_string_array_to_python(o->oc_names);
+  oc_at_oids_must = c_string_array_to_python(o->oc_at_oids_must);
+  oc_at_oids_may  = c_string_array_to_python(o->oc_at_oids_may);
+  py_ret = PyList_New(9);
+  PyList_SetItem(py_ret, 0, PyString_FromString(o->oc_oid));
+  PyList_SetItem(py_ret, 1, oc_names);
+  if (o->oc_desc) {
+    PyList_SetItem(py_ret, 2, PyString_FromString(o->oc_desc)); 
+  } else {
+    PyList_SetItem(py_ret, 2, PyString_FromString(""));
+  }
+  PyList_SetItem(py_ret, 3, PyInt_FromLong(o->oc_obsolete));
+  PyList_SetItem(py_ret, 4, oc_sup_oids);
+  PyList_SetItem(py_ret, 5, PyInt_FromLong(o->oc_kind));
+  PyList_SetItem(py_ret, 6, oc_at_oids_must);
+  PyList_SetItem(py_ret, 7, oc_at_oids_may);
+
+  PyList_SetItem(py_ret, 8, 
+		 schema_extension_to_python(o->oc_extensions));
+
+  ldap_objectclass_free(o);
+  return py_ret;
+}
+
+
+static char doc_ldap_str2attributetype[] = 
+"";
+
+static PyObject*
+l_ldap_str2attributetype(PyObject* self, PyObject *args)
+{
+  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
+  char *at_string;
+  const char *errp;
+  LDAPAttributeType *a;
+  PyObject *py_ret;
+  PyObject *at_names;
+  
+  if (!PyArg_ParseTuple(args, "si", &at_string,&flag))
+    return NULL;
+  a = ldap_str2attributetype( at_string, &ret, &errp, flag);
+  if (ret) {
+    py_ret = PyInt_FromLong(ret);
+    return py_ret;
+  }
+  
+  py_ret = PyList_New(15);
+  PyList_SetItem(py_ret, 0, PyString_FromString(a->at_oid));
+  at_names = c_string_array_to_python(a->at_names);
+  PyList_SetItem(py_ret, 1, at_names);
+  if (a->at_desc) {
+    PyList_SetItem(py_ret, 2, PyString_FromString(a->at_desc)); 
+  } else {
+    PyList_SetItem(py_ret, 2, PyString_FromString(""));
+  }
+  PyList_SetItem(py_ret, 3, PyInt_FromLong(a->at_obsolete));
+  if (a->at_sup_oid) {
+    PyList_SetItem(py_ret, 4, PyString_FromString(a->at_sup_oid)); 
+  } else {
+    PyList_SetItem(py_ret, 4, PyString_FromString(""));
+  }
+  if (a->at_equality_oid) {
+    PyList_SetItem(py_ret, 5, PyString_FromString(a->at_equality_oid)); 
+  } else {
+    PyList_SetItem(py_ret, 5, PyString_FromString(""));
+  }
+  if (a->at_ordering_oid) {
+    PyList_SetItem(py_ret, 6, PyString_FromString(a->at_ordering_oid)); 
+  } else {
+    PyList_SetItem(py_ret, 6, PyString_FromString(""));
+  }
+  if (a->at_substr_oid) {
+    PyList_SetItem(py_ret, 7, PyString_FromString(a->at_substr_oid)); 
+  } else {
+    PyList_SetItem(py_ret, 7, PyString_FromString(""));
+  }
+  if (a->at_syntax_oid) {
+    PyList_SetItem(py_ret, 8, PyString_FromString(a->at_syntax_oid)); 
+  } else {
+    PyList_SetItem(py_ret, 8, PyString_FromString(""));
+  }
+  PyList_SetItem(py_ret, 9, PyInt_FromLong(a->at_syntax_len));
+  PyList_SetItem(py_ret,10, PyInt_FromLong(a->at_single_value));
+  PyList_SetItem(py_ret,11, PyInt_FromLong(a->at_collective));
+  PyList_SetItem(py_ret,12, PyInt_FromLong(a->at_no_user_mod));
+  PyList_SetItem(py_ret,13, PyInt_FromLong(a->at_usage));
+  
+  PyList_SetItem(py_ret, 14, 
+		 schema_extension_to_python(a->at_extensions));
+  ldap_attributetype_free(a);
+  return py_ret;
+}
+
+static char doc_ldap_str2syntax[] = 
+"";
+
+
+static PyObject*
+l_ldap_str2syntax(PyObject* self, PyObject *args)
+{
+  LDAPSyntax *s;
+  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
+  const char *errp;
+  char *syn_string;
+  PyObject *py_ret, *syn_names;
+  
+  if (!PyArg_ParseTuple(args, "si", &syn_string,&flag))
+    return NULL;
+  s = ldap_str2syntax(syn_string, &ret, &errp, flag);
+  if (ret) {
+    py_ret = PyInt_FromLong(ret);
+    return py_ret;
+  }
+  py_ret = PyList_New(4);
+  PyList_SetItem(py_ret, 0, PyString_FromString(s->syn_oid));
+  syn_names = c_string_array_to_python(s->syn_names);
+  PyList_SetItem(py_ret, 1, syn_names);
+  if (s->syn_desc) {
+    PyList_SetItem(py_ret, 2, PyString_FromString(s->syn_desc)); 
+  } else {
+    PyList_SetItem(py_ret, 2, PyString_FromString(""));
+  }
+  PyList_SetItem(py_ret, 3, 
+		 schema_extension_to_python(s->syn_extensions));
+  ldap_syntax_free(s);
+  return py_ret;
+}
+
+static char doc_ldap_str2matchingrule[] = 
+"";
+
+static PyObject*
+l_ldap_str2matchingrule(PyObject* self, PyObject *args)
+{
+  LDAPMatchingRule *m;
+  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
+  const char *errp;
+  char *mr_string;
+  PyObject *py_ret, *mr_names;
+  
+  if (!PyArg_ParseTuple(args, "si", &mr_string,&flag))
+    return NULL;
+  m = ldap_str2matchingrule(mr_string, &ret, &errp, flag);
+  if (ret) {
+    py_ret = PyInt_FromLong(ret);
+    return py_ret;
+  }
+  py_ret = PyList_New(6);
+  PyList_SetItem(py_ret, 0, PyString_FromString(m->mr_oid));
+  mr_names = c_string_array_to_python(m->mr_names);
+  PyList_SetItem(py_ret, 1, mr_names);
+  if (m->mr_desc) {
+    PyList_SetItem(py_ret, 2, PyString_FromString(m->mr_desc)); 
+  } else {
+    PyList_SetItem(py_ret, 2, PyString_FromString(""));
+  }
+  PyList_SetItem(py_ret, 3, PyInt_FromLong(m->mr_obsolete));
+  if (m->mr_syntax_oid) {
+    PyList_SetItem(py_ret, 4, PyString_FromString(m->mr_syntax_oid)); 
+  } else {
+    PyList_SetItem(py_ret, 4, PyString_FromString(""));
+  }  
+  PyList_SetItem(py_ret, 5, 
+		 schema_extension_to_python(m->mr_extensions));
+  ldap_matchingrule_free(m);
+  return py_ret;
+}
+
+/* methods */
+
+static PyMethodDef methods[] = {
+    { "str2objectclass", (PyCFunction)l_ldap_str2objectclass,	METH_VARARGS,
+    	doc_ldap_str2objectclass },
+    { "str2attributetype", (PyCFunction)l_ldap_str2attributetype,	
+      METH_VARARGS, doc_ldap_str2attributetype },
+    { "str2syntax", (PyCFunction)l_ldap_str2syntax, 
+      METH_VARARGS, doc_ldap_str2syntax },
+    { "str2matchingrule", (PyCFunction)l_ldap_str2matchingrule, 
+      METH_VARARGS, doc_ldap_str2matchingrule },
+    { NULL, NULL }
+};
+
+
+void
+LDAPinit_schema( PyObject* d ) {
+    LDAPadd_methods( d, methods );
+}
diff --git a/Modules/schema.h b/Modules/schema.h
new file mode 100644
index 0000000..52492b3
--- /dev/null
+++ b/Modules/schema.h
@@ -0,0 +1,14 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: schema.h,v 1.5 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_schema_
+#define __h_schema_
+
+
+
+#include "common.h"
+extern void LDAPinit_schema( PyObject* );
+
+
+#endif /* __h_schema_ */
+
diff --git a/Modules/version.c b/Modules/version.c
new file mode 100644
index 0000000..264a285
--- /dev/null
+++ b/Modules/version.c
@@ -0,0 +1,20 @@
+/* Set release version
+ * See http://www.python-ldap.org/ for details.
+ * $Id: version.c,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+
+#include "common.h"
+
+#define _STR(x)	#x
+#define STR(x)	_STR(x)
+
+static char version_str[] = STR(LDAPMODULE_VERSION);
+
+void
+LDAPinit_version( PyObject* d ) 
+{
+	PyObject *version;
+
+	version = PyString_FromString(version_str);
+	PyDict_SetItemString( d, "__version__", version );
+	Py_DECREF(version);
+}
diff --git a/Modules/version.h b/Modules/version.h
new file mode 100644
index 0000000..d9a36d9
--- /dev/null
+++ b/Modules/version.h
@@ -0,0 +1,12 @@
+/* Set release version
+ * See http://www.python-ldap.org/ for details.
+ * $Id: version.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+
+#ifndef __h_version_
+#define __h_version_
+
+
+#include "common.h"
+extern void LDAPinit_version( PyObject* d );
+
+#endif /* __h_version_ */

From e1aa8183a713d55783c400a71ae382d1d6e56082 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 17 Apr 2009 14:34:34 +0000
Subject: [PATCH 031/868] Refer to new project home-page

---
 Lib/ldap/cidict.py | 125 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)
 create mode 100644 Lib/ldap/cidict.py

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
new file mode 100644
index 0000000..b0a0a85
--- /dev/null
+++ b/Lib/ldap/cidict.py
@@ -0,0 +1,125 @@
+"""
+This is a convenience wrapper for dictionaries
+returned from LDAP servers containing attribute
+names of variable case.
+
+See http://www.python-ldap.org/ for details.
+
+$Id: cidict.py,v 1.13 2009/04/17 14:34:34 stroeder Exp $
+"""
+
+__version__ = """$Revision: 1.13 $"""
+
+from UserDict import UserDict
+from string import lower
+
+class cidict(UserDict):
+  """
+  Case-insensitive but case-respecting dictionary.
+  """
+
+  def __init__(self,default=None):
+    self._keys = {}
+    UserDict.__init__(self,{})
+    self.update(default or {})
+
+  def __getitem__(self,key):
+    return self.data[lower(key)]
+
+  def __setitem__(self,key,value):
+    lower_key = lower(key)
+    self._keys[lower_key] = key
+    self.data[lower_key] = value
+
+  def __delitem__(self,key):
+    lower_key = lower(key)
+    del self._keys[lower_key]
+    del self.data[lower_key]
+
+  def update(self,dict):
+    for key in dict.keys():
+      self[key] = dict[key]
+
+  def has_key(self,key):
+    return UserDict.has_key(self,lower(key))
+
+  def __contains__(self,key):
+    return self.has_key(key)
+
+  def get(self,key,failobj=None):
+    try:
+      return self[key]
+    except KeyError:
+      return failobj
+
+  def keys(self):
+    return self._keys.values()
+
+  def items(self):
+    result = []
+    for k in self._keys.values():
+      result.append((k,self[k]))
+    return result
+
+
+def strlist_minus(a,b):
+  """
+  Return list of all items in a which are not in b (a - b).
+  a,b are supposed to be lists of case-insensitive strings.
+  """
+  temp = cidict()
+  for elt in b:
+    temp[elt] = elt
+  result = [
+    elt
+    for elt in a
+    if not temp.has_key(elt)
+  ]
+  return result
+
+
+def strlist_intersection(a,b):
+  """
+  Return intersection of two lists of case-insensitive strings a,b.
+  """
+  temp = cidict()
+  for elt in a:
+    temp[elt] = elt
+  result = [
+    temp[elt]
+    for elt in b
+    if temp.has_key(elt)
+  ]
+  return result
+
+
+def strlist_union(a,b):
+  """
+  Return union of two lists of case-insensitive strings a,b.
+  """
+  temp = cidict()
+  for elt in a:
+    temp[elt] = elt
+  for elt in b:
+    temp[elt] = elt
+  return temp.values()
+
+
+if __debug__ and __name__ == '__main__':
+  x = { 'AbCDeF' : 123 }
+  cix = cidict(x)
+  assert cix["ABCDEF"] == 123
+  assert cix.get("ABCDEF",None) == 123
+  assert cix.get("not existent",None) is None
+  cix["xYZ"] = 987
+  assert cix["XyZ"] == 987
+  assert cix.get("XyZ",None) == 987
+  cix_keys = cix.keys()
+  cix_keys.sort()
+  assert cix_keys==['AbCDeF','xYZ'],ValueError(repr(cix_keys))
+  cix_items = cix.items()
+  cix_items.sort()
+  assert cix_items==[('AbCDeF',123),('xYZ',987)],ValueError(repr(cix_items))
+  del cix["abcdEF"]
+  assert not cix._keys.has_key("abcdef")
+  assert not cix.has_key("AbCDef")

From 434b5d44b07fa6b5dbac35c72ee222c4db7693de Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 29 Apr 2009 18:13:55 +0000
Subject: [PATCH 032/868] Fixed ldap.schema.tokenizer.split_tokens() to accept
 a single DOLLAR as separator

---
 Lib/ldap/schema/tokenizer.py            | 85 +++++++++++++++++++++++++
 Tests/Lib/ldap/schema/test_tokenizer.py | 30 +++++++++
 2 files changed, 115 insertions(+)
 create mode 100644 Lib/ldap/schema/tokenizer.py
 create mode 100644 Tests/Lib/ldap/schema/test_tokenizer.py

diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
new file mode 100644
index 0000000..469c326
--- /dev/null
+++ b/Lib/ldap/schema/tokenizer.py
@@ -0,0 +1,85 @@
+"""
+ldap.schema.tokenizer - Low-level parsing functions for schema element strings
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: tokenizer.py,v 1.13 2009/04/29 18:13:55 stroeder Exp $
+"""
+
+
+def split_tokens(s,keywordDict):
+  """
+  Returns list of syntax elements with quotes and spaces
+  stripped.
+  """
+  result = []
+  result_append = result.append
+  s_len = len(s)
+  i = 0
+  while i<s_len:
+    start = i
+    while i<s_len and s[i]!="'":
+      if s[i]=="(" or s[i]==")":
+        if i>start:
+          result_append(s[start:i])
+        result_append(s[i])
+        i +=1 # Consume parentheses
+        start = i
+      elif s[i]==" " or s[i]=="$":
+        if i>start:
+          result_append(s[start:i])
+        i +=1
+        # Consume more space chars
+        while i<s_len and s[i]==" ":
+          i +=1
+        start = i
+      else:
+        i +=1
+    if i>start:
+      result_append(s[start:i])
+    i +=1
+    if i>=s_len:
+      break
+    start = i
+    while i<s_len and s[i]!="'":
+      i +=1
+    if i>=start:
+      result_append(s[start:i])
+    i +=1
+  return result # split_tokens()
+
+
+def extract_tokens(l,known_tokens):
+  """
+  Returns dictionary of known tokens with all values
+  """
+  assert l[0].strip()=="(" and l[-1].strip()==")",ValueError(l)
+  result = {}
+  result_has_key = result.has_key
+  result.update(known_tokens)
+  i = 0
+  l_len = len(l)
+  while i<l_len:
+    if result_has_key(l[i]):
+      token = l[i]
+      i += 1 # Consume token
+      if i<l_len:
+        if result_has_key(l[i]):
+          # non-valued
+          result[token] = (())
+        elif l[i]=="(":
+          # multi-valued
+          i += 1 # Consume left parentheses
+          start = i
+          while i<l_len and l[i]!=")":
+            i += 1
+          result[token] = tuple(filter(lambda v:v!='$',l[start:i]))
+          i += 1 # Consume right parentheses
+        else:
+          # single-valued
+          result[token] = l[i],
+          i += 1 # Consume single value
+    else:
+      i += 1 # Consume unrecognized item
+  return result
+
diff --git a/Tests/Lib/ldap/schema/test_tokenizer.py b/Tests/Lib/ldap/schema/test_tokenizer.py
new file mode 100644
index 0000000..8f66f8a
--- /dev/null
+++ b/Tests/Lib/ldap/schema/test_tokenizer.py
@@ -0,0 +1,30 @@
+import ldap.schema
+from ldap.schema.tokenizer import split_tokens,extract_tokens
+
+testcases_split_tokens = (
+  (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
+  ("BLUBBER DI BLUBB",["BLUBBER","DI","BLUBB"]),
+  ("BLUBBER  DI   BLUBB  ",["BLUBBER","DI","BLUBB"]),
+  ("BLUBBER  DI  'BLUBB'   ",["BLUBBER","DI","BLUBB"]),
+  ("BLUBBER ( DI ) 'BLUBB'   ",["BLUBBER","(","DI",")","BLUBB"]),
+  ("BLUBBER(DI)",["BLUBBER","(","DI",")"]),
+  ("BLUBBER ( DI)",["BLUBBER","(","DI",")"]),
+  ("BLUBBER ''",["BLUBBER",""]),
+  ("( BLUBBER (DI 'BLUBB'))",["(","BLUBBER","(","DI","BLUBB",")",")"]),
+  ("BLUBB (DA$BLAH)",['BLUBB',"(","DA","BLAH",")"]),
+  ("BLUBB ( DA $  BLAH )",['BLUBB',"(","DA","BLAH",")"]),
+  ("BLUBB (DA$ BLAH)",['BLUBB',"(","DA","BLAH",")"]),
+  ("BLUBB (DA $BLAH)",['BLUBB',"(","DA","BLAH",")"]),
+  ("BLUBB 'DA$BLAH'",['BLUBB',"DA$BLAH"]),
+  ("BLUBB DI 'BLU B B ER' DA 'BLAH' ",['BLUBB','DI','BLU B B ER','DA','BLAH']),
+  ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER",['BLUBB','DI','BLU B B ER','DA','BLAH','LABER']),
+  ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]), # for Oracle
+  ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ",['BLUBB','DI','BLU B B ER','MUST','BLAH']) # for Oracle
+)
+
+for t,r in testcases_split_tokens:
+  l = ldap.schema.tokenizer.split_tokens(t,{'MUST':None})
+  if l!=r:
+    print 'String:',repr(t)
+    print '=>',l
+    print 'differs from',r

From 45dd1fc1fa0f14c0f412651f81b714c74df8b062 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 26 Jul 2009 11:09:58 +0000
Subject: [PATCH 033/868] All sub-modules import __version__ from main module
 ldap

---
 Lib/ldap/sasl.py            | 111 ++++++++++++++++++++++++++++++++++++
 Lib/ldap/schema/__init__.py |  12 ++++
 2 files changed, 123 insertions(+)
 create mode 100644 Lib/ldap/sasl.py
 create mode 100644 Lib/ldap/schema/__init__.py

diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
new file mode 100644
index 0000000..4e2d23c
--- /dev/null
+++ b/Lib/ldap/sasl.py
@@ -0,0 +1,111 @@
+"""
+sasl.py - support for SASL mechanism
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: sasl.py,v 1.15 2009/07/26 11:09:58 stroeder Exp $
+
+Description:
+The ldap.sasl module provides SASL authentication classes.
+Each class provides support for one SASL mechanism. This is done by
+implementing a callback() - method, which will be called by the
+LDAPObject's sasl_bind_s() method
+Implementing support for new sasl mechanism is very easy --- see
+the examples of digest_md5 and gssapi.
+
+Compability:
+- Tested with Python 2.0+ but should work with Python 1.5.x
+"""
+
+from ldap import __version__
+
+if __debug__:
+  # Tracing is only supported in debugging mode
+  import traceback
+  from ldap import _trace_level,_trace_file,_trace_stack_limit
+
+# These are the SASL callback id's , as defined in sasl.h
+CB_USER        = 0x4001
+CB_AUTHNAME    = 0x4002
+CB_LANGUAGE    = 0x4003
+CB_PASS        = 0x4004
+CB_ECHOPROMPT  = 0x4005
+CB_NOECHOPROMPT= 0x4006
+CB_GETREALM    = 0x4007
+
+class sasl:
+    """This class handles SASL interactions for authentication.
+    If an instance of this class is passed to ldap's sasl_bind_s()
+    method, the library will call its callback() method. For
+    specific SASL authentication mechanisms, this method can be
+    overridden"""
+
+    def __init__(self,cb_value_dict,mech):
+        """ The (generic) base class takes a cb_value_dictionary of
+        question-answer pairs. Questions are specified by the respective
+        SASL callback id's. The mech argument is a string that specifies
+        the SASL mechaninsm to be uesd."""
+        self.cb_value_dict = cb_value_dict or {}
+        self.mech = mech
+
+    def callback(self,cb_id,challenge,prompt,defresult):
+        """ The callback method will be called by the sasl_bind_s()
+        method several times. Each time it will provide the id, which
+        tells us what kind of information is requested (the CB_ ...
+        constants above). The challenge might be a short (english) text
+        or some binary string, from which the return value is calculated.
+        The prompt argument is always a human-readable description string;
+        The defresult is a default value provided by the sasl library
+
+        Currently, we do not use the challenge and prompt information, and
+        return only information which is stored in the self.cb_value_dict
+        cb_value_dictionary. Note that the current callback interface is not very
+        useful for writing generic sasl GUIs, which would need to know all
+        the questions to ask, before the answers are returned to the sasl
+        lib (in contrast to one question at a time)."""
+        
+        # The following print command might be useful for debugging
+        # new sasl mechanisms. So it is left here
+        cb_result = self.cb_value_dict.get(cb_id,defresult) or ''
+        if __debug__:
+          if _trace_level>=1:
+            _trace_file.write("*** id=%d, challenge=%s, prompt=%s, defresult=%s\n-> %s\n" % (
+                cb_id, challenge, prompt, repr(defresult), repr(self.cb_value_dict.get(cb_result))
+              ))
+        return cb_result
+    
+
+class cram_md5(sasl):
+    """This class handles SASL CRAM-MD5 authentication."""
+
+    def __init__(self,authc_id, password, authz_id=""):
+        auth_dict = {CB_AUTHNAME:authc_id, CB_PASS:password,
+                     CB_USER:authz_id}
+        sasl.__init__(self,auth_dict,"CRAM-MD5")
+
+
+class digest_md5(sasl):
+    """This class handles SASL DIGEST-MD5 authentication."""
+
+    def __init__(self,authc_id, password, authz_id=""):
+        auth_dict = {CB_AUTHNAME:authc_id, CB_PASS:password,
+                     CB_USER:authz_id}
+        sasl.__init__(self,auth_dict,"DIGEST-MD5")
+
+
+class gssapi(sasl):
+    """This class handles SASL GSSAPI (i.e. Kerberos V)
+    authentication."""
+
+    def __init__(self,authz_id=""):
+        sasl.__init__(self, {CB_USER:authz_id},"GSSAPI")
+
+
+class external(sasl):
+    """This class handles SASL EXTERNAL authentication
+    (i.e. X.509 client certificate)"""
+
+    def __init__(self,authz_id=""):
+        sasl.__init__(self, {CB_USER:authz_id},"EXTERNAL")
+
+
diff --git a/Lib/ldap/schema/__init__.py b/Lib/ldap/schema/__init__.py
new file mode 100644
index 0000000..641afa8
--- /dev/null
+++ b/Lib/ldap/schema/__init__.py
@@ -0,0 +1,12 @@
+"""
+ldap.schema -  LDAPv3 schema handling
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: __init__.py,v 1.7 2009/07/26 11:09:58 stroeder Exp $
+"""
+
+from ldap import __version__
+
+from ldap.schema.subentry import SubSchema,SCHEMA_ATTRS,SCHEMA_CLASS_MAPPING,SCHEMA_ATTR_MAPPING,urlfetch
+from ldap.schema.models import *

From 0341c24b6736ea71e16ac9c99c3e19de08aec8f5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 1 Aug 2009 08:50:29 +0000
Subject: [PATCH 034/868] Correctly use ldap.async.AsyncSearchHandler, some
 other cosmetic corrections

---
 Demo/Lib/ldap/async/deltree.py | 80 ++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 Demo/Lib/ldap/async/deltree.py

diff --git a/Demo/Lib/ldap/async/deltree.py b/Demo/Lib/ldap/async/deltree.py
new file mode 100644
index 0000000..58df3b3
--- /dev/null
+++ b/Demo/Lib/ldap/async/deltree.py
@@ -0,0 +1,80 @@
+import ldap,ldap.async
+
+class DeleteLeafs(ldap.async.AsyncSearchHandler):
+  """
+  Class for deleting entries which are results of a search.
+  
+  DNs of Non-leaf entries are collected in DeleteLeafs.nonLeafEntries.
+  """
+  _entryResultTypes = ldap.async._entryResultTypes
+
+  def __init__(self,l):
+    ldap.async.AsyncSearchHandler.__init__(self,l)
+    self.nonLeafEntries = []
+    self.deletedEntries = 0
+
+  def startSearch(self,searchRoot,searchScope):
+    if not searchScope in [ldap.SCOPE_ONELEVEL,ldap.SCOPE_SUBTREE]:
+      raise ValueError, "Parameter searchScope must be either ldap.SCOPE_ONELEVEL or ldap.SCOPE_SUBTREE."
+    self.nonLeafEntries = []
+    self.deletedEntries = 0
+    ldap.async.AsyncSearchHandler.startSearch(
+      self,
+      searchRoot,
+      searchScope,
+      filterStr='(objectClass=*)',
+      attrList=['hasSubordinates','numSubordinates'],
+      attrsOnly=0,
+    )
+
+  def _processSingleResult(self,resultType,resultItem):
+    if self._entryResultTypes.has_key(resultType):
+      # Don't process search references
+      dn,entry = resultItem
+      hasSubordinates = entry.get(
+        'hasSubordinates',
+        entry.get('hassubordinates',['FALSE']
+        )
+      )[0]
+      numSubordinates = entry.get(
+        'numSubordinates',
+        entry.get('numsubordinates',['0'])
+      )[0]
+      if hasSubordinates=='TRUE' or int(numSubordinates):
+        self.nonLeafEntries.append(dn)
+      else:
+        try:
+          self._l.delete_s(dn)
+        except ldap.NOT_ALLOWED_ON_NONLEAF,e:
+          self.nonLeafEntries.append(dn)
+        else:
+          self.deletedEntries = self.deletedEntries+1
+
+
+def DelTree(l,dn,scope=ldap.SCOPE_ONELEVEL):
+  """
+  Recursively delete entries below or including entry with name dn.
+  """
+  leafs_deleter = DeleteLeafs(l)
+  leafs_deleter.startSearch(dn,scope)
+  leafs_deleter.processResults()
+  deleted_entries = leafs_deleter.deletedEntries
+  non_leaf_entries = leafs_deleter.nonLeafEntries[:]
+  while non_leaf_entries:
+    dn = non_leaf_entries.pop()
+    print deleted_entries,len(non_leaf_entries),dn
+    leafs_deleter.startSearch(dn,ldap.SCOPE_SUBTREE)
+    leafs_deleter.processResults()
+    deleted_entries = deleted_entries+leafs_deleter.deletedEntries
+    non_leaf_entries.extend(leafs_deleter.nonLeafEntries)
+  return # DelTree()
+
+
+# Create LDAPObject instance
+l = ldap.initialize('ldap://localhost:1390')
+
+# Try a bind to provoke failure if protocol version is not supported
+l.simple_bind_s('cn=Directory Manager,dc=IMC,dc=org','controller')
+
+# Delete all entries *below* the entry dc=Delete,dc=IMC,dc=org
+DelTree(l,'dc=Delete,dc=IMC,dc=org',ldap.SCOPE_ONELEVEL)

From 5fac716fb5bd10dc65ea422087bd7d15e718c756 Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Tue, 4 Aug 2009 05:39:10 +0000
Subject: [PATCH 035/868] Changed internal API List_to_LDAPControls() to
 LDAPControls_from_object()

Reasons: exported symbols of the library should begin with "LDAP",
also gives us a function with a converter signature we can use later.
---
 Modules/ldapcontrol.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 Modules/ldapcontrol.h

diff --git a/Modules/ldapcontrol.h b/Modules/ldapcontrol.h
new file mode 100644
index 0000000..f615858
--- /dev/null
+++ b/Modules/ldapcontrol.h
@@ -0,0 +1,15 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: ldapcontrol.h,v 1.6 2009/08/04 05:39:10 leonard Exp $ */
+
+#ifndef __h_ldapcontrol
+#define __h_ldapcontrol
+
+#include "common.h"
+#include "ldap.h"
+
+void LDAPinit_control(PyObject *d);
+void LDAPControl_List_DEL( LDAPControl** );
+int  LDAPControls_from_object(PyObject *, LDAPControl ***);
+PyObject* LDAPControls_to_List(LDAPControl **ldcs);
+
+#endif /* __h_ldapcontrol */

From c876b63acfcbe64c515e05cb43ec6dd9c166b95e Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Sun, 16 Aug 2009 06:20:46 +0000
Subject: [PATCH 036/868] Add some unit tests

---
 Tests/t_search.py | 95 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 Tests/t_search.py

diff --git a/Tests/t_search.py b/Tests/t_search.py
new file mode 100644
index 0000000..e938cab
--- /dev/null
+++ b/Tests/t_search.py
@@ -0,0 +1,95 @@
+import ldap, unittest
+import slapd
+
+from ldap.ldapobject import LDAPObject
+
+server = None
+
+class TestSearch(unittest.TestCase):
+
+    def setUp(self):
+        global server
+        if server is None:
+            server = slapd.Slapd()
+            server.start()
+            base = server.get_dn_suffix()
+
+            # insert some Foo* objects via ldapadd
+            server.ldapadd("\n".join([
+                "dn: cn=Foo1,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo1",
+                "",
+                "dn: cn=Foo2,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo2",
+                "",
+                "dn: cn=Foo3,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo3",
+                "",
+                "dn: ou=Container,"+base,
+                "objectClass: organizationalUnit",
+                "ou: Container",
+                "",
+                "dn: cn=Foo4,ou=Container,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo4",
+                "",
+            ])+"\n")
+
+        l = LDAPObject(server.get_url())
+        l.protocol_version = 3
+        l.set_option(ldap.OPT_REFERRALS,0)
+        l.simple_bind_s(server.get_root_dn(), 
+                server.get_root_password())
+        self.ldap = l
+        self.server = server
+
+    def test_search_subtree(self):
+        base = self.server.get_dn_suffix()
+        l = self.ldap
+
+        result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
+        result.sort()
+        self.assertEquals(result,
+            [('cn=Foo1,'+base,
+               {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}),
+             ('cn=Foo2,'+base,
+               {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}),
+             ('cn=Foo3,'+base,
+               {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}),
+             ('cn=Foo4,ou=Container,'+base,
+               {'cn': ['Foo4'], 'objectClass': ['organizationalRole']}),
+            ]
+        )
+
+    def test_search_onelevel(self):
+        base = self.server.get_dn_suffix()
+        l = self.ldap
+
+        result = l.search_s(base, ldap.SCOPE_ONELEVEL, '(cn=Foo*)', ['*'])
+        result.sort()
+        self.assertEquals(result,
+            [('cn=Foo1,'+base,
+               {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}),
+             ('cn=Foo2,'+base,
+               {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}),
+             ('cn=Foo3,'+base,
+               {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}),
+            ]
+        )
+
+    def test_search_oneattr(self):
+        base = self.server.get_dn_suffix()
+        l = self.ldap
+
+        result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo4)', ['cn'])
+        result.sort()
+        self.assertEquals(result,
+            [('cn=Foo4,ou=Container,'+base, {'cn': ['Foo4']})]
+        )
+
+
+if __name__ == '__main__':
+    unittest.main()

From ce8aca92cfd9340ca50d6c65b483e2a8e4269d53 Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Mon, 17 Aug 2009 00:06:49 +0000
Subject: [PATCH 037/868] Add more tests for the C Extension module.

---
 Tests/slapd.py | 383 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 383 insertions(+)
 create mode 100644 Tests/slapd.py

diff --git a/Tests/slapd.py b/Tests/slapd.py
new file mode 100644
index 0000000..48747fa
--- /dev/null
+++ b/Tests/slapd.py
@@ -0,0 +1,383 @@
+
+"""
+Utilities for starting up a test slapd server 
+and talking to it with ldapsearch/ldapadd.
+"""
+
+import sys, os, socket, time, subprocess, logging
+
+_log = logging.getLogger("slapd")
+
+def quote(s):
+    '''Quotes the '"' and '\' characters in a string and surrounds with "..."'''
+    return '"' + s.replace('\\','\\\\').replace('"','\\"') + '"'
+
+def mkdirs(path):
+    """Creates the directory path unless it already exists"""
+    if not os.access(os.path.join(path, os.path.curdir), os.F_OK):
+        _log.debug("creating temp directory %s", path)
+        os.mkdir(path)
+    return path
+
+def delete_directory_content(path):
+    for dirpath,dirnames,filenames in os.walk(path, topdown=False):
+        for n in filenames: 
+            _log.info("remove %s", os.path.join(dirpath, n))
+            os.remove(os.path.join(dirpath, n))
+        for n in dirnames: 
+            _log.info("rmdir %s", os.path.join(dirpath, n))
+            os.rmdir(os.path.join(dirpath, n))
+
+LOCALHOST = '127.0.0.1'
+
+def find_available_tcp_port(host=LOCALHOST):
+    s = socket.socket()
+    s.bind((host, 0))
+    port = s.getsockname()[1]
+    s.close()
+    _log.info("Found available port %d", port)
+    return port
+
+class Slapd:
+    """
+    Controller class for a slapd instance, OpenLDAP's server.
+
+    This class creates a temporary data store for slapd, runs it
+    on a private port, and initialises it with a top-level dc and
+    the root user.
+
+    When a reference to an instance of this class is lost, the slapd
+    server is shut down.
+    """
+
+    _log = logging.getLogger("Slapd")
+
+    # Use /var/tmp to placate apparmour on Ubuntu:
+    PATH_TMPDIR = "/var/tmp/python-ldap-test"  
+    PATH_SBINDIR = "/usr/sbin"
+    PATH_BINDIR = "/usr/bin"
+    PATH_SCHEMA_CORE = "/etc/ldap/schema/core.schema"
+    PATH_LDAPADD = os.path.join(PATH_BINDIR, "ldapadd")
+    PATH_LDAPSEARCH = os.path.join(PATH_BINDIR, "ldapsearch")
+    PATH_SLAPD = os.path.join(PATH_SBINDIR, "slapd")
+    PATH_SLAPTEST = os.path.join(PATH_SBINDIR, "slaptest")
+
+    # TODO add paths for other OSs
+
+    def check_paths(cls):
+        """
+        Checks that the configured executable paths look valid.
+        If they don't, then logs warning messages (not errors).
+        """
+        for name,path in (
+                ("slapd", cls.PATH_SLAPD),
+                ("ldapadd", cls.PATH_LDAPADD),
+                ("ldapsearch", cls.PATH_LDAPSEARCH),
+             ):
+            cls._log.debug("checking %s executable at %s", name, path)
+            if not os.access(path, os.X_OK):
+                cls._log.warn("cannot find %s executable at %s", name, path)
+    check_paths = classmethod(check_paths)
+
+    def __init__(self):
+        self._config = []
+        self._proc = None
+        self._port = 0
+        self._tmpdir = self.PATH_TMPDIR
+        self._dn_suffix = "dc=python-ldap,dc=org"
+        self._root_cn = "Manager"
+        self._root_password = "password"
+        self._slapd_debug_level = 0
+
+    # Setters 
+    def set_port(self, port):
+        self._port = port
+    def set_dn_suffix(self, dn):
+        self._dn_suffix = dn
+    def set_root_cn(self, cn):
+        self._root_cn = cn
+    def set_root_password(self, pw):
+        self._root_password = pw
+    def set_tmpdir(self, path):
+        self._tmpdir = path
+    def set_slapd_debug_level(self, level):
+        self._slapd_debug_level = level
+    def set_debug(self):
+        self._log.setLevel(logging.DEBUG)
+        self.set_slapd_debug_level('Any')
+
+    # getters
+    def get_url(self):
+        return "ldap://%s:%d/" % self.get_address()
+    def get_address(self):
+        if self._port == 0:
+            self._port = find_available_tcp_port(LOCALHOST)
+        return (LOCALHOST, self._port)
+    def get_dn_suffix(self):
+        return self._dn_suffix
+    def get_root_dn(self):
+        return "cn=" + self._root_cn + "," + self.get_dn_suffix()
+    def get_root_password(self):
+        return self._root_password
+    def get_tmpdir(self):
+        return self._tmpdir
+
+    def __del__(self):
+        self.stop()
+
+    def configure(self, cfg):
+        """
+        Appends slapd.conf configuration lines to cfg.
+        Also re-initializes any backing storage.
+        Feel free to subclass and override this method.
+        """
+
+        # Global
+        cfg.append("include " + quote(self.PATH_SCHEMA_CORE))
+        cfg.append("allow bind_v2")
+
+        # Database
+        ldif_dir = mkdirs(os.path.join(self.get_tmpdir(), "ldif-data"))
+        delete_directory_content(ldif_dir) # clear it out
+        cfg.append("database ldif")
+        cfg.append("directory " + quote(ldif_dir))
+
+        cfg.append("suffix " + quote(self.get_dn_suffix()))
+        cfg.append("rootdn " + quote(self.get_root_dn()))
+        cfg.append("rootpw " + quote(self.get_root_password()))
+
+    def _write_config(self):
+        """Writes the slapd.conf file out, and returns the path to it."""
+        path = os.path.join(self._tmpdir, "slapd.conf")
+        ldif_dir = mkdirs(self._tmpdir)
+        if os.access(path, os.F_OK):
+            self._log.debug("deleting existing %s", path)
+            os.remove(path)
+        self._log.debug("writing config to %s", path)
+        file(path, "w").writelines([line + "\n" for line in self._config])
+        return path
+
+    def start(self):
+        """
+        Starts the slapd server process running, and waits for it to come up. 
+        """
+        if self._proc is None:
+            ok = False
+            config_path = None
+            try:
+                self.configure(self._config)
+                self._test_configuration()
+                self._start_slapd()
+                self._wait_for_slapd()
+                ok = True
+                self._log.debug("slapd ready at %s", self.get_url())
+                self.started()
+            finally:
+                if not ok:
+                    if config_path:
+                        try: os.remove(config_path)
+                        except os.error: pass
+                    if self._proc:
+                        self.stop()
+
+    def _start_slapd(self):
+        # Spawns/forks the slapd process
+        config_path = self._write_config()
+        self._log.info("starting slapd")
+        self._proc = subprocess.Popen([self.PATH_SLAPD, 
+                "-f", config_path, 
+                "-h", self.get_url(), 
+                "-d", str(self._slapd_debug_level),
+                ])
+        self._proc_config = config_path
+
+    def _wait_for_slapd(self):
+        # Waits until the LDAP server socket is open, or slapd crashed
+        s = socket.socket()
+        while 1:
+            if self._proc.poll() is not None:
+                self._stopped()
+                raise RuntimeError("slapd exited before opening port")
+            try:
+               self._log.debug("Connecting to %s", repr(self.get_address()))
+               s.connect(self.get_address())
+               s.close()
+               return
+            except socket.error:
+               time.sleep(1)
+
+    def stop(self):
+        """Stops the slapd server, and waits for it to terminate"""
+        if self._proc is not None:
+            self._log.debug("stopping slapd")
+            if hasattr(self._proc, 'terminate'):
+                self._proc.terminate()
+            else:
+                import posix, signal
+                posix.kill(self._proc.pid, signal.SIGHUP)
+                #time.sleep(1)
+                #posix.kill(self._proc.pid, signal.SIGTERM)
+                #posix.kill(self._proc.pid, signal.SIGKILL)
+            self.wait()
+
+    def restart(self):
+        """
+        Restarts the slapd server; ERASING previous content.
+        Starts the server even it if isn't already running.
+        """
+        self.stop()
+        self.start()
+
+    def wait(self):
+        """Waits for the slapd process to terminate by itself."""
+        if self._proc:
+            self._proc.wait()
+            self._stopped()
+
+    def _stopped(self):
+        """Called when the slapd server is known to have terminated"""
+        if self._proc is not None:
+            self._log.info("slapd terminated")
+            self._proc = None
+            try: 
+                os.remove(self._proc_config)
+            except os.error: 
+                self._log.debug("could not remove %s", self._proc_config)
+
+    def _test_configuration(self):
+        config_path = self._write_config()
+        try:
+            self._log.debug("testing configuration")
+            verboseflag = "-Q"
+            if self._log.isEnabledFor(logging.DEBUG):
+                verboseflag = "-v"
+            p = subprocess.Popen([
+                self.PATH_SLAPTEST, 
+                verboseflag, 
+                "-f", config_path
+            ])
+            if p.wait() != 0:
+                raise RuntimeError("configuration test failed")
+            self._log.debug("configuration seems ok")
+        finally:
+            os.remove(config_path)
+
+    def ldapadd(self, ldif, extra_args=[]):
+        """Runs ldapadd on this slapd instance, passing it the ldif content"""
+        self._log.debug("adding %s", repr(ldif))
+        p = subprocess.Popen([self.PATH_LDAPADD, 
+                "-x",
+                "-D", self.get_root_dn(),
+                "-w", self.get_root_password(),
+                "-H", self.get_url()] + extra_args,
+                stdin = subprocess.PIPE, stdout=subprocess.PIPE)
+        p.communicate(ldif)
+        if p.wait() != 0:
+            raise RuntimeError("ldapadd process failed")
+
+    def ldapsearch(self, base=None, filter='(objectClass=*)', attrs=[],
+        scope='sub', extra_args=[]):
+        if base is None: base = self.get_dn_suffix()
+        self._log.debug("ldapsearch filter=%s", repr(filter))
+        p = subprocess.Popen([self.PATH_LDAPSEARCH, 
+                "-x",
+                "-D", self.get_root_dn(),
+                "-w", self.get_root_password(),
+                "-H", self.get_url(),
+                "-b", base,
+                "-s", scope,
+                "-LL",
+                ] + extra_args + [ filter ] + attrs,
+                stdout = subprocess.PIPE)
+        output = p.communicate()[0]
+        if p.wait() != 0:
+            raise RuntimeError("ldapadd process failed")
+
+        # RFC 2849: LDIF format
+        # unfold
+        lines = []
+        for l in output.split('\n'):
+            if l.startswith(' '):
+                lines[-1] = lines[-1] + l[1:]
+            elif l == '' and lines and lines[-1] == '':
+                pass # ignore multiple blank lines
+            else:
+                lines.append(l)
+        # Remove comments
+        lines = [l for l in lines if not l.startswith("#")]
+
+        # Remove leading version and blank line(s)
+        if lines and lines[0] == '': del lines[0]
+        if not lines or lines[0] != 'version: 1':
+            raise RuntimeError("expected 'version: 1', got " + repr(lines[:1]))
+        del lines[0]
+        if lines and lines[0] == '': del lines[0]
+
+        # ensure the ldif ends with a blank line (unless it is just blank)
+        if lines and lines[-1] != '': lines.append('')
+
+        objects = []
+        obj = []
+        for line in lines:
+            if line == '': # end of an object
+                if obj[0][0] != 'dn':
+                    raise RuntimeError("first line not dn", repr(obj))
+                objects.append((obj[0][1], obj[1:]))
+                obj = []
+            else:
+                attr,value = line.split(':',2)
+                if value.startswith(': '):
+                    value = base64.decodestring(value[2:])
+                elif value.startswith(' '):
+                    value = value[1:]
+                else:
+                    raise RuntimeError("bad line: " + repr(line))
+                obj.append((attr,value))
+        assert obj == []
+        return objects
+
+    def started(self):
+        """
+        This method is called when the LDAP server has started up and is empty.
+        By default, this method adds the two initial objects,
+        the domain object and the root user object.
+        """
+        assert self.get_dn_suffix().startswith("dc=")
+        suffix_dc = self.get_dn_suffix().split(',')[0][3:]
+        assert self.get_root_dn().startswith("cn=")
+        assert self.get_root_dn().endswith("," + self.get_dn_suffix())
+        root_cn = self.get_root_dn().split(',')[0][3:]
+
+        self._log.debug("adding %s and %s",
+                self.get_dn_suffix(),
+                self.get_root_dn())
+
+        self.ldapadd("\n".join([
+            'dn: ' + self.get_dn_suffix(),
+            'objectClass: dcObject',
+            'objectClass: organization',
+            'dc: ' + suffix_dc,
+            'o: ' + suffix_dc,
+            '',
+            'dn: ' + self.get_root_dn(),
+            'objectClass: organizationalRole',
+            'cn: ' + root_cn,
+            ''
+        ]))
+
+Slapd.check_paths()
+
+if __name__ == '__main__' and sys.argv == ['run']:
+    logging.basicConfig(level=logging.DEBUG)
+    slapd = Slapd()
+    print("Starting slapd...")
+    slapd.start()
+    print("Contents of LDAP server follow:\n")
+    for dn,attrs in slapd.ldapsearch():
+        print("dn: " + dn)
+        for name,val in attrs:
+            print(name + ": " + val)
+        print("")
+    print(slapd.get_url())
+    slapd.wait()
+

From 20bee65a8ba66902675fe6c1d44dd9396c78c802 Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Mon, 17 Aug 2009 01:49:47 +0000
Subject: [PATCH 038/868] Factor out LDAPberval_to_object()

Also commit other berval converters which are not yet called by anything.

In places where bervals are returned as objects, PyString_FromStringAndSize()
was being used. In some rare cases, a NULL berval pointer (not NULL data)
is returned as None (not a string). This factors that out to the berval.c
compilation unit.
---
 Modules/berval.c  | 97 +++++++++++++++++++++++++++++++++++++++++++++++
 Modules/berval.h  | 15 ++++++++
 Tests/runtests.sh | 26 +++++++++++++
 3 files changed, 138 insertions(+)
 create mode 100644 Modules/berval.c
 create mode 100644 Modules/berval.h
 create mode 100755 Tests/runtests.sh

diff --git a/Modules/berval.c b/Modules/berval.c
new file mode 100644
index 0000000..1c71bb3
--- /dev/null
+++ b/Modules/berval.c
@@ -0,0 +1,97 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: berval.c,v 1.1 2009/08/17 01:49:47 leonard Exp $ */
+
+#include "common.h"
+#include "berval.h"
+
+/*
+ * Converts a Python object into a data for a berval structure.
+ *
+ * New memory is allocated, and the content of the object is copied into it.
+ * Then the (pre-existing) berval structure's field are filled in with pointer
+ * and length data.
+ *
+ * The source object must implement the buffer interface, or be None.
+ * If the source object is None, bv->bv_val will be set to NULL and bv_len to 0.
+ * Otherwise, bv->bv_val will be non-NULL (even for zero-length data).
+ * This allows the caller to distinguish a None argument as something special.
+ *
+ * Returns 0 on failure, leaving *bv unchanged, and setting an error.
+ * Returns 1 on success: the berval must be freed with LDAPberval_release().
+ */
+int
+LDAPberval_from_object(PyObject *obj, struct berval *bv)
+{
+    const void *data;
+    char *datacp;
+    Py_ssize_t len;
+
+    if (PyNone_Check(obj)) {
+        bv->bv_len = 0;
+        bv->bv_val = NULL;
+        return 1;
+    }
+
+    if (!PyObject_AsReadBuffer(obj, &data, &len))
+        return 0;
+
+    datacp = PyMem_MALLOC(len ? len : 1);
+    if (!datacp) {
+        PyErr_NoMemory();
+        return 0;
+    }
+    memcpy(datacp, data, len);
+
+    bv->bv_len = len;
+    bv->bv_val = datacp;
+    return 1;
+}
+
+/*
+ * Returns true if the object could be used to initialize a berval structure
+ * with LDAPberval_from_object()
+ */
+int
+LDAPberval_from_object_check(PyObject *obj)
+{
+    return PyNone_Check(obj) ||
+           PyObject_CheckReadBuffer(obj);
+}
+
+/*
+ * Releases memory allocated by LDAPberval_from_object().
+ * Has no effect if the berval pointer is NULL or the berval data is NULL.
+ */
+void
+LDAPberval_release(struct berval *bv) {
+    if (bv && bv->bv_val) {
+        PyMem_FREE(bv->bv_val);
+        bv->bv_len = 0;
+        bv->bv_val = NULL;
+    }
+}
+
+/*
+ * Copies out the data from a berval, and returns it as a new Python object,
+ * Returns None if the berval pointer is NULL.
+ *
+ * Note that this function is not the exact inverse of LDAPberval_from_object
+ * with regards to the NULL/None conversion.
+ *
+ * Returns a new Python object on success, or NULL on failure.
+ */
+PyObject *
+LDAPberval_to_object(const struct berval *bv)
+{
+    PyObject *ret = NULL;
+
+    if (!bv) {
+        ret = Py_None;
+        Py_INCREF(ret);
+    }
+    else {
+        ret = PyString_FromStringAndSize(bv->bv_val, bv->bv_len);
+    }
+
+    return ret;
+}
diff --git a/Modules/berval.h b/Modules/berval.h
new file mode 100644
index 0000000..0b32438
--- /dev/null
+++ b/Modules/berval.h
@@ -0,0 +1,15 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: berval.h,v 1.1 2009/08/17 01:49:47 leonard Exp $ */
+
+#ifndef __h_berval 
+#define __h_berval 
+
+#include "common.h"
+#include "lber.h"
+
+int  LDAPberval_from_object(PyObject *obj, struct berval *bv);
+int  LDAPberval_from_object_check(PyObject *obj);
+void LDAPberval_release(struct berval *bv);
+PyObject *LDAPberval_to_object(const struct berval *bv);
+
+#endif /* __h_berval_ */
diff --git a/Tests/runtests.sh b/Tests/runtests.sh
new file mode 100755
index 0000000..f857025
--- /dev/null
+++ b/Tests/runtests.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+#
+# This script runs all the t_*.py tests in the current directory,
+# preparing PYTHONPATH to use the most recent local build
+#
+# Run with -v option for verbose
+#
+
+set -e
+: ${PYTHON:="python"}
+plat_specifier=`$PYTHON -c 'import sys,distutils.util; \
+        print(distutils.util.get_platform()+"-"+sys.version[0:3])'`
+failed=
+for test in t_*.py;  do
+    echo "$test:"
+    PYTHONPATH="../build/lib.$plat_specifier" $PYTHON "$test" "$@" || 
+        failed="$failed $test"
+done
+
+if test -n "$failed"; then
+   echo "Tests that failed:$failed" >&2
+   exit 1
+else
+   echo "All tests passed. Yay."
+   exit 0
+fi

From e54787d89cfb4da8747cbd2bb8825ced0d6b13ee Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Mon, 17 Aug 2009 05:00:57 +0000
Subject: [PATCH 039/868] issue #1964993: corrected exceptions raised by
 set_option/get_option

---
 Modules/functions.c | 151 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 151 insertions(+)
 create mode 100644 Modules/functions.c

diff --git a/Modules/functions.c b/Modules/functions.c
new file mode 100644
index 0000000..8224cba
--- /dev/null
+++ b/Modules/functions.c
@@ -0,0 +1,151 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: functions.c,v 1.27 2009/08/17 05:00:57 leonard Exp $ */
+
+#include "common.h"
+#include "functions.h"
+#include "LDAPObject.h"
+#include "berval.h"
+#include "errors.h"
+#include "options.h"
+
+/* ldap_initialize */
+
+static PyObject*
+l_ldap_initialize(PyObject* unused, PyObject *args)
+{
+    char *uri;
+    LDAP *ld = NULL;
+    int ret;
+
+    if (!PyArg_ParseTuple(args, "s", &uri))
+    	return NULL;
+
+    Py_BEGIN_ALLOW_THREADS
+    ret = ldap_initialize(&ld, uri);
+    Py_END_ALLOW_THREADS
+    if (ret != LDAP_SUCCESS)
+    	return LDAPerror(ld, "ldap_initialize");
+    return (PyObject*)newLDAPObject(ld);
+}
+
+
+/* ldap_str2dn */
+
+static PyObject*
+l_ldap_str2dn( PyObject* unused, PyObject *args )
+{
+    struct berval str;
+    LDAPDN dn;
+    int flags = 0;
+    PyObject *result = NULL, *tmp;
+    int res, i, j;
+    Py_ssize_t str_len;
+
+    /*
+     * From a DN string such as "a=b,c=d;e=f", build
+     * a list-equivalent of AVA structures; namely:
+     * ((('a','b',1),('c','d',1)),(('e','f',1),))
+     * The integers are a bit combination of the AVA_* flags
+     */
+    if (!PyArg_ParseTuple( args, "z#|i:str2dn", 
+	    &str.bv_val, &str_len, &flags )) 
+	return NULL;
+    str.bv_len = (ber_len_t) str_len;
+
+    res = ldap_bv2dn(&str, &dn, flags);
+    if (res != LDAP_SUCCESS)
+	return LDAPerr(res);
+
+    tmp = PyList_New(0);
+    if (!tmp)
+	goto failed;
+
+    for (i = 0; dn[i]; i++) {
+	LDAPRDN rdn;
+	PyObject *rdnlist;
+
+	rdn = dn[i];
+	rdnlist = PyList_New(0);
+	if (!rdnlist)
+	    goto failed;
+	if (PyList_Append(tmp, rdnlist) == -1) {
+	    Py_DECREF(rdnlist);
+	    goto failed;
+	}
+
+	for (j = 0; rdn[j]; j++) {
+	    LDAPAVA *ava = rdn[j];
+	    PyObject *tuple;
+
+	    tuple = Py_BuildValue("(O&O&i)", 
+		LDAPberval_to_object, &ava->la_attr,
+		LDAPberval_to_object, &ava->la_value,
+		ava->la_flags & ~(LDAP_AVA_FREE_ATTR|LDAP_AVA_FREE_VALUE));
+	    if (!tuple) {
+		Py_DECREF(rdnlist);
+		goto failed;
+	    }
+
+	    if (PyList_Append(rdnlist, tuple) == -1) {
+		Py_DECREF(tuple);
+		goto failed;
+	    }
+	    Py_DECREF(tuple);
+	}
+	Py_DECREF(rdnlist);
+    }
+
+    result = tmp;
+    tmp = NULL;
+
+failed:
+    Py_XDECREF(tmp);
+    ldap_dnfree(dn);
+    return result;
+}
+
+/* ldap_set_option (global options) */
+
+static PyObject*
+l_ldap_set_option(PyObject* self, PyObject *args)
+{
+    PyObject *value;
+    int option;
+
+    if (!PyArg_ParseTuple(args, "iO:set_option", &option, &value))
+	return NULL;
+    if (!LDAP_set_option(NULL, option, value))
+	return NULL;
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
+/* ldap_get_option (global options) */
+
+static PyObject*
+l_ldap_get_option(PyObject* self, PyObject *args)
+{
+    int option;
+
+    if (!PyArg_ParseTuple(args, "i:get_option", &option))
+	return NULL;
+    return LDAP_get_option(NULL, option);
+}
+
+
+/* methods */
+
+static PyMethodDef methods[] = {
+    { "initialize",	(PyCFunction)l_ldap_initialize,		METH_VARARGS },
+    { "str2dn",	    (PyCFunction)l_ldap_str2dn,			METH_VARARGS },
+    { "set_option", (PyCFunction)l_ldap_set_option,		METH_VARARGS },
+    { "get_option", (PyCFunction)l_ldap_get_option,		METH_VARARGS },
+    { NULL, NULL }
+};
+
+/* initialisation */
+
+void
+LDAPinit_functions( PyObject* d ) {
+    LDAPadd_methods( d, methods );
+}

From 162cedf71ba62b3944d18a27ed206d55e679f966 Mon Sep 17 00:00:00 2001
From: leonard <leonard>
Date: Mon, 17 Aug 2009 05:38:17 +0000
Subject: [PATCH 040/868] Avoid leaking slapd processes when testing

---
 Tests/t_cext.py | 616 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 616 insertions(+)
 create mode 100644 Tests/t_cext.py

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
new file mode 100644
index 0000000..7a44c92
--- /dev/null
+++ b/Tests/t_cext.py
@@ -0,0 +1,616 @@
+
+import unittest, slapd
+import _ldap
+import logging
+
+reusable_server = None
+def get_reusable_server():
+    global reusable_server
+    if reusable_server is None:
+        reusable_server = slapd.Slapd()
+    return reusable_server
+
+class TestLdapCExtension(unittest.TestCase):
+    """Tests the LDAP C Extension module, _ldap.
+       These tests apply only to the _ldap module and bypass the
+       LDAPObject wrapper completely."""
+
+    timeout = 3
+
+    def _init_server(self, reuse_existing=True):
+        global reusable_server
+        """Sets self.server to a test LDAP server and self.base
+           to its base"""
+        if reuse_existing:
+            server = get_reusable_server()
+        else:
+            server = slapd.Slapd() # private server
+        #server.set_debug()  # enables verbose messages
+        server.start()   # no effect if already started
+        self.server = server
+        self.base = server.get_dn_suffix()
+        return server
+
+    def _init(self, reuse_existing=True, bind=True):
+        """Starts a server, and returns a LDAPObject bound to it"""
+        server = self._init_server(reuse_existing)
+        l = _ldap.initialize(server.get_url())
+        if bind:
+            # Perform a simple bind
+            l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+            m = l.simple_bind(server.get_root_dn(), server.get_root_password())
+            result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ONE, self.timeout)
+            self.assertTrue(result, _ldap.RES_BIND)
+        return l
+
+    def assertNotNone(self, expr, msg=None):
+        self.failIf(expr is None, msg or repr(expr))
+    def assertNone(self, expr, msg=None):
+        self.failIf(expr is not None, msg or repr(expr))
+
+    # Test for the existence of a whole bunch of constants
+    # that the C module is supposed to export
+    def test_constants(self):
+        self.assertEquals(_ldap.PORT, 389)
+        self.assertEquals(_ldap.VERSION1, 1)
+        self.assertEquals(_ldap.VERSION2, 2)
+        self.assertEquals(_ldap.VERSION3, 3)
+
+        # constants for result3()
+        self.assertEquals(_ldap.RES_BIND, 0x61)
+        self.assertEquals(_ldap.RES_SEARCH_ENTRY, 0x64)
+        self.assertEquals(_ldap.RES_SEARCH_RESULT, 0x65)
+        self.assertEquals(_ldap.RES_MODIFY, 0x67)
+        self.assertEquals(_ldap.RES_ADD, 0x69)
+        self.assertEquals(_ldap.RES_DELETE, 0x6b)
+        self.assertEquals(_ldap.RES_MODRDN, 0x6d)
+        self.assertEquals(_ldap.RES_COMPARE, 0x6f)
+        self.assertEquals(_ldap.RES_SEARCH_REFERENCE, 0x73) # v3
+        self.assertEquals(_ldap.RES_EXTENDED, 0x78)         # v3
+        #self.assertEquals(_ldap.RES_INTERMEDIATE, 0x79)     # v3
+        self.assertNotNone(_ldap.RES_ANY)
+        self.assertNotNone(_ldap.RES_UNSOLICITED)
+
+        self.assertNotNone(_ldap.AUTH_NONE)
+        self.assertNotNone(_ldap.AUTH_SIMPLE)
+
+        self.assertNotNone(_ldap.SCOPE_BASE)
+        self.assertNotNone(_ldap.SCOPE_ONELEVEL)
+        self.assertNotNone(_ldap.SCOPE_SUBTREE)
+
+        self.assertNotNone(_ldap.MOD_ADD)
+        self.assertNotNone(_ldap.MOD_DELETE)
+        self.assertNotNone(_ldap.MOD_REPLACE)
+        self.assertNotNone(_ldap.MOD_INCREMENT)
+        self.assertNotNone(_ldap.MOD_BVALUES)
+
+        # for result3()
+        self.assertNotNone(_ldap.MSG_ONE)
+        self.assertNotNone(_ldap.MSG_ALL)
+        self.assertNotNone(_ldap.MSG_RECEIVED)
+
+        # for OPT_DEFEF
+        self.assertNotNone(_ldap.DEREF_NEVER)
+        self.assertNotNone(_ldap.DEREF_SEARCHING)
+        self.assertNotNone(_ldap.DEREF_FINDING)
+        self.assertNotNone(_ldap.DEREF_ALWAYS)
+
+        # for OPT_SIZELIMIT, OPT_TIMELIMIT
+        self.assertNotNone(_ldap.NO_LIMIT)
+
+        # standard options
+        self.assertNotNone(_ldap.OPT_API_INFO)
+        self.assertNotNone(_ldap.OPT_DEREF)
+        self.assertNotNone(_ldap.OPT_SIZELIMIT)
+        self.assertNotNone(_ldap.OPT_TIMELIMIT)
+        self.assertNotNone(_ldap.OPT_REFERRALS)
+        self.assertNotNone(_ldap.OPT_RESTART)
+        self.assertNotNone(_ldap.OPT_PROTOCOL_VERSION)
+        self.assertNotNone(_ldap.OPT_SERVER_CONTROLS)
+        self.assertNotNone(_ldap.OPT_CLIENT_CONTROLS)
+        self.assertNotNone(_ldap.OPT_API_FEATURE_INFO)
+        self.assertNotNone(_ldap.OPT_HOST_NAME)
+        self.assertNotNone(_ldap.OPT_ERROR_NUMBER)   # = OPT_RESULT_CODE
+        self.assertNotNone(_ldap.OPT_ERROR_STRING)   # = OPT_DIAGNOSITIC_MESSAGE
+        self.assertNotNone(_ldap.OPT_MATCHED_DN)
+
+        # OpenLDAP specific
+        self.assertNotNone(_ldap.OPT_DEBUG_LEVEL)
+        self.assertNotNone(_ldap.OPT_TIMEOUT)
+        self.assertNotNone(_ldap.OPT_REFHOPLIMIT)
+        self.assertNotNone(_ldap.OPT_NETWORK_TIMEOUT)
+        self.assertNotNone(_ldap.OPT_URI)
+        #self.assertNotNone(_ldap.OPT_REFERRAL_URLS)
+        #self.assertNotNone(_ldap.OPT_SOCKBUF)
+        #self.assertNotNone(_ldap.OPT_DEFBASE)
+        #self.assertNotNone(_ldap.OPT_CONNECT_ASYNC)
+
+        # str2dn()
+        self.assertNotNone(_ldap.DN_FORMAT_LDAP)
+        self.assertNotNone(_ldap.DN_FORMAT_LDAPV3)
+        self.assertNotNone(_ldap.DN_FORMAT_LDAPV2)
+        self.assertNotNone(_ldap.DN_FORMAT_DCE)
+        self.assertNotNone(_ldap.DN_FORMAT_UFN)
+        self.assertNotNone(_ldap.DN_FORMAT_AD_CANONICAL)
+        self.assertNotNone(_ldap.DN_FORMAT_MASK)
+        self.assertNotNone(_ldap.DN_PRETTY)
+        self.assertNotNone(_ldap.DN_SKIP)
+        self.assertNotNone(_ldap.DN_P_NOLEADTRAILSPACES)
+        self.assertNotNone(_ldap.DN_P_NOSPACEAFTERRDN)
+        self.assertNotNone(_ldap.DN_PEDANTIC)
+        self.assertNotNone(_ldap.AVA_NULL)
+        self.assertNotNone(_ldap.AVA_STRING)
+        self.assertNotNone(_ldap.AVA_BINARY)
+        self.assertNotNone(_ldap.AVA_NONPRINTABLE)
+
+        # these two constants are pointless? XXX
+        self.assertEquals(_ldap.LDAP_OPT_ON, 1) 
+        self.assertEquals(_ldap.LDAP_OPT_OFF, 0)
+
+        # these constants useless after ldap_url_parse() was dropped XXX
+        self.assertNotNone(_ldap.URL_ERR_BADSCOPE)
+        self.assertNotNone(_ldap.URL_ERR_MEM)
+
+    def test_simple_bind(self):
+        l = self._init()
+
+    def test_simple_anonymous_bind(self):
+        l = self._init(bind=False)
+        m = l.simple_bind("", "")
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertTrue(result, _ldap.RES_BIND)
+        self.assertEquals(msgid, m)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(ctrls, [])
+
+        # see if we can get the rootdse while we're here
+        m = l.search_ext("", _ldap.SCOPE_BASE, '(objectClass=*)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(pmsg[0][0], "") # rootDSE has no dn
+        self.assertEquals(msgid, m)
+        self.assertTrue(pmsg[0][1].has_key('objectClass'))
+
+    def test_unbind(self):
+        l = self._init()
+        m = l.unbind_ext()
+        self.assertNone(m)
+
+        # Second attempt to unbind should yield an exception
+        try: l.unbind_ext()
+        except _ldap.error: pass
+
+    def test_search_ext_individual(self):
+        l = self._init()
+
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, 
+                '(objectClass=dcObject)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ONE, self.timeout)
+
+        # Expect to get just one object
+        self.assertEquals(result, _ldap.RES_SEARCH_ENTRY)
+        self.assertEquals(len(pmsg), 1)
+        self.assertEquals(len(pmsg[0]), 2)
+        self.assertEquals(pmsg[0][0], self.base)
+        self.assertEquals(pmsg[0][0], self.base)
+        self.assertTrue('dcObject' in pmsg[0][1]['objectClass'])
+        self.assertTrue('organization' in pmsg[0][1]['objectClass'])
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ONE, self.timeout)
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+    def test_abandon(self):
+        l = self._init()
+
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+
+        ret = l.abandon_ext(m)
+        self.assertNone(ret)
+
+        got_timeout = False
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, 0.3)  # (timeout /could/ be longer)
+        except _ldap.TIMEOUT, e:
+            got_timeout = True
+        self.assertTrue(got_timeout)
+
+    def test_search_ext_all(self):
+        l = self._init()
+
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+
+        # Expect to get some objects
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertTrue(len(pmsg) >= 2)
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+    def test_add(self):
+        l = self._init()
+
+        m = l.add_ext("cn=Foo," + self.base, [
+               ('objectClass','organizationalRole'), 
+               ('cn', 'Foo'),
+               ('description', 'testing'),
+            ])
+
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        # search for it back
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+
+        # Expect to get the objects
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(len(pmsg), 1)
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        self.assertEquals(pmsg[0], ('cn=Foo,'+self.base,
+                { 'objectClass': ['organizationalRole'],
+                  'cn': ['Foo'],
+                  'description': ['testing'] }))
+
+    def test_compare(self):
+        l = self._init()
+
+        # first, add an object with a field we can compare on
+        dn = "cn=CompareTest," + self.base
+        m = l.add_ext(dn, [
+               ('objectClass','person'), 
+               ('sn', 'CompareTest'),
+               ('cn', 'CompareTest'),
+               ('userPassword', 'the_password'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        # try a false compare
+        m = l.compare_ext(dn, "userPassword", "bad_string")
+        compared_false = False
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            self.fail(repr(r))
+        except _ldap.COMPARE_FALSE:
+            compared_false = True
+        self.assertTrue(compared_false)
+
+        # try a true compare
+        m = l.compare_ext(dn, "userPassword", "the_password")
+        compared_true = False
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            self.fail(repr(r))
+        except _ldap.COMPARE_TRUE:
+            compared_true = True
+        self.assertTrue(compared_true)
+
+        m = l.compare_ext(dn, "badAttribute", "ignoreme")
+        raised_error = False
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            self.fail(repr(r))
+        except _ldap.error:
+            raised_error = True
+        self.assertTrue(raised_error)
+
+    def test_delete_no_such_object(self):
+        l = self._init()
+
+        # try deleting an object that doesn't exist
+        not_found = False
+        m = l.delete_ext("cn=DoesNotExist,"+self.base)
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            self.fail(r)
+        except _ldap.NO_SUCH_OBJECT:
+            not_found = True
+        self.assertTrue(not_found)
+
+    def test_delete(self):
+        l = self._init()
+        # first, add an object we will delete
+        dn = "cn=Deleteme,"+self.base
+        m = l.add_ext(dn, [
+               ('objectClass','organizationalRole'), 
+               ('cn', 'Deleteme'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        m = l.delete_ext(dn)
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_DELETE)
+        self.assertEquals(msgid, m)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(ctrls, [])
+
+    def test_modify_no_such_object(self):
+        l = self._init()
+
+        # try deleting an object that doesn't exist
+        not_found = False
+        m = l.modify_ext("cn=DoesNotExist,"+self.base, [
+                (_ldap.MOD_ADD, 'description', ['blah']),
+            ])
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            self.fail(r)
+        except _ldap.NO_SUCH_OBJECT:
+            not_found = True
+        self.assertTrue(not_found)
+
+    def DISABLED_test_modify_no_such_object_empty_attrs(self):
+        # XXX ldif-backend for slapd appears broken???
+
+        l = self._init()
+
+        # try deleting an object that doesn't exist
+        m = l.modify_ext("cn=DoesNotExist,"+self.base, [
+                (_ldap.MOD_ADD, 'description', []),
+            ])
+        self.assertTrue(isinstance(m, int))
+        r = l.result3(m, _ldap.MSG_ALL, self.timeout) # what should happen??
+        self.fail(r)
+
+    def test_modify(self):
+        l = self._init()
+        # first, add an object we will delete
+        dn = "cn=AddToMe,"+self.base
+        m = l.add_ext(dn, [
+               ('objectClass','person'), 
+               ('cn', 'AddToMe'),
+               ('sn', 'Modify'),
+               ('description', 'a description'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        m = l.modify_ext(dn, [
+                (_ldap.MOD_ADD, 'description', ['b desc', 'c desc']),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_MODIFY)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        # search for it back
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+
+        # Expect to get the objects
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(len(pmsg), 1)
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        self.assertEquals(pmsg[0][0], dn)
+        d = list(pmsg[0][1]['description'])
+        d.sort()
+        self.assertEquals(d, ['a description', 'b desc', 'c desc'])
+
+    def test_rename(self):
+        l = self._init()
+        dn = "cn=RenameMe,"+self.base
+        m = l.add_ext(dn, [
+               ('objectClass','organizationalRole'), 
+               ('cn', 'RenameMe'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        # do the rename with same parent
+        m = l.rename(dn, "cn=IAmRenamed")
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_MODRDN)
+        self.assertEquals(msgid, m)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(ctrls, [])
+
+        # make sure the old one is gone
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(len(pmsg), 0) # expect no results
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        # check that the new one looks right
+        dn2 = "cn=IAmRenamed,"+self.base
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+        self.assertEquals(len(pmsg), 1)
+        self.assertEquals(pmsg[0][0], dn2)
+        self.assertEquals(pmsg[0][1]['cn'], ['IAmRenamed'])
+
+        # create the container
+        containerDn = "ou=RenameContainer,"+self.base
+        m = l.add_ext(containerDn, [
+               ('objectClass','organizationalUnit'), 
+               ('ou', 'RenameContainer'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        # WORKAROUND bug in slapd. (Without an existing child, 
+        # renames into a container object do not work for the ldif backend,
+        # the renamed object appears to be deleted, not moved.)
+        # see http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5408
+        m = l.add_ext("cn=Bogus," + containerDn, [
+               ('objectClass','organizationalRole'), 
+               ('cn', 'Bogus'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        # now rename from dn2 to the conater
+        dn3 = "cn=IAmRenamedAgain," + containerDn
+
+        # Now try renaming dn2 across container (simultaneous name change)
+        m = l.rename(dn2, "cn=IAmRenamedAgain", containerDn)
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_MODRDN)
+        self.assertEquals(msgid, m)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(ctrls, [])
+
+        # make sure dn2 is gone
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(len(pmsg), 0) # expect no results
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+
+        # make sure dn3 is there
+        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
+        self.assertEquals(len(pmsg), 1)
+        self.assertEquals(pmsg[0][0], dn3)
+        self.assertEquals(pmsg[0][1]['cn'], ['IAmRenamedAgain'])
+
+
+    def test_whoami(self):
+        l = self._init()
+        r = l.whoami_s()
+        self.assertEquals("dn:" + self.server.get_root_dn(), r)
+
+    def test_whoami_unbound(self):
+        l = self._init(bind=False)
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        r = l.whoami_s()
+        self.assertEquals("", r)
+
+    def test_whoami_anonymous(self):
+        l = self._init(bind=False)
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+
+        # Anonymous bind
+        m = l.simple_bind("", "")
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertTrue(result, _ldap.RES_BIND)
+
+        r = l.whoami_s()
+        self.assertEquals("", r)
+
+    def test_passwd(self):
+        l = self._init()
+
+        # first, create a user to change password on
+        dn = "cn=PasswordTest," + self.base
+        m = l.add_ext(dn, [
+               ('objectClass','person'), 
+               ('sn', 'PasswordTest'),
+               ('cn', 'PasswordTest'),
+               ('userPassword', 'initial'),
+            ])
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(result, _ldap.RES_ADD)
+
+        # try changing password with a wrong old-pw
+        m = l.passwd(dn, "bogus", "ignored")
+        try:
+            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            self.fail("expected UNWILLING_TO_PERFORM")
+        except _ldap.UNWILLING_TO_PERFORM:
+            pass
+
+        # try changing password with a correct old-pw
+        m = l.passwd(dn, "initial", "changed")
+        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        self.assertEquals(msgid, m)
+        self.assertEquals(pmsg, [])
+        self.assertEquals(result, _ldap.RES_EXTENDED)
+        self.assertEquals(ctrls, [])
+
+    def test_options(self):
+        oldval = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
+        try:
+
+            try:
+                _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, "3")
+                self.fail("expected string value to raise a type error")
+            except TypeError: pass
+
+            _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION2)
+            v = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
+            self.assertEquals(v, _ldap.VERSION2)
+            _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+            v = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
+            self.assertEquals(v, _ldap.VERSION3)
+        finally:
+            _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, oldval)
+
+        l = self._init()
+
+        # Try changing some basic options and checking that they took effect
+
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION2)
+        v = l.get_option(_ldap.OPT_PROTOCOL_VERSION)
+        self.assertEquals(v, _ldap.VERSION2)
+
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        v = l.get_option(_ldap.OPT_PROTOCOL_VERSION)
+        self.assertEquals(v, _ldap.VERSION3)
+
+        # Try setting options that will yield a known error.
+        try:
+            _ldap.get_option(_ldap.OPT_MATCHED_DN)
+            self.fail("expected ValueError")
+        except ValueError:
+            pass
+
+    def _require_attr(self, obj, attrname):
+        """Returns true if the attribute exists on the object.
+           This is to allow some tests to be optional, because
+           _ldap is compiled with different properties depending
+           on the underlying C library.
+           This could me made to thrown an exception if you want the
+           tests to be strict."""
+        if hasattr(obj, attrname):
+            return True
+        #self.fail("required attribute '%s' missing" % attrname)
+        return False
+
+    def test_sasl(self):
+        l = self._init()
+        if not self._require_attr(l, 'sasl_interactive_bind_s'): # HAVE_SASL
+            return
+        # TODO
+
+    def test_tls(self):
+        l = self._init()
+        if not self._require_attr(l, 'start_tls_s'):    # HAVE_TLS
+            return
+        # TODO
+
+    def test_cancel(self):
+        l = self._init()
+        if not self._require_attr(l, 'cancel'):         # FEATURE_CANCEL
+            return
+
+    def test_str2dn(self):
+        pass
+
+if __name__ == '__main__':
+    unittest.main()

From 849cb9389a8b938459b07ba8d41375c6077eeb1e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 20 Aug 2009 08:51:30 +0000
Subject: [PATCH 041/868] Optionally display result of
 l.get_option(ldap.OPT_X_SASL_USERNAME)

---
 Demo/sasl_bind.py | 84 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 Demo/sasl_bind.py

diff --git a/Demo/sasl_bind.py b/Demo/sasl_bind.py
new file mode 100644
index 0000000..05af652
--- /dev/null
+++ b/Demo/sasl_bind.py
@@ -0,0 +1,84 @@
+# For documentation, see comments in Module/LDAPObject.c and the
+# ldap.sasl module documentation.
+
+import ldap,ldap.sasl
+
+ldap.sasl._trace_level=0
+
+ldap.set_option(ldap.OPT_DEBUG_LEVEL,0)
+
+for ldap_uri,sasl_mech,sasl_cb_value_dict in [
+  (
+    "ldap://nb2.stroeder.local:1390/",
+    'CRAM-MD5',
+    {
+      ldap.sasl.CB_AUTHNAME    :'fred',
+      ldap.sasl.CB_PASS        :'secret',
+    }
+  ),
+  (
+    "ldap://nb2.stroeder.local:1390/",
+    'PLAIN',
+    {
+      ldap.sasl.CB_AUTHNAME    :'fred',
+      ldap.sasl.CB_PASS        :'secret',
+    }
+  ),
+  (
+    "ldap://nb2.stroeder.local:1390/",
+    'LOGIN',
+    {
+      ldap.sasl.CB_AUTHNAME    :'fred',
+      ldap.sasl.CB_PASS        :'secret',
+    }
+  ),
+  (
+    "ldapi://%2Ftmp%2Fopenldap-socket/",
+    'EXTERNAL',
+    { }
+  ),
+  (
+    "ldap://nb2.stroeder.local:1390/",
+    'GSSAPI',
+    { }
+  ),
+  (
+    "ldap://nb2.stroeder.local:1390/",
+    'NTLM',
+    {
+      ldap.sasl.CB_AUTHNAME    :'fred',
+      ldap.sasl.CB_PASS        :'secret',
+    }
+  ),
+  (
+    "ldap://nb2.stroeder.local:1390/",
+    'DIGEST-MD5',
+    {
+      ldap.sasl.CB_AUTHNAME    :'fred',
+      ldap.sasl.CB_PASS        :'secret',
+    }
+  ),
+]:
+  sasl_auth = ldap.sasl.sasl(sasl_cb_value_dict,sasl_mech)
+  print 20*'*',sasl_auth.mech,20*'*'
+  # Open the LDAP connection
+  l = ldap.initialize(ldap_uri,trace_level=0)
+  # Set protocol version to LDAPv3 to enable SASL bind!
+  l.protocol_version = 3
+  try:
+    l.sasl_interactive_bind_s("", sasl_auth)
+  except ldap.LDAPError,e:
+    print 'Error using SASL mechanism',sasl_auth.mech,str(e)
+  else:
+    print 'Sucessfully bound using SASL mechanism:',sasl_auth.mech
+    try:
+      print 'Result of Who Am I? ext. op:',repr(l.whoami_s())
+    except ldap.LDAPError,e:
+      print 'Error using SASL mechanism',sasl_auth.mech,str(e)
+    try:
+      print 'OPT_X_SASL_USERNAME',repr(l.get_option(ldap.OPT_X_SASL_USERNAME))
+    except AttributeError:
+      pass
+
+  l.unbind()
+  del l

From 81035b1505cd6492d98c83a759db495da6e5758f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 31 Oct 2009 20:00:40 +0000
Subject: [PATCH 042/868] Added PKG-INFO

---
 MANIFEST.in | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 MANIFEST.in

diff --git a/MANIFEST.in b/MANIFEST.in
new file mode 100644
index 0000000..7ea2fdd
--- /dev/null
+++ b/MANIFEST.in
@@ -0,0 +1,6 @@
+include MANIFEST.in Makefile CHANGES INSTALL LICENCE README TODO PKG-INFO
+include Modules/*.c Modules/*.h Modules/LICENSE
+recursive-include Build *.cfg*
+recursive-include Lib *.py
+recursive-include Demo *.py
+recursive-include Tests *.py

From 0c20c6f16cf311f237ec1c01dfedc5734cfd050c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 3 Dec 2009 22:09:35 +0000
Subject: [PATCH 043/868] Enabled more test cases

---
 Tests/t_ldapurl.py | 242 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 242 insertions(+)
 create mode 100644 Tests/t_ldapurl.py

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
new file mode 100644
index 0000000..5ccd442
--- /dev/null
+++ b/Tests/t_ldapurl.py
@@ -0,0 +1,242 @@
+import ldap, unittest
+import urllib
+
+from ldapurl import LDAPUrl
+
+class MyLDAPUrl(LDAPUrl):
+  attr2extype = {
+    'who':'bindname',
+    'cred':'X-BINDPW',
+    'start_tls':'startTLS',
+    'trace_level':'trace',
+  }
+
+def sort(l):
+    "Returns a sorted copy of a list"
+    l2 = [e for e in l]
+    l2.sort()
+    return l2
+
+class TestLDAPUrl(unittest.TestCase):
+
+    def assertNone(self, expr, msg=None):
+        self.failIf(expr is not None, msg or ("%r" % expr))
+
+    def test_combo(self):
+        u = MyLDAPUrl("ldap://127.0.0.1:1234/dc=example,dc=com"
+            + "?attr1,attr2,attr3"
+            + "?sub"
+            + "?" + urllib.quote("(objectClass=*)")
+            + "?bindname=" + urllib.quote("cn=d,c=au")
+            + ",X-BINDPW=" + urllib.quote("???")
+            + ",trace=8"
+        )
+        self.assertEquals(u.urlscheme, "ldap")
+        self.assertEquals(u.hostport, "127.0.0.1:1234")
+        self.assertEquals(u.dn, "dc=example,dc=com")
+        self.assertEquals(u.attrs, ["attr1","attr2","attr3"])
+        self.assertEquals(u.scope, ldap.SCOPE_SUBTREE)
+        self.assertEquals(u.filterstr, "(objectClass=*)")
+        self.assertEquals(len(u.extensions), 3)
+        self.assertEquals(u.who, "cn=d,c=au")
+        self.assertEquals(u.cred, "???")
+        self.assertEquals(u.trace_level, "8")
+
+    def test_parse_default_hostport(self):
+        u = LDAPUrl("ldap://")
+        self.assertEquals(u.urlscheme, "ldap")
+        self.assertEquals(u.hostport, "")
+
+    def test_parse_empty_dn(self):
+        u = LDAPUrl("ldap://")
+        self.assertEquals(u.dn, "")
+        u = LDAPUrl("ldap:///")
+        self.assertEquals(u.dn, "")
+        u = LDAPUrl("ldap:///?")
+        self.assertEquals(u.dn, "")
+
+    def test_parse_default_attrs(self):
+        u = LDAPUrl("ldap://")
+        self.assertNone(u.attrs)
+
+    def test_parse_default_scope(self):
+        u = LDAPUrl("ldap://")
+        self.assertNone(u.scope)     # RFC4516 s3
+
+    def test_parse_default_filter(self):
+        u = LDAPUrl("ldap://")
+        self.assertNone(u.filterstr) # RFC4516 s3
+
+    def test_parse_default_extensions(self):
+        u = LDAPUrl("ldap://")
+        self.assertEquals(len(u.extensions), 0)
+
+    def test_parse_schemes(self):
+        u = LDAPUrl("ldap://")
+        self.assertEquals(u.urlscheme, "ldap")
+        u = LDAPUrl("ldapi://")
+        self.assertEquals(u.urlscheme, "ldapi")
+        u = LDAPUrl("ldaps://")
+        self.assertEquals(u.urlscheme, "ldaps")
+
+    def test_parse_hostport(self):
+        u = LDAPUrl("ldap://a")
+        self.assertEquals(u.hostport, "a")
+        u = LDAPUrl("ldap://a.b")
+        self.assertEquals(u.hostport, "a.b")
+        u = LDAPUrl("ldap://a.")
+        self.assertEquals(u.hostport, "a.")
+        u = LDAPUrl("ldap://%61%62:%32/")
+        self.assertEquals(u.hostport, "ab:2")
+        u = LDAPUrl("ldap://[::1]/")
+        self.assertEquals(u.hostport, "[::1]")
+        u = LDAPUrl("ldap://[::1]")
+        self.assertEquals(u.hostport, "[::1]")
+        u = LDAPUrl("ldap://[::1]:123/")
+        self.assertEquals(u.hostport, "[::1]:123")
+        u = LDAPUrl("ldap://[::1]:123")
+        self.assertEquals(u.hostport, "[::1]:123")
+
+    def test_parse_dn(self):
+        u = LDAPUrl("ldap:///")
+        self.assertEquals(u.dn, "")
+        u = LDAPUrl("ldap:///dn=foo")
+        self.assertEquals(u.dn, "dn=foo")
+        u = LDAPUrl("ldap:///dn=foo%2cdc=bar")
+        self.assertEquals(u.dn, "dn=foo,dc=bar")
+        u = LDAPUrl("ldap:///dn=foo%20bar")
+        self.assertEquals(u.dn, "dn=foo bar")
+        u = LDAPUrl("ldap:///dn=foo%2fbar")
+        self.assertEquals(u.dn, "dn=foo/bar")
+        u = LDAPUrl("ldap:///dn=foo%2fbar?")
+        self.assertEquals(u.dn, "dn=foo/bar")
+        u = LDAPUrl("ldap:///dn=foo%3f?")
+        self.assertEquals(u.dn, "dn=foo?")
+        u = LDAPUrl("ldap:///dn=foo%3f")
+        self.assertEquals(u.dn, "dn=foo?")
+        u = LDAPUrl("ldap:///dn=str%c3%b6der.com")
+        self.assertEquals(u.dn, "dn=str\xc3\xb6der.com")
+
+    def test_parse_attrs(self):
+        u = LDAPUrl("ldap:///?")
+        self.assertEquals(u.attrs, None)
+        u = LDAPUrl("ldap:///??")
+        self.assertEquals(u.attrs, None)
+        u = LDAPUrl("ldap:///?*?")
+        self.assertEquals(u.attrs, ['*'])
+        u = LDAPUrl("ldap:///?*,*?")
+        self.assertEquals(u.attrs, ['*','*'])
+        u = LDAPUrl("ldap:///?a")
+        self.assertEquals(u.attrs, ['a'])
+        u = LDAPUrl("ldap:///?%61")
+        self.assertEquals(u.attrs, ['a'])
+        u = LDAPUrl("ldap:///?a,b")
+        self.assertEquals(u.attrs, ['a','b'])
+        u = LDAPUrl("ldap:///?a%3fb")
+        self.assertEquals(u.attrs, ['a?b'])
+
+    def test_parse_scope_default(self):
+        u = LDAPUrl("ldap:///??")
+        self.assertNone(u.scope) # on opposite to RFC4516 s3 for referral chasing
+        u = LDAPUrl("ldap:///???")
+        self.assertNone(u.scope) # on opposite to RFC4516 s3 for referral chasing
+
+    def test_parse_scope(self):
+        u = LDAPUrl("ldap:///??sub")
+        self.assertEquals(u.scope, ldap.SCOPE_SUBTREE)
+        u = LDAPUrl("ldap:///??sub?")
+        self.assertEquals(u.scope, ldap.SCOPE_SUBTREE)
+        u = LDAPUrl("ldap:///??base")
+        self.assertEquals(u.scope, ldap.SCOPE_BASE)
+        u = LDAPUrl("ldap:///??base?")
+        self.assertEquals(u.scope, ldap.SCOPE_BASE)
+        u = LDAPUrl("ldap:///??one")
+        self.assertEquals(u.scope, ldap.SCOPE_ONELEVEL)
+        u = LDAPUrl("ldap:///??one?")
+        self.assertEquals(u.scope, ldap.SCOPE_ONELEVEL)
+
+    def test_parse_filter(self):
+        u = LDAPUrl("ldap:///???(cn=Bob)")
+        self.assertEquals(u.filterstr, "(cn=Bob)")
+        u = LDAPUrl("ldap:///???(cn=Bob)?")
+        self.assertEquals(u.filterstr, "(cn=Bob)")
+        u = LDAPUrl("ldap:///???(cn=Bob%20Smith)?")
+        self.assertEquals(u.filterstr, "(cn=Bob Smith)")
+        u = LDAPUrl("ldap:///???(cn=Bob/Smith)?")
+        self.assertEquals(u.filterstr, "(cn=Bob/Smith)")
+        u = LDAPUrl("ldap:///???(cn=Bob:Smith)?")
+        self.assertEquals(u.filterstr, "(cn=Bob:Smith)")
+        u = LDAPUrl("ldap:///???&(cn=Bob)(objectClass=user)?")
+        self.assertEquals(u.filterstr, "&(cn=Bob)(objectClass=user)")
+        u = LDAPUrl("ldap:///???|(cn=Bob)(objectClass=user)?")
+        self.assertEquals(u.filterstr, "|(cn=Bob)(objectClass=user)")
+        u = LDAPUrl("ldap:///???(cn=Q%3f)?")
+        self.assertEquals(u.filterstr, "(cn=Q?)")
+        u = LDAPUrl("ldap:///???(cn=Q%3f)")
+        self.assertEquals(u.filterstr, "(cn=Q?)")
+        u = LDAPUrl("ldap:///???(sn=Str%c3%b6der)") # (possibly bad?)
+        self.assertEquals(u.filterstr, "(sn=Str\xc3\xb6der)")
+        u = LDAPUrl("ldap:///???(sn=Str\\c3\\b6der)")
+        self.assertEquals(u.filterstr, "(sn=Str\\c3\\b6der)") # (recommended)
+        u = LDAPUrl("ldap:///???(cn=*\\2a*)")
+        self.assertEquals(u.filterstr, "(cn=*\\2a*)")
+        u = LDAPUrl("ldap:///???(cn=*%5c2a*)")
+        self.assertEquals(u.filterstr, "(cn=*\\2a*)")
+
+    def test_parse_extensions(self):
+        u = LDAPUrl("ldap:///????")
+        self.assertNone(u.extensions)
+        self.assertNone(u.who)
+        u = LDAPUrl("ldap:///????bindname=cn=root")
+        self.assertEquals(len(u.extensions), 1)
+        self.assertEquals(u.who, "cn=root")
+        u = LDAPUrl("ldap:///????!bindname=cn=root")
+        self.assertEquals(len(u.extensions), 1)
+        self.assertEquals(u.who, "cn=root")
+        u = LDAPUrl("ldap:///????bindname=%3f,X-BINDPW=%2c")
+        self.assertEquals(len(u.extensions), 2)
+        self.assertEquals(u.who, "?")
+        self.assertEquals(u.cred, ",")
+
+    def test_parse_extensions_nulls(self):
+        u = LDAPUrl("ldap:///????bindname=%00name")
+        self.assertEquals(u.who, "\0name")
+
+    def test_parse_extensions_5questions(self):
+        u = LDAPUrl("ldap:///????bindname=?")
+        self.assertEquals(len(u.extensions), 1)
+        self.assertEquals(u.who, "?")
+
+    def test_parse_extensions_novalue(self):
+        u = LDAPUrl("ldap:///????bindname")
+        self.assertEquals(len(u.extensions), 1)
+        self.assertNone(u.who)
+
+    def test_bad_urls(self):
+        for bad in ("", "ldap:", "ldap:/", ":///", "://", "///", "//", "/",
+                "ldap:///?????",       # extension can't start with '?'
+                "LDAP://", "invalid://", "ldap:///??invalid",
+                #XXX-- the following should raise exceptions!
+                "ldap://:389/",         # [host [COLON port]]
+                "ldap://a:/",           # [host [COLON port]]
+                "ldap://%%%/",          # invalid URL encoding
+                "ldap:///?,",           # attrdesc *(COMMA attrdesc)
+                "ldap:///?a,",          # attrdesc *(COMMA attrdesc)
+                "ldap:///?,a",          # attrdesc *(COMMA attrdesc)
+                "ldap:///?a,,b",        # attrdesc *(COMMA attrdesc)
+                "ldap://%00/",          # RFC4516 2.1
+                "ldap:///%00",          # RFC4516 2.1
+                "ldap:///?%00",         # RFC4516 2.1
+                "ldap:///??%00",        # RFC4516 2.1
+                "ldap:///????0=0",      # extype must start with Alpha
+                "ldap:///????a_b=0",    # extype contains only [-a-zA-Z0-9]
+                "ldap:///????!!a=0",    # only one exclamation allowed
+        ):
+            try: 
+                LDAPUrl(bad)
+                self.fail("should have raised ValueError: %r" % bad)
+            except ValueError:
+                pass
+
+if __name__ == '__main__':
+    unittest.main()

From 6613f0a3e17ad79b57440344e8ba5d36230afc22 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 3 Jun 2010 12:26:39 +0000
Subject: [PATCH 044/868] Module-wide locking is now limited to calling
 _ldap.initialize(). Still ldap.functions._ldap_function_call() is used to
 wrap all calls for writing debug log.

---
 Lib/ldap/dn.py | 110 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100644 Lib/ldap/dn.py

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
new file mode 100644
index 0000000..b75a03f
--- /dev/null
+++ b/Lib/ldap/dn.py
@@ -0,0 +1,110 @@
+"""
+dn.py - misc stuff for handling distinguished names (see RFC 4514)
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: dn.py,v 1.11 2010/06/03 12:26:39 stroeder Exp $
+
+Compability:
+- Tested with Python 2.0+
+"""
+
+from ldap import __version__
+
+
+import _ldap
+
+import ldap.functions
+
+
+def escape_dn_chars(s):
+  """
+  Escape all DN special characters found in s
+  with a back-slash (see RFC 4514, section 2.4)
+  """
+  if s:
+    s = s.replace('\\','\\\\')
+    s = s.replace(',' ,'\\,')
+    s = s.replace('+' ,'\\+')
+    s = s.replace('"' ,'\\"')
+    s = s.replace('<' ,'\\<')
+    s = s.replace('>' ,'\\>')
+    s = s.replace(';' ,'\\;')
+    s = s.replace('=' ,'\\=')
+    s = s.replace('\000' ,'\\\000')    
+    if s[0]=='#' or s[0]==' ':
+      s = ''.join(('\\',s))
+    if s[-1]==' ':
+      s = ''.join((s[:-1],'\\ '))
+  return s
+
+
+def str2dn(dn,flags=0):
+  """
+  This function takes a DN as string as parameter and returns
+  a decomposed DN. It's the inverse to dn2str().
+  
+  flags describes the format of the dn
+
+  See also the OpenLDAP man-page ldap_str2dn(3)
+  """
+  if not dn:
+    return []
+  return ldap.functions._ldap_function_call(None,_ldap.str2dn,dn,flags)
+
+
+def dn2str(dn):
+  """
+  This function takes a decomposed DN as parameter and returns
+  a single string. It's the inverse to str2dn() but will always
+  return a DN in LDAPv3 format compliant to RFC 4514.
+  """
+  return ','.join([
+    '+'.join([
+      '='.join((atype,escape_dn_chars(avalue or '')))
+      for atype,avalue,dummy in rdn])
+    for rdn in dn
+  ])
+
+def explode_dn(dn,notypes=0,flags=0):
+  """
+  explode_dn(dn [, notypes=0]) -> list
+  
+  This function takes a DN and breaks it up into its component parts.
+  The notypes parameter is used to specify that only the component's
+  attribute values be returned and not the attribute types.
+  """
+  if not dn:
+    return []
+  dn_decomp = str2dn(dn,flags)
+  rdn_list = []
+  for rdn in dn_decomp:
+    if notypes:
+      rdn_list.append('+'.join([
+        escape_dn_chars(avalue or '')
+        for atype,avalue,dummy in rdn
+      ]))
+    else:
+      rdn_list.append('+'.join([
+        '='.join((atype,escape_dn_chars(avalue or '')))
+        for atype,avalue,dummy in rdn
+      ]))
+  return rdn_list
+
+
+def explode_rdn(rdn,notypes=0,flags=0):
+  """
+  explode_rdn(rdn [, notypes=0]) -> list
+  
+  This function takes a RDN and breaks it up into its component parts
+  if it is a multi-valued RDN.
+  The notypes parameter is used to specify that only the component's
+  attribute values be returned and not the attribute types.
+  """
+  if not rdn:
+    return []
+  rdn_decomp = str2dn(rdn,flags)[0]
+  if notypes:
+    return [avalue or '' for atype,avalue,dummy in rdn_decomp]
+  else:
+    return ['='.join((atype,escape_dn_chars(avalue or ''))) for atype,avalue,dummy in rdn_decomp]

From 37f50da0ef29835c9eddd0801a0fc5cf8da5bddb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 21 Feb 2011 21:04:00 +0000
Subject: [PATCH 045/868] Patches by Rich for LDAPv3 ext.op. and ext. controls
 in intermediate results

---
 Modules/message.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 Modules/message.h

diff --git a/Modules/message.h b/Modules/message.h
new file mode 100644
index 0000000..88af31a
--- /dev/null
+++ b/Modules/message.h
@@ -0,0 +1,14 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: message.h,v 1.6 2011/02/21 21:04:00 stroeder Exp $ */
+
+#ifndef __h_message 
+#define __h_message 
+
+#include "common.h"
+#include "lber.h"
+#include "ldap.h"
+
+extern PyObject* LDAPmessage_to_python( LDAP*ld, LDAPMessage*m, int add_ctrls, int add_intermediates );
+
+#endif /* __h_message_ */
+

From 110aa5bd1dbb5687a0d9d14df85b13f384695749 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 21 Mar 2011 14:19:43 +0000
Subject: [PATCH 046/868] Helper class for using logging as trace file object

---
 Lib/ldap/logger.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 Lib/ldap/logger.py

diff --git a/Lib/ldap/logger.py b/Lib/ldap/logger.py
new file mode 100644
index 0000000..a6083dc
--- /dev/null
+++ b/Lib/ldap/logger.py
@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+"""
+Helper class for using logging as trace file object
+"""
+
+import logging
+
+class logging_file_class:
+
+  def __init__(self,logging_level):
+    self._logging_level = logging_level
+  
+  def write(self,msg):
+    logging.log(self._logging_level,msg[:-1])
+
+logging_file_obj = logging_file_class(logging.DEBUG)

From 415696b54a9ada7d4fd2d398ebdd54d64f7130b6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 28 Mar 2011 17:43:18 +0000
Subject: [PATCH 047/868] Links to pyasn1 and pyasn1-modules

---
 Demo/pyasn1/README | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 Demo/pyasn1/README

diff --git a/Demo/pyasn1/README b/Demo/pyasn1/README
new file mode 100644
index 0000000..a96d6cd
--- /dev/null
+++ b/Demo/pyasn1/README
@@ -0,0 +1,6 @@
+The sample modules/scripts herein require modules pyasn1 and pyasn1-modules.
+
+http://pyasn1.sourceforge.net/
+
+http://pypi.python.org/pypi/pyasn1
+http://pypi.python.org/pypi/pyasn1-modules

From 59508ff41a3cd66c71623cddf305428888315a73 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 31 Mar 2011 19:20:37 +0000
Subject: [PATCH 048/868] new class API in ldap.controls, not
 backwards-compatible\!

---
 Demo/page_control.py | 64 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 Demo/page_control.py

diff --git a/Demo/page_control.py b/Demo/page_control.py
new file mode 100644
index 0000000..9d1a0e2
--- /dev/null
+++ b/Demo/page_control.py
@@ -0,0 +1,64 @@
+url = "ldap://localhost:1390/"
+base = "dc=stroeder,dc=de"
+search_flt = r'(objectClass=*)'
+page_size = 10
+
+import ldap,pprint
+from ldap.controls import SimplePagedResultsControl
+
+searchreq_attrlist=['cn','entryDN','entryUUID','mail','objectClass']
+
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldap.set_option(ldap.OPT_REFERRALS, 0)
+l = ldap.initialize(url,trace_level=1)
+l.protocol_version = 3
+l.simple_bind_s("", "")
+
+req_ctrl = SimplePagedResultsControl(True,size=page_size,cookie='')
+
+known_ldap_resp_ctrls = {
+  SimplePagedResultsControl.controlType:SimplePagedResultsControl,
+}
+
+# Send search request
+msgid = l.search_ext(
+  base,
+  ldap.SCOPE_SUBTREE,
+  search_flt,
+  attrlist=searchreq_attrlist,
+  serverctrls=[req_ctrl]
+)
+
+pages = 0
+while True:
+    pages += 1
+    print "Getting page %d" % (pages)
+    rtype, rdata, rmsgid, serverctrls = l.result3(msgid,resp_ctrl_classes=known_ldap_resp_ctrls)
+    print '%d results' % len(rdata)
+    print 'serverctrls=',pprint.pprint(serverctrls)
+#    pprint.pprint(rdata)
+    pctrls = [
+      c
+      for c in serverctrls
+      if c.controlType == SimplePagedResultsControl.controlType
+    ]
+    if pctrls:
+        print 'pctrls[0].size',repr(pctrls[0].size)
+        print 'pctrls[0].cookie',repr(pctrls[0].cookie)
+        if pctrls[0].cookie:
+            # Copy cookie from response control to request control
+            req_ctrl.cookie = pctrls[0].cookie
+            msgid = l.search_ext(
+              base,
+              ldap.SCOPE_SUBTREE,
+              search_flt,
+              attrlist=searchreq_attrlist,
+              serverctrls=[req_ctrl]
+            )
+        else:
+            break
+    else:
+        print "Warning:  Server ignores RFC 2696 control."
+        break
+
+l.unbind_s()

From b59d1db282119ab0bde577a53adfce0b0919cc9f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 2 Apr 2011 22:30:55 +0000
Subject: [PATCH 049/868] Updated/completed dependencies

---
 INSTALL | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 INSTALL

diff --git a/INSTALL b/INSTALL
new file mode 100644
index 0000000..71bbcef
--- /dev/null
+++ b/INSTALL
@@ -0,0 +1,28 @@
+------------------------------
+Installing python-ldap
+------------------------------
+
+Prerequisites:
+
+  Required:
+
+    - Python 2.3 or newer (see http://www.python.org)
+
+    - OpenLDAP 2.4.11+ client libs (see http://www.openldap.org)
+      It is not possible and not supported
+      by the python-ldap project to build with prior versions.
+
+  Optional dependencies of OpenLDAP libs:
+
+    - Cyrus SASL 2.1.x or newer (see http://asg.web.cmu.edu/sasl/sasl-library.html)
+
+    - OpenSSL 0.9.7 or newer (see http://www.openssl.org)
+    
+    - MIT Kerberos or heimdal libs
+
+Quick build instructions:
+    edit setup.cfg (see Build/ for platform-specific examples)
+    python setup.py build
+    python setup.py install
+
+$Id: INSTALL,v 1.10 2011/04/02 22:30:55 stroeder Exp $

From 4db243647515d09b04a02d076f5efa2bfd5e1a43 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 11 Apr 2011 11:29:59 +0000
Subject: [PATCH 050/868] Substituted tabs by spaces

---
 Modules/LDAPObject.c | 1382 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 1382 insertions(+)
 create mode 100644 Modules/LDAPObject.c

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
new file mode 100644
index 0000000..1b2326a
--- /dev/null
+++ b/Modules/LDAPObject.c
@@ -0,0 +1,1382 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: LDAPObject.c,v 1.90 2011/04/11 11:29:59 stroeder Exp $ */
+
+#include "common.h"
+#include "patchlevel.h"
+
+#include <math.h>
+#include <limits.h>
+#include "errors.h"
+#include "constants.h"
+#include "LDAPObject.h"
+#include "ldapcontrol.h"
+#include "message.h"
+#include "berval.h"
+#include "options.h"
+
+#ifdef HAVE_SASL
+#include <sasl.h>
+#endif
+
+static void free_attrs(char***);
+
+/* constructor */
+
+LDAPObject*
+newLDAPObject( LDAP* l ) 
+{
+    LDAPObject* self = (LDAPObject*) PyObject_NEW(LDAPObject, &LDAP_Type);
+    if (self == NULL) 
+        return NULL;
+    self->ldap = l;
+    self->_save = NULL;
+    self->valid = 1;
+    return self;
+}
+
+/* destructor */
+
+static void
+dealloc( LDAPObject* self )
+{
+    if (self->ldap) {
+        if (self->valid) {
+            LDAP_BEGIN_ALLOW_THREADS( self );
+            ldap_unbind_ext( self->ldap, NULL, NULL );
+            LDAP_END_ALLOW_THREADS( self );
+            self->valid = 0;
+        }
+        self->ldap = NULL;
+    }
+    PyObject_DEL(self);
+}
+
+/*------------------------------------------------------------
+ * utility functions
+ */
+
+/* 
+ * check to see if the LDAPObject is valid, 
+ * ie has been opened, and not closed. An exception is set if not valid.
+ */
+
+static int
+not_valid( LDAPObject* l ) {
+    if (l->valid) {
+        return 0;
+    } else {
+        PyErr_SetString( LDAPexception_class, "LDAP connection invalid" );
+        return 1;
+    }
+}
+
+/* free a LDAPMod (complete or partially) allocated in Tuple_to_LDAPMod() */
+
+static void
+LDAPMod_DEL( LDAPMod* lm )
+{
+    Py_ssize_t i;
+
+    if (lm->mod_type)
+        PyMem_DEL(lm->mod_type);
+    if (lm->mod_bvalues) {
+        for (i = 0; lm->mod_bvalues[i]; i++) {
+            PyMem_DEL(lm->mod_bvalues[i]);
+        }
+        PyMem_DEL(lm->mod_bvalues);
+    }
+    PyMem_DEL(lm);
+}
+
+/* 
+ * convert a tuple of the form (int,str,[str,...]) 
+ * or (str, [str,...]) if no_op is true, into an LDAPMod structure.
+ * See ldap_modify(3) for details.
+ *
+ * NOTE: the resulting LDAPMod structure has pointers directly into
+ *       the Python string storage, so LDAPMod structures MUST have a
+ *       shorter lifetime than the tuple passed in.
+ */
+
+/* XXX - there is no way to pass complex-structured BER objects in here! */
+
+static LDAPMod*
+Tuple_to_LDAPMod( PyObject* tup, int no_op ) 
+{
+    int op;
+    char *type;
+    PyObject *list, *item;
+    LDAPMod *lm = NULL;
+    Py_ssize_t i, len, nstrs;
+
+    if (!PyTuple_Check(tup)) {
+        PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+           "expected a tuple", tup));
+        return NULL;
+    }
+
+    if (no_op) {
+        if (!PyArg_ParseTuple( tup, "sO", &type, &list ))
+                return NULL;
+        op = 0;
+    } else {
+        if (!PyArg_ParseTuple( tup, "isO", &op, &type, &list ))
+                return NULL;
+    }
+
+    lm = PyMem_NEW(LDAPMod, 1);
+    if (lm == NULL)
+        goto nomem;
+
+    lm->mod_op = op | LDAP_MOD_BVALUES;
+    lm->mod_bvalues = NULL;
+
+    len = strlen(type);
+    lm->mod_type = PyMem_NEW(char, len + 1);
+    if (lm->mod_type == NULL)
+        goto nomem;
+    memcpy(lm->mod_type, type, len + 1);
+
+    if (list == Py_None) {
+        /* None indicates a NULL mod_bvals */
+    } else if (PyString_Check(list)) {
+        /* Single string is a singleton list */
+        lm->mod_bvalues = PyMem_NEW(struct berval *, 2);
+        if (lm->mod_bvalues == NULL)
+            goto nomem;
+        lm->mod_bvalues[0] = PyMem_NEW(struct berval, 1);
+        if (lm->mod_bvalues[0] == NULL)
+            goto nomem;
+        lm->mod_bvalues[1] = NULL;
+        lm->mod_bvalues[0]->bv_len = PyString_Size(list);
+        lm->mod_bvalues[0]->bv_val = PyString_AsString(list);
+    } else if (PySequence_Check(list)) {
+        nstrs = PySequence_Length(list);
+        lm->mod_bvalues = PyMem_NEW(struct berval *, nstrs + 1);
+        if (lm->mod_bvalues == NULL)
+            goto nomem;
+        for (i = 0; i < nstrs; i++) {
+          lm->mod_bvalues[i] = PyMem_NEW(struct berval, 1);
+          if (lm->mod_bvalues[i] == NULL)
+              goto nomem;
+          lm->mod_bvalues[i+1] = NULL;
+          item = PySequence_GetItem(list, i);
+          if (item == NULL)
+              goto error;
+          if (!PyString_Check(item)) {
+              PyErr_SetObject( PyExc_TypeError, Py_BuildValue( "sO",
+                  "expected a string in the list", item));
+              Py_DECREF(item);
+              goto error;
+          }
+          lm->mod_bvalues[i]->bv_len = PyString_Size(item);
+          lm->mod_bvalues[i]->bv_val = PyString_AsString(item);
+          Py_DECREF(item);
+        }
+        if (nstrs == 0)
+            lm->mod_bvalues[0] = NULL;
+    }
+
+    return lm;
+
+nomem:
+    PyErr_NoMemory();
+error:
+    if (lm) 
+        LDAPMod_DEL(lm);
+
+    return NULL;
+}
+
+/* free the structure allocated in List_to_LDAPMods() */
+
+static void
+LDAPMods_DEL( LDAPMod** lms ) {
+    LDAPMod** lmp;
+    for ( lmp = lms; *lmp; lmp++ )
+        LDAPMod_DEL( *lmp );
+    PyMem_DEL(lms);
+}
+
+/* 
+ * convert a list of tuples into a LDAPMod*[] array structure 
+ * NOTE: list of tuples must live longer than the LDAPMods
+ */
+
+static LDAPMod**
+List_to_LDAPMods( PyObject *list, int no_op ) {
+
+    Py_ssize_t i, len;
+    LDAPMod** lms;
+    PyObject *item;
+
+    if (!PySequence_Check(list)) {
+        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
+                        "expected list of tuples", list ));
+        return NULL;
+    }
+
+    len = PySequence_Length(list);
+
+    if (len < 0) {
+        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
+                         "expected list of tuples", list ));
+        return NULL;
+    }
+
+    lms = PyMem_NEW(LDAPMod *, len + 1);
+    if (lms == NULL) 
+        goto nomem;
+
+    for (i = 0; i < len; i++) {
+        lms[i] = NULL;
+        item = PySequence_GetItem(list, i);
+        if (item == NULL) 
+            goto error;
+        lms[i] = Tuple_to_LDAPMod(item, no_op);
+        Py_DECREF(item);
+        if (lms[i] == NULL)
+            goto error;
+    }
+    lms[len] = NULL;
+    return lms;
+
+nomem:
+    PyErr_NoMemory();
+error:
+    if (lms)
+        LDAPMods_DEL(lms);
+    return NULL;
+}
+
+/*
+ * convert a python list of strings into an attr list (char*[]).
+ * returns 1 if successful, 0 if not (with exception set)
+ * XXX the strings should live longer than the resulting attrs pointer.
+ */
+
+int
+attrs_from_List( PyObject *attrlist, char***attrsp ) {
+
+    char **attrs = NULL;
+    Py_ssize_t i, len;
+    PyObject *item;
+
+    if (attrlist == Py_None) {
+        /* None means a NULL attrlist */
+    } else if (PyString_Check(attrlist)) {
+        /* caught by John Benninghoff <johnb@netscape.com> */
+        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
+                  "expected *list* of strings, not a string", attrlist ));
+        goto error;
+    } else if (PySequence_Check(attrlist)) {
+        len = PySequence_Length(attrlist);
+        attrs = PyMem_NEW(char *, len + 1);
+        if (attrs == NULL)
+            goto nomem;
+
+        for (i = 0; i < len; i++) {
+            attrs[i] = NULL;
+            item = PySequence_GetItem(attrlist, i);
+            if (item == NULL)
+                goto error;
+            if (!PyString_Check(item)) {
+                PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+                                "expected string in list", item));
+                Py_DECREF(item);
+                goto error;
+            }
+            attrs[i] = PyString_AsString(item);
+            Py_DECREF(item);
+        }
+        attrs[len] = NULL;
+    } else {
+        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
+                         "expected list of strings or None", attrlist ));
+        goto error;
+    }
+
+    *attrsp = attrs;
+    return 1;
+
+nomem:
+    PyErr_NoMemory();
+error:
+    free_attrs(&attrs);
+    return 0;
+}
+
+/* free memory allocated from above routine */
+
+static void
+free_attrs( char*** attrsp ) {
+    char **attrs = *attrsp;
+
+    if (attrs != NULL) {
+        PyMem_DEL(attrs);
+        *attrsp = NULL;
+    }
+}
+
+/*------------------------------------------------------------
+ * methods
+ */
+
+/* ldap_unbind_ext */
+
+static PyObject*
+l_ldap_unbind_ext( LDAPObject* self, PyObject* args )
+{
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "|OO", &serverctrls, &clientctrls)) return NULL;
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_unbind_ext( self->ldap, server_ldcs, client_ldcs );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_unbind_ext" );
+
+    self->valid = 0;
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
+/* ldap_abandon_ext */
+
+static PyObject*
+l_ldap_abandon_ext( LDAPObject* self, PyObject* args )
+{
+    int msgid;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "i|OO", &msgid, &serverctrls, &clientctrls)) return NULL;
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_abandon_ext( self->ldap, msgid, server_ldcs, client_ldcs );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_abandon_ext" );
+
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
+/* ldap_add_ext */
+
+static PyObject *
+l_ldap_add_ext( LDAPObject* self, PyObject *args )
+{
+    char *dn;
+    PyObject *modlist;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+    LDAPMod **mods;
+
+    if (!PyArg_ParseTuple( args, "sO|OO", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
+    if (not_valid(self)) return NULL;
+
+    mods = List_to_LDAPMods( modlist, 1 );
+    if (mods == NULL)
+        return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_add_ext( self->ldap, dn, mods, server_ldcs, client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS( self );
+    LDAPMods_DEL( mods );
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_add_ext" );
+
+    return PyInt_FromLong(msgid);
+}
+
+/* ldap_simple_bind */
+
+static PyObject*
+l_ldap_simple_bind( LDAPObject* self, PyObject* args )
+{
+    char *who;
+    int msgid;
+    int ldaperror;
+    Py_ssize_t cred_len;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+    struct berval cred;
+
+    if (!PyArg_ParseTuple( args, "ss#|OO", &who, &cred.bv_val, &cred_len, &serverctrls, &clientctrls )) return NULL;
+    cred.bv_len = (ber_len_t) cred_len;
+
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_sasl_bind( self->ldap, who, LDAP_SASL_SIMPLE, &cred, server_ldcs, client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_simple_bind" );
+
+    return PyInt_FromLong( msgid );
+}
+
+
+#ifdef HAVE_SASL
+/* The following functions implement SASL binds. A new method
+   sasl_interactive_bind_s(bind_dn, sasl_mechanism) has been introduced.
+
+   * The bind_dn argument will be passed to the c library; however,
+     normally it is not needed and should be an empty string.
+
+   * The sasl_mechanism argument is an instance of a class that
+     implements a callback interface. For convenience, it should be
+     derived from the sasl class (which lives in the ldap.sasl module).
+     See the module documentation for more information.
+
+     Check your /usr/lib/sasl/ directory for locally installed SASL
+     auth modules ("mechanisms"), or try
+
+       ldapsearch   -b "" -s base -LLL -x  supportedSASLMechanisms
+     
+     (perhaps with an additional -h and -p argument for ldap host and
+     port). The latter will show you which SASL mechanisms are known
+     to the LDAP server. If you do not want to set up Kerberos, you
+     can still use SASL binds. Your authentication data should then be
+     stored in /etc/sasldb (see saslpasswd(8)). If the LDAP server
+     does not find the sasldb, it wont allow for DIGEST-MD5 and
+     CRAM-MD5. One important thing to get started with sasldb: you
+     should first add a dummy user (saslpasswd -c dummy), and this
+     will give you some strange error messages. Then delete the dummy
+     user (saslpasswd -d dummy), and now you can start adding users to
+     your sasldb (again, use the -c switch). Strange, eh?
+
+   * The sasl_mechanism object must implement a method, which will be
+     called by the sasl lib several times. The prototype of the
+     callback looks like this: callback(id, challenge, prompt,
+     defresult) has to return a string (or maybe None). The id
+     argument specifies, which information should be passed back to
+     the SASL lib (see SASL_CB_xxx in sasl.h)
+
+
+   A nice "Howto get LDAPv3 up and running with Kerberos and SSL" can
+   be found at http://www.bayour.com/LDAPv3-HOWTO.html.  Instead of
+   MIT Kerberos, I used Heimdal for my tests (since it is included
+   with SuSE Linux).
+
+   Todo:
+   
+   * Find a better interface than the python callback. This is 
+     really ugly. Perhaps one could make use of a sasl class, like
+     in the perl ldap module.
+
+   * Thread safety?
+
+   * Memory Management?
+   
+   * Write more docs
+
+   * ...
+
+*/
+static int interaction ( unsigned flags, 
+                         sasl_interact_t *interact,
+                         PyObject* SASLObject )
+{
+/*  const char *dflt = interact->defresult; */
+  PyObject *result;
+  char *c_result;
+  result = PyObject_CallMethod(SASLObject,
+                               "callback",
+                               "isss",
+                               interact->id,  /* see sasl.h */
+                               interact->challenge,
+                               interact->prompt,   
+                               interact->defresult);
+
+  if (result == NULL) 
+    /*searching for a better error code */
+    return LDAP_OPERATIONS_ERROR; 
+  c_result = PyString_AsString(result); /*xxx Error checking?? */
+  
+  /* according to the sasl docs, we should malloc() the returned
+     string only for calls where interact->id == SASL_CB_PASS, so we
+     probably leak a few bytes per ldap bind. However, if I restrict
+     the strdup() to this case, I get segfaults. Should probably be
+     fixed sometimes.
+  */
+  interact->result = strdup( c_result );
+  if (interact->result == NULL)
+    return LDAP_OPERATIONS_ERROR;
+  interact->len = strlen(c_result);
+  /* We _should_ overwrite the python string buffer for security
+     reasons, however we may not (api/stringObjects.html). Any ideas?
+  */
+  
+  Py_DECREF(result); /*not needed any longer */
+  result = NULL;
+  
+  return LDAP_SUCCESS;
+}
+
+
+/* 
+  This function will be called by ldap_sasl_interactive_bind(). The
+  "*in" is an array of sasl_interact_t's (see sasl.h for a
+  reference). The last interact in the array has an interact->id of
+  SASL_CB_LIST_END.
+
+*/
+
+int py_ldap_sasl_interaction(   LDAP *ld, 
+                                unsigned flags, 
+                                void *defaults,
+                                void *in )
+{
+  /* These are just typecasts */
+  sasl_interact_t *interact = (sasl_interact_t *) in;
+  PyObject *SASLObject = (PyObject *) defaults;
+  /* Loop over the array of sasl_interact_t structs */
+  while( interact->id != SASL_CB_LIST_END ) {
+    int rc = 0;
+    rc = interaction( flags, interact, SASLObject );
+    if( rc )  return rc;
+    interact++;
+  }
+  return LDAP_SUCCESS;
+}
+
+static PyObject* 
+l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
+{
+    char *c_mechanism;
+    char *who;
+
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    PyObject       *SASLObject = NULL;
+    PyObject *mechanism = NULL;
+    int msgid;
+
+    static unsigned sasl_flags = LDAP_SASL_QUIET;
+
+    /* 
+     * In Python 2.3+, a "I" format argument indicates that we're either converting
+     * the Python object into a long or an unsigned int. In versions prior to that,
+     * it will always convert to a long. Since the sasl_flags variable is an
+     * unsigned int, we need to use the "I" flag if we're running Python 2.3+ and a
+     * "i" otherwise. 
+     */
+#if (PY_MAJOR_VERSION == 2) && (PY_MINOR_VERSION < 3)
+    if (!PyArg_ParseTuple(args, "sOOOi", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
+#else
+    if (!PyArg_ParseTuple(args, "sOOOI", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
+#endif
+      return NULL;
+
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    /* now we extract the sasl mechanism from the SASL Object */
+    mechanism = PyObject_GetAttrString(SASLObject, "mech");
+    if (mechanism == NULL) return NULL;
+    c_mechanism = PyString_AsString(mechanism);
+    Py_DECREF(mechanism);
+    mechanism = NULL;
+
+    /* Don't know if it is the "intended use" of the defaults
+       parameter of ldap_sasl_interactive_bind_s when we pass the
+       Python object SASLObject, but passing it through some
+       static variable would destroy thread safety, IMHO.
+     */
+    msgid = ldap_sasl_interactive_bind_s(self->ldap, 
+                                         who, 
+                                         c_mechanism, 
+                                         (LDAPControl**) server_ldcs, 
+                                         (LDAPControl**) client_ldcs,
+                                         sasl_flags, 
+                                         py_ldap_sasl_interaction, 
+                                         SASLObject);
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if (msgid != LDAP_SUCCESS)
+        return LDAPerror( self->ldap, "ldap_sasl_interactive_bind_s" );
+    return PyInt_FromLong( msgid );
+}
+#endif
+
+
+#ifdef LDAP_API_FEATURE_CANCEL
+
+/* ldap_cancel */
+
+static PyObject*
+l_ldap_cancel( LDAPObject* self, PyObject* args )
+{
+    int msgid;
+    int cancelid;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "i|OO", &cancelid, &serverctrls, &clientctrls)) return NULL;
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_cancel( self->ldap, cancelid, server_ldcs, client_ldcs, &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_cancel" );
+
+    return PyInt_FromLong( msgid );
+}
+
+#endif
+
+/* ldap_compare_ext */
+
+static PyObject *
+l_ldap_compare_ext( LDAPObject* self, PyObject *args )
+{
+    char *dn, *attr;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+    Py_ssize_t value_len;
+    struct berval value;
+
+    if (!PyArg_ParseTuple( args, "sss#|OO", &dn, &attr, &value.bv_val, &value_len, &serverctrls, &clientctrls )) return NULL;
+    value.bv_len = (ber_len_t) value_len;
+
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_compare_ext( self->ldap, dn, attr, &value, server_ldcs, client_ldcs, &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_compare_ext" );
+
+    return PyInt_FromLong( msgid );
+}
+
+
+/* ldap_delete_ext */
+
+static PyObject *
+l_ldap_delete_ext( LDAPObject* self, PyObject *args )
+{
+    char *dn;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "s|OO", &dn, &serverctrls, &clientctrls )) return NULL;
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_delete_ext( self->ldap, dn, server_ldcs, client_ldcs, &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_delete_ext" );
+
+    return PyInt_FromLong(msgid);
+}
+
+
+/* ldap_modify_ext */
+
+static PyObject *
+l_ldap_modify_ext( LDAPObject* self, PyObject *args )
+{
+    char *dn;
+    PyObject *modlist;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+    LDAPMod **mods;
+
+    if (!PyArg_ParseTuple( args, "sO|OO", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
+    if (not_valid(self)) return NULL;
+
+    mods = List_to_LDAPMods( modlist, 0 );
+    if (mods == NULL)
+        return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_modify_ext( self->ldap, dn, mods, server_ldcs, client_ldcs, &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPMods_DEL( mods );
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_modify_ext" );
+
+    return PyInt_FromLong( msgid );
+}
+
+
+/* ldap_rename */
+
+static PyObject *
+l_ldap_rename( LDAPObject* self, PyObject *args )
+{
+    char *dn, *newrdn;
+    char *newSuperior = NULL;
+    int delold = 1;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "ss|ziOO", &dn, &newrdn, &newSuperior, &delold, &serverctrls, &clientctrls ))
+        return NULL;
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_rename( self->ldap, dn, newrdn, newSuperior, delold, server_ldcs, client_ldcs, &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_rename" );
+
+    return PyInt_FromLong( msgid );
+}
+
+
+/* ldap_result4 */
+
+static PyObject *
+l_ldap_result4( LDAPObject* self, PyObject *args )
+{
+    int msgid = LDAP_RES_ANY;
+    int all = 1;
+    double timeout = -1.0;
+    int add_ctrls = 0;
+    int add_intermediates = 0;
+    int add_extop = 0;
+    struct timeval tv;
+    struct timeval* tvp;
+    int res_type;
+    LDAPMessage *msg = NULL;
+    PyObject *result_str, *retval, *pmsg, *pyctrls = 0;
+    int res_msgid = 0;
+    char *retoid = 0;
+    PyObject *valuestr = 0;
+
+    if (!PyArg_ParseTuple( args, "|iidiii", &msgid, &all, &timeout, &add_ctrls, &add_intermediates, &add_extop ))
+        return NULL;
+    if (not_valid(self)) return NULL;
+    
+    if (timeout >= 0) {
+        tvp = &tv;
+        set_timeval_from_double( tvp, timeout );
+    } else {
+        tvp = NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    res_type = ldap_result( self->ldap, msgid, all, tvp, &msg );
+    LDAP_END_ALLOW_THREADS( self );
+
+    if (res_type < 0)   /* LDAP or system error */
+        return LDAPerror( self->ldap, "ldap_result4" );
+
+    if (res_type == 0) {
+        /* Polls return (None, None, None, None); timeouts raise an exception */
+        if (timeout == 0) {
+            if (add_extop) {
+                return Py_BuildValue("(OOOOOO)", Py_None, Py_None, Py_None, Py_None, Py_None, Py_None);
+            } else {
+                return Py_BuildValue("(OOOO)", Py_None, Py_None, Py_None, Py_None);
+            }
+        }
+        else
+            return LDAPerr(LDAP_TIMEOUT);
+    }
+
+    if (msg)
+        res_msgid = ldap_msgid(msg);
+
+    int result = LDAP_SUCCESS;
+    char **refs = NULL;
+    LDAPControl **serverctrls = 0;
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    if (res_type == LDAP_RES_SEARCH_ENTRY) {
+        /* LDAPmessage_to_python will parse entries and read the controls for each entry */
+    } else if (res_type == LDAP_RES_SEARCH_REFERENCE) {
+        /* LDAPmessage_to_python will parse refs and read the controls for each res */
+    } else if (res_type == LDAP_RES_INTERMEDIATE) {
+        /* LDAPmessage_to_python will parse intermediates and controls */
+    } else {
+        int rc;
+        if (res_type == LDAP_RES_EXTENDED) {
+            struct berval *retdata = 0;
+            rc = ldap_parse_extended_result( self->ldap, msg, &retoid, &retdata, 0 );
+            /* handle error rc!=0 here? */
+            if (rc == LDAP_SUCCESS) {
+                valuestr = LDAPberval_to_object(retdata);
+            }
+            ber_bvfree( retdata );
+        }
+            
+        rc = ldap_parse_result( self->ldap, msg, &result, NULL, NULL, &refs,
+                                &serverctrls, 0 );
+    }
+    LDAP_END_ALLOW_THREADS( self );
+
+    if (result != LDAP_SUCCESS) {               /* result error */
+        char *e, err[1024];
+        if (result == LDAP_REFERRAL && refs && refs[0]) {
+            snprintf(err, sizeof(err), "Referral:\n%s", refs[0]);
+            e = err;
+        } else
+            e = "ldap_parse_result";
+        ldap_msgfree(msg);
+        return LDAPerror( self->ldap, e );
+    }
+
+    if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
+        int err = LDAP_NO_MEMORY;
+        ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &err);
+        ldap_msgfree(msg);
+        return LDAPerror(self->ldap, "LDAPControls_to_List");
+    }
+    ldap_controls_free(serverctrls);
+
+    pmsg = LDAPmessage_to_python( self->ldap, msg, add_ctrls, add_intermediates );
+
+    result_str = LDAPconstant( res_type );
+
+    if (pmsg == NULL) {
+            retval = NULL;
+    } else {
+        /* s handles NULL, but O does not */
+        if (add_extop) {
+            retval = Py_BuildValue("(OOiOsO)", result_str, pmsg, res_msgid,
+                                   pyctrls, retoid, valuestr ? valuestr : Py_None);
+        } else {
+            retval = Py_BuildValue("(OOiO)", result_str, pmsg, res_msgid, pyctrls);
+        }
+
+        if (pmsg != Py_None) {
+        Py_DECREF(pmsg);
+        }
+    }
+    if (valuestr) {
+        Py_DECREF(valuestr);
+    }
+    Py_XDECREF(pyctrls);
+    Py_DECREF(result_str);
+    return retval;
+}
+
+
+/* ldap_search_ext */
+
+static PyObject*
+l_ldap_search_ext( LDAPObject* self, PyObject* args )
+{
+    char *base;
+    int scope;
+    char *filter;
+    PyObject *attrlist = Py_None;
+    char **attrs;
+    int attrsonly = 0;
+
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    double timeout = -1.0;
+    struct timeval tv;
+    struct timeval* tvp;
+
+    int sizelimit = 0;
+
+    int msgid;
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "sis|OiOOdi",
+                           &base, &scope, &filter, &attrlist, &attrsonly,
+                           &serverctrls, &clientctrls, &timeout, &sizelimit )) return NULL;
+    if (not_valid(self)) return NULL;
+
+    if (!attrs_from_List( attrlist, &attrs )) 
+         return NULL;
+
+    if (timeout >= 0) {
+        tvp = &tv;
+        set_timeval_from_double( tvp, timeout );
+    } else {
+        tvp = NULL;
+    }
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_search_ext( self->ldap, base, scope, filter, attrs, attrsonly,
+                             server_ldcs, client_ldcs, tvp, sizelimit, &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+
+    free_attrs( &attrs );
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_search_ext" );
+
+    return PyInt_FromLong( msgid );
+}       
+
+
+/* ldap_whoami_s (available since OpenLDAP 2.1.13) */
+
+static PyObject*
+l_ldap_whoami_s( LDAPObject* self, PyObject* args )
+{
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    struct berval *bvalue = NULL;
+
+    PyObject *result;
+
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "|OO", &serverctrls, &clientctrls)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_whoami_s( self->ldap, &bvalue, server_ldcs, client_ldcs );
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_whoami_s" );
+
+    result = LDAPberval_to_object(bvalue);
+
+    return result;
+}
+
+#ifdef HAVE_TLS
+/* ldap_start_tls_s */
+
+static PyObject*
+l_ldap_start_tls_s( LDAPObject* self, PyObject* args )
+{
+    int result;
+
+    if (!PyArg_ParseTuple( args, "" )) return NULL;
+    if (not_valid(self)) return NULL;
+
+    result = ldap_start_tls_s( self->ldap, NULL, NULL );
+    if ( result != LDAP_SUCCESS ){
+        ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &result);
+        return LDAPerror( self->ldap, "ldap_start_tls_s" );
+    }
+
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
+#endif
+
+/* ldap_set_option */
+
+static PyObject*
+l_ldap_set_option(PyObject* self, PyObject *args)
+{
+    PyObject *value;
+    int option;
+
+    if (!PyArg_ParseTuple(args, "iO:set_option", &option, &value))
+        return NULL;
+    if (LDAP_set_option((LDAPObject *)self, option, value) == -1)
+        return NULL;
+    Py_INCREF(Py_None);
+    return Py_None;
+}
+
+
+/* ldap_get_option */
+
+static PyObject*
+l_ldap_get_option(PyObject* self, PyObject *args)
+{
+    int option;
+
+    if (!PyArg_ParseTuple(args, "i:get_option", &option))
+        return NULL;
+    return LDAP_get_option((LDAPObject *)self, option);
+}
+
+
+/* ldap_passwd */
+
+static PyObject *
+l_ldap_passwd( LDAPObject* self, PyObject *args )
+{
+    struct berval user;
+    Py_ssize_t user_len;
+    struct berval oldpw;
+    Py_ssize_t oldpw_len;
+    struct berval newpw;
+    Py_ssize_t newpw_len;
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "z#z#z#|OO", &user.bv_val, &user_len, &oldpw.bv_val, &oldpw_len, &newpw.bv_val, &newpw_len, &serverctrls, &clientctrls ))
+        return NULL;
+
+    user.bv_len = (ber_len_t) user_len;
+    oldpw.bv_len = (ber_len_t) oldpw_len;
+    newpw.bv_len = (ber_len_t) newpw_len;
+    
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_passwd( self->ldap,
+            user.bv_val != NULL ? &user : NULL,
+            oldpw.bv_val != NULL ? &oldpw : NULL,
+            newpw.bv_val != NULL ? &newpw : NULL,
+            server_ldcs,
+            client_ldcs,
+            &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+    
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_passwd" );
+
+    return PyInt_FromLong( msgid );
+}
+
+
+/* ldap_extended_operation */
+
+static PyObject *
+l_ldap_extended_operation( LDAPObject* self, PyObject *args )
+{
+    char *reqoid = NULL;
+    struct berval reqvalue = {0, NULL};
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    int msgid;
+    int ldaperror;
+
+    if (!PyArg_ParseTuple( args, "sz#|OO", &reqoid, &reqvalue.bv_val, &reqvalue.bv_len, &serverctrls, &clientctrls ))
+        return NULL;
+
+    if (not_valid(self)) return NULL;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_extended_operation( self->ldap, reqoid,
+            reqvalue.bv_val != NULL ? &reqvalue : NULL,
+            server_ldcs,
+            client_ldcs,
+            &msgid );
+    LDAP_END_ALLOW_THREADS( self );
+    
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if ( ldaperror!=LDAP_SUCCESS )
+        return LDAPerror( self->ldap, "ldap_extended_operation" );
+
+    return PyInt_FromLong( msgid );
+}
+
+/* methods */
+
+static PyMethodDef methods[] = {
+    {"unbind_ext",      (PyCFunction)l_ldap_unbind_ext,         METH_VARARGS },
+    {"abandon_ext",     (PyCFunction)l_ldap_abandon_ext,        METH_VARARGS },
+    {"add_ext",         (PyCFunction)l_ldap_add_ext,            METH_VARARGS },
+    {"simple_bind",     (PyCFunction)l_ldap_simple_bind,        METH_VARARGS },
+#ifdef HAVE_SASL
+    {"sasl_interactive_bind_s", (PyCFunction)l_ldap_sasl_interactive_bind_s,    METH_VARARGS },
+#endif
+    {"compare_ext",     (PyCFunction)l_ldap_compare_ext,        METH_VARARGS },
+    {"delete_ext",      (PyCFunction)l_ldap_delete_ext,         METH_VARARGS },
+    {"modify_ext",      (PyCFunction)l_ldap_modify_ext,         METH_VARARGS },
+    {"rename",          (PyCFunction)l_ldap_rename,             METH_VARARGS },
+    {"result4",         (PyCFunction)l_ldap_result4,            METH_VARARGS },
+    {"search_ext",      (PyCFunction)l_ldap_search_ext,         METH_VARARGS },
+#ifdef HAVE_TLS
+    {"start_tls_s",     (PyCFunction)l_ldap_start_tls_s,        METH_VARARGS },
+#endif
+    {"whoami_s",        (PyCFunction)l_ldap_whoami_s,           METH_VARARGS },
+    {"passwd",          (PyCFunction)l_ldap_passwd,             METH_VARARGS },
+    {"set_option",      (PyCFunction)l_ldap_set_option,         METH_VARARGS },
+    {"get_option",      (PyCFunction)l_ldap_get_option,         METH_VARARGS },
+#ifdef LDAP_API_FEATURE_CANCEL
+    {"cancel",          (PyCFunction)l_ldap_cancel,             METH_VARARGS },
+#endif
+    {"extop",           (PyCFunction)l_ldap_extended_operation,         METH_VARARGS },
+    { NULL, NULL }
+};
+
+/* get attribute */
+
+static PyObject*
+getattr(LDAPObject* self, char* name) 
+{
+        return Py_FindMethod(methods, (PyObject*)self, name);
+}
+
+/* set attribute */
+
+static int
+setattr(LDAPObject* self, char* name, PyObject* value) 
+{
+        PyErr_SetString(PyExc_AttributeError, name);
+        return -1;
+}
+
+/* type entry */
+
+PyTypeObject LDAP_Type = {
+#if defined(MS_WINDOWS) || defined(__CYGWIN__)
+        /* see http://www.python.org/doc/FAQ.html#3.24 */
+        PyObject_HEAD_INIT(NULL)
+#else /* ! MS_WINDOWS */
+        PyObject_HEAD_INIT(&PyType_Type)
+#endif /* MS_WINDOWS */
+        0,                      /*ob_size*/
+        "LDAP",                 /*tp_name*/
+        sizeof(LDAPObject),     /*tp_basicsize*/
+        0,                      /*tp_itemsize*/
+        /* methods */
+        (destructor)dealloc,    /*tp_dealloc*/
+        0,                      /*tp_print*/
+        (getattrfunc)getattr,   /*tp_getattr*/
+        (setattrfunc)setattr,   /*tp_setattr*/
+        0,                      /*tp_compare*/
+        0,                      /*tp_repr*/
+        0,                      /*tp_as_number*/
+        0,                      /*tp_as_sequence*/
+        0,                      /*tp_as_mapping*/
+        0,                      /*tp_hash*/
+};

From b89890494322a50720630fc049a27f9daa35533b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 15 Apr 2011 08:40:19 +0000
Subject: [PATCH 051/868] Small demo script for ldap.controls.psearch

---
 Demo/pyasn1/psearch.py | 79 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 Demo/pyasn1/psearch.py

diff --git a/Demo/pyasn1/psearch.py b/Demo/pyasn1/psearch.py
new file mode 100644
index 0000000..86bdb37
--- /dev/null
+++ b/Demo/pyasn1/psearch.py
@@ -0,0 +1,79 @@
+# -*- coding: utf-8 -*-
+"""
+Demo script for Persistent Search Control
+(see http://tools.ietf.org/html/draft-ietf-ldapext-psearch)
+
+See http://www.python-ldap.org/ for project details.
+This needs the following software:
+Python
+pyasn1
+pyasn1-modules
+python-ldap 2.4+
+"""
+
+import sys,ldap,ldapurl,getpass
+
+from ldap.controls.psearch import PersistentSearchControl,EntryChangeNotificationControl,CHANGE_TYPES_STR
+
+try:
+  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+except IndexError:
+  print 'Usage: psearch.py <LDAP URL>'
+  sys.exit(1)
+
+# Set debugging level
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 2
+ldapmodule_trace_file = sys.stderr
+
+ldap_conn = ldap.ldapobject.LDAPObject(
+  ldap_url.initializeUrl(),
+  trace_level=ldapmodule_trace_level,
+  trace_file=ldapmodule_trace_file
+)
+
+if ldap_url.cred is None:
+  print 'Password for %s:' % (repr(ldap_url.who))
+  ldap_url.cred = getpass.getpass()
+
+try:
+  ldap_conn.simple_bind_s(ldap_url.who,ldap_url.cred)
+
+except ldap.INVALID_CREDENTIALS,e:
+  print 'Simple bind failed:',str(e)
+  sys.exit(1)
+
+psc = PersistentSearchControl()
+
+msg_id = ldap_conn.search_ext(
+  ldap_url.dn,
+  ldap_url.scope,
+  ldap_url.filterstr,
+  attrlist = ldap_url.attrs or ['*','+'],
+  serverctrls=[psc],
+)
+
+while True:
+  try:
+    res_type,res_data,res_msgid,_,_,_ = ldap_conn.result4(
+      msg_id,
+      all=0,
+      timeout=10.0,
+      add_ctrls=1,
+      add_intermediates=1,
+      resp_ctrl_classes={EntryChangeNotificationControl.controlType:EntryChangeNotificationControl},
+    )
+  except ldap.TIMEOUT:
+    print 'Timeout waiting for results...'
+  else:
+    for dn,entry,srv_ctrls in res_data:
+      ecn_ctrls = [
+        c
+        for c in srv_ctrls
+        if c.controlType == EntryChangeNotificationControl.controlType
+      ]
+
+      if ecn_ctrls:
+        changeType,previousDN,changeNumber = ecn_ctrls[0].changeType,ecn_ctrls[0].previousDN,ecn_ctrls[0].changeNumber
+        change_type_desc = CHANGE_TYPES_STR[changeType]
+        print 'changeType: %s (%d), changeNumber: %s, previousDN: %s' % (change_type_desc,changeType,changeNumber,repr(previousDN))

From 88d35a8369ebc3d65740d777f39bdc0fd96d834a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 6 Jun 2011 13:07:38 +0000
Subject: [PATCH 052/868] ldap.modlist.modifyModlist(): New key-word argument
 case_ignore_attr_types used to define attribute types for which comparison of
 old and new values should be case-insensitive

---
 Lib/ldap/modlist.py            | 126 ++++++++++++++++++++++++++++++
 Tests/Lib/ldap/test_modlist.py | 137 +++++++++++++++++++++++++++++++++
 2 files changed, 263 insertions(+)
 create mode 100644 Lib/ldap/modlist.py
 create mode 100644 Tests/Lib/ldap/test_modlist.py

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
new file mode 100644
index 0000000..b0fe364
--- /dev/null
+++ b/Lib/ldap/modlist.py
@@ -0,0 +1,126 @@
+"""
+ldap.modlist - create add/modify modlist's
+
+See http://www.python-ldap.org/ for details.
+
+$Id: modlist.py,v 1.18 2011/06/06 13:07:38 stroeder Exp $
+
+Python compability note:
+This module is known to work with Python 2.0+ but should work
+with Python 1.5.2 as well.
+"""
+
+from ldap import __version__
+
+import string,ldap,ldap.cidict
+
+
+def list_dict(l,case_insensitive=0):
+  """
+  return a dictionary with all items of l being the keys of the dictionary
+
+  If argument case_insensitive is non-zero ldap.cidict.cidict will be
+  used for case-insensitive string keys
+  """
+  if case_insensitive:
+    d = ldap.cidict.cidict()
+  else:
+    d = {}
+  for i in l:
+    d[i]=None
+  return d
+
+
+def addModlist(entry,ignore_attr_types=None):
+  """Build modify list for call of method LDAPObject.add()"""
+  ignore_attr_types = list_dict(map(string.lower,(ignore_attr_types or [])))
+  modlist = []
+  for attrtype in entry.keys():
+    if ignore_attr_types.has_key(string.lower(attrtype)):
+      # This attribute type is ignored
+      continue
+    # Eliminate empty attr value strings in list
+    attrvaluelist = filter(lambda x:x!=None,entry[attrtype])
+    if attrvaluelist:
+      modlist.append((attrtype,entry[attrtype]))
+  return modlist # addModlist()
+
+
+def modifyModlist(
+  old_entry,new_entry,ignore_attr_types=None,ignore_oldexistent=0,case_ignore_attr_types=None
+):
+  """
+  Build differential modify list for calling LDAPObject.modify()/modify_s()
+
+  old_entry
+      Dictionary holding the old entry
+  new_entry
+      Dictionary holding what the new entry should be
+  ignore_attr_types
+      List of attribute type names to be ignored completely
+  ignore_oldexistent
+      If non-zero attribute type names which are in old_entry
+      but are not found in new_entry at all are not deleted.
+      This is handy for situations where your application
+      sets attribute value to '' for deleting an attribute.
+      In most cases leave zero.
+  case_ignore_attr_types
+      List of attribute type names for which comparison will be made
+      case-insensitive
+  """
+  ignore_attr_types = list_dict(map(string.lower,(ignore_attr_types or [])))
+  case_ignore_attr_types = list_dict(map(string.lower,(case_ignore_attr_types or [])))
+  modlist = []
+  attrtype_lower_map = {}
+  for a in old_entry.keys():
+    attrtype_lower_map[string.lower(a)]=a
+  for attrtype in new_entry.keys():
+    attrtype_lower = string.lower(attrtype)
+    if ignore_attr_types.has_key(attrtype_lower):
+      # This attribute type is ignored
+      continue
+    # Filter away null-strings
+    new_value = filter(lambda x:x!=None,new_entry[attrtype])
+    if attrtype_lower_map.has_key(attrtype_lower):
+      old_value = old_entry.get(attrtype_lower_map[attrtype_lower],[])
+      old_value = filter(lambda x:x!=None,old_value)
+      del attrtype_lower_map[attrtype_lower]
+    else:
+      old_value = []
+    if not old_value and new_value:
+      # Add a new attribute to entry
+      modlist.append((ldap.MOD_ADD,attrtype,new_value))
+    elif old_value and new_value:
+      # Replace existing attribute
+      replace_attr_value = len(old_value)!=len(new_value)
+      if not replace_attr_value:
+        case_insensitive = case_ignore_attr_types.has_key(attrtype_lower)
+        old_value_dict=list_dict(old_value,case_insensitive)
+        new_value_dict=list_dict(new_value,case_insensitive)
+        delete_values = []
+        for v in old_value:
+          if not new_value_dict.has_key(v):
+            replace_attr_value = 1
+            break
+        add_values = []
+        if not replace_attr_value:
+          for v in new_value:
+            if not old_value_dict.has_key(v):
+              replace_attr_value = 1
+              break
+      if replace_attr_value:
+        modlist.append((ldap.MOD_DELETE,attrtype,None))
+        modlist.append((ldap.MOD_ADD,attrtype,new_value))
+    elif old_value and not new_value:
+      # Completely delete an existing attribute
+      modlist.append((ldap.MOD_DELETE,attrtype,None))
+  if not ignore_oldexistent:
+    # Remove all attributes of old_entry which are not present
+    # in new_entry at all
+    for a in attrtype_lower_map.keys():
+      if ignore_attr_types.has_key(a):
+        # This attribute type is ignored
+        continue
+      attrtype = attrtype_lower_map[a]
+      modlist.append((ldap.MOD_DELETE,attrtype,None))
+  return modlist # modifyModlist()
diff --git a/Tests/Lib/ldap/test_modlist.py b/Tests/Lib/ldap/test_modlist.py
new file mode 100644
index 0000000..fef0f65
--- /dev/null
+++ b/Tests/Lib/ldap/test_modlist.py
@@ -0,0 +1,137 @@
+"""
+Tests for module ldap.modlist
+"""
+
+import ldap
+
+from ldap.modlist import addModlist,modifyModlist
+  
+print '\nTesting function addModlist():'
+addModlist_tests = [
+  (
+    {
+      'objectClass':['person','pilotPerson'],
+      'cn':['Michael Str\303\266der','Michael Stroeder'],
+      'sn':['Str\303\266der'],
+      'dummy1':[],
+      'dummy2':['2'],
+      'dummy3':[''],
+    },
+    [
+      ('objectClass',['person','pilotPerson']),
+      ('cn',['Michael Str\303\266der','Michael Stroeder']),
+      ('sn',['Str\303\266der']),
+      ('dummy2',['2']),
+      ('dummy3',['']),
+    ]
+  ),
+]
+for entry,test_modlist in addModlist_tests:
+  test_modlist.sort()
+  result_modlist = addModlist(entry)
+  result_modlist.sort()
+  if test_modlist!=result_modlist:
+    print 'addModlist(%s) returns\n%s\ninstead of\n%s.' % (
+      repr(entry),repr(result_modlist),repr(test_modlist)
+    )
+
+print '\nTesting function modifyModlist():'
+modifyModlist_tests = [
+
+  (
+    {
+      'objectClass':['person','pilotPerson'],
+      'cn':['Michael Str\303\266der','Michael Stroeder'],
+      'sn':['Str\303\266der'],
+      'enum':['a','b','c'],
+      'c':['DE'],
+    },
+    {
+      'objectClass':['person','inetOrgPerson'],
+      'cn':['Michael Str\303\266der','Michael Stroeder'],
+      'sn':[],
+      'enum':['a','b','d'],
+      'mail':['michael@stroeder.com'],
+    },
+    [],
+    [
+      (ldap.MOD_DELETE,'objectClass',None),
+      (ldap.MOD_ADD,'objectClass',['person','inetOrgPerson']),
+      (ldap.MOD_DELETE,'c',None),
+      (ldap.MOD_DELETE,'sn',None),
+      (ldap.MOD_ADD,'mail',['michael@stroeder.com']),
+      (ldap.MOD_DELETE,'enum',None),
+      (ldap.MOD_ADD,'enum',['a','b','d']),
+    ]
+  ),
+
+  (
+    {
+      'c':['DE'],
+    },
+    {
+      'c':['FR'],
+    },
+    [],
+    [
+      (ldap.MOD_DELETE,'c',None),
+      (ldap.MOD_ADD,'c',['FR']),
+    ]
+  ),
+
+  # Now a weird test-case for catching all possibilities
+  # of removing an attribute with MOD_DELETE,attr_type,None
+  (
+    {
+      'objectClass':['person'],
+      'cn':[None],
+      'sn':[''],
+      'c':['DE'],
+    },
+    {
+      'objectClass':[],
+      'cn':[],
+      'sn':[None],
+    },
+    [],
+    [
+      (ldap.MOD_DELETE,'c',None),
+      (ldap.MOD_DELETE,'objectClass',None),
+      (ldap.MOD_DELETE,'sn',None),
+    ]
+  ),
+
+  (
+    {
+      'objectClass':['person'],
+      'cn':['Michael Str\303\266der','Michael Stroeder'],
+      'sn':['Str\303\266der'],
+      'enum':['a','b','C'],
+    },
+    {
+      'objectClass':['Person'],
+      'cn':['Michael Str\303\266der','Michael Stroeder'],
+      'sn':[],
+      'enum':['a','b','c'],
+    },
+    ['objectClass'],
+    [
+      (ldap.MOD_DELETE,'sn',None),
+      (ldap.MOD_DELETE,'enum',None),
+      (ldap.MOD_ADD,'enum',['a','b','c']),
+    ]
+  ),
+
+]
+for old_entry,new_entry,case_ignore_attr_types,test_modlist in modifyModlist_tests:
+  test_modlist.sort()
+  result_modlist = modifyModlist(old_entry,new_entry,case_ignore_attr_types=case_ignore_attr_types)
+  result_modlist.sort()
+
+  if test_modlist!=result_modlist:
+    print 'modifyModlist(%s,%s) returns\n%s\ninstead of\n%s.' % (
+      repr(old_entry),
+      repr(new_entry),
+      repr(result_modlist),
+      repr(test_modlist)
+    )

From f4933175f36d230075f9c27bacb02a9753773855 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 8 Jun 2011 20:36:18 +0000
Subject: [PATCH 053/868] Test all LDAP operations

---
 Demo/pyasn1/readentrycontrol.py | 112 ++++++++++++++++++++++++++++++++
 1 file changed, 112 insertions(+)
 create mode 100644 Demo/pyasn1/readentrycontrol.py

diff --git a/Demo/pyasn1/readentrycontrol.py b/Demo/pyasn1/readentrycontrol.py
new file mode 100644
index 0000000..077fe6c
--- /dev/null
+++ b/Demo/pyasn1/readentrycontrol.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python
+"""
+This sample script demonstrates the use of the pre-read control (see RFC 4527).
+
+Originally contributed by Andreas Hasenack <ahasenack@terra.com.br>
+
+Requires module pyasn1 (see http://pyasn1.sourceforge.net/)
+"""
+
+import pprint,ldap,ldap.modlist
+
+from ldap.controls.readentry import PreReadControl,PostReadControl
+
+uri = "ldap://localhost:2071/"
+
+l = ldap.initialize(uri,trace_level=2)
+l.simple_bind_s('uid=diradm,ou=schulung,dc=stroeder,dc=local','testsecret')
+
+print """#---------------------------------------------------------------------------
+# Add new entry
+#---------------------------------------------------------------------------
+"""
+
+new_test_dn = "uid=ablume,ou=Users,ou=schulung,dc=stroeder,dc=local"
+new_test_dn2 = "uid=ablume2,ou=Users,ou=schulung,dc=stroeder,dc=local"
+new_test_entry = {
+  'objectClass':['account','posixAccount'],
+  'uid':['ablume'],
+  'cn':['Anna Blume'],
+  'uidNumber':['10000'],
+  'gidNumber':['10000'],
+  'homeDirectory':['/home/ablume'],
+}
+
+pr = PostReadControl(criticality=True,attrList=['entryUUID','entryCSN'])
+
+msg_id = l.add_ext(
+  new_test_dn,
+  ldap.modlist.addModlist(new_test_entry),
+  serverctrls = [pr]
+)
+_,_,_,resp_ctrls = l.result3(msg_id)
+print "resp_ctrls[0].dn:",resp_ctrls[0].dn
+print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+
+print """#---------------------------------------------------------------------------
+# Modify entry
+#---------------------------------------------------------------------------
+"""
+
+pr = PreReadControl(criticality=True,attrList=['uidNumber','gidNumber','entryCSN'])
+
+msg_id = l.modify_ext(
+  new_test_dn,
+  [(ldap.MOD_INCREMENT, "uidNumber", "1"),(ldap.MOD_INCREMENT, "gidNumber", "1")],
+  serverctrls = [pr]
+)
+_,_,_,resp_ctrls = l.result3(msg_id)
+print "resp_ctrls[0].dn:",resp_ctrls[0].dn
+print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+
+pr = PostReadControl(criticality=True,attrList=['uidNumber','gidNumber','entryCSN'])
+
+msg_id = l.modify_ext(
+  new_test_dn,
+  [(ldap.MOD_INCREMENT, "uidNumber", "1"),(ldap.MOD_INCREMENT, "gidNumber", "1")],
+  serverctrls = [pr]
+)
+_,_,_,resp_ctrls = l.result3(msg_id)
+print "resp_ctrls[0].dn:",resp_ctrls[0].dn
+print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+
+print """#---------------------------------------------------------------------------
+# Rename entry
+#---------------------------------------------------------------------------
+"""
+
+pr = PostReadControl(criticality=True,attrList=['uid'])
+msg_id = l.rename(
+  new_test_dn,
+  "uid=ablume2",
+  delold=1,
+  serverctrls = [pr]
+)
+_,_,_,resp_ctrls = l.result3(msg_id)
+print "resp_ctrls[0].dn:",resp_ctrls[0].dn
+print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+
+pr = PreReadControl(criticality=True,attrList=['uid'])
+msg_id = l.rename(
+  new_test_dn2,
+  "uid=ablume",
+  delold=1,
+  serverctrls = [pr]
+)
+_,_,_,resp_ctrls = l.result3(msg_id)
+print "resp_ctrls[0].dn:",resp_ctrls[0].dn
+print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+
+print """#---------------------------------------------------------------------------
+# Delete entry
+#---------------------------------------------------------------------------
+"""
+
+pr = PreReadControl(criticality=True,attrList=['*','+'])
+msg_id = l.delete_ext(
+  new_test_dn,
+  serverctrls = [pr]
+)
+_,_,_,resp_ctrls = l.result3(msg_id)
+print "resp_ctrls[0].dn:",resp_ctrls[0].dn
+print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)

From b7d0dd2a9ab3417fd59fa06780c1bff63803b6ec Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 1 Jul 2011 16:54:50 +0000
Subject: [PATCH 054/868] Corrected tag [1] since a fix for OpenLDAP is
 available to make it compliant to RFC 2589

---
 Lib/ldap/extop/dds.py | 79 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 Lib/ldap/extop/dds.py

diff --git a/Lib/ldap/extop/dds.py b/Lib/ldap/extop/dds.py
new file mode 100644
index 0000000..5844a61
--- /dev/null
+++ b/Lib/ldap/extop/dds.py
@@ -0,0 +1,79 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.extop.dds - Classes for Dynamic Entries extended operations
+(see RFC 2589)
+
+This needs the following software:
+Python
+pyasn1
+pyasn1-modules
+python-ldap 2.4+
+"""
+
+from ldap.extop import ExtendedRequest,ExtendedResponse
+
+# Imports from pyasn1
+from pyasn1.type import namedtype,univ,tag
+from pyasn1.codec.der import encoder,decoder
+from pyasn1_modules.rfc2251 import LDAPDN
+
+
+class RefreshRequest(ExtendedRequest):
+
+  requestName = '1.3.6.1.4.1.1466.101.119.1'
+  defaultRequestTtl = 86400
+
+  class RefreshRequestValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+      namedtype.NamedType(
+        'entryName',
+        LDAPDN().subtype(
+          implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,0)
+        )
+      ),
+      namedtype.NamedType(
+        'requestTtl',
+        univ.Integer().subtype(
+          implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,1)
+        )
+      ),
+    )
+
+  def __init__(self,requestName=None,entryName=None,requestTtl=None):
+    self.entryName = entryName
+    self.requestTtl = requestTtl or self.defaultRequestTtl
+
+  def encodedRequestValue(self):
+    p = self.RefreshRequestValue()
+    p.setComponentByName(
+      'entryName',
+      LDAPDN(self.entryName).subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple,0)
+      )
+    )
+    p.setComponentByName(
+      'requestTtl',
+      univ.Integer(self.requestTtl).subtype(
+        implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,1)
+      )
+    )
+    return encoder.encode(p)
+
+
+class RefreshResponse(ExtendedResponse):
+  responseName = '1.3.6.1.4.1.1466.101.119.1'
+
+  class RefreshResponseValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+      namedtype.NamedType(
+        'responseTtl',
+        univ.Integer().subtype(
+          implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,1)
+        )
+      )
+    )
+
+  def decodeResponseValue(self,value):
+    respValue,_ = decoder.decode(value,asn1Spec=self.RefreshResponseValue())
+    self.responseTtl = int(respValue.getComponentByName('responseTtl'))
+    return self.responseTtl

From cb07e1de4c75291c61b66a19306fc84104ede9a2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 5 Jul 2011 13:53:12 +0000
Subject: [PATCH 055/868] New module ldap.controls.sessiontrack

---
 Demo/pyasn1/sessiontrack.py | 59 +++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 Demo/pyasn1/sessiontrack.py

diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
new file mode 100644
index 0000000..dd4797e
--- /dev/null
+++ b/Demo/pyasn1/sessiontrack.py
@@ -0,0 +1,59 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+"""
+demo_track_ldap_session.py
+
+Client-seitige Demo-Implementierung von Session Tracking Control
+
+http://tools.ietf.org/html/draft-wahl-ldap-session-03
+"""
+
+__version__ = '0.1'
+
+import sys,getpass,ldap,ldapurl
+
+from ldap.controls.sessiontrack import SessionTrackingControl,SESSION_TRACKING_FORMAT_OID_USERNAME
+
+try:
+  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+except IndexError,ValueError:
+  print 'Usage: %s <LDAP URL>' % (sys.argv[0])
+  sys.exit(1)
+
+# Set debugging level
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 2
+ldapmodule_trace_file = sys.stderr
+
+ldap_conn = ldap.ldapobject.LDAPObject(
+  ldap_url.initializeUrl(),
+  trace_level=ldapmodule_trace_level,
+  trace_file=ldapmodule_trace_file
+)
+
+if ldap_url.who and ldap_url.cred is None:
+  print 'Password for %s:' % (repr(ldap_url.who))
+  ldap_url.cred = getpass.getpass()
+
+try:
+  ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
+
+except ldap.INVALID_CREDENTIALS,e:
+  print 'Simple bind failed:',str(e)
+  sys.exit(1)
+
+st_ctrl = SessionTrackingControl(
+  '192.0.2.1',
+  'app.example.com',
+  SESSION_TRACKING_FORMAT_OID_USERNAME,
+  'bloggs'
+)
+
+ldap_conn.search_ext_s(
+  ldap_url.dn or '',
+  ldap_url.scope or ldap.SCOPE_SUBTREE,
+  ldap_url.filterstr or '(objectClass=*)',
+  ldap_url.attrs or ['*'],
+  serverctrls=[st_ctrl]
+)
+

From 3164f072dd4eff13ac0cab5b20fb0e7e4472d8cd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 8 Jul 2011 10:15:26 +0000
Subject: [PATCH 056/868] OIDs and NAMEs are checked for uniqueness

---
 Demo/schema.py | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 Demo/schema.py

diff --git a/Demo/schema.py b/Demo/schema.py
new file mode 100644
index 0000000..c8103f3
--- /dev/null
+++ b/Demo/schema.py
@@ -0,0 +1,63 @@
+import sys,ldap,ldap.schema
+
+schema_attrs = ldap.schema.SCHEMA_ATTRS
+
+ldap.set_option(ldap.OPT_DEBUG_LEVEL,0)
+
+ldap._trace_level = 0
+
+subschemasubentry_dn,schema = ldap.schema.urlfetch(sys.argv[-1])
+
+if subschemasubentry_dn is None:
+  print 'No sub schema sub entry found!'
+  sys.exit(1)
+
+if schema.non_unique_oids:
+  print '*** Schema errors ***'
+  print 'non-unique OIDs:\n','\r\n'.join(schema.non_unique_oids)
+
+print '*** Schema from',repr(subschemasubentry_dn)
+
+# Display schema
+for attr_type,schema_class in ldap.schema.SCHEMA_CLASS_MAPPING.items():
+  print '*'*20,attr_type,'*'*20
+  for element_id in schema.listall(schema_class):
+    se_orig = schema.get_obj(schema_class,element_id)
+    print attr_type,str(se_orig)
+print '*** Testing object class inetOrgPerson ***'
+
+drink = schema.get_obj(ldap.schema.AttributeType,'favouriteDrink')
+if not drink is None:
+  print '*** drink ***'
+  print 'drink.names',repr(drink.names)
+  print 'drink.collective',repr(drink.collective)
+
+inetOrgPerson = schema.get_obj(ldap.schema.ObjectClass,'inetOrgPerson')
+if not inetOrgPerson is None:
+  print inetOrgPerson.must,inetOrgPerson.may
+
+print '*** person,organizationalPerson,inetOrgPerson ***'
+try:
+  print schema.attribute_types(
+    ['person','organizationalPerson','inetOrgPerson']
+  )
+  print schema.attribute_types(
+    ['person','organizationalPerson','inetOrgPerson'],
+    attr_type_filter = [
+      ('no_user_mod',[0]),
+      ('usage',range(2)),
+    ]  
+  )
+except KeyError,e:
+  print '***KeyError',str(e)
+
+
+schema.ldap_entry()
+
+print str(schema.get_obj(ldap.schema.MatchingRule,'2.5.13.0'))
+print str(schema.get_obj(ldap.schema.MatchingRuleUse,'2.5.13.0'))
+
+print str(schema.get_obj(ldap.schema.AttributeType,'name'))
+print str(schema.get_inheritedobj(ldap.schema.AttributeType,'cn',['syntax','equality','substr','ordering']))
+
+must_attr,may_attr = schema.attribute_types(['person','organizationalPerson','inetOrgPerson'],raise_keyerror=0)

From cb324f9372d2e65b21bd499981a15a07b7ae5410 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 21 Jul 2011 18:29:14 +0000
Subject: [PATCH 057/868] Empty file must be there

---
 PKG-INFO | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 PKG-INFO

diff --git a/PKG-INFO b/PKG-INFO
new file mode 100644
index 0000000..e69de29

From 914ef85f3ac80016ed1fa6b93cd6b1a804acb87c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 21 Jul 2011 20:33:26 +0000
Subject: [PATCH 058/868] Usage of Sphinx domains, lots of clean-ups and
 repaired function/method results

---
 Doc/ldap-filter.rst | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 Doc/ldap-filter.rst

diff --git a/Doc/ldap-filter.rst b/Doc/ldap-filter.rst
new file mode 100644
index 0000000..8295792
--- /dev/null
+++ b/Doc/ldap-filter.rst
@@ -0,0 +1,41 @@
+.. % $Id: ldap-filter.rst,v 1.4 2011/07/21 20:33:26 stroeder Exp $
+
+
+:py:mod:`ldap.filter` LDAP filter handling
+============================================
+
+.. py:module:: ldap.filter
+   :synopsis: LDAP filter handling.
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+.. % Author of the module code;
+
+
+.. seealso::
+
+   :rfc:`4515` - Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters.
+
+The :mod:`ldap.filter` module defines the following functions:
+
+
+.. function:: escape_filter_chars(assertion_value[, escape_mode=0])
+
+   This function escapes characters in *assertion_value* which  are special in LDAP
+   filters. You should use this function when  building LDAP filter strings from
+   arbitrary input.    *escape_mode* means:  If :const:`0` only special chars
+   mentioned in RFC 4515 are escaped.  If :const:`1` all NON-ASCII chars are
+   escaped.  If :const:`2` all chars are escaped.
+
+   .. % -> string
+
+
+.. function:: filter_format(filter_template, assertion_values)
+
+   This function applies :func:`escape_filter_chars` to each of the strings in
+   list *assertion_values*. After that *filter_template* containing  as many
+   :const:`%s` placeholders as count of assertion values is  used to build the
+   whole filter string.
+
+   .. % -> string
+

From bd12e58aa5801f036d182ec6ce2d1aad87694d32 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 07:20:53 +0000
Subject: [PATCH 059/868] Reference newer LDAPv3 RFC 4515

---
 Lib/ldap/filter.py | 55 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 Lib/ldap/filter.py

diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
new file mode 100644
index 0000000..23f34c6
--- /dev/null
+++ b/Lib/ldap/filter.py
@@ -0,0 +1,55 @@
+"""
+filters.py - misc stuff for handling LDAP filter strings (see RFC2254)
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: filter.py,v 1.9 2011/07/22 07:20:53 stroeder Exp $
+
+Compability:
+- Tested with Python 2.0+
+"""
+
+from ldap import __version__
+
+
+def escape_filter_chars(assertion_value,escape_mode=0):
+  """
+  Replace all special characters found in assertion_value
+  by quoted notation.
+  
+  escape_mode
+      If 0 only special chars mentioned in RFC 4515 are escaped.
+      If 1 all NON-ASCII chars are escaped.
+      If 2 all chars are escaped.
+  """
+  if escape_mode:
+    r = []
+    if escape_mode==1:
+      for c in assertion_value:
+        if c < '0' or c > 'z' or c in "\\*()":
+          c = "\\%02x" % ord(c)
+        r.append(c)
+    elif escape_mode==2:
+      for c in assertion_value:
+        r.append("\\%02x" % ord(c))
+    else:
+      raise ValueError('escape_mode must be 0, 1 or 2.')
+    s = ''.join(r)
+  else:
+    s = assertion_value.replace('\\', r'\5c')
+    s = s.replace(r'*', r'\2a')
+    s = s.replace(r'(', r'\28')
+    s = s.replace(r')', r'\29')
+    s = s.replace('\x00', r'\00')
+  return s 
+
+
+def filter_format(filter_template,assertion_values):
+  """
+  filter_template
+        String containing %s as placeholder for assertion values.
+  assertion_values
+        List or tuple of assertion values. Length must match
+        count of %s in filter_template.
+  """
+  return filter_template % (tuple(map(escape_filter_chars,assertion_values)))

From 9b1b2d0fbcd7d2ffc9f8f70205b8fb9baca328a4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 07:43:45 +0000
Subject: [PATCH 060/868] Separate seealso for LDAPv2 RFC

---
 Doc/ldap-dn.rst | 114 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 114 insertions(+)
 create mode 100644 Doc/ldap-dn.rst

diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
new file mode 100644
index 0000000..81b6ba7
--- /dev/null
+++ b/Doc/ldap-dn.rst
@@ -0,0 +1,114 @@
+.. % $Id: ldap-dn.rst,v 1.6 2011/07/22 07:43:45 stroeder Exp $
+
+
+:py:mod:`ldap.dn` LDAP Distinguished Name handling
+====================================================
+
+.. py:module:: ldap.dn
+   :synopsis: LDAP Distinguished Name handling.
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+.. % Author of the module code;
+
+
+.. seealso::
+
+   For LDAPv3 DN syntax see:
+
+   :rfc:`4514` - Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names
+
+.. seealso::
+
+   For deprecated LDAPv2 DN syntax (obsoleted by LDAPv3) see:
+
+   :rfc:`1779` - A String Representation of Distinguished Names
+
+The :mod:`ldap.dn` module defines the following functions:
+
+
+.. function:: escape_dn_chars(s)
+
+   This function escapes characters in string *s* which  are special in LDAP
+   distinguished names. You should use  this function when building LDAP DN strings
+   from arbitrary input.
+
+   .. % -> string
+
+
+.. function:: str2dn(s [, flags=0])
+
+   This function takes *s* and breaks it up into its component parts  down to AVA
+   level. The optional parameter *flags* describes the DN format of s  (see
+   :ref:`ldap-dn-flags`). Note that hex-encoded non-ASCII chars are decoded
+   to the raw bytes.
+
+   .. % -> list
+
+
+.. function:: dn2str(dn)
+
+   This function takes a decomposed DN in *dn* and returns  a single string. It's
+   the inverse to :func:`str2dn`.  Special characters are escaped with the help of
+   function :func:`escape_dn_chars`.
+
+   .. % -> string
+
+
+.. function:: explode_dn(dn [, notypes=0[, flags=0]])
+
+   This function takes *dn* and breaks it up into its component parts.   Each part
+   is known as an RDN (Relative Distinguished Name). The optional  *notypes*
+   parameter is used to specify that only the RDN values be   returned and not
+   their types. The optional parameter *flags*  describes the DN format of s (see
+   :ref:`ldap-dn-flags`).    This function is emulated by function
+   :func:`str2dn`  since the function ldap_explode_dn() in the C library is
+   deprecated.
+
+   .. % -> list
+
+
+.. function:: explode_rdn(rdn [, notypes=0[, flags=0]])
+
+   This function takes a (multi-valued) *rdn* and breaks it up  into a list of
+   characteristic attributes. The optional  *notypes* parameter is used to specify
+   that only the RDN values be   returned and not their types. The optional *flags*
+   parameter  describes the DN format of s (see :ref:`ldap-dn-flags`).    This
+   function is emulated by function :func:`str2dn`  since the function
+   ldap_explode_rdn() in the C library is deprecated.
+
+   .. % -> list
+
+
+.. _ldap-dn-example:
+
+Examples
+^^^^^^^^^
+
+Splitting a LDAPv3 DN to AVA level. Note that both examples have the same result
+but in the first example the non-ASCII chars are passed as is (byte buffer string)
+whereas in the second example the hex-encoded DN representation are passed to the function.
+
+>>> ldap.dn.str2dn('cn=Michael Str\xc3\xb6der,dc=stroeder,dc=com',flags=ldap.DN_FORMAT_LDAPV3)
+[[('cn', 'Michael Str\xc3\xb6der', 4)], [('dc', 'stroeder', 1)], [('dc', 'com', 1)]]
+>>> ldap.dn.str2dn('cn=Michael Str\C3\B6der,dc=stroeder,dc=com',flags=ldap.DN_FORMAT_LDAPV3)
+[[('cn', 'Michael Str\xc3\xb6der', 4)], [('dc', 'stroeder', 1)], [('dc', 'com', 1)]]
+
+
+Splitting a LDAPv2 DN into RDN parts:
+
+>>> ldap.dn.explode_dn('cn=Michael Stroeder;dc=stroeder;dc=com',flags=ldap.DN_FORMAT_LDAPV2)
+['cn=Michael Stroeder', 'dc=stroeder', 'dc=com']
+
+
+Splitting a multi-valued RDN:
+
+>>> ldap.dn.explode_rdn('cn=Michael Stroeder+mail=michael@stroeder.com',flags=ldap.DN_FORMAT_LDAPV2)
+['cn=Michael Stroeder', 'mail=michael@stroeder.com']
+
+Splitting a LDAPv3 DN with a multi-valued RDN into its AVA parts:
+
+
+>>> ldap.dn.str2dn('cn=Michael Stroeder+mail=michael@stroeder.com,dc=stroeder,dc=com')
+[[('cn', 'Michael Stroeder', 1), ('mail', 'michael@stroeder.com', 1)], [('dc', 'stroeder', 1)], [('dc', 'com', 1)]]
+

From 4cf7cb577ffee107e2796af37ec90e3e34378b81 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 13:27:01 +0000
Subject: [PATCH 061/868] doc-string based docs

---
 Doc/ldapurl.rst            | 126 +++++++++++++++++++++++++++++++++++++
 Lib/ldap/extop/__init__.py |  74 ++++++++++++++++++++++
 2 files changed, 200 insertions(+)
 create mode 100644 Doc/ldapurl.rst
 create mode 100644 Lib/ldap/extop/__init__.py

diff --git a/Doc/ldapurl.rst b/Doc/ldapurl.rst
new file mode 100644
index 0000000..b5bea92
--- /dev/null
+++ b/Doc/ldapurl.rst
@@ -0,0 +1,126 @@
+.. % $Id: ldapurl.rst,v 1.9 2011/07/22 13:27:01 stroeder Exp $
+
+###################################
+:py:mod:`ldapurl` LDAP URL handling
+###################################
+
+.. py:module:: ldapurl
+   :synopsis: Parses and generates LDAP URLs
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+This module parses and generates LDAP URLs.    It is implemented in pure Python
+and does not rely on any  non-standard modules. Therefore it can be used stand-
+alone without  the rest of the python-ldap package.    Compability note: This
+module has been solely tested on Python 2.x and above.
+
+.. seealso::
+
+   :rfc:`4516` - The LDAP URL Format
+
+
+Constants
+=========
+
+The :mod:`ldapurl` module exports the following constants:
+
+.. py:data:: SEARCH_SCOPE
+
+   This dictionary maps a search scope string identifier  to the corresponding
+   integer value used with search operations  in :mod:`ldap`.
+
+
+.. py:data:: SEARCH_SCOPE_STR
+
+   This dictionary is the inverse to :const:`SEARCH_SCOPE`. It  maps a search scope
+   integer value to the corresponding string identifier  used in a LDAP URL string
+   representation.
+
+
+.. py:data:: LDAP_SCOPE_BASE
+
+
+.. py:data:: LDAP_SCOPE_ONELEVEL
+
+
+.. py:data:: LDAP_SCOPE_SUBTREE
+
+
+Functions
+=========
+
+.. autofunction:: ldapurl.isLDAPUrl
+
+
+.. autofunction:: ldapurl.ldapUrlEscape
+
+
+Classes
+=======
+
+.. _ldapurl-ldapurl:
+
+LDAP URLs
+^^^^^^^^^
+
+A :py:class:`LDAPUrl` object represents a complete LDAP URL.
+
+.. autoclass:: ldapurl.LDAPUrl 
+
+
+LDAP URL extensions
+^^^^^^^^^^^^^^^^^^^
+
+A :py:class:`LDAPUrlExtension` object represents a single LDAP URL extension
+whereas :py:class:`LDAPUrlExtensions` represents a list of LDAP URL extensions.
+
+
+.. _ldapurl-ldapurlextension:
+
+.. autoclass:: ldapurl.LDAPUrlExtension
+
+.. _ldapurl-ldapurlextensions:
+
+.. autoclass:: ldapurl.LDAPUrlExtensions
+
+
+.. _ldapurl-example:
+
+Example
+^^^^^^^
+
+Important security advice:
+For security reasons you shouldn't specify passwords in LDAP URLs
+unless you really know what you are doing.
+
+The following example demonstrates how to parse a LDAP URL
+with :mod:`ldapurl` module.
+
+
+>>> import ldapurl
+>>> ldap_url = ldapurl.LDAPUrl('ldap://localhost:1389/dc=stroeder,dc=com?cn,mail???bindname=cn=Michael%2cdc=stroeder%2cdc=com,X-BINDPW=secret')
+>>> # Using the parsed LDAP URL by reading the class attributes
+>>> ldap_url.dn
+'dc=stroeder,dc=com'
+>>> ldap_url.hostport
+'localhost:1389'
+>>> ldap_url.attrs
+['cn','mail']
+>>> ldap_url.filterstr
+'(objectclass=*)'
+>>> ldap_url.who
+'cn=Michael,dc=stroeder,dc=com'
+>>> ldap_url.cred
+'secret'
+>>> ldap_url.scope
+0
+
+
+The following example demonstrates how to generate a LDAP URL
+with \module{ldapurl} module.
+
+>>> import ldapurl
+>>> ldap_url = ldapurl.LDAPUrl(hostport='localhost:1389',dn='dc=stroeder,dc=com',attrs=['cn','mail'],who='cn=Michael,dc=stroeder,dc=com',cred='secret')
+>>> ldap_url.unparse()
+'ldap://localhost:1389/dc=stroeder,dc=com?cn,mail?base?(objectclass=*)?bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,X-BINDPW=secret'
+
diff --git a/Lib/ldap/extop/__init__.py b/Lib/ldap/extop/__init__.py
new file mode 100644
index 0000000..2ab61c6
--- /dev/null
+++ b/Lib/ldap/extop/__init__.py
@@ -0,0 +1,74 @@
+"""
+controls.py - support classes for LDAPv3 extended operations
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: __init__.py,v 1.4 2011/07/22 13:27:02 stroeder Exp $
+
+Description:
+The ldap.extop module provides base classes for LDAPv3 extended operations.
+Each class provides support for a certain extended operation request and
+response.
+"""
+
+from ldap import __version__
+
+
+class ExtendedRequest:
+  """
+  Generic base class for a LDAPv3 extended operation request
+
+  requestName
+      OID as string of the LDAPv3 extended operation request
+  requestValue
+      value of the LDAPv3 extended operation request
+      (here it is the BER-encoded ASN.1 request value)
+  """
+
+  def __init__(self,requestName,requestValue):
+    self.requestName = requestName
+    self.requestValue = requestValue
+
+  def __repr__(self):
+    return '%s(%s,%s)' % (self.__class__.__name__,self.requestName,self.requestValue)
+
+  def encodedRequestValue(self):
+    """
+    returns the BER-encoded ASN.1 request value composed by class attributes
+    set before
+    """
+    return self.requestValue
+
+
+class ExtendedResponse:
+  """
+  Generic base class for a LDAPv3 extended operation response
+
+  requestName
+      OID as string of the LDAPv3 extended operation response
+  encodedResponseValue
+      BER-encoded ASN.1 value of the LDAPv3 extended operation response
+  """
+
+  def __init__(self,responseName,encodedResponseValue):
+    self.responseName = responseName
+    self.responseValue = self.decodeResponseValue(encodedResponseValue)
+
+  def __repr__(self):
+    return '%s(%s,%s)' % (self.__class__.__name__,self.responseName,self.responseValue)
+
+  def decodeResponseValue(self,value):
+    """
+    decodes the BER-encoded ASN.1 extended operation response value and
+    sets the appropriate class attributes
+    """
+    return value
+
+
+# Optionally import sub-modules which need pyasn1 et al
+try:
+  import pyasn1,pyasn1_modules.rfc2251
+except ImportError:
+  pass
+else:
+  from ldap.extop.dds import *

From 68efa3feb60e918a75ffe5910c17394fdb9d5495 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 13:47:47 +0000
Subject: [PATCH 062/868] More doc strings in ldap.controls

---
 Lib/ldap/controls/psearch.py | 134 +++++++++++++++++++++++++++++++++++
 1 file changed, 134 insertions(+)
 create mode 100644 Lib/ldap/controls/psearch.py

diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
new file mode 100644
index 0000000..243fb03
--- /dev/null
+++ b/Lib/ldap/controls/psearch.py
@@ -0,0 +1,134 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.psearch - classes for Persistent Search Control
+(see http://tools.ietf.org/html/draft-ietf-ldapext-psearch)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: psearch.py,v 1.4 2011/07/22 13:47:47 stroeder Exp $
+"""
+
+__all__ = [
+  'PersistentSearchControl',
+  'EntryChangeNotificationControl',
+  'CHANGE_TYPES_INT',
+  'CHANGE_TYPES_STR',
+]
+
+# Imports from python-ldap 2.4+
+import ldap.controls
+from ldap.controls import RequestControl,ResponseControl,KNOWN_RESPONSE_CONTROLS
+
+# Imports from pyasn1
+from pyasn1.type import namedtype,namedval,univ,constraint
+from pyasn1.codec.ber import encoder,decoder
+from pyasn1_modules.rfc2251 import LDAPDN
+
+#---------------------------------------------------------------------------
+# Constants and classes for Persistent Search Control
+#---------------------------------------------------------------------------
+
+CHANGE_TYPES_INT = {
+  'add':1,
+  'delete':2,
+  'modify':4,
+  'modDN':8,
+}
+CHANGE_TYPES_STR = dict([(v,k) for k,v in CHANGE_TYPES_INT.items()])
+
+
+class PersistentSearchControl(RequestControl):
+  """
+  Implements the request control for persistent search.
+
+  changeTypes
+    List of strings specifiying the types of changes returned by the server.
+    Setting to None requests all changes.
+  changesOnly
+    Boolean which indicates whether only changes are returned by the server.
+  returnECs
+    Boolean which indicates whether the server should return an
+    Entry Change Notication response control
+  """
+
+  class PersistentSearchControlValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+      namedtype.NamedType('changeTypes',univ.Integer()),
+      namedtype.NamedType('changesOnly',univ.Boolean()),
+      namedtype.NamedType('returnECs',univ.Boolean()),
+    )
+
+  controlType = "2.16.840.1.113730.3.4.3"
+
+  def __init__(self,criticality=True,changeTypes=None,changesOnly=False,returnECs=True):
+    self.criticality,self.changesOnly,self.returnECs = \
+      criticality,changesOnly,returnECs
+    self.changeTypes = changeTypes or CHANGE_TYPES_INT.values()
+
+  def encodeControlValue(self):
+    if not type(self.changeTypes)==type(0):
+      # Assume a sequence type of integers to be OR-ed
+      changeTypes_int = 0
+      for ct in self.changeTypes:
+        changeTypes_int = changeTypes_int|CHANGE_TYPES_INT.get(ct,ct)
+      self.changeTypes = changeTypes_int
+    p = self.PersistentSearchControlValue()
+    p.setComponentByName('changeTypes',univ.Integer(self.changeTypes))
+    p.setComponentByName('changesOnly',univ.Boolean(self.changesOnly))
+    p.setComponentByName('returnECs',univ.Boolean(self.returnECs))
+    return encoder.encode(p)
+
+
+class ChangeType(univ.Enumerated):
+  namedValues = namedval.NamedValues(
+    ('add',1),
+    ('delete',2),
+    ('modify',4),
+    ('modDN',8),
+  )
+  subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(1,2,4,8)
+
+
+class EntryChangeNotificationValue(univ.Sequence):
+  componentType = namedtype.NamedTypes(
+    namedtype.NamedType('changeType',ChangeType()),
+    namedtype.OptionalNamedType('previousDN', LDAPDN()),
+    namedtype.OptionalNamedType('changeNumber',univ.Integer()),
+  )
+
+
+class EntryChangeNotificationControl(ResponseControl):
+  """
+  Implements the response control for persistent search.
+
+  Class attributes with values extracted from the response control:
+
+  changeType
+    String indicating the type of change causing this result to be
+    returned by the server
+  previousDN
+    Old DN of the entry in case of a modrdn change
+  changeNumber
+    A change serial number returned by the server (optional).
+  """
+
+  controlType = "2.16.840.1.113730.3.4.7"
+
+  def decodeControlValue(self,encodedControlValue):
+    ecncValue,_ = decoder.decode(encodedControlValue,asn1Spec=EntryChangeNotificationValue())
+    self.changeType = int(ecncValue.getComponentByName('changeType'))
+    if len(ecncValue)==3:
+      self.previousDN = str(ecncValue.getComponentByName('previousDN'))
+      self.changeNumber = int(ecncValue.getComponentByName('changeNumber'))
+    elif len(ecncValue)==2:
+      if self.changeType==8:
+        self.previousDN = str(ecncValue.getComponentByName('previousDN'))
+        self.changeNumber = None
+      else:
+        self.previousDN = None
+        self.changeNumber = int(ecncValue.getComponentByName('changeNumber'))
+    else:
+      self.previousDN,self.changeNumber = None,None
+    return (self.changeType,self.previousDN,self.changeNumber)
+
+KNOWN_RESPONSE_CONTROLS[EntryChangeNotificationControl.controlType] = EntryChangeNotificationControl

From 493644c980c0921de513caacbe787e17ab64f23d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 17:28:46 +0000
Subject: [PATCH 063/868] Modified references to pyasn1

---
 Doc/ldap-extop.rst | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 Doc/ldap-extop.rst

diff --git a/Doc/ldap-extop.rst b/Doc/ldap-extop.rst
new file mode 100644
index 0000000..10a9c12
--- /dev/null
+++ b/Doc/ldap-extop.rst
@@ -0,0 +1,43 @@
+.. % $Id: ldap-extop.rst,v 1.4 2011/07/22 17:28:46 stroeder Exp $
+
+********************************************************************
+:py:mod:`ldap.extop` High-level access to LDAPv3 extended operations
+********************************************************************
+
+.. py:module:: ldap.extop
+   :synopsis: High-level access to LDAPv3 extended operations.
+
+
+Classes
+=======
+
+This module defines the following classes:
+
+.. autoclass:: ldap.extop.ExtendedRequest
+   :members:
+
+
+.. autoclass:: ldap.extop.ExtendedResponse
+   :members:
+
+
+:py:mod:`ldap.extop.dds` Classes for Dynamic Entries extended operations
+========================================================================
+
+.. py:module:: ldap.extop.dds
+   :synopsis: Classes for Dynamic Entries extended operations
+
+This requires :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed.
+
+.. seealso::
+
+   :rfc:`2589` - Lightweight Directory Access Protocol (v3): Extensions for Dynamic Directory Services
+
+
+.. autoclass:: ldap.extop.dds.RefreshRequest
+   :members:
+
+
+.. autoclass:: ldap.extop.dds.RefreshResponse
+   :members:
+

From 8805dc84e09902d9f4ed3ad1275792b705b1cae0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 17:39:44 +0000
Subject: [PATCH 064/868] Some clarifications and added case_ignore_attr_types
 for modifyModlist()

---
 Doc/ldap-modlist.rst | 53 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 Doc/ldap-modlist.rst

diff --git a/Doc/ldap-modlist.rst b/Doc/ldap-modlist.rst
new file mode 100644
index 0000000..5fd6351
--- /dev/null
+++ b/Doc/ldap-modlist.rst
@@ -0,0 +1,53 @@
+.. % $Id: ldap-modlist.rst,v 1.4 2011/07/22 17:39:44 stroeder Exp $
+
+
+:py:mod:`ldap.modlist` Generate modify lists
+==============================================
+
+.. py:module:: ldap.modlist
+
+
+The :mod:`ldap.modlist` module defines the following functions:
+
+
+.. function:: addModlist(entry [, ignore_attr_types=[]]) -> list
+
+   This function builds a list suitable for passing it directly as argument
+   *modlist* to method :py:meth:`ldap.ldapobject.LDAPObject.add` or
+   its synchronous counterpart :py:meth:`ldap.ldapobject.LDAPObject.add_s`.
+
+   *entry* is a dictionary like returned when receiving search results.
+
+   *ignore_attr_types* is a list of attribute type
+   names which shall be ignored completely. Attributes of these types will not appear
+   in the result at all.
+
+
+.. function:: modifyModlist( old_entry, new_entry [, ignore_attr_types=[] [, ignore_oldexistent=0 [, case_ignore_attr_types=None]]]) -> list
+
+   This function builds a list suitable for passing it directly as argument
+   *modlist* to method :py:meth:`ldap.ldapobject.LDAPObject.modify` or
+   its synchronous counterpart :py:meth:`ldap.ldapobject.LDAPObject.modify_s`. 
+   
+   Roughly when applying the resulting modify list to an entry
+   holding  the data *old_entry* it will be modified in such a way that the entry
+   holds *new_entry* after the modify operation. It is handy in situations when it
+   is impossible to track user changes to an entry's data or for synchronizing
+   operations.
+   
+   *old_entry* and *new_entry* are dictionaries like returned when
+   receiving search results.
+   
+   *ignore_attr_types* is a list of attribute type
+   names which shall be ignored completely. These attribute types will not appear
+   in the result at all.
+
+   If *ignore_oldexistent* is non-zero attribute type names which
+   are in *old_entry* but are not found in *new_entry* at all are not deleted.
+   This is handy for situations where your application sets attribute value to
+   an empty string for deleting an attribute. In most cases leave zero.
+
+   If *case_ignore_attr_types* is a list of attribute type names for which
+   the comparison will be conducted case-insensitive. It is useful in
+   situations where a LDAP server normalizes values and one wants to avoid
+   unnecessary changes (e.g. case of attribute type names in DNs).

From 591daea36524d1215f6423d3ee085cc1419bf4cd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 22 Jul 2011 17:46:07 +0000
Subject: [PATCH 065/868] Most stuff done by auto-creation of Sphinx relying on
 doc strings

---
 Doc/ldap-schema.rst | 87 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 Doc/ldap-schema.rst

diff --git a/Doc/ldap-schema.rst b/Doc/ldap-schema.rst
new file mode 100644
index 0000000..81c4236
--- /dev/null
+++ b/Doc/ldap-schema.rst
@@ -0,0 +1,87 @@
+.. % $Id: ldap-schema.rst,v 1.4 2011/07/22 17:46:07 stroeder Exp $
+
+
+********************************************
+:py:mod:`ldap.schema` Handling LDAPv3 schema
+********************************************
+
+.. py:module:: ldap.schema
+
+This module deals with schema information usually retrieved from
+a special subschema subentry provided by the server.
+It is closely modeled along the directory information model described
+in the following RFC with which you should make yourself familiar
+when trying to use this module:
+
+.. seealso::
+
+   :rfc:`4512` - Lightweight Directory Access Protocol (LDAP): Directory Information Models
+
+
+:py:mod:`ldap.schema.subentry` Processing LDAPv3 subschema subentry
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.schema.subentry
+
+
+.. py:data:: NOT_HUMAN_READABLE_LDAP_SYNTAXES
+
+   Dictionary where the keys are the OIDs of LDAP syntaxes known to be
+   not human-readable when displayed to a console without conversion
+   and which cannot be decoded to a :py:data:`types.UnicodeType`.
+
+
+Functions
+=========
+
+.. autofunction:: ldap.schema.subentry.urlfetch
+
+Classes
+=======
+
+.. autoclass:: ldap.schema.subentry.SubSchema
+   :members:
+
+
+:py:mod:`ldap.schema.models` Schema elements
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.schema.models
+
+
+.. autoclass:: ldap.schema.models.Entry
+   :members:
+
+.. autoclass:: ldap.schema.models.SchemaElement
+   :members:
+
+.. autoclass:: ldap.schema.models.AttributeType
+   :members:
+
+.. autoclass:: ldap.schema.models.ObjectClass
+   :members:
+
+.. autoclass:: ldap.schema.models.MatchingRule
+   :members:
+
+.. autoclass:: ldap.schema.models.MatchingRuleUse
+   :members:
+
+.. autoclass:: ldap.schema.models.DITContentRule
+   :members:
+
+.. autoclass:: ldap.schema.models.NameForm
+   :members:
+
+.. autoclass:: ldap.schema.models.DITStructureRule
+   :members:
+
+
+.. _ldap.schema-example:
+
+Examples for ldap.schema
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+::
+
+   import ldap.schema

From 899a353b26e59f876d4e0304b3ca1732c1b3fbf2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 23 Jul 2011 07:42:04 +0000
Subject: [PATCH 066/868] Added doc strings to classes

---
 Lib/ldap/controls/libldap.py | 77 ++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 Lib/ldap/controls/libldap.py

diff --git a/Lib/ldap/controls/libldap.py b/Lib/ldap/controls/libldap.py
new file mode 100644
index 0000000..0615d52
--- /dev/null
+++ b/Lib/ldap/controls/libldap.py
@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*-
+"""
+controls.libldap - LDAP controls wrapper classes with en-/decoding done
+by OpenLDAP functions
+
+See http://www.python-ldap.org/ for details.
+
+$Id: libldap.py,v 1.2 2011/07/23 07:42:04 stroeder Exp $
+"""
+
+import _ldap,ldap
+from ldap.controls import RequestControl,LDAPControl,KNOWN_RESPONSE_CONTROLS
+
+
+class AssertionControl(RequestControl):
+  """
+  LDAP Assertion control, as defined in RFC 4528
+
+  filterstr
+    LDAP filter string specifying which assertions have to match
+    so that the server processes the operation
+  """
+  
+  controlType = ldap.CONTROL_ASSERT    
+  def __init__(self,criticality=True,filterstr='(objectClass=*)'):
+    self.criticality = criticality
+    self.filterstr = filterstr
+
+  def encodeControlValue(self):
+    return _ldap.encode_assertion_control(self.filterstr)
+
+KNOWN_RESPONSE_CONTROLS[ldap.CONTROL_ASSERT] = AssertionControl
+
+
+class MatchedValuesControl(RequestControl):
+  """
+  LDAP Matched Values control, as defined in RFC 3876
+
+  filterstr
+    LDAP filter string specifying which attribute values
+    should be returned
+  """
+  
+  controlType = ldap.CONTROL_VALUESRETURNFILTER
+  
+  def __init__(self,criticality=False,filterstr='(objectClass=*)'):
+    self.criticality = criticality
+    self.filterstr = filterstr
+
+  def encodeControlValue(self):
+    return _ldap.encode_valuesreturnfilter_control(self.filterstr)
+
+KNOWN_RESPONSE_CONTROLS[ldap.CONTROL_VALUESRETURNFILTER] = MatchedValuesControl
+
+
+class SimplePagedResultsControl(LDAPControl):
+  """
+  LDAP Control Extension for Simple Paged Results Manipulation
+
+  size
+    Page size requested (number of entries to be returned)
+  cookie
+    Cookie string received with last page
+  """
+  controlType = ldap.CONTROL_PAGEDRESULTS
+
+  def __init__(self,criticality=False,size=None,cookie=None):
+    self.criticality = criticality
+    self.size,self.cookie = size,cookie
+
+  def encodeControlValue(self):
+    return _ldap.encode_page_control(self.size,self.cookie)
+
+  def decodeControlValue(self,encodedControlValue):
+    self.size,self.cookie = _ldap.decode_page_control(encodedControlValue)
+
+KNOWN_RESPONSE_CONTROLS[ldap.CONTROL_PAGEDRESULTS] = SimplePagedResultsControl

From 4cd4d70db41c0024fd6696308f3a78e94f3eb1cb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2011 19:00:53 +0000
Subject: [PATCH 067/868] Fixed CVS Id

---
 Doc/installing.rst | 111 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)
 create mode 100644 Doc/installing.rst

diff --git a/Doc/installing.rst b/Doc/installing.rst
new file mode 100644
index 0000000..475adcf
--- /dev/null
+++ b/Doc/installing.rst
@@ -0,0 +1,111 @@
+.. % $Id: installing.rst,v 1.15 2011/07/24 19:00:53 stroeder Exp $
+
+***********************
+Building and installing
+***********************
+
+python-ldap is built and installed using the Python DistUtils installed
+along with your Python installation:
+
+::
+
+  python setup.py build
+  python setup.py install
+
+If you have more than one Python interpreter installed locally you should
+use the same one you plan to use python-ldap with.
+
+See further instructions for using DistUtils here: http://docs.python.org/install/index.html
+
+Prerequisites
+=============
+
+The following software packages are required to be installed
+on the local system when building python-ldap:
+
+- Python version 2.3 or later including its development files: http://www.python.org/
+- OpenLDAP client libs version 2.4.11 or later: http://www.openldap.org/
+  It is not possible and not supported to build with prior versions.
+- OpenSSL (optional): http://www.openssl.org/
+- cyrus-sasl (optional): http://www.cyrussasl.org
+- Kerberos libs, MIT or heimdal (optional)
+
+Furthermore some sub-modules of :py:mod:`ldap.controls` and :py:mod:`ldap.extop`
+require :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed.
+
+  http://pyasn1.sf.net
+
+
+setup.cfg
+=========
+
+The file setup.cfg allows to set some build and installation
+parameters for reflecting the local installation of required
+software packages. Only section [_ldap] is described here.
+More information about other sections can be found in the
+documentation of Python's DistUtils.
+
+.. data:: library_dirs
+
+   Specifies in which directories to search for required libraries.
+
+.. data:: include_dirs
+
+   Specifies in which directories to search for include files of required libraries.
+
+.. data:: libs
+
+   A space-separated list of library names to link to (see :ref:`libs-used-label`).
+
+.. data:: extra_compile_args
+
+   Compiler options.
+
+.. data:: extra_objects
+
+.. _libs-used-label:
+
+Libs used
+---------
+
+.. data:: ldap
+.. data:: ldap_r
+
+   The LDAP protocol library of OpenLDAP. ldap_r is the reentrant version
+   and should be preferred.
+
+.. data:: lber
+
+   The BER encoder/decoder library of OpenLDAP.
+
+.. data:: sasl2
+
+   The Cyrus-SASL library if needed and present during build
+
+.. data:: ssl
+
+   The SSL/TLS library of OpenSSL if needed and present during build
+
+.. data:: crypto
+
+   The basic cryptographic library of OpenSSL if needed and present during build
+
+Example
+=============
+
+The following example is for a full-featured build (including SSL and SASL support)
+of python-ldap with OpenLDAP installed in a different prefix directory
+(here /opt/openldap-2.3) and SASL header files found in /usr/include/sasl.
+Debugging symbols are preserved with compile option -g.
+
+::
+
+  [_ldap]
+  library_dirs = /opt/openldap-2.3/lib
+  include_dirs = /opt/openldap-2.3/include /usr/include/sasl
+
+  extra_compile_args = -g
+  extra_objects =
+
+  libs = ldap_r lber sasl2 ssl crypto
+

From ca8051b319c2177b9544a2f14431f4b426e3834b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 28 Jul 2011 08:23:32 +0000
Subject: [PATCH 068/868] Removed unneeded import statements

---
 Lib/ldap/resiter.py | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 Lib/ldap/resiter.py

diff --git a/Lib/ldap/resiter.py b/Lib/ldap/resiter.py
new file mode 100644
index 0000000..e34fad6
--- /dev/null
+++ b/Lib/ldap/resiter.py
@@ -0,0 +1,29 @@
+"""
+ldap.resiter - processing LDAP results with iterators
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: resiter.py,v 1.6 2011/07/28 08:23:32 stroeder Exp $
+
+Python compability note:
+Requires Python 2.3+
+"""
+
+
+class ResultProcessor:
+  """
+  Mix-in class used with ldap.ldapopbject.LDAPObject or derived classes.
+  """
+
+  def allresults(self,msgid,timeout=-1):
+    """
+    Generator function which returns an iterator for processing all LDAP operation
+    results of the given msgid retrieved with LDAPObject.result3() -> 4-tuple
+    """
+    result_type,result_list,result_msgid,result_serverctrls = self.result3(msgid,0,timeout)
+    while result_type and result_list:
+      # Loop over list of search results
+      for result_item in result_list:
+        yield (result_type,result_list,result_msgid,result_serverctrls)
+      result_type,result_list,result_msgid,result_serverctrls = self.result3(msgid,0,timeout)
+    return # allresults()

From 40c88eb9f23d09e75e1278c778a4e968d2c9e2a8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 28 Jul 2011 08:52:01 +0000
Subject: [PATCH 069/868] Added classes with .. autoclass::

---
 Doc/ldap-async.rst | 110 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100644 Doc/ldap-async.rst

diff --git a/Doc/ldap-async.rst b/Doc/ldap-async.rst
new file mode 100644
index 0000000..7652ebb
--- /dev/null
+++ b/Doc/ldap-async.rst
@@ -0,0 +1,110 @@
+.. % $Id: ldap-async.rst,v 1.4 2011/07/28 08:52:01 stroeder Exp $
+
+
+**************************************************************
+:py:mod:`ldap.async` Stream-processing of large search results
+**************************************************************
+
+.. py:module:: ldap.async
+   :synopsis: Framework for stream-processing of large search results.
+
+With newer Python versions one might want to consider using
+:py:mod:`ldap.resiter` instead.
+
+
+Classes
+=======
+
+.. autoclass:: ldap.async.AsyncSearchHandler
+   :members:
+
+.. autoclass:: ldap.async.List
+   :members:
+
+.. autoclass:: ldap.async.Dict
+   :members:
+
+.. autoclass:: ldap.async.IndexedDict
+   :members:
+
+.. autoclass:: ldap.async.LDIFWriter
+   :members:
+
+.. autoclass:: ldap.async.DSMLWriter
+   :members:
+
+.. _ldap.async-example:
+
+Examples
+========
+
+.. _ldap.async-example.List:
+
+Using ldap.async.List
+^^^^^^^^^^^^^^^^^^^^^
+
+This example demonstrates how to use class ldap.async.List for
+retrieving partial search results even though the exception
+:exc:`ldap.SIZELIMIT_EXCEEDED` was raised because a server side limit was hit. ::
+
+   import sys,ldap,ldap.async
+
+   s = ldap.async.List(
+     ldap.initialize('ldap://localhost'),
+   )
+
+   s.startSearch(
+     'dc=stroeder,dc=com',
+     ldap.SCOPE_SUBTREE,
+     '(objectClass=*)',
+   )
+
+   try:
+     partial = s.processResults()
+   except ldap.SIZELIMIT_EXCEEDED:
+     sys.stderr.write('Warning: Server-side size limit exceeded.\n')
+   else:
+     if partial:
+       sys.stderr.write('Warning: Only partial results received.\n')
+
+   sys.stdout.write(
+     '%d results received.\n' % (
+       len(s.allResults)
+     )
+   )
+
+.. _ldap.async-example.LDIFWriter:
+
+Using ldap.async.LDIFWriter
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+This example demonstrates how to use class ldap.async.LDIFWriter
+for writing search results as LDIF to stdout. ::
+
+   import sys,ldap,ldap.async
+
+   s = ldap.async.LDIFWriter(
+     ldap.initialize('ldap://localhost:1390'),
+     sys.stdout
+   )
+
+   s.startSearch(
+     'dc=stroeder,dc=com',
+     ldap.SCOPE_SUBTREE,
+     '(objectClass=*)',
+   )
+
+   try:
+     partial = s.processResults()
+   except ldap.SIZELIMIT_EXCEEDED:
+     sys.stderr.write('Warning: Server-side size limit exceeded.\n')
+   else:
+     if partial:
+       sys.stderr.write('Warning: Only partial results received.\n')
+
+   sys.stderr.write(
+     '%d results received.\n' % (
+       s.endResultBreak-s.beginResultsDropped
+     )
+   )
+

From 5fcccd5c52415dc4a72a65890b6463dbc436b210 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 28 Jul 2011 08:57:12 +0000
Subject: [PATCH 070/868] Class attributes in doc strings

---
 Lib/ldap/controls/readentry.py | 90 ++++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 Lib/ldap/controls/readentry.py

diff --git a/Lib/ldap/controls/readentry.py b/Lib/ldap/controls/readentry.py
new file mode 100644
index 0000000..19ba9d5
--- /dev/null
+++ b/Lib/ldap/controls/readentry.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python
+"""
+ldap.controls.readentry - classes for the Read Entry controls
+(see RFC 4527)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: readentry.py,v 1.4 2011/07/28 08:57:12 stroeder Exp $
+"""
+
+import ldap
+
+from pyasn1.codec.ber import encoder,decoder
+from ldap.controls import LDAPControl,KNOWN_RESPONSE_CONTROLS
+
+from pyasn1_modules.rfc2251 import AttributeDescriptionList,SearchResultEntry
+
+
+class ReadEntryControl(LDAPControl):
+  """
+  Base class for read entry control described in RFC 4527
+
+  attrList
+      list of attribute type names requested
+
+  Class attributes with values extracted from the response control:
+
+  dn
+      string holding the distinguished name of the LDAP entry
+  entry
+      dictionary holding the LDAP entry
+  """
+
+  def __init__(self,criticality=False,attrList=None):
+    self.criticality,self.attrList,self.entry = criticality,attrList or [],None
+
+  def encodeControlValue(self):
+    attributeSelection = AttributeDescriptionList()
+    for i in range(len(self.attrList)):
+      attributeSelection.setComponentByPosition(i,self.attrList[i])
+    return encoder.encode(attributeSelection)
+
+  def decodeControlValue(self,encodedControlValue):
+    decodedEntry,_ = decoder.decode(encodedControlValue,asn1Spec=SearchResultEntry())
+    self.dn = str(decodedEntry[0])
+    self.entry = {}
+    for attr in decodedEntry[1]:
+      self.entry[str(attr[0])] = [ str(attr_value) for attr_value in attr[1] ]
+
+
+class PreReadControl(ReadEntryControl):
+  """
+  Class for pre-read control described in RFC 4527
+
+  attrList
+      list of attribute type names requested
+
+  Class attributes with values extracted from the response control:
+
+  dn
+      string holding the distinguished name of the LDAP entry
+      before the operation was done by the server
+  entry
+      dictionary holding the LDAP entry
+      before the operation was done by the server
+  """
+  controlType = ldap.CONTROL_PRE_READ
+
+KNOWN_RESPONSE_CONTROLS[PreReadControl.controlType] = PreReadControl
+
+
+class PostReadControl(ReadEntryControl):
+  """
+  Class for post-read control described in RFC 4527
+
+  attrList
+      list of attribute type names requested
+
+  Class attributes with values extracted from the response control:
+
+  dn
+      string holding the distinguished name of the LDAP entry
+      after the operation was done by the server
+  entry
+      dictionary holding the LDAP entry
+      after the operation was done by the server
+  """
+  controlType = ldap.CONTROL_POST_READ
+
+KNOWN_RESPONSE_CONTROLS[PostReadControl.controlType] = PostReadControl

From fd86465dba2769bc1483b063b2f729c10d0a3a48 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 28 Jul 2011 09:05:10 +0000
Subject: [PATCH 071/868] Let autoclass also include members

---
 Doc/dsml.rst | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 Doc/dsml.rst

diff --git a/Doc/dsml.rst b/Doc/dsml.rst
new file mode 100644
index 0000000..3e9bcbf
--- /dev/null
+++ b/Doc/dsml.rst
@@ -0,0 +1,28 @@
+.. % $Id: dsml.rst,v 1.5 2011/07/28 09:05:10 stroeder Exp $
+
+***************************************
+:mod:`dsml` DSMLv1 parser and generator
+***************************************
+
+.. :py:module:: dsml
+   :synopsis: Parses and generates DSMLv1 files
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+This module parses and generates LDAP data in the format DSMLv1. It is
+implemented in pure Python and does not rely on any non-standard modules.
+Therefore it can be used stand-alone without the rest of the python-ldap
+package.
+
+
+.. autoclass:: dsml.DSMLWriter
+   :members:
+
+.. autoclass:: dsml.DSMLParser
+   :members:
+
+
+.. _dsml-example:
+
+Example
+=======

From 97d259e302a307446f00a26dd081314c30293e15 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 27 Aug 2011 15:43:06 +0000
Subject: [PATCH 072/868] Fixed cut&paste typo

---
 Doc/ldap-resiter.rst | 52 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 Doc/ldap-resiter.rst

diff --git a/Doc/ldap-resiter.rst b/Doc/ldap-resiter.rst
new file mode 100644
index 0000000..443ded5
--- /dev/null
+++ b/Doc/ldap-resiter.rst
@@ -0,0 +1,52 @@
+.. % $Id: ldap-resiter.rst,v 1.5 2011/08/27 15:43:06 stroeder Exp $
+
+
+:py:mod:`ldap.resiter` Generator for stream-processing of large search results
+==============================================================================
+
+.. py:module:: ldap.resiter
+   :synopsis: Generator for stream-processing of large search results.
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+.. _ldap.resiter-classes:
+
+.. py:class:: ResultProcessor
+
+This is a mix-in class to be used with class :py:class:`ldap.LDAPObject` or
+derived classes which has these methods:
+
+  .. automethod:: ldap.resiter.ResultProcessor.allresults
+
+
+.. _ldap.resiter-example:
+
+
+Examples
+========
+
+.. _ldap.resiter.ResultProcessor-example:
+
+Using ldap.resiter.ResultProcessor
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+This example demonstrates how to use mix-in class ldap.resiter.ResultProcessor for
+retrieving results formerly requested with :py:meth:`ldap.LDAPObject.search()` and
+processing them in a for-loop.
+
+::
+
+  import sys,ldap,ldap.resiter
+
+  class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
+    pass
+
+  l = MyLDAPObject('ldap://localhost')
+
+  # Asynchronous search method
+  msg_id = l.search('dc=stroeder,dc=com',ldap.SCOPE_SUBTREE,'(objectClass=*)')
+
+  for res_type,res_data,res_msgid,res_controls in l.allresults(msg_id):
+    for dn,entry in res_data:
+      # process dn and entry
+      print dn,entry['objectClass']

From 06f4b34dc411abc91ef4c2a6d2f60cebfd17f21e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 14 Sep 2011 18:29:18 +0000
Subject: [PATCH 073/868] Added auto-generated functions/classes

---
 Doc/ldif.rst | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)
 create mode 100644 Doc/ldif.rst

diff --git a/Doc/ldif.rst b/Doc/ldif.rst
new file mode 100644
index 0000000..19edf58
--- /dev/null
+++ b/Doc/ldif.rst
@@ -0,0 +1,83 @@
+.. % $Id: ldif.rst,v 1.8 2011/09/14 18:29:18 stroeder Exp $
+
+#####################################
+:mod:`ldif` LDIF parser and generator
+#####################################
+
+.. py:module:: ldif
+   :synopsis: Parses and generates LDIF files
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+This module parses and generates LDAP data in the format LDIF.    It is
+implemented in pure Python and does not rely on any non-standard modules.
+Therefore it can be used stand-alone without the rest of the python-ldap
+package.
+
+.. seealso::
+
+   :rfc:`2849` - The LDAP Data Interchange Format (LDIF) - Technical Specification
+
+
+Functions
+^^^^^^^^^
+
+.. autofunction:: ldif.CreateLDIF
+
+.. autofunction:: ldif.ParseLDIF
+
+
+Classes
+^^^^^^^
+
+.. autoclass:: ldif.LDIFWriter
+
+.. autoclass:: ldif.LDIFParser
+
+.. autoclass:: LDIFRecordList
+
+.. autoclass:: LDIFCopy
+
+
+.. _ldif-example:
+
+Example
+^^^^^^^
+
+The following example demonstrates how to write LDIF output
+of an LDAP entry with :mod:`ldif` module.
+
+>>> import sys,ldif
+>>> entry={'objectClass':['top','person'],'cn':['Michael Stroeder'],'sn':['Stroeder']}
+>>> dn='cn=Michael Stroeder,ou=Test'
+>>> ldif_writer=ldif.LDIFWriter(sys.stdout)
+>>> ldif_writer.unparse(dn,entry)
+dn: cn=Michael Stroeder,ou=Test
+cn: Michael Stroeder
+objectClass: top
+objectClass: person
+sn: Stroeder
+
+
+The following example demonstrates how to parse an LDIF file
+with :mod:`ldif` module, skip some entries and write the result to stdout. ::
+
+   import sys
+   from ldif import LDIFParser,LDIFWriter
+
+   SKIP_DN = ["uid=foo,ou=People,dc=example,dc=com", 
+      "uid=bar,ou=People,dc=example,dc=com"]
+
+   class MyLDIF(LDIFParser):
+      def __init__(self,input,output):
+         LDIFParser.__init__(self,input)
+         self.writer = LDIFWriter(output)
+
+      def handle(self,dn,entry):
+         if dn in SKIP_DN:
+           return
+         self.writer.unparse(dn,entry)
+
+   parser = MyLDIF(open("input.ldif", 'rb'), sys.stdout)
+   parser.parse()
+

From ca45ede28e3dcfddfdd5b13133eb98dc64fc247b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Oct 2011 18:38:06 +0000
Subject: [PATCH 074/868] Fixes for memory leaks by Chris Mikkelson

---
 Modules/ldapcontrol.c | 377 ++++++++++++++++++++++++++++++++++++++++++
 Modules/message.c     | 257 ++++++++++++++++++++++++++++
 2 files changed, 634 insertions(+)
 create mode 100644 Modules/ldapcontrol.c
 create mode 100644 Modules/message.c

diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
new file mode 100644
index 0000000..14a8625
--- /dev/null
+++ b/Modules/ldapcontrol.c
@@ -0,0 +1,377 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: ldapcontrol.c,v 1.20 2011/10/26 18:38:06 stroeder Exp $ */
+
+#include "common.h"
+#include "LDAPObject.h"
+#include "ldapcontrol.h"
+#include "berval.h"
+#include "errors.h"
+
+#include "lber.h"
+
+/* Prints to stdout the contents of an array of LDAPControl objects */
+
+/* XXX: This is a debugging tool, and the printf generates some warnings
+ * about pointer types. I left it here in case something breaks and we
+ * need to inspect an LDAPControl structure.
+
+static void
+LDAPControl_DumpList( LDAPControl** lcs ) {
+    LDAPControl** lcp;
+    LDAPControl* lc;
+        for ( lcp = lcs; *lcp; lcp++ ) {
+        lc = *lcp;
+        printf("OID: %s\nCriticality: %d\nBER length: %d\nBER value: %x\n",
+            lc->ldctl_oid, lc->ldctl_iscritical, lc->ldctl_value.bv_len,
+            lc->ldctl_value.bv_val);
+    }
+} */
+
+/* Free a single LDAPControl object created by Tuple_to_LDAPControl */
+  
+static void
+LDAPControl_DEL( LDAPControl* lc )
+{
+    if (lc == NULL)
+        return;
+  
+    if (lc->ldctl_oid)
+        PyMem_DEL(lc->ldctl_oid);
+    PyMem_DEL(lc);
+}
+
+/* Free an array of LDAPControl objects created by LDAPControls_from_object */
+
+void
+LDAPControl_List_DEL( LDAPControl** lcs )
+{
+    LDAPControl** lcp;
+    if (lcs == NULL)
+        return;
+
+    for ( lcp = lcs; *lcp; lcp++ )
+        LDAPControl_DEL( *lcp );
+
+    PyMem_DEL( lcs );
+}
+
+/* Takes a tuple of the form:
+ * (OID: string, Criticality: int/boolean, Value: string/None)
+ * and converts it into an LDAPControl structure.
+ *
+ * The Value string should represent an ASN.1 encoded structure.
+ */
+
+static LDAPControl*
+Tuple_to_LDAPControl( PyObject* tup )
+{
+    char *oid;
+    char iscritical;
+    struct berval berbytes;
+    PyObject *bytes;
+    LDAPControl *lc = NULL;
+    Py_ssize_t len;
+
+    if (!PyTuple_Check(tup)) {
+	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+	   "expected a tuple", tup));
+	return NULL;
+    }
+
+    if (!PyArg_ParseTuple( tup, "sbO", &oid, &iscritical, &bytes ))
+        return NULL;
+  
+    lc = PyMem_NEW(LDAPControl, 1);
+    if (lc == NULL) {
+        PyErr_NoMemory();
+        return NULL;
+    }
+
+    lc->ldctl_iscritical = iscritical;
+
+    len = strlen(oid);
+    lc->ldctl_oid = PyMem_NEW(char, len + 1);
+    if (lc->ldctl_oid == NULL) {
+        PyErr_NoMemory();
+        LDAPControl_DEL(lc);
+        return NULL;
+    }
+    memcpy(lc->ldctl_oid, oid, len + 1);
+
+    /* The berval can either be None or a String */
+    if (PyNone_Check(bytes)) {
+        berbytes.bv_len = 0;
+        berbytes.bv_val = NULL;
+    }
+    else if (PyString_Check(bytes)) {
+        berbytes.bv_len = PyString_Size(bytes);
+        berbytes.bv_val = PyString_AsString(bytes);
+    }
+    else {
+	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+            "expected a string", bytes));
+        LDAPControl_DEL(lc);
+        return NULL;
+    }
+    
+    lc->ldctl_value = berbytes;
+
+    return lc;
+}
+
+/* Convert a list of tuples (of a format acceptable to the Tuple_to_LDAPControl
+ * function) into an array of LDAPControl objects. */
+
+int
+LDAPControls_from_object(PyObject* list, LDAPControl ***controls_ret)
+{
+    Py_ssize_t len, i;
+    LDAPControl** ldcs;
+    LDAPControl* ldc;
+    PyObject* item;
+  
+    if (!PySequence_Check(list)) {
+	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+	   "expected a list", list));
+	return 0;
+    }
+
+    len = PySequence_Length(list);
+    ldcs = PyMem_NEW(LDAPControl*, len + 1);
+    if (ldcs == NULL) {
+        PyErr_NoMemory();
+        return 0;
+    }
+
+    for (i = 0; i < len; i++) {
+      item = PySequence_GetItem(list, i);
+      if (item == NULL) {
+          PyMem_DEL(ldcs);
+          return 0;
+      }
+
+      ldc = Tuple_to_LDAPControl(item);
+      if (ldc == NULL) {
+          Py_DECREF(item);
+          PyMem_DEL(ldcs);
+          return 0;
+      }
+
+      ldcs[i] = ldc;
+      Py_DECREF(item);
+    }
+
+    ldcs[len] = NULL;
+    *controls_ret = ldcs;
+    return 1;
+}
+
+PyObject*
+LDAPControls_to_List(LDAPControl **ldcs)
+{
+    PyObject *res = 0, *pyctrl;
+    LDAPControl **tmp = ldcs;
+    Py_ssize_t num_ctrls = 0, i;
+
+    if (tmp)
+        while (*tmp++) num_ctrls++;
+
+    if (!(res = PyList_New(num_ctrls)))
+        goto endlbl;
+
+    for (i = 0; i < num_ctrls; i++) {
+        if (!(pyctrl = Py_BuildValue("sbO&", ldcs[i]->ldctl_oid,
+                                     ldcs[i]->ldctl_iscritical,
+                                     LDAPberval_to_object,
+                                     &ldcs[i]->ldctl_value))) {
+            goto endlbl;
+        }
+        PyList_SET_ITEM(res, i, pyctrl);
+    }
+    Py_INCREF(res);
+
+ endlbl:
+    Py_XDECREF(res);
+    return res;
+}
+
+
+
+/* --------------- en-/decoders ------------- */
+
+/* Matched Values, aka, Values Return Filter */
+static PyObject*
+encode_rfc3876(PyObject *self, PyObject *args)
+{
+	PyObject *res = 0;
+	int err;
+	BerElement *vrber = 0;
+	char *vrFilter;
+	struct berval *ctrl_val;
+
+	if (!PyArg_ParseTuple(args, "s:encode_valuesreturnfilter_control", &vrFilter)) {
+		goto endlbl;
+	}
+
+	if (!(vrber = ber_alloc_t(LBER_USE_DER))) {
+		LDAPerr(LDAP_NO_MEMORY);
+		goto endlbl;
+	}
+
+	err = ldap_put_vrFilter(vrber, vrFilter);
+	if (err == -1) {
+		LDAPerr(LDAP_FILTER_ERROR);
+		goto endlbl;
+	}
+
+	err = ber_flatten(vrber, &ctrl_val);
+	if (err == -1) {
+		LDAPerr(LDAP_NO_MEMORY);
+		goto endlbl;
+	}
+
+	res = LDAPberval_to_object(ctrl_val);
+
+endlbl:
+	if (vrber)
+		ber_free(vrber, 1);
+
+	return res;
+}
+
+static PyObject*
+encode_rfc2696(PyObject *self, PyObject *args)
+{
+    PyObject *res = 0;
+    BerElement *ber = 0;
+    struct berval cookie, *ctrl_val;
+    Py_ssize_t cookie_len;
+    unsigned long size;
+    ber_tag_t tag;
+
+    if (!PyArg_ParseTuple(args, "is#:encode_page_control", &size,
+                          &cookie.bv_val, &cookie_len)) {
+        goto endlbl;
+    }
+    cookie.bv_len = (ber_len_t) cookie_len;
+
+    if (!(ber = ber_alloc_t(LBER_USE_DER))) {
+        LDAPerr(LDAP_NO_MEMORY);
+        goto endlbl;
+    }
+
+    tag = ber_printf(ber, "{i", size);
+    if (tag == LBER_ERROR) {
+        LDAPerr(LDAP_ENCODING_ERROR);
+        goto endlbl;
+    }
+
+    if (!cookie.bv_len)
+        tag = ber_printf(ber, "o", "", 0);
+    else
+        tag = ber_printf(ber, "O", &cookie);
+    if (tag == LBER_ERROR) {
+        LDAPerr(LDAP_ENCODING_ERROR);
+        goto endlbl;
+    }
+
+    tag = ber_printf(ber, /*{ */ "N}");
+    if (tag == LBER_ERROR) {
+        LDAPerr(LDAP_ENCODING_ERROR);
+        goto endlbl;
+    }
+
+    if (-1 == ber_flatten(ber, &ctrl_val)) {
+        LDAPerr(LDAP_NO_MEMORY);
+        goto endlbl;
+    }
+
+    res = LDAPberval_to_object(ctrl_val);
+
+ endlbl:
+    if (ber)
+        ber_free(ber, 1);
+    return res;
+}
+
+
+static PyObject*
+decode_rfc2696(PyObject *self, PyObject *args)
+{
+    PyObject *res = 0;
+    BerElement *ber = 0;
+    struct berval ldctl_value;
+    ber_tag_t tag;
+    struct berval *cookiep;
+    unsigned long count;
+    Py_ssize_t ldctl_value_len;
+
+    if (!PyArg_ParseTuple(args, "s#:decode_page_control",
+                          &ldctl_value.bv_val, &ldctl_value_len)) {
+        goto endlbl;
+    }
+    ldctl_value.bv_len = (ber_len_t) ldctl_value_len;
+
+    if (!(ber = ber_init(&ldctl_value))) {
+        LDAPerr(LDAP_NO_MEMORY);
+        goto endlbl;
+    }
+
+    tag = ber_scanf(ber, "{iO", &count, &cookiep);
+    if (tag == LBER_ERROR) {
+        LDAPerr(LDAP_DECODING_ERROR);
+        goto endlbl;
+    }
+
+    res = Py_BuildValue("(lO&)", count, LDAPberval_to_object, cookiep);
+
+ endlbl:
+    if (ber)
+        ber_free(ber, 1);
+    return res;
+}
+
+static PyObject*
+encode_assertion_control(PyObject *self, PyObject *args)
+{
+    int err;
+    PyObject *res = 0;
+    char *assertion_filterstr;
+    struct berval ctrl_val;
+    LDAP *ld = NULL;
+
+    if (!PyArg_ParseTuple(args, "s:encode_assertion_control",
+                          &assertion_filterstr)) {
+        goto endlbl;
+    }
+
+    err = ldap_create(&ld);
+    if (err != LDAP_SUCCESS)
+    	return LDAPerror(ld, "ldap_create");
+
+    err = ldap_create_assertion_control_value(ld,assertion_filterstr,&ctrl_val);
+    if (err != LDAP_SUCCESS)
+    	return LDAPerror(ld, "ldap_create_assertion_control_value");
+
+    res = LDAPberval_to_object(&ctrl_val);
+
+    endlbl:
+
+    return res;
+}
+
+static PyMethodDef methods[] = {
+    {"encode_page_control", encode_rfc2696, METH_VARARGS },
+    {"decode_page_control", decode_rfc2696, METH_VARARGS },
+    {"encode_valuesreturnfilter_control", encode_rfc3876, METH_VARARGS },
+    {"encode_assertion_control", encode_assertion_control, METH_VARARGS },
+    { NULL, NULL }
+};
+
+void
+LDAPinit_control(PyObject *d)
+{
+    LDAPadd_methods(d, methods);
+}
+
+
diff --git a/Modules/message.c b/Modules/message.c
new file mode 100644
index 0000000..7cc7072
--- /dev/null
+++ b/Modules/message.c
@@ -0,0 +1,257 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: message.c,v 1.19 2011/10/26 18:38:06 stroeder Exp $ */
+
+#include "common.h"
+#include "message.h"
+#include "berval.h"
+#include "errors.h"
+#include "ldapcontrol.h"
+#include "constants.h"
+
+/*
+ * Converts an LDAP message into a Python structure.
+ *
+ * On success, returns a list of dictionaries.
+ * On failure, returns NULL, and sets an error.
+ *
+ * The message m is always freed, regardless of return value.
+ *
+ * If add_ctrls is non-zero, per-entry/referral/partial/intermediate
+ * controls will be added as a third item to each entry tuple
+ *
+ * If add_intermediates is non-zero, intermediate/partial results will
+ * be returned
+ */
+PyObject *
+LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermediates)
+{
+    /* we convert an LDAP message into a python structure.
+     * It is always a list of dictionaries.
+     * We always free m.
+     */
+
+     PyObject *result, *pyctrls = 0;
+     LDAPMessage* entry;
+     LDAPControl **serverctrls = 0;
+     int rc;
+
+     result = PyList_New(0);
+     if (result == NULL) {
+        ldap_msgfree( m );
+	return NULL;
+     }
+
+     for(entry = ldap_first_entry(ld,m);
+         entry != NULL;
+	 entry = ldap_next_entry(ld,entry))
+     {
+	 char *dn;
+	 char *attr;
+	 BerElement *ber = NULL;
+	 PyObject* entrytuple; 
+	 PyObject* attrdict; 
+
+	 dn = ldap_get_dn( ld, entry );
+	 if (dn == NULL)  {
+	     Py_DECREF(result);
+             ldap_msgfree( m );
+	     return LDAPerror( ld, "ldap_get_dn" );
+	 }
+
+	 attrdict = PyDict_New();
+	 if (attrdict == NULL) {
+		Py_DECREF(result);
+		ldap_msgfree( m );
+		ldap_memfree(dn);
+		return NULL;
+	 }
+
+	 rc = ldap_get_entry_controls( ld, entry, &serverctrls );
+	 if (rc) {
+	    Py_DECREF(result);
+	    ldap_msgfree( m );
+	    ldap_memfree(dn);
+	    return LDAPerror( ld, "ldap_get_entry_controls" );
+	 }
+
+	 /* convert serverctrls to list of tuples */
+	 if ( ! ( pyctrls = LDAPControls_to_List( serverctrls ) ) ) {
+	    int err = LDAP_NO_MEMORY;
+	    ldap_set_option( ld, LDAP_OPT_ERROR_NUMBER, &err );
+	    Py_DECREF(result);
+	    ldap_msgfree( m );
+	    ldap_memfree(dn);
+	    ldap_controls_free(serverctrls);
+	    return LDAPerror( ld, "LDAPControls_to_List" );
+	 }
+	 ldap_controls_free(serverctrls);
+
+  	 /* Fill attrdict with lists */
+	 for( attr = ldap_first_attribute( ld, entry, &ber );
+	      attr != NULL;
+	      attr = ldap_next_attribute( ld, entry, ber )
+	 ) {
+	     PyObject* valuelist;
+	     struct berval ** bvals =
+	     	ldap_get_values_len( ld, entry, attr );
+
+	     /* Find which list to append to */
+	     if ( PyMapping_HasKeyString( attrdict, attr ) ) {
+		 valuelist = PyMapping_GetItemString( attrdict, attr );
+	     } else {
+		 valuelist = PyList_New(0);
+		 if (valuelist != NULL && PyMapping_SetItemString(attrdict, 
+		     attr, valuelist) == -1) {
+			Py_DECREF(valuelist);
+			valuelist = NULL;	/* catch error later */
+		 }
+	     }
+
+	     if (valuelist == NULL) {
+		Py_DECREF(attrdict);
+		Py_DECREF(result);
+		if (ber != NULL)
+		    ber_free(ber, 0);
+		ldap_msgfree( m );
+		ldap_memfree(attr);
+		ldap_memfree(dn);
+		Py_XDECREF(pyctrls);
+		return NULL;
+	     }
+
+	     if (bvals != NULL) {
+	        Py_ssize_t i;
+		for (i=0; bvals[i]; i++) {
+		    PyObject *valuestr;
+
+		    valuestr = LDAPberval_to_object(bvals[i]);
+		    if (PyList_Append( valuelist, valuestr ) == -1) {
+			Py_DECREF(attrdict);
+			Py_DECREF(result);
+			Py_DECREF(valuestr);
+			Py_DECREF(valuelist);
+			if (ber != NULL)
+			    ber_free(ber, 0);
+			ldap_msgfree( m );
+			ldap_memfree(attr);
+			ldap_memfree(dn);
+			Py_XDECREF(pyctrls);
+			return NULL;
+		    }
+		    Py_DECREF(valuestr);
+	    	}
+		ldap_value_free_len(bvals);
+	     }
+	     Py_DECREF( valuelist );
+	     ldap_memfree(attr);
+	 }
+
+	 if (add_ctrls) {
+	    entrytuple = Py_BuildValue("(sOO)", dn, attrdict, pyctrls);
+	 } else {
+	    entrytuple = Py_BuildValue("(sO)", dn, attrdict);
+	 }
+	 ldap_memfree(dn);
+	 Py_DECREF(attrdict);
+	 Py_XDECREF(pyctrls);
+	 PyList_Append(result, entrytuple);
+	 Py_DECREF(entrytuple);
+	 if (ber != NULL)
+		 ber_free(ber, 0);
+     }
+     for(entry = ldap_first_reference(ld,m);
+	 entry != NULL;
+	 entry = ldap_next_reference(ld,entry))
+     {
+	 char **refs = NULL;
+	 PyObject* entrytuple;
+	 PyObject* reflist = PyList_New(0);
+
+	 if (reflist == NULL)  {
+	     Py_DECREF(result);
+	     ldap_msgfree( m );
+	     return NULL;
+	 }
+	 if (ldap_parse_reference(ld, entry, &refs, &serverctrls, 0) != LDAP_SUCCESS) {
+             Py_DECREF(reflist);
+	     Py_DECREF(result);
+	     ldap_msgfree( m );
+	     return LDAPerror( ld, "ldap_parse_reference" );
+	 }
+	 /* convert serverctrls to list of tuples */
+	 if ( ! ( pyctrls = LDAPControls_to_List( serverctrls ) ) ) {
+	     int err = LDAP_NO_MEMORY;
+	     ldap_set_option( ld, LDAP_OPT_ERROR_NUMBER, &err );
+             Py_DECREF(reflist);
+	     Py_DECREF(result);
+	     ldap_msgfree( m );
+	     ldap_controls_free(serverctrls);
+	     return LDAPerror( ld, "LDAPControls_to_List" );
+	 }
+	 ldap_controls_free(serverctrls);
+	 if (refs) {
+	     Py_ssize_t i;
+	     for (i=0; refs[i] != NULL; i++) {
+		 PyObject *refstr = PyString_FromString(refs[i]);
+		 PyList_Append(reflist, refstr);
+		 Py_DECREF(refstr);
+	     }
+	     ber_memvfree( (void **) refs );
+	 }
+	 if (add_ctrls) {
+	    entrytuple = Py_BuildValue("(sOO)", NULL, reflist, pyctrls);
+	 } else {
+	    entrytuple = Py_BuildValue("(sO)", NULL, reflist);
+	 }
+	 Py_DECREF(reflist);
+	 Py_XDECREF(pyctrls);
+	 PyList_Append(result, entrytuple);
+	 Py_DECREF(entrytuple);
+     }
+     if (add_intermediates) {
+	for(entry = ldap_first_message(ld,m);
+	    entry != NULL;
+	    entry = ldap_next_message(ld,entry))
+	   {
+	      /* list of tuples */
+	      /* each tuple is OID, Berval, controllist */
+	      if ( LDAP_RES_INTERMEDIATE == ldap_msgtype( entry ) ) {
+		 PyObject* valtuple;
+		 PyObject *valuestr;
+		 char *retoid = 0;
+		 struct berval *retdata = 0;
+
+		 if (ldap_parse_intermediate( ld, entry, &retoid, &retdata, &serverctrls, 0 ) != LDAP_SUCCESS) {
+		    Py_DECREF(result);
+		    ldap_msgfree( m );
+		    return LDAPerror( ld, "ldap_parse_intermediate" );
+		 }
+		 /* convert serverctrls to list of tuples */
+		 if ( ! ( pyctrls = LDAPControls_to_List( serverctrls ) ) ) {
+		    int err = LDAP_NO_MEMORY;
+		    ldap_set_option( ld, LDAP_OPT_ERROR_NUMBER, &err );
+		    Py_DECREF(result);
+		    ldap_msgfree( m );
+		    ldap_controls_free(serverctrls);
+		    ldap_memfree( retoid );
+		    ber_bvfree( retdata );
+		    return LDAPerror( ld, "LDAPControls_to_List" );
+		 }
+		 ldap_controls_free(serverctrls);
+
+		 valuestr = LDAPberval_to_object(retdata);
+		 ber_bvfree( retdata );
+		 valtuple = Py_BuildValue("(sOO)", retoid,
+					  valuestr ? valuestr : Py_None,
+					  pyctrls);
+		 ldap_memfree( retoid );
+		 Py_DECREF(valuestr);
+		 Py_XDECREF(pyctrls);
+		 PyList_Append(result, valtuple);
+		 Py_DECREF(valtuple);
+	      }
+	   }
+     }
+     ldap_msgfree( m );
+     return result;
+}

From b25942fae3f638bf3a6830cc94383e922e35d28b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Oct 2011 18:43:21 +0000
Subject: [PATCH 075/868] Abandon old mailing list name

---
 README | 102 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 README

diff --git a/README b/README
new file mode 100644
index 0000000..981f264
--- /dev/null
+++ b/README
@@ -0,0 +1,102 @@
+---------------------------------------
+python-ldap: LDAP client API for Python
+---------------------------------------
+
+What is python-ldap?
+
+python-ldap provides an object-oriented API to access LDAP
+directory servers from Python programs. Mainly it wraps the
+OpenLDAP client libs for that purpose.
+
+Additionally the package contains modules for other LDAP-related
+stuff (e.g. processing LDIF, LDAPURLs, LDAPv3 sub-schema, etc.).
+
+Not included: Direct BER support
+
+See INSTALL for version compability
+
+See TODO for planned features. Contributors welcome.
+
+For module documentation, see:
+
+	http://www.python-ldap.org/
+
+Quick usage example:
+    import ldap
+    l = ldap.initialize("ldap://my_ldap_server.my_domain")
+    l.simple_bind_s("","")
+    l.search_s("o=My Organisation, c=AU", ldap.SCOPE_SUBTREE, "objectclass=*")
+
+See directory Demo/ of source distribution package for more
+example code.
+
+Author(s) contact and documentation:
+
+   http://www.python-ldap.org/
+
+   If you are looking for help, please try the mailing list archives
+   first, then send a question to the mailing list.
+   Be warned that questions will be ignored if they can be
+   trivially answered by referring to the documentation.
+
+   If you are interested in helping, please contact the mailing list.
+   If you want new features or upgrades, please check the mailing list
+   archives and then enquire about any progress.
+
+Acknowledgements:
+
+   Thanks to Konstantin Chuguev <Konstantin.Chuguev at dante.org.uk>
+   and Steffen Ries <steffen.ries at sympatico.ca> for working
+   on support for OpenLDAP 2.0.x features.
+
+   Thanks to Michael Stroeder <michael at stroeder.com> for the
+   modules ldif, ldapurl, ldap/schema/*.py, ldap/*.py and ldap/controls/*.py.
+
+   Thanks to Hans Aschauer <Hans.Aschauer at Physik.uni-muenchen.de>
+   for the C wrapper schema and SASL support.
+
+   Thanks to Mauro Cicognini <mcicogni at siosistemi.it> for the
+   WIN32/MSVC6 bits, and the pre-built WIN32 ldap.pyd.
+
+   Thanks to Waldemar Osuch <waldemar.osuch at gmail.com> for contributing
+   the new-style docs based on reStructuredText.
+
+   Thanks to Torsten Kurbad <torsten at tk-webart.de> for the
+   easy_install support.
+
+   Thanks to James Andrewartha <jamesa at daa.com.au> for
+   significant contribution to Doc/*.tex.
+
+   Thanks to Rich Megginson <rmeggins at redhat.com> for extending
+   support for LDAPv3 controls and adding support for LDAPv3 extended
+   operations.
+
+   Thanks to Peter Gietz, DAASI for funding some control modules.
+
+   Thanks to Chris Mikkelson for various fixes and ldap.syncrepl.
+
+   These very kind people have supplied patches or suggested changes:
+
+       Federico Di Gregorio <fog at mixadlive.com>
+       John Benninghoff <johnb at netscape.com>
+       Donn Cave <donn at u.washington.edu>
+       Jason Gunthorpe <jgg at debian.org>
+       gurney_j <gurney_j at 4j.lane.edu>
+       Eric S. Johansson <esj at harvee.billerica.ma.us>
+       David Margrave <davidma at premier1.net>
+       Uche Ogbuji <uche.ogbuji at fourthought.com>
+       Neale Pickett <neale at lanl.gov>
+       Blake Weston <weston at platinum1.cambridge.scr.slb.com>
+       Wido Depping <wido.depping at gmail.com>
+       Deepak Giridharagopal <deepak at arlut.utexas.edu>
+       Ingo Steuwer <steuwer at univention.de>
+       Andreas Hasenack <ahasenack at terra.com.br>
+       Matej Vela <vela at debian.org>
+
+   Thanks to all the guys on the python-ldap mailing list for
+   their contributions and input into this package.
+
+   Thanks! We may have missed someone: please mail us if we have omitted
+   your name.
+
+$Id: README,v 1.25 2011/10/26 18:43:21 stroeder Exp $

From 50507d02751e6f95e9a3d000f4439364dfbb049e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Oct 2011 19:41:27 +0000
Subject: [PATCH 076/868] Stub doc based on autoclass

---
 Doc/ldap-syncrepl.rst | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 Doc/ldap-syncrepl.rst

diff --git a/Doc/ldap-syncrepl.rst b/Doc/ldap-syncrepl.rst
new file mode 100644
index 0000000..388526e
--- /dev/null
+++ b/Doc/ldap-syncrepl.rst
@@ -0,0 +1,25 @@
+.. % $Id: ldap-syncrepl.rst,v 1.1 2011/10/26 19:41:27 stroeder Exp $
+
+********************************************************************
+:py:mod:`ldap.syncrepl` Implementation of a syncrepl consumer
+********************************************************************
+
+.. py:module:: ldap.syncrepl
+   :synopsis: Implementation of a syncrepl consumer
+
+.. seealso::
+
+   :rfc:`4533` - Lightweight Directory Access Protocol (v3): Content Synchronization Operation
+
+This requires :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed.
+
+
+Classes
+=======
+
+This module defines the following classes:
+
+
+.. autoclass:: ldap.syncrepl.SyncreplConsumer
+   :members:
+

From 065102e6b57ac6487933a2619bfe704d1f71c16a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Oct 2011 19:42:25 +0000
Subject: [PATCH 077/868] Added ldap.syncrepl

---
 Doc/index.rst |  44 +++++++++++++
 setup.py      | 179 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 223 insertions(+)
 create mode 100644 Doc/index.rst
 create mode 100644 setup.py

diff --git a/Doc/index.rst b/Doc/index.rst
new file mode 100644
index 0000000..ad86059
--- /dev/null
+++ b/Doc/index.rst
@@ -0,0 +1,44 @@
+##########################
+python-ldap Documentation
+##########################
+
+.. % $Id: index.rst,v 1.8 2011/10/26 19:42:45 stroeder Exp $
+
+.. topic:: Abstract
+
+   This document describes the package python-ldap with its various modules.
+
+   Depending on what you want to do this manual assumes basic to expert
+   knowledge about the Python language and the LDAP standard (LDAPv3).
+
+
+********
+Contents
+********
+
+.. toctree::
+   :maxdepth: 3
+
+   installing.rst
+   ldap.rst
+   ldap-async.rst
+   ldap-controls.rst
+   ldap-dn.rst
+   ldap-extop.rst
+   ldap-filter.rst
+   ldap-modlist.rst
+   ldap-resiter.rst
+   ldap-schema.rst
+   ldap-syncrepl.rst
+   ldif.rst
+   ldapurl.rst
+   dsml.rst
+
+
+******************
+Indices and tables
+******************
+
+* :ref:`genindex`
+* :ref:`modindex`
+* :ref:`search`
diff --git a/setup.py b/setup.py
new file mode 100644
index 0000000..a9a6219
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,179 @@
+"""
+setup.py - Setup package with the help Python's DistUtils
+
+See http://www.python-ldap.org/ for details.
+
+$Id: setup.py,v 1.71 2011/10/26 19:42:25 stroeder Exp $
+"""
+
+has_setuptools = False
+try:
+        from setuptools import setup, Extension
+        has_setuptools = True
+except ImportError:
+        from distutils.core import setup, Extension
+
+from ConfigParser import ConfigParser
+import sys,os,string,time
+
+##################################################################
+# Weird Hack to grab release version of python-ldap from local dir
+##################################################################
+exec_startdir = os.path.dirname(os.path.abspath(sys.argv[0]))
+package_init_file_name = reduce(os.path.join,[exec_startdir,'Lib','ldap','__init__.py'])
+f = open(package_init_file_name,'r')
+s = f.readline()
+while s:
+  s = string.strip(s)
+  if s[0:11]=='__version__':
+    version = eval(string.split(s,'=')[1])
+    break
+  s = f.readline()
+f.close()
+
+#-- A class describing the features and requirements of OpenLDAP 2.0
+class OpenLDAP2:
+  library_dirs = []
+  include_dirs = []
+  extra_compile_args = []
+  extra_link_args = []
+  extra_objects = []
+  libs = ['ldap', 'lber']
+  defines = [ ]
+  extra_files = []
+
+LDAP_CLASS = OpenLDAP2
+
+#-- Read the [_ldap] section of setup.cfg
+cfg = ConfigParser()
+cfg.read('setup.cfg')
+if cfg.has_section('_ldap'):
+  for name in dir(LDAP_CLASS):
+    if cfg.has_option('_ldap', name):
+      print name + ': ' + cfg.get('_ldap', name)
+      setattr(LDAP_CLASS, name, string.split(cfg.get('_ldap', name)))
+
+for i in range(len(LDAP_CLASS.defines)):
+  LDAP_CLASS.defines[i]=((LDAP_CLASS.defines[i],None))
+
+for i in range(len(LDAP_CLASS.extra_files)):
+  destdir, origfiles = string.split(LDAP_CLASS.extra_files[i], ':')
+  origfileslist = string.split(origfiles, ',')
+  LDAP_CLASS.extra_files[i]=(destdir, origfileslist)
+
+#-- Let distutils/setuptools do the rest
+name = 'python-ldap'
+
+# Python 2.3.6+ and setuptools are needed to build eggs, so
+# let's handle setuptools' additional  keyword arguments to
+# setup() in a fashion that doesn't break compatibility  to
+# distutils. This still allows 'normal' builds where either
+# Python > 2.3.5 or setuptools (or both ;o) are not available.
+kwargs = dict()
+if has_setuptools:
+  kwargs = dict(
+    include_package_data = True,
+    install_requires = ['setuptools'],
+    zip_safe = False
+  )
+
+setup(
+  #-- Package description
+  name = name,
+  version = version,
+  description = 'Python modules for implementing LDAP clients',
+  long_description = """python-ldap:
+  python-ldap provides an object-oriented API to access LDAP directory servers
+  from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.
+  Additionally the package contains modules for other LDAP-related stuff
+  (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations
+  and controls, etc.). 
+  """,
+  author = 'python-ldap project',
+  author_email = 'python-ldap@python.org',
+  url = 'http://www.python-ldap.org/',
+  download_url = 'http://pypi.python.org/pypi/python-ldap/',
+  classifiers = [
+    'Development Status :: 5 - Production/Stable',
+    'Intended Audience :: Developers',
+    'Intended Audience :: System Administrators',
+    'Operating System :: OS Independent',
+    'Operating System :: MacOS :: MacOS X',
+    'Operating System :: Microsoft :: Windows',
+    'Operating System :: POSIX',
+    'Programming Language :: C',
+    'Programming Language :: Python',
+    'Topic :: Database',
+    'Topic :: Internet',
+    'Topic :: Software Development :: Libraries :: Python Modules',
+    'Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP',
+    'License :: OSI Approved :: Python Software Foundation License',
+  ],
+  license = 'Python style',
+  #-- C extension modules
+  ext_modules = [
+    Extension(
+      '_ldap',
+      [
+        'Modules/LDAPObject.c',
+        'Modules/ldapcontrol.c',
+        'Modules/common.c',
+        'Modules/constants.c',
+        'Modules/errors.c',
+        'Modules/functions.c',
+        'Modules/schema.c',
+        'Modules/ldapmodule.c',
+        'Modules/message.c',
+        'Modules/version.c',
+        'Modules/options.c',
+        'Modules/berval.c',
+      ],
+      libraries = LDAP_CLASS.libs,
+      include_dirs = ['Modules'] + LDAP_CLASS.include_dirs,
+      library_dirs = LDAP_CLASS.library_dirs,
+      extra_compile_args = LDAP_CLASS.extra_compile_args,
+      extra_link_args = LDAP_CLASS.extra_link_args,
+      extra_objects = LDAP_CLASS.extra_objects,
+      runtime_library_dirs = (not sys.platform.startswith("win"))*LDAP_CLASS.library_dirs,
+      define_macros = LDAP_CLASS.defines + \
+        ('ldap_r' in LDAP_CLASS.libs or 'oldap_r' in LDAP_CLASS.libs)*[('HAVE_LIBLDAP_R',None)] + \
+        ('sasl' in LDAP_CLASS.libs or 'sasl2' in LDAP_CLASS.libs or 'libsasl' in LDAP_CLASS.libs)*[('HAVE_SASL',None)] + \
+        ('ssl' in LDAP_CLASS.libs and 'crypto' in LDAP_CLASS.libs)*[('HAVE_TLS',None)] + \
+        [('LDAPMODULE_VERSION', version)]
+    ),
+  ],
+  #-- Python "stand alone" modules
+  py_modules = [
+    'ldapurl',
+    'ldif',
+    'dsml',
+    'ldap',
+    'ldap.async',
+    'ldap.controls',
+    'ldap.controls.libldap',
+    'ldap.controls.ppolicy',
+    'ldap.controls.psearch',
+    'ldap.controls.readentry',
+    'ldap.controls.sessiontrack',
+    'ldap.controls.simple',
+    'ldap.cidict',
+    'ldap.dn',
+    'ldap.extop',
+    'ldap.extop.dds',
+    'ldap.filter',
+    'ldap.functions',
+    'ldap.ldapobject',
+    'ldap.logger',
+    'ldap.modlist',
+    'ldap.resiter',
+    'ldap.sasl',
+    'ldap.schema',
+    'ldap.schema.models',
+    'ldap.schema.subentry',
+    'ldap.schema.tokenizer',
+    'ldap.syncrepl',
+  ],
+  package_dir = {'': 'Lib',},
+  data_files = LDAP_CLASS.extra_files,
+  **kwargs
+)

From e4173acd69254b950dfeb7663e83a8e338f5df18 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 23 Nov 2011 17:27:46 +0000
Subject: [PATCH 078/868] Fixed lock acquire() and release() to use the same
 lock instance

---
 Lib/ldap/functions.py | 132 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 132 insertions(+)
 create mode 100644 Lib/ldap/functions.py

diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
new file mode 100644
index 0000000..03157fe
--- /dev/null
+++ b/Lib/ldap/functions.py
@@ -0,0 +1,132 @@
+"""
+functions.py - wraps functions of module _ldap
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: functions.py,v 1.28 2011/11/23 17:27:46 stroeder Exp $
+
+Compability:
+- Tested with Python 2.0+ but should work with Python 1.5.x
+- functions should behave exactly the same like in _ldap
+
+Usage:
+Directly imported by ldap/__init__.py. The symbols of _ldap are
+overridden.
+
+Thread-lock:
+Basically calls into the LDAP lib are serialized by the module-wide
+lock _ldapmodule_lock.
+"""
+
+from ldap import __version__
+
+__all__ = [
+  'open','initialize','init',
+  'explode_dn','explode_rdn',
+  'get_option','set_option',
+]
+
+import sys,pprint,_ldap,ldap
+
+from ldap import LDAPError
+
+from ldap.dn import explode_dn,explode_rdn
+
+from ldap.ldapobject import LDAPObject
+
+if __debug__:
+  # Tracing is only supported in debugging mode
+  import traceback
+
+
+def _ldap_function_call(lock,func,*args,**kwargs):
+  """
+  Wrapper function which locks and logs calls to function
+
+  lock
+      Instance of threading.Lock or compatible
+  func
+      Function to call with arguments passed in via *args and **kwargs
+  """
+  if lock:
+    lock.acquire()
+  if __debug__:
+    if ldap._trace_level>=1:
+      ldap._trace_file.write('*** %s.%s %s\n' % (
+        '_ldap',func.__name__,
+        pprint.pformat((args,kwargs))
+      ))
+      if ldap._trace_level>=9:
+        traceback.print_stack(limit=ldap._trace_stack_limit,file=ldap._trace_file)
+  try:
+    try:
+      result = func(*args,**kwargs)
+    finally:
+      if lock:
+        lock.release()
+  except LDAPError,e:
+    if __debug__ and ldap._trace_level>=2:
+      ldap._trace_file.write('=> LDAPError: %s\n' % (str(e)))
+    raise
+  if __debug__ and ldap._trace_level>=2:
+    ldap._trace_file.write('=> result:\n%s\n' % (pprint.pformat(result)))
+  return result
+
+
+def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None):
+  """
+  Return LDAPObject instance by opening LDAP connection to
+  LDAP host specified by LDAP URL
+
+  Parameters:
+  uri
+        LDAP URL containing at least connection scheme and hostport,
+        e.g. ldap://localhost:389
+  trace_level
+        If non-zero a trace output of LDAP calls is generated.
+  trace_file
+        File object where to write the trace output to.
+        Default is to use stdout.
+  """
+  return LDAPObject(uri,trace_level,trace_file,trace_stack_limit)
+
+
+def open(host,port=389,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None):
+  """
+  Return LDAPObject instance by opening LDAP connection to
+  specified LDAP host
+
+  Parameters:
+  host
+        LDAP host and port, e.g. localhost
+  port
+        integer specifying the port number to use, e.g. 389
+  trace_level
+        If non-zero a trace output of LDAP calls is generated.
+  trace_file
+        File object where to write the trace output to.
+        Default is to use stdout.
+  """
+  import warnings
+  warnings.warn('ldap.open() is deprecated! Use ldap.initialize() instead.', DeprecationWarning,2)
+  return initialize('ldap://%s:%d' % (host,port),trace_level,trace_file,trace_stack_limit)
+
+init = open
+
+
+def get_option(option):
+  """
+  get_option(name) -> value
+
+  Get the value of an LDAP global option.
+  """
+  return _ldap_function_call(None,_ldap.get_option,option)
+
+
+def set_option(option,invalue):
+  """
+  set_option(name, value)
+
+  Set the value of an LDAP global option.
+  """
+  return _ldap_function_call(None,_ldap.set_option,option,invalue)

From 3fd52be6b5579fc8b1eaa26b786e4e03c05c5ae7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 24 Nov 2011 19:40:24 +0000
Subject: [PATCH 079/868] Fallback values for who and cred

---
 Demo/pyasn1/dds.py | 55 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 Demo/pyasn1/dds.py

diff --git a/Demo/pyasn1/dds.py b/Demo/pyasn1/dds.py
new file mode 100644
index 0000000..656b439
--- /dev/null
+++ b/Demo/pyasn1/dds.py
@@ -0,0 +1,55 @@
+# -*- coding: utf-8 -*-
+"""
+Demo script for Dynamic Entries (see RFC 2589)
+
+This needs the following software:
+Python
+pyasn1
+pyasn1-modules
+python-ldap 2.4+
+"""
+
+from ldap.extop.dds import RefreshRequest,RefreshResponse
+
+import sys,ldap,ldapurl,getpass
+
+try:
+  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+  request_ttl = int(sys.argv[2])
+except IndexError,ValueError:
+  print 'Usage: dds.py <LDAP URL> <TTL>'
+  sys.exit(1)
+
+# Set debugging level
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 2
+ldapmodule_trace_file = sys.stderr
+
+ldap_conn = ldap.ldapobject.LDAPObject(
+  ldap_url.initializeUrl(),
+  trace_level=ldapmodule_trace_level,
+  trace_file=ldapmodule_trace_file
+)
+
+if ldap_url.cred is None:
+  print 'Password for %s:' % (repr(ldap_url.who))
+  ldap_url.cred = getpass.getpass()
+
+try:
+  ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
+
+except ldap.INVALID_CREDENTIALS,e:
+  print 'Simple bind failed:',str(e)
+  sys.exit(1)
+
+else:
+  extreq = RefreshRequest(entryName=ldap_url.dn,requestTtl=request_ttl)
+  try:
+    extop_resp_obj = ldap_conn.extop_s(extreq,extop_resp_class=RefreshResponse)
+  except ldap.LDAPError,e:
+    print str(e)
+  else:
+    if extop_resp_obj.responseTtl!=request_ttl:
+      print 'Different response TTL:',extop_resp_obj.responseTtl
+    else:
+      print 'Response TTL:',extop_resp_obj.responseTtl

From a7c052b701ef4e8e5f6bb9e821122ec3aa92b948 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 24 Nov 2011 19:41:47 +0000
Subject: [PATCH 080/868] Simple demo for ldap.controls.ppolicy

---
 Demo/pyasn1/ppolicy.py | 50 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 Demo/pyasn1/ppolicy.py

diff --git a/Demo/pyasn1/ppolicy.py b/Demo/pyasn1/ppolicy.py
new file mode 100644
index 0000000..2bb24a2
--- /dev/null
+++ b/Demo/pyasn1/ppolicy.py
@@ -0,0 +1,50 @@
+# -*- coding: utf-8 -*-
+"""
+Demo script for Password Policy Controls
+(see http://tools.ietf.org/html/draft-behera-ldap-password-policy)
+
+This needs the following software:
+Python
+pyasn1
+pyasn1-modules
+python-ldap 2.4+
+"""
+
+import sys,ldap,ldapurl,getpass
+
+from ldap.controls.ppolicy import PasswordPolicyError,PasswordPolicyControl
+
+try:
+  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+except IndexError,ValueError:
+  print 'Usage: ppolicy.py <LDAP URL>'
+  sys.exit(1)
+
+# Set debugging level
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 2
+ldapmodule_trace_file = sys.stderr
+
+ldap_conn = ldap.ldapobject.LDAPObject(
+  ldap_url.initializeUrl(),
+  trace_level=ldapmodule_trace_level,
+  trace_file=ldapmodule_trace_file
+)
+
+if ldap_url.cred is None:
+  print 'Password for %s:' % (repr(ldap_url.who))
+  ldap_url.cred = getpass.getpass()
+
+try:
+  msgid = ldap_conn.simple_bind(ldap_url.who,ldap_url.cred,serverctrls=[PasswordPolicyControl()])
+  res_type,res_data,res_msgid,res_ctrls = ldap_conn.result3(msgid)
+except ldap.INVALID_CREDENTIALS,e:
+  print 'Simple bind failed:',str(e)
+  sys.exit(1)
+else:
+  if res_ctrls[0].controlType==PasswordPolicyControl.controlType:
+    ppolicy_ctrl = res_ctrls[0]
+    print 'PasswordPolicyControl'
+    print 'error',repr(ppolicy_ctrl.error),(ppolicy_ctrl.error!=None)*repr(PasswordPolicyError(ppolicy_ctrl.error))
+    print 'timeBeforeExpiration',repr(ppolicy_ctrl.timeBeforeExpiration)
+    print 'graceAuthNsRemaining',repr(ppolicy_ctrl.graceAuthNsRemaining)

From 4e39af9f4d259c2296c51a13f79fba74f903ee1d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 27 Nov 2011 15:26:06 +0000
Subject: [PATCH 081/868] Another fix for decoding the password policy response
 control

---
 Lib/ldap/controls/ppolicy.py | 96 ++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 Lib/ldap/controls/ppolicy.py

diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
new file mode 100644
index 0000000..7f8cc7f
--- /dev/null
+++ b/Lib/ldap/controls/ppolicy.py
@@ -0,0 +1,96 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.ppolicy - classes for Password Policy controls
+(see http://tools.ietf.org/html/draft-behera-ldap-password-policy)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: ppolicy.py,v 1.3 2011/11/27 15:26:06 stroeder Exp $
+"""
+
+__all__ = [
+  'PasswordPolicyControl'
+]
+
+# Imports from python-ldap 2.4+
+import ldap.controls
+from ldap.controls import RequestControl,ResponseControl,ValueLessRequestControl,KNOWN_RESPONSE_CONTROLS
+
+# Imports from pyasn1
+from pyasn1.type import tag,namedtype,namedval,univ,constraint
+from pyasn1.codec.ber import encoder,decoder
+from pyasn1_modules.rfc2251 import LDAPDN
+
+
+class PasswordPolicyWarning(univ.Choice):
+  componentType = namedtype.NamedTypes(
+    namedtype.NamedType('timeBeforeExpiration',univ.Integer().subtype(
+      implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,0)
+    )),
+    namedtype.NamedType('graceAuthNsRemaining',univ.Integer().subtype(
+      implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,1)
+    )),
+  )
+
+
+class PasswordPolicyError(univ.Enumerated):
+  namedValues = namedval.NamedValues(
+    ('passwordExpired',0),
+    ('accountLocked',1),
+    ('changeAfterReset',2),
+    ('passwordModNotAllowed',3),
+    ('mustSupplyOldPassword',4),
+    ('insufficientPasswordQuality',5),
+    ('passwordTooShort',6),
+    ('passwordTooYoung',7),
+    ('passwordInHistory',8)
+  )
+  subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(0,1,2,3,4,5,6,7,8)
+
+
+class PasswordPolicyResponseValue(univ.Sequence):
+  componentType = namedtype.NamedTypes(
+    namedtype.OptionalNamedType(
+      'warning',
+      PasswordPolicyWarning().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,0)
+      ),
+    ),
+    namedtype.OptionalNamedType(
+      'error',PasswordPolicyError().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatSimple,1)
+      )
+    ),
+  )
+
+
+class PasswordPolicyControl(ValueLessRequestControl,ResponseControl):
+  controlType = '1.3.6.1.4.1.42.2.27.8.5.1'
+
+  def __init__(self,criticality=False):
+    self.criticality = criticality
+
+  def decodeControlValue(self,encodedControlValue):
+    ppolicyValue,_ = decoder.decode(encodedControlValue,asn1Spec=PasswordPolicyResponseValue())
+    warning = ppolicyValue.getComponentByName('warning')
+    if warning is None:
+      self.timeBeforeExpiration,self.graceAuthNsRemaining = None,None
+    else:
+      timeBeforeExpiration = warning.getComponentByName('timeBeforeExpiration')
+      if timeBeforeExpiration!=None:
+        self.timeBeforeExpiration = int(timeBeforeExpiration)
+      else:
+        self.timeBeforeExpiration = None
+      graceAuthNsRemaining = warning.getComponentByName('graceAuthNsRemaining')
+      if graceAuthNsRemaining!=None:
+        self.graceAuthNsRemaining = int(graceAuthNsRemaining)
+      else:
+        self.graceAuthNsRemaining = None
+    error = ppolicyValue.getComponentByName('error')
+    if error is None:
+      self.error = None
+    else:
+      self.error = int(error)
+      
+
+KNOWN_RESPONSE_CONTROLS[PasswordPolicyControl.controlType] = PasswordPolicyControl

From 4c51489dfdb14bee9b46a49966a3c089cd5e5dbb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 10 Jan 2012 23:28:08 +0000
Subject: [PATCH 082/868] Reference ldap.MOD* constants with module name

---
 Doc/ldap.rst | 1125 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 1125 insertions(+)
 create mode 100644 Doc/ldap.rst

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
new file mode 100644
index 0000000..5226c32
--- /dev/null
+++ b/Doc/ldap.rst
@@ -0,0 +1,1125 @@
+.. % $Id: ldap.rst,v 1.27 2012/01/10 23:28:08 stroeder Exp $
+
+********************************************
+:py:mod:`ldap` LDAP library interface module
+********************************************
+
+.. py:module:: ldap
+    :platform: Posix, Windows
+    :synopsis: Access to an underlying LDAP C library.
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+This module provides access to the LDAP  (Lightweight Directory Access Protocol)
+C API implemented  in OpenLDAP 2.3 or newer.  It is similar to the C API, with
+the notable differences  that lists are manipulated via Python  list operations
+and errors appear as exceptions.    For far more detailed information on the C
+interface,   please see the (expired) draft-ietf-ldapext-ldap-c-api-04.    This
+documentation is current for the Python LDAP module, version  |release|.  Source
+and binaries are available from http://www.python-ldap.org/.
+
+
+Functions
+=========
+
+This module defines the following functions:
+
+.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None]]]) -> LDAPObject object
+
+   Initializes a new connection object for accessing the given LDAP server,
+   and return an LDAP object (see :ref:`ldap-objects`) used to perform operations
+   on that server.  Parameter *uri* has to be a valid LDAP URL.
+
+   Note that the C wrapper function :py:func:_ldap.initialize() is called which calls
+   the OpenLDAP funtion ldap_initialize(). Calling this function just initializes
+   the LDAP connection struct in the C API - nothing else. The first call to
+   an operation method (bind, search etc.) then really opens the connection.
+   Before that nothing is sent on the wire.
+
+   The optional arguments are for generating debug log information:
+   *trace_level* specifies the amount of information being logged,
+   *trace_file* specifies a file-like object as target of the debug log and
+   *trace_stack_limit* specifies the stack limit of tracebacks in debug log.
+
+   Possible values for *trace_level* are
+   :py:const:`0` for no logging,
+   :py:const:`1` for only logging the method calls with arguments,
+   :py:const:`2` for logging the method calls with arguments and the complete results and
+   :py:const:`9` for also logging the traceback of method calls.
+
+   .. seealso::
+
+      :rfc:`4516` - Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator
+
+.. py:function:: open(host [, port=PORT]) -> LDAPObject object
+
+   Opens a new connection with an LDAP server, and return an LDAP object  (see
+   :ref:`ldap-objects`) used to perform operations on that server.  *host* is a
+   string containing solely the host name. *port* is an integer specifying the
+   port where the LDAP server is  listening (default is 389).
+
+   Note: Using this function is deprecated.
+
+
+.. py:function:: get_option(option) -> int|string
+
+   This function returns the value of the global option specified by *option*.
+
+
+.. py:function:: set_option(option, invalue) -> None
+
+   This function sets the value of the global option specified by *option* to
+   *invalue*.
+
+
+.. _ldap-constants:
+
+Constants
+=========
+
+The module defines various constants. Note that some constants depend
+on the build options and which underlying libs were used or even on
+the version of the libs. So before using those constants the application has
+to explicitly check whether they are available.
+
+General
+-------
+
+.. py:data:: PORT
+
+   The assigned TCP port number (389) that LDAP servers listen on.
+
+.. py:data:: SASL_AVAIL
+
+   Integer where a non-zero value indicates that python-ldap was built with
+   support for SASL (Cyrus-SASL).
+
+.. py:data:: TLS_AVAIL
+
+   Integer where a non-zero value indicates that python-ldap was built with
+   support for SSL/TLS (OpenSSL or similar libs).
+
+
+.. _ldap-options:
+
+Options
+-------
+
+.. seealso::
+
+   :manpage:`ldap.conf{5}` and :manpage:`ldap_get_options{3}`
+
+
+For use with functions :py:func:set_option() and :py:func:get_option()
+and methods :py:method:LDAPObject.set_option() and :py:method:LDAPObject.get_option() the
+following option identifiers are defined as constants:
+
+.. py:data:: OPT_API_FEATURE_INFO
+
+.. py:data:: OPT_API_INFO
+
+.. py:data:: OPT_CLIENT_CONTROLS
+
+.. py:data:: OPT_DEBUG_LEVEL
+
+   Sets the debug level within the underlying LDAP C lib.
+
+.. py:data:: OPT_DEFBASE
+
+.. py:data:: OPT_DEREF
+
+   Specifies how alias derefencing is done within the underlying LDAP C lib.
+
+.. py:data:: OPT_ERROR_STRING
+
+.. py:data:: OPT_DIAGNOSTIC_MESSAGE
+
+.. py:data:: OPT_HOST_NAME
+
+.. py:data:: OPT_MATCHED_DN
+
+.. py:data:: OPT_NETWORK_TIMEOUT
+
+.. py:data:: OPT_PROTOCOL_VERSION
+
+   Sets the LDAP protocol version used for a connection. This is mapped to
+   object attribute `ldap.LDAPObject.protocol_version`
+
+.. py:data:: OPT_REFERRALS
+
+   int specifying whether referrals should be automatically chased within
+   the underlying LDAP C lib.
+
+.. py:data:: OPT_REFHOPLIMIT
+
+.. py:data:: OPT_RESTART
+
+.. py:data:: OPT_SERVER_CONTROLS
+
+.. py:data:: OPT_SIZELIMIT
+
+.. py:data:: OPT_SUCCESS
+
+.. py:data:: OPT_TIMELIMIT
+
+.. py:data:: OPT_TIMEOUT
+
+.. py:data:: OPT_URI
+
+.. _ldap-sasl-options:
+
+SASL options
+::::::::::::
+
+.. py:data:: OPT_X_SASL_AUTHCID
+
+.. py:data:: OPT_X_SASL_AUTHZID
+
+.. py:data:: OPT_X_SASL_MECH
+
+.. py:data:: OPT_X_SASL_NOCANON
+
+   If set to zero SASL host name canonicalization is disabled.
+
+.. py:data:: OPT_X_SASL_REALM
+
+.. py:data:: OPT_X_SASL_SECPROPS
+
+.. py:data:: OPT_X_SASL_SSF
+
+.. py:data:: OPT_X_SASL_SSF_EXTERNAL
+
+.. py:data:: OPT_X_SASL_SSF_MAX
+
+.. py:data:: OPT_X_SASL_SSF_MIN
+
+.. _ldap-tls-options:
+
+TLS options
+:::::::::::
+
+.. py:data:: OPT_X_TLS
+
+.. py:data:: OPT_X_TLS_ALLOW
+
+.. py:data:: OPT_X_TLS_CACERTDIR
+
+.. py:data:: OPT_X_TLS_CACERTFILE
+
+.. py:data:: OPT_X_TLS_CERTFILE
+
+.. py:data:: OPT_X_TLS_CIPHER_SUITE
+
+.. py:data:: OPT_X_TLS_CTX
+
+.. py:data:: OPT_X_TLS_DEMAND
+
+.. py:data:: OPT_X_TLS_HARD
+
+.. py:data:: OPT_X_TLS_KEYFILE
+
+.. py:data:: OPT_X_TLS_NEVER
+
+.. py:data:: OPT_X_TLS_RANDOM_FILE
+
+.. py:data:: OPT_X_TLS_REQUIRE_CERT
+
+.. py:data:: OPT_X_TLS_TRY
+
+.. _ldap-keepalive-options:
+
+Keepalive options
+:::::::::::::::::
+
+.. py:data:: OPT_X_KEEPALIVE_IDLE
+
+.. py:data:: OPT_X_KEEPALIVE_PROBES
+
+.. py:data:: OPT_X_KEEPALIVE_INTERVAL
+
+.. _ldap-dn-flags:
+
+DN format flags
+----------------
+
+This constants are used for DN-parsing functions found in
+sub-module :py:mod:`ldap.dn`.
+
+.. seealso::
+
+   :manpage:`ldap_str2dn{3}`
+
+
+.. py:data:: DN_FORMAT_LDAP
+
+.. py:data:: DN_FORMAT_LDAPV3
+
+.. py:data:: DN_FORMAT_LDAPV2
+
+.. py:data:: DN_FORMAT_DCE
+
+.. py:data:: DN_FORMAT_UFN
+
+.. py:data:: DN_FORMAT_AD_CANONICAL
+
+.. py:data:: DN_FORMAT_MASK
+
+.. py:data:: DN_PRETTY
+
+.. py:data:: DN_SKIP
+
+.. py:data:: DN_P_NOLEADTRAILSPACES
+
+.. py:data:: DN_P_NOSPACEAFTERRDN
+
+.. py:data:: DN_PEDANTIC
+
+
+
+.. _ldap-exceptions:
+
+Exceptions
+==========
+
+The module defines the following exceptions:
+
+.. py:exception:: LDAPError
+
+   This is the base class of all execeptions raised by the module :py:mod:`ldap`.
+   Unlike the C interface, errors are not returned as result codes, but
+   are instead turned into exceptions, raised as soon an the error condition
+   is detected.
+
+   The exceptions are accompanied by a dictionary possibly
+   containing an string value for the key :py:const:`desc`
+   (giving an English description of the error class)
+   and/or a string value for the key :py:const:`info`
+   (giving a string containing more information that the server may have sent).
+
+   A third possible field of this dictionary is :py:const:`matched` and
+   is set to a truncated form of the name provided or alias dereferenced
+   for the lowest entry (object or alias) that was matched.
+
+
+.. py:exception:: ADMINLIMIT_EXCEEDED
+
+.. py:exception:: AFFECTS_MULTIPLE_DSAS
+
+.. py:exception:: ALIAS_DEREF_PROBLEM
+
+   A problem was encountered when dereferencing an alias.
+   (Sets the :py:const:`matched` field.)
+
+.. py:exception:: ALIAS_PROBLEM
+
+   An alias in the directory points to a nonexistent entry.
+   (Sets the :py:const:`matched` field.)
+
+.. py:exception:: ALREADY_EXISTS
+
+   The entry already exists. E.g. the *dn* specified with :py:meth:`add()`
+   already exists in the DIT.
+
+.. py:exception:: AUTH_UNKNOWN
+
+   The authentication method specified to :py:meth:`bind()` is not known.
+
+.. py:exception:: BUSY
+
+   The DSA is busy.
+
+.. py:exception:: CLIENT_LOOP
+
+.. py:exception:: COMPARE_FALSE
+
+   A compare operation returned false.
+   (This exception should never be seen because :py:meth:`compare()` returns
+   a boolean result.)
+
+.. py:exception:: COMPARE_TRUE
+
+   A compare operation returned true.
+   (This exception should never be seen because :py:meth:`compare()` returns
+   a boolean result.)
+
+.. py:exception:: CONFIDENTIALITY_REQUIRED
+
+   Indicates that the session is not protected by a protocol such
+   as Transport Layer Security (TLS), which provides session
+   confidentiality.
+
+.. py:exception:: CONNECT_ERROR
+
+.. py:exception:: CONSTRAINT_VIOLATION
+
+   An attribute value specified or an operation started violates some
+   server-side constraint
+   (e.g., a postalAddress has too many lines or a line that is too long
+   or a password is expired).
+
+.. py:exception:: CONTROL_NOT_FOUND
+
+.. py:exception:: DECODING_ERROR
+
+   An error was encountered decoding a result from the LDAP server.
+
+.. py:exception:: ENCODING_ERROR
+
+   An error was encountered encoding parameters to send to the LDAP server.
+
+.. py:exception:: FILTER_ERROR
+
+   An invalid filter was supplied to :py:meth:`search()`
+   (e.g. unbalanced parentheses).
+
+.. py:exception:: INAPPROPRIATE_AUTH
+
+   Inappropriate authentication was specified (e.g. :py:const:`AUTH_SIMPLE`
+   was specified and the entry does not have a userPassword attribute).
+
+.. py:exception:: INAPPROPRIATE_MATCHING
+
+   Filter type not supported for the specified attribute.
+
+.. py:exception:: INSUFFICIENT_ACCESS
+
+   The user has insufficient access to perform the operation.
+
+.. py:exception:: INVALID_CREDENTIALS
+
+   Invalid credentials were presented during :py:meth:`bind()` or
+   :py:meth:`simple_bind()`.
+   (e.g., the wrong password).
+
+.. py:exception:: INVALID_DN_SYNTAX
+
+   A syntactically invalid DN was specified. (Sets the :py:const:`matched` field.)
+
+.. py:exception:: INVALID_SYNTAX
+
+   An attribute value specified by the client did not comply to the
+   syntax defined in the server-side schema.
+
+.. py:exception:: IS_LEAF
+
+   The object specified is a leaf of the diretcory tree.
+   Sets the :py:const:`matched` field of the exception dictionary value.
+
+.. py:exception:: LOCAL_ERROR
+
+   Some local error occurred. This is usually due to failed memory allocation.
+
+.. py:exception:: LOOP_DETECT
+
+   A loop was detected.
+
+.. py:exception:: MORE_RESULTS_TO_RETURN
+
+.. py:exception:: NAMING_VIOLATION
+
+   A naming violation occurred. This is raised e.g. if the LDAP server
+   has constraints about the tree naming.
+
+.. py:exception:: NO_OBJECT_CLASS_MODS
+
+   Modifying the objectClass attribute as requested is not allowed
+   (e.g. modifying structural object class of existing entry).
+
+.. py:exception:: NOT_ALLOWED_ON_NONLEAF
+
+   The operation is not allowed on a non-leaf object.
+
+.. py:exception:: NOT_ALLOWED_ON_RDN
+
+   The operation is not allowed on an RDN.
+
+.. py:exception:: NOT_SUPPORTED
+
+.. py:exception:: NO_MEMORY
+
+.. py:exception:: NO_OBJECT_CLASS_MODS
+
+   Object class modifications are not allowed.
+
+.. py:exception:: NO_RESULTS_RETURNED
+
+.. py:exception:: NO_SUCH_ATTRIBUTE
+
+   The attribute type specified does not exist in the entry.
+
+.. py:exception:: NO_SUCH_OBJECT
+
+   The specified object does not exist in the directory.
+   Sets the :py:const:`matched` field of the exception dictionary value.
+
+.. py:exception:: OBJECT_CLASS_VIOLATION
+
+   An object class violation occurred when the LDAP server checked
+   the data sent by the client against the server-side schema
+   (e.g. a "must" attribute was missing in the entry data).
+
+.. py:exception:: OPERATIONS_ERROR
+
+   An operations error occurred.
+
+.. py:exception:: OTHER
+
+   An unclassified error occurred.
+
+.. py:exception:: PARAM_ERROR
+
+   An ldap routine was called with a bad parameter.
+
+.. py:exception:: PARTIAL_RESULTS
+
+   Partial results only returned. This exception is raised if
+   a referral is received when using LDAPv2.
+   (This exception should never be seen with LDAPv3.)
+
+.. py:exception:: PROTOCOL_ERROR
+
+   A violation of the LDAP protocol was detected.
+
+.. py:exception:: RESULTS_TOO_LARGE
+
+   The result does not fit into a UDP packet. This happens only when using
+   UDP-based CLDAP (connection-less LDAP) which is not supported anyway.
+
+.. py:exception:: SASL_BIND_IN_PROGRESS
+
+.. py:exception:: SERVER_DOWN
+
+   The  LDAP  library  can't  contact the LDAP server.
+
+.. py:exception:: SIZELIMIT_EXCEEDED
+
+   An LDAP size limit was exceeded.
+   This could be due to a ``sizelimit`` configuration on the LDAP server.
+
+.. py:exception:: STRONG_AUTH_NOT_SUPPORTED
+
+   The LDAP server does not support strong authentication.
+
+.. py:exception:: STRONG_AUTH_REQUIRED
+
+   Strong authentication is required  for the operation.
+
+.. py:exception:: TIMELIMIT_EXCEEDED
+
+   An LDAP time limit was exceeded.
+
+.. py:exception:: TIMEOUT
+
+   A timelimit was exceeded while waiting for a result from the server.
+
+.. py:exception:: TYPE_OR_VALUE_EXISTS
+
+   An  attribute  type or attribute value specified already
+   exists in the entry.
+
+.. py:exception:: UNAVAILABLE
+
+   The DSA is unavailable.
+
+.. py:exception:: UNAVAILABLE_CRITICAL_EXTENSION
+
+   Indicates that the LDAP server was unable to satisfy a request
+   because one or more critical extensions were not available. Either
+   the server does not support the control or the control is not appropriate
+   for the operation type.
+
+.. py:exception:: UNDEFINED_TYPE
+
+   An attribute type used is not defined in the server-side schema.
+
+.. py:exception:: UNWILLING_TO_PERFORM
+
+   The  DSA is  unwilling to perform the operation.
+
+.. py:exception:: USER_CANCELLED
+
+   The operation was cancelled via the :py:meth:`abandon()` method.
+
+The above exceptions are raised when a result code from an underlying API
+call does not indicate success.
+
+
+.. _ldap-objects:
+
+LDAPObject classes
+==================
+
+.. py:class:: LDAPObject
+
+   Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
+   and :py:func:`open()` (deprecated). The connection is automatically unbound
+   and closed when the LDAP object is deleted. Internally :py:class:`LDAPObject`
+   is set to :py:class:`SimpleLDAPObject` by default.
+
+
+.. py:class:: SimpleLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5]]])
+
+   Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
+   and :py:func:`open()` (deprecated). The connection is automatically unbound
+   and closed  when the LDAP object is deleted.
+
+
+.. py:class:: ReconnectLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5] [, retry_max=1 [, retry_delay=60.0]]]])
+
+   This class is derived from :py:class:`SimpleLDAPObject` and used for automatic
+   reconnects when using the synchronous request methods (see below). This class
+   also implements the pickle protocol.
+
+   For automatic reconnects it has additional arguments:
+
+   *retry_max* specifies the number of reconnect attempts before
+   re-raising the :py:exc:`ldap.SERVER_DOWN` exception.
+
+   *retry_delay* specifies the time in seconds between reconnect attempts.
+
+
+Arguments for LDAPv3 controls
+-----------------------------
+
+The :py:mod:`ldap.controls` module can be used for constructing and
+decoding LDAPv3 controls. These arguments are available in the methods
+with names ending in :py:const:`_ext` or :py:const:`_ext_s`:
+
+*serverctrls*
+  is a list of :py:class:`ldap.controls.LDAPControl` instances sent to the server along
+  with the LDAP request (see module :py:mod:`ldap.controls`). These are
+  controls which alter the behaviour of the server when processing the
+  request if the control is supported by the server. The effect of controls
+  might differ depending on the type of LDAP request or controls might not
+  be applicable with certain LDAP requests at all.
+
+*clientctrls*
+  is a list of :py:class:`ldap.controls.LDAPControl` instances passed to the
+  client API and alter the behaviour of the client when processing the
+  request.
+
+
+Sending LDAP requests
+---------------------
+
+Most methods on LDAP objects initiate an asynchronous request to the
+LDAP server and return a message id that can be used later to retrieve
+the result with :py:meth:`result()`.
+
+Methods with names ending in :py:const:`_s` are the synchronous form
+and wait for and return with the server's result, or with
+:py:const:`None` if no data is expected.
+
+
+:class:`LDAPObject` instances have the following methods:
+
+.. py:method:: LDAPObject.abandon(msgid) -> None
+
+.. py:method:: LDAPObject.abandon_ext(msgid [, serverctrls=None [, clientctrls=None]]) -> None
+
+   Abandons an LDAP operation in progress without waiting for a LDAP response.
+   The *msgid* argument should be the message ID of an outstanding LDAP
+   operation as returned by the asynchronous methods :py:meth:`search()`, :py:meth:`modify()`, etc.
+   The caller can expect that the result of an abandoned operation will not be
+   returned from a future call to :py:meth:`result()`.
+
+   *serverctrls* and *clientctrls* like described above.
+
+
+.. py:method:: LDAPObject.add(dn, modlist) -> int
+
+.. py:method:: LDAPObject.add_s(dn, modlist) -> None
+
+.. py:method:: LDAPObject.add_ext(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> int
+
+.. py:method:: LDAPObject.add_ext_s(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> None
+
+   Performs an LDAP add operation. The *dn* argument is the distinguished
+   name (DN) of the entry to add, and *modlist* is a list of attributes to be
+   added. The modlist is similar the one passed to :py:meth:`modify()`, except that the
+   operation integer is omitted from the tuples in modlist. You might want to
+   look into sub-module \refmodule{ldap.modlist} for generating the modlist.
+
+   The asynchronous methods :py:meth:`add()` and :py:meth:`add_ext()`
+   return the message ID of the initiated request.
+
+   *serverctrls* and *clientctrls* like described above.
+
+.. py:method:: LDAPObject.bind(who, cred, method) -> int
+
+.. py:method:: LDAPObject.bind_s(who, cred, method) -> None
+
+.. py:method:: LDAPObject.simple_bind([who='' [, cred='']]) -> int
+
+.. py:method:: LDAPObject.simple_bind_s([who='' [, cred='']]) -> None
+
+   After an LDAP object is created, and before any other operations can be
+   attempted over the connection, a bind operation must be performed.
+
+   This method attempts to bind with the LDAP server using
+   either simple authentication, or Kerberos (if available).
+   The first and most general method, :py:meth:`bind()`,
+   takes a third parameter, *method* which can currently solely
+   be :py:const:`AUTH_SIMPLE`.
+
+
+.. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth) -> None
+
+   This call is used to bind to the directory with a SASL bind request.
+
+
+.. py:method:: LDAPObject.cancel( cancelid, [, serverctrls=None [, clientctrls=None]]) -> None
+
+   Send cancels extended operation for an LDAP operation specified by *cancelid*.
+   The *cancelid* should be the message id of an outstanding LDAP operation as returned
+   by the asynchronous methods search(), modify() etc.  The caller
+   can expect that the result of an abandoned operation will not be
+   returned from a future call to :py:meth:`result()`.
+   In opposite to :py:meth:`abandon()` this extended operation gets an result from
+   the server and thus should be preferred if the server supports it.
+
+   *serverctrls* and *clientctrls* like described above.
+
+   :rfc:`3909` - Lightweight Directory Access Protocol (LDAP): Cancel Operation
+
+
+.. py:method:: LDAPObject.compare(dn, attr, value) -> int
+
+.. py:method:: LDAPObject.compare_s(dn, attr, value) -> tuple
+
+.. py:method:: LDAPObject.compare_ext(dn, attr, value [, serverctrls=None [, clientctrls=None]]) -> int
+
+.. py:method:: LDAPObject.compare_ext_s(dn, attr, value [, serverctrls=None [, clientctrls=None]]) -> tuple
+
+   Perform an LDAP comparison between the attribute named *attr* of
+   entry *dn*, and the value *value*. The synchronous forms
+   returns :py:const:`0` for false, or :py:const:`1` for true.
+   The asynchronous forms returns the message ID of the initiated request,
+   and the result of the asynchronous compare can be obtained using
+   :py:meth:`result()`.
+
+   Note that the asynchronous technique yields the answer
+   by raising the exception objects :py:exc:`ldap.COMPARE_TRUE` or
+   :py:exc:`ldap.COMPARE_FALSE`.
+
+   *serverctrls* and *clientctrls* like described above.
+
+   .. note::
+
+      A design fault in the LDAP API prevents *value*
+      from containing *NULL* characters.
+
+
+.. py:method:: LDAPObject.delete(dn) -> int
+
+.. py:method::  LDAPObject.delete_s(dn) -> None
+
+.. py:method:: LDAPObject.delete_ext(dn [, serverctrls=None [, clientctrls=None]]) -> int
+
+.. py:method:: LDAPObject.delete_ext_s(dn [, serverctrls=None [, clientctrls=None]]) -> None
+
+   Performs an LDAP delete operation on *dn*. The asynchronous form
+   returns the message id of the initiated request, and the result can be obtained
+   from a subsequent call to :py:meth:`result()`.
+
+   *serverctrls* and *clientctrls* like described above.
+
+
+.. py:method:: extop(extreq[,serverctrls=None[,clientctrls=None]]]) -> int
+
+.. py:method:: extop_s(extreq[,serverctrls=None[,clientctrls=None[,extop_resp_class=None]]]]) -> (respoid,respvalue)
+
+   Performs an LDAP extended operation. The asynchronous
+   form returns the message id of the initiated request, and the
+   result can be obtained from a subsequent call to :py:meth:`extop_result()`.
+
+   The *extreq* is an instance of class :py:class:`ldap.extop.ExtendedRequest`
+   containing the parameters for the extended operation request.
+   
+   If argument *extop_resp_class* is set to a sub-class of
+   :py:class:`ldap.extop.ExtendedResponse` this class is used to return an
+   object of this class instead of a raw BER value in respvalue.
+
+.. py:method:: extop_result(self,msgid=ldap.RES_ANY,all=1,timeout=None) -> (respoid,respvalue)
+
+   Wrapper method around :py:meth:`result4()` just for retrieving
+   the result of an extended operation sent before.
+
+
+.. py:method:: LDAPObject.modify(dn, modlist) -> int
+
+.. py:method:: LDAPObject.modify_s(dn, modlist) -> None
+
+.. py:method:: LDAPObject.modify_ext(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> int
+
+.. py:method:: LDAPObject.modify_ext_s(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> None
+
+   Performs an LDAP modify operation on an entry's attributes.
+   The *dn* argument is the distinguished name (DN) of the entry to modify,
+   and *modlist* is a list of modifications to make to that entry.
+
+   Each element in the list *modlist* should be a tuple of the form
+   *(mod_op,mod_type,mod_vals)*,
+   where *mod_op* indicates the operation (one of :py:const:`ldap.MOD_ADD`,
+   :py:const:`ldap.MOD_DELETE`, or :py:const:`ldap.MOD_REPLACE`),
+   *mod_type* is a string indicating the attribute type name, and
+   *mod_vals* is either a string value or a list of string values to add,
+   delete or replace respectively.  For the delete operation, *mod_vals*
+   may be :py:const:`None` indicating that all attributes are to be deleted.
+
+   *serverctrls* and *clientctrls* like described above.
+
+   The asynchronous methods :py:meth:`modify()` and :py:meth:`modify_ext()`
+   return the message ID of the initiated request.
+
+   You might want to look into sub-module :py:mod:`ldap.modlist` for
+   generating *modlist*.
+
+
+.. py:method:: LDAPObject.modrdn(dn, newrdn [, delold=1]) -> int
+
+
+.. py:method::  LDAPObject.modrdn_s(dn, newrdn [, delold=1]) -> None
+
+   Perform a ``modify RDN`` operation, (i.e. a renaming operation).
+   These routines take *dn* (the DN of the entry whose RDN is to be changed,
+   and *newrdn*, the new RDN to give to the entry. The optional parameter
+   *delold* is used to specify whether the old RDN should be kept as an
+   attribute of the entry or not.
+   The asynchronous version returns the initiated message id.
+
+   This operation is emulated by :py:meth:`rename()` and :py:meth:`rename_s()` methods
+   since the modrdn2* routines in the C library are deprecated.
+
+
+.. py:method:: LDAPObject.passwd(user, oldpw, newpw [, serverctrls=None [, clientctrls=None]]) -> int
+
+.. py:method:: LDAPObject.passwd_s(user, oldpw, newpw [, serverctrls=None [, clientctrls=None]]) -> None
+
+   Perform a ``LDAP Password Modify Extended Operation`` operation
+   on the entry specified by *user*.
+   The old password in *oldpw* is replaced with the new
+   password in *newpw* by a LDAP server supporting this operation.
+
+   If *oldpw* is not :py:const:`None` it has to match the old password
+   of the specified *user* which is sometimes used when a user changes
+   his own password.
+
+   *serverctrls* and *clientctrls* like described above.
+
+   The asynchronous version returns the initiated message id.
+
+   .. seealso::
+
+      :rfc:`3062` - LDAP Password Modify Extended Operation
+
+
+
+.. py:method:: LDAPObject.rename(dn, newrdn [, newsuperior=None [, delold=1 [, serverctrls=None [, clientctrls=None]]]]) -> int
+
+.. py:method:: LDAPObject.rename_s(dn, newrdn [, newsuperior=None [, delold=1 [, serverctrls=None [, clientctrls=None]]]]) -> None
+
+   Perform a ``Rename`` operation, (i.e. a renaming operation).
+   These routines take *dn* (the DN of the entry whose RDN is to be changed,
+   and *newrdn*, the new RDN to give to the entry.
+   The optional parameter *newsuperior* is used to specify
+   a new parent DN for moving an entry in the tree
+   (not all LDAP servers support this).
+   The optional parameter *delold* is used to specify
+   whether the old RDN should be kept as an attribute of the entry or not.
+
+   *serverctrls* and *clientctrls* like described above.
+
+.. py:method:: LDAPObject.result([msgid=RES_ANY [, all=1 [, timeout=None]]]) -> 2-tuple
+
+   This method is used to wait for and return the result of an operation
+   previously initiated by one of the LDAP *asynchronous* operations
+   (eg :py:meth:`search()`, :py:meth:`modify()`, etc.)
+
+   The *msgid* parameter is the integer identifier returned by that method.
+   The identifier is guaranteed to be unique across an LDAP session,
+   and tells the :py:meth:`result()` method to request the result of that
+   specific operation.
+
+   If a result is desired from any one of the in-progress operations,
+   *msgid* should be specified as the constant :py:const:`RES_ANY`
+   and the method :py:meth:`result2()` should be used instead.
+
+   The *all* parameter only has meaning for :py:meth:`search()` responses
+   and is used to select whether a single entry of the search
+   response should be returned, or to wait for all the results
+   of the search before returning.
+
+   A search response is made up of zero or more search entries
+   followed by a search result. If *all* is 0, search entries will
+   be returned one at a time as they come in, via separate calls
+   to :py:meth:`result()`. If all is 1, the search response will be returned
+   in its entirety, i.e. after all entries and the final search
+   result have been received.
+
+   For *all* set to 0, result tuples
+   trickle in (with the same message id), and with the result types
+   :py:const:`RES_SEARCH_ENTRY` and :py:const:`RES_SEARCH_REFERENCE`,
+   until the final result which has a result type of :py:const:`RES_SEARCH_RESULT`
+   and a (usually) empty data field.  When all is set to 1, only one result is returned,
+   with a result type of RES_SEARCH_RESULT, and all the result tuples
+   listed in the data field.
+
+   The *timeout* parameter is a limit on the number of seconds that the
+   method will wait for a response from the server.
+   If *timeout* is negative (which is the default),
+   the method will wait indefinitely for a response.
+   The timeout can be expressed as a floating-point value, and
+   a value of :py:const:`0` effects a poll.
+   If a timeout does occur, a :py:exc:`ldap.TIMEOUT` exception is raised,
+   unless polling, in which case ``(None, None)`` is returned.
+
+   The :py:meth:`result()` method returns a tuple of the form
+   ``(result-type, result-data)``.
+   The first element, ``result-type`` is a string, being one of
+   these module constants:
+   :py:const:`RES_BIND`, :py:const:`RES_SEARCH_ENTRY`,
+   :py:const:`RES_SEARCH_REFERENCE`, :py:const:`RES_SEARCH_RESULT`,
+   :py:const:`RES_MODIFY`, :py:const:`RES_ADD`, :py:const:`RES_DELETE`,
+   :py:const:`RES_MODRDN`, or :py:const:`RES_COMPARE`.
+
+   If *all* is :py:const:`0`, one response at a time is returned on
+   each call to :py:meth:`result()`, with termination indicated by
+   ``result-data`` being an empty list.
+
+   See :py:meth:`search()` for a description of the search result's
+   ``result-data``, otherwise the ``result-data`` is normally meaningless.
+
+
+
+.. py:method:: LDAPObject.result2([msgid=RES_ANY [, all=1 [, timeout=None]]]) -> 3-tuple
+
+   This method behaves almost exactly like :py:meth:`result()`. But
+   it returns a 3-tuple also containing the message id of the
+   outstanding LDAP operation a particular result message belongs
+   to. This is especially handy if one needs to dispatch results
+   obtained with ``msgid=``:py:const:`RES_ANY` to several consumer
+   threads which invoked a particular LDAP operation.
+
+
+.. py:method:: LDAPObject.result3([msgid=RES_ANY [, all=1 [, timeout=None]]]) -> 4-tuple
+
+   This method behaves almost exactly like :py:meth:`result2()`. But it
+   returns an extra item in the tuple, the decoded server controls.
+
+.. py:method:: LDAPObject.result4([msgid=RES_ANY [, all=1 [, timeout=None [, add_ctrls=0 [, add_intermediates=0 [, add_extop=0 [, resp_ctrl_classes=None]]]]]]]) -> 6-tuple
+
+   This method behaves almost exactly like :py:meth:`result3()`. But it
+   returns an extra items in the tuple, the decoded results of an extended response.
+
+   The additional arguments are:
+
+   *add_ctrls* (integer flag) specifies whether response controls are returned.
+   
+   add_intermediates (integer flag) specifies whether response controls of
+   intermediate search results are returned.
+
+   *add_extop* (integer flag) specifies whether the response of an
+   extended operation is returned. If using extended operations you should
+   consider using the method :py:meth:`extop_result()` or
+   :py:meth:`extop_s()` instead.
+
+   *resp_ctrl_classes* is a dictionary mapping the OID of a response controls to a
+   :py:class:`ldap.controls.ResponseControl` class of response controls known by the
+   application. So the response control value will be automatically decoded.
+   If :py:const:`None` the global dictionary :py:data:`ldap.controls.KNOWN_RESPONSE_CONTROLS`
+   is used instead.
+
+.. py:method:: LDAPObject.search(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->int
+
+.. py:method:: LDAPObject.search_s(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->list|None
+
+.. py:method:: LDAPObject.search_st(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0 [, timeout=-1]]]]) -> list|None
+
+.. py:method:: LDAPObject.search_ext(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0 [, serverctrls=None [, clientctrls=None [, timeout=-1 [, sizelimit=0]]]]]]]) -> int
+
+.. py:method:: LDAPObject.search_ext_s(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0 [, serverctrls=None [, clientctrls=None [, timeout=-1 [, sizelimit=0]]]]]]]) -> list|None
+
+   Perform an LDAP search operation, with *base* as the DN of the entry
+   at which to start the search, *scope* being one of
+   :py:const:`SCOPE_BASE` (to search the object itself),
+   :py:const:`SCOPE_ONELEVEL` (to search the object's immediate children), or
+   :py:const:`SCOPE_SUBTREE` (to search the object and all its descendants).
+
+   The *filterstr* argument is a string representation of the filter to apply in
+   the search.
+
+   .. seealso::
+
+      :rfc:`4515` - Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters.
+
+
+   Each result tuple is of the form ``(dn, attrs)``,
+   where *dn* is a string containing the DN (distinguished name) of the
+   entry, and *attrs* is a dictionary containing the attributes associated
+   with the entry. The keys of *attrs* are strings, and the associated
+   values are lists of strings.
+
+   The DN in *dn* is automatically extracted using the underlying libldap
+   function :cfunc:`ldap_get_dn()`, which may raise an exception if the
+   DN is malformed.
+
+   If *attrsonly* is non-zero, the values of *attrs* will be meaningless
+   (they are not transmitted in the result).
+
+   The retrieved attributes can be limited with the *attrlist* parameter.
+   If *attrlist* is :py:const:`None`, all the attributes of each entry are returned.
+
+   *serverctrls* and *clientctrls* like described above.
+
+   The synchronous form with timeout, :py:meth:`search_st()` or :py:meth:`search_ext_s()`,
+   will block for at most *timeout* seconds (or indefinitely if *timeout*
+   is negative). A :py:exc:`ldap.TIMEOUT` exception is raised if no result is received
+   within the specified time.
+
+   The amount of search results retrieved can be limited with the
+   *sizelimit* parameter when using :py:meth:`search_ext()`
+   or :py:meth:`search_ext_s()` (client-side search limit). If non-zero
+   not more than *sizelimit* results are returned by the server.
+
+
+
+.. py:method:: LDAPObject.start_tls_s() -> None
+
+   Negotiate TLS with server. The ``version`` attribute must have been
+   set to :py:const:`VERSION3` (which it is by default) before calling this method.
+   If TLS could not be started an exception will be raised.
+
+  .. seealso::
+
+    :rfc:`2830` - Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security
+
+
+
+.. py:method:: LDAPObject.unbind() -> int
+
+.. py:method:: LDAPObject.unbind_s() -> None
+
+.. py:method:: LDAPObject.unbind_ext([, serverctrls=None [, clientctrls=None]]) -> int
+
+.. py:method:: LDAPObject.unbind_ext_s([, serverctrls=None [, clientctrls=None]]) -> None
+
+   This call is used to unbind from the directory, terminate the
+   current association, and free resources. Once called, the connection to the
+   LDAP server is closed and the LDAP object is marked invalid.
+   Further invocation of methods on the object will yield exceptions.
+
+   *serverctrls* and *clientctrls* like described above.
+
+   These methods are all synchronous in nature.
+
+
+.. py:method:: LDAPObject.whoami_s() -> string
+
+   This synchronous method implements the LDAP "Who Am I?"
+   extended operation.
+
+   It is useful for finding out to find out which identity
+   is assumed by the LDAP server after a SASL bind.
+
+   .. seealso::
+
+      :rfc:`4532` - Lightweight Directory Access Protocol (LDAP) "Who am I?" Operation
+
+
+Connection-specific LDAP options
+--------------------------------
+
+.. py:method:: LDAPObject.get_option(option) -> int|string
+
+   This method returns the value of the LDAPObject option
+   specified by *option*.
+
+
+.. py:method:: LDAPObject.set_option(option, invalue) -> None
+
+   This method sets the value of the LDAPObject option
+   specified by *option* to *invalue*.
+
+
+Object attributes
+-----------------
+
+If the underlying library provides enough information,
+each LDAP object will also have the following attributes.
+These attributes are mutable unless described as read-only.
+
+.. py:attribute:: LDAPObject.deref -> int
+
+   Controls whether aliases are automatically dereferenced.
+   This must be one of :py:const:`DEREF_NEVER`, :py:const:`DEREF_SEARCHING`,
+   :py:const:`DEREF_FINDING` or :py:const:`DEREF_ALWAYS`.
+   This option is mapped to option constant :py:const:`OPT_DEREF`
+   and used in the underlying OpenLDAP client lib.
+
+
+.. py:attribute:: LDAPObject.network_timeout -> int
+
+   Limit on waiting for a network response, in seconds.
+   Defaults to :py:const:`NO_LIMIT`.
+   This option is mapped to option constant :py:const:`OPT_NETWORK_TIMEOUT`
+   and used in the underlying OpenLDAP client lib.
+
+
+.. py:attribute:: LDAPObject.protocol_version -> int
+
+   Version of LDAP in use (either :py:const:`VERSION2` for LDAPv2
+   or :py:const:`VERSION3` for LDAPv3).
+   This option is mapped to option constant :py:const:`OPT_PROTOCOL_VERSION`
+   and used in the underlying OpenLDAP client lib.
+
+   .. note::
+
+      It is highly recommended to set the protocol version after establishing
+      a LDAP connection with :py:func:`ldap.initialize()` and before submitting
+      the first request.
+
+
+.. py:attribute:: LDAPObject.sizelimit -> int
+
+   Limit on size of message to receive from server.
+   Defaults to :py:const:`NO_LIMIT`.
+   This option is mapped to option constant :py:const:`OPT_SIZELIMIT`
+   and used in the underlying OpenLDAP client lib. Its use is deprecated
+   in favour of *sizelimit* parameter when using :py:meth:`search_ext()`.
+
+
+.. py:attribute:: LDAPObject.timelimit -> int
+
+   Limit on waiting for any response, in seconds.
+   Defaults to :py:const:`NO_LIMIT`.
+   This option is mapped to option constant :py:const:`OPT_TIMELIMIT`
+   and used in the underlying OpenLDAP client lib. Its use is deprecated
+   in favour of using :py:attr:`timeout`.
+
+
+.. py:attribute:: LDAPObject.timeout -> int
+
+   Limit on waiting for any response, in seconds.
+   Defaults to :py:const:`NO_LIMIT`.
+   This option is used in the wrapper module.
+
+
+.. _ldap-example:
+
+Example
+=======
+
+The following example demonstrates how to open a connection to an
+LDAP server using the :py:mod:`ldap` module and invoke a synchronous
+subtree search.
+
+>>> import ldap
+>>> l = ldap.initialize('ldap://localhost:1390')
+>>> l.search_s('ou=Testing,dc=stroeder,dc=de',ldap.SCOPE_SUBTREE,'(cn=fred*)',['cn','mail'])
+[('cn=Fred Feuerstein,ou=Testing,dc=stroeder,dc=de', {'cn': ['Fred Feuerstein']})]
+>>> r = l.search_s('ou=Testing,dc=stroeder,dc=de',ldap.SCOPE_SUBTREE,'(objectClass=*)',['cn','mail'])
+>>> for dn,entry in r:
+>>>   print 'Processing',repr(dn)
+>>>   handle_ldap_entry(entry)
+

From 6455849f82f7860188b641bdea3ce2145d9473c9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 11 Jan 2012 10:04:48 +0000
Subject: [PATCH 083/868] Fixed memory leak reported by David Malcolm

---
 Modules/errors.c | 219 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 219 insertions(+)
 create mode 100644 Modules/errors.c

diff --git a/Modules/errors.c b/Modules/errors.c
new file mode 100644
index 0000000..35e3dec
--- /dev/null
+++ b/Modules/errors.c
@@ -0,0 +1,219 @@
+/*
+ * errors that arise from ldap use
+ * Most errors become their own exception
+ * See http://www.python-ldap.org/ for details.
+ * $Id: errors.c,v 1.23 2012/01/11 10:04:48 stroeder Exp $ */
+
+#include "common.h"
+#include "errors.h"
+
+/* the base exception class */
+
+PyObject*
+LDAPexception_class;
+
+/* list of error objects */
+
+#define LDAP_ERROR_MIN          LDAP_REFERRAL_LIMIT_EXCEEDED
+
+#ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
+  #define LDAP_ERROR_MAX          LDAP_PROXIED_AUTHORIZATION_DENIED
+#else
+  #ifdef LDAP_ASSERTION_FAILED
+    #define LDAP_ERROR_MAX          LDAP_ASSERTION_FAILED
+  #else
+    #define LDAP_ERROR_MAX          LDAP_OTHER
+  #endif
+#endif
+
+#define LDAP_ERROR_OFFSET       -LDAP_ERROR_MIN
+
+static PyObject* errobjects[ LDAP_ERROR_MAX-LDAP_ERROR_MIN+1 ];
+
+
+/* Convert a bare LDAP error number into an exception */
+PyObject*
+LDAPerr(int errnum)
+{
+  if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
+    PyErr_SetNone(errobjects[errnum+LDAP_ERROR_OFFSET]);
+  else
+    PyErr_SetObject(LDAPexception_class, 
+    Py_BuildValue("{s:i}", "errnum", errnum));
+  return NULL;
+}
+
+/* Convert an LDAP error into an informative python exception */
+PyObject*
+LDAPerror( LDAP *l, char *msg ) 
+{
+  if (l == NULL) {
+    PyErr_SetFromErrno( LDAPexception_class );
+    return NULL;
+  }
+  else {
+    int errnum, opt_errnum;
+    PyObject *errobj;
+    PyObject *info;
+    PyObject *str;
+
+    char *matched, *error;
+
+    opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
+    if (opt_errnum != LDAP_OPT_SUCCESS)
+      errnum = opt_errnum;
+
+    if (errnum == LDAP_NO_MEMORY)
+      return PyErr_NoMemory();
+
+    if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
+      errobj = errobjects[errnum+LDAP_ERROR_OFFSET];
+    else
+      errobj = LDAPexception_class;
+    
+    info = PyDict_New();
+    if (info == NULL)
+      return NULL;
+
+    str = PyString_FromString(ldap_err2string(errnum));
+    if (str)
+      PyDict_SetItemString( info, "desc", str );
+    Py_XDECREF(str);
+
+    if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
+      && matched != NULL) {
+        if (*matched != '\0') {
+      str = PyString_FromString(matched);
+      if (str)
+          PyDict_SetItemString( info, "matched", str );
+      Py_XDECREF(str);
+        }
+        ldap_memfree(matched);
+    }
+    
+    if (errnum == LDAP_REFERRAL) {
+        str = PyString_FromString(msg);
+        if (str)
+      PyDict_SetItemString( info, "info", str );
+        Py_XDECREF(str);
+    } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0
+      && error != NULL) {
+        if (error != '\0') {
+      str = PyString_FromString(error);
+      if (str)
+          PyDict_SetItemString( info, "info", str );
+      Py_XDECREF(str);
+        }
+        ldap_memfree(error);
+    }
+    PyErr_SetObject( errobj, info );
+    Py_DECREF(info);
+    return NULL;
+  }
+}
+
+
+/* initialisation */
+
+void
+LDAPinit_errors( PyObject*d ) {
+
+        /* create the base exception class */
+        LDAPexception_class = PyErr_NewException("ldap.LDAPError",
+                                                  NULL,
+                                                  NULL);
+        PyDict_SetItemString( d, "LDAPError", LDAPexception_class );
+
+  /* XXX - backward compatibility with pre-1.8 */
+  PyDict_SetItemString( d, "error", LDAPexception_class );
+
+  /* create each LDAP error object */
+
+# define seterrobj2(n,o) \
+    PyDict_SetItemString( d, #n, (errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = o) )
+
+
+# define seterrobj(n) { \
+    PyObject *e = PyErr_NewException("ldap." #n,    \
+    LDAPexception_class, NULL);   \
+    seterrobj2(n, e);         \
+    Py_INCREF(e);           \
+  }
+
+  seterrobj(ADMINLIMIT_EXCEEDED);
+  seterrobj(AFFECTS_MULTIPLE_DSAS);
+  seterrobj(ALIAS_DEREF_PROBLEM);
+  seterrobj(ALIAS_PROBLEM);
+  seterrobj(ALREADY_EXISTS);
+  seterrobj(AUTH_UNKNOWN);
+  seterrobj(BUSY);
+  seterrobj(CLIENT_LOOP);
+  seterrobj(COMPARE_FALSE);
+  seterrobj(COMPARE_TRUE);
+  seterrobj(CONFIDENTIALITY_REQUIRED);
+  seterrobj(CONNECT_ERROR);
+  seterrobj(CONSTRAINT_VIOLATION);
+  seterrobj(CONTROL_NOT_FOUND);
+  seterrobj(DECODING_ERROR);
+  seterrobj(ENCODING_ERROR);
+  seterrobj(FILTER_ERROR);
+  seterrobj(INAPPROPRIATE_AUTH);
+  seterrobj(INAPPROPRIATE_MATCHING);
+  seterrobj(INSUFFICIENT_ACCESS);
+  seterrobj(INVALID_CREDENTIALS);
+  seterrobj(INVALID_DN_SYNTAX);
+  seterrobj(INVALID_SYNTAX);
+  seterrobj(IS_LEAF);
+  seterrobj(LOCAL_ERROR);
+  seterrobj(LOOP_DETECT);
+  seterrobj(MORE_RESULTS_TO_RETURN);
+  seterrobj(NAMING_VIOLATION);
+  seterrobj(NO_OBJECT_CLASS_MODS);
+  seterrobj(NOT_ALLOWED_ON_NONLEAF);
+  seterrobj(NOT_ALLOWED_ON_RDN);
+  seterrobj(NOT_SUPPORTED);
+  seterrobj(NO_MEMORY);
+  seterrobj(NO_OBJECT_CLASS_MODS);
+  seterrobj(NO_RESULTS_RETURNED);
+  seterrobj(NO_SUCH_ATTRIBUTE);
+  seterrobj(NO_SUCH_OBJECT);
+  seterrobj(OBJECT_CLASS_VIOLATION);
+  seterrobj(OPERATIONS_ERROR);
+  seterrobj(OTHER);
+  seterrobj(PARAM_ERROR);
+  seterrobj(PARTIAL_RESULTS);
+  seterrobj(PROTOCOL_ERROR);
+  seterrobj(REFERRAL);
+  seterrobj(REFERRAL_LIMIT_EXCEEDED);
+  seterrobj(RESULTS_TOO_LARGE);
+  seterrobj(SASL_BIND_IN_PROGRESS);
+  seterrobj(SERVER_DOWN);
+  seterrobj(SIZELIMIT_EXCEEDED);
+  seterrobj(STRONG_AUTH_NOT_SUPPORTED);
+  seterrobj(STRONG_AUTH_REQUIRED);
+  seterrobj(SUCCESS);
+  seterrobj(TIMELIMIT_EXCEEDED);
+  seterrobj(TIMEOUT);
+  seterrobj(TYPE_OR_VALUE_EXISTS);
+  seterrobj(UNAVAILABLE);
+  seterrobj(UNAVAILABLE_CRITICAL_EXTENSION);
+  seterrobj(UNDEFINED_TYPE);
+  seterrobj(UNWILLING_TO_PERFORM);
+  seterrobj(USER_CANCELLED);
+
+#ifdef LDAP_API_FEATURE_CANCEL
+  seterrobj(CANCELLED);
+  seterrobj(NO_SUCH_OPERATION);
+  seterrobj(TOO_LATE);
+  seterrobj(CANNOT_CANCEL);
+#endif
+
+#ifdef LDAP_ASSERTION_FAILED
+  seterrobj(ASSERTION_FAILED);
+#endif
+
+#ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
+  seterrobj(PROXIED_AUTHORIZATION_DENIED);
+#endif
+
+}

From c0d1fe899dcd59a464808df942ba09aa9ace9f39 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 25 Jan 2012 19:24:40 +0000
Subject: [PATCH 084/868] Another note about LDAPError instances

---
 TODO | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 TODO

diff --git a/TODO b/TODO
new file mode 100644
index 0000000..d205eb7
--- /dev/null
+++ b/TODO
@@ -0,0 +1,30 @@
+*** List of things to-do in no particular order ***
+
+General:
+- Define common Python style license for all modules
+- Support Python 3.2+
+
+Modules/
+- Specific support for more controls
+  - VLV control
+  - server-side sorting control
+- Wrap libldif as faster drop-in replacement for module ldif?
+- Attach response controls to LDAPError instances to deliver the
+  controls to the calling application in case of an error
+- Attach more useful information to LDAPError instances, e.g. the filter used
+  when doing a search in case of ldap.FILTER_ERROR etc.
+
+Lib/
+- Unicode support for DNs, filter strings, etc. but not entry attributes!
+(Everybody asking for the latter should check the mailing list archive first.)
+- Caching of search requests for each LDAPObject instance
+- LDIF parser for replication logs and change records
+- DSMLv2 support
+
+Tests/
+- Clean up and finish the mess of small test scripts started.
+- Create a test script that exercises everything with a server
+  holding the BLITS test data set
+
+------------------------------------------------------------------
+$Id: TODO,v 1.38 2012/01/25 19:24:40 stroeder Exp $

From d925c0a74af95ebc463c7322f492eb2ec5b71c92 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 21 Feb 2012 16:51:55 +0000
Subject: [PATCH 085/868] Added expirmental support for
 draft-vchu-ldap-pwd-policy

---
 Lib/ldap/controls/pwdpolicy.py | 41 ++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 Lib/ldap/controls/pwdpolicy.py

diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
new file mode 100644
index 0000000..81e4330
--- /dev/null
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.pwdpolicy - classes for Password Policy controls
+(see http://tools.ietf.org/html/draft-vchu-ldap-pwd-policy)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: pwdpolicy.py,v 1.1 2012/02/21 16:51:55 stroeder Exp $
+"""
+
+__all__ = [
+  'ExpirationWarningControl'
+]
+
+# Imports from python-ldap 2.4+
+import ldap.controls
+from ldap.controls import RequestControl,ResponseControl,ValueLessRequestControl,KNOWN_RESPONSE_CONTROLS
+
+
+class PasswordExpiringControl(OctetStringInteger):
+  """
+  Indicates time in seconds when password will expire
+  """
+  controlType = '2.16.840.1.113730.3.4.5'
+
+  def decodeControlValue(self,encodedControlValue):
+    self.gracePeriod = struct.unpack('!Q',encodedControlValue)[0]
+
+KNOWN_RESPONSE_CONTROLS[PasswordExpiringControl.controlType] = PasswordExpiringControl
+
+
+class PasswordExpiredControl(ResponseControl):
+  """
+  Indicates that password is expired
+  """
+  controlType = '2.16.840.1.113730.3.4.4'
+
+  def decodeControlValue(self,encodedControlValue):
+    self.passwordExpired = encodedControlValue=='0'
+
+KNOWN_RESPONSE_CONTROLS[PasswordExpiredControl.controlType] = PasswordExpiredControl

From 3261c5f3d3b721c9c312c12d999a81c33c55d50d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 21 Feb 2012 17:17:16 +0000
Subject: [PATCH 086/868] Hopefully smoother...

---
 setup.cfg | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 setup.cfg

diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 0000000..9ab58af
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,38 @@
+# Example for setup.cfg
+# You have to edit this file to reflect your system configuation
+#
+# $Id: setup.cfg,v 1.30 2012/02/21 17:17:16 stroeder Exp $
+
+# Section for compiling the C extension module
+# for wrapping OpenLDAP 2 libs
+[_ldap]
+
+# Define extra include and library dirs if needed
+library_dirs = /opt/openldap-RE24/lib /usr/lib
+include_dirs = /opt/openldap-RE24/include /usr/include/sasl /usr/include
+
+# These defines needs OpenLDAP built with
+# ./configure --with-cyrus-sasl --with-tls
+defines = HAVE_SASL HAVE_TLS HAVE_LIBLDAP_R
+
+extra_compile_args = 
+extra_objects = 
+
+# Example for full-featured build:
+# Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
+libs = ldap_r
+
+# Installation options
+[install]
+compile = 1
+optimize = 1
+
+# Linux distributors/packagers should adjust these settings
+[bdist_rpm]
+provides = python-ldap
+requires = python libldap-2_4
+vendor = python-ldap project
+packager = Michael Ströder
+distribution_name = openSUSE 11.x
+release = 1
+doc_files = CHANGES README INSTALL TODO Demo/

From b52476013de85b81bfc98d75df7208b40f0b6786 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 7 Jun 2012 18:38:06 +0000
Subject: [PATCH 087/868] Better version of Demo/pyasn1/syncrepl.py

---
 Demo/pyasn1/syncrepl.py | 170 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 170 insertions(+)
 create mode 100644 Demo/pyasn1/syncrepl.py

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
new file mode 100644
index 0000000..04fdc66
--- /dev/null
+++ b/Demo/pyasn1/syncrepl.py
@@ -0,0 +1,170 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+"""
+This script implements a syncrepl consumer which syncs data from an OpenLDAP
+server to a local (shelve) database.
+
+Notes:
+
+The bound user needs read access to the attributes entryDN and entryCSN.
+
+This needs the following software:
+Python
+pyasn1 0.1.4+
+pyasn1-modules
+python-ldap 2.4.10+
+"""
+
+# Import the python-ldap modules
+import ldap,ldapurl
+# Import specific classes from python-ldap
+from ldap.ldapobject import ReconnectLDAPObject
+from ldap.syncrepl import SyncreplConsumer
+
+# Import modules from Python standard lib
+import shelve,signal,time,sys,logging
+
+
+# Global state
+watcher_running = True
+ldap_connection = False
+
+
+class SyncReplConsumer(ReconnectLDAPObject,SyncreplConsumer):
+    """
+    Syncrepl Consumer interface
+    """
+
+    def __init__(self,db_path,*args,**kwargs):
+        # Initialise the LDAP Connection first
+        ldap.ldapobject.ReconnectLDAPObject.__init__(self, *args, **kwargs)
+        # Now prepare the data store
+        self.__data = shelve.open(db_path, 'c')
+        # We need this for later internal use
+        self.__presentUUIDs = dict()
+
+    def __del__(self):
+            # Close the data store properly to avoid corruption
+            self.__data.close()
+
+    def syncrepl_get_cookie(self):
+        if 'cookie' in self.__data:
+            return self.__data['cookie']
+
+    def syncrepl_set_cookie(self,cookie):
+        self.__data['cookie'] = cookie
+
+    def syncrepl_entry(self,dn,attributes,uuid):
+        # First we determine the type of change we have here (and store away the previous data for later if needed)
+        previous_attributes = dict()
+        if uuid in self.__data:
+            change_type = 'modify'
+            previous_attributes = self.__data[uuid]
+        else:
+            change_type = 'add'
+        # Now we store our knowledge of the existence of this entry (including the DN as an attribute for convenience)
+        attributes['dn'] = dn
+        self.__data[uuid] = attributes
+        # Debugging
+        print 'Detected', change_type, 'of entry:', dn
+        # If we have a cookie then this is not our first time being run, so it must be a change
+        if 'ldap_cookie' in self.__data:
+                self.perform_application_sync(dn, attributes, previous_attributes)
+
+    def syncrepl_delete(self,uuids):
+        # Make sure we know about the UUID being deleted, just in case...
+        uuids = [uuid for uuid in uuids if uuid in self.__data]
+        # Delete all the UUID values we know of
+        for uuid in uuids:
+            print 'Detected deletion of entry:', self.__data[uuid]['dn']
+            del self.__data[uuid]
+
+    def syncrepl_present(self,uuids,refreshDeletes=False):
+        # If we have not been given any UUID values, then we have recieved all the present controls...
+        if uuids is None:
+            # We only do things if refreshDeletes is false as the syncrepl extension will call syncrepl_delete instead when it detects a delete notice
+            if refreshDeletes is False:
+                deletedEntries = [uuid for uuid in self.__data.keys() if uuid not in self.__presentUUIDs and uuid != 'ldap_cookie']
+                self.syncrepl_delete( deletedEntries )
+            # Phase is now completed, reset the list
+            self.__presentUUIDs = {}
+        else:
+            # Note down all the UUIDs we have been sent
+            for uuid in uuids:
+                    self.__presentUUIDs[uuid] = True
+
+    def perform_application_sync(self,dn,attributes,previous_attributes):
+        print 'Performing application sync for:', dn
+        return True
+
+
+# Shutdown handler
+def commenceShutdown(signum, stack):
+    # Declare the needed global variables
+    global watcher_running, ldap_connection
+    print 'Shutting down!'
+
+    # We are no longer running
+    watcher_running = False
+
+    # Tear down the server connection
+    if( ldap_connection ):
+            del ldap_connection
+
+    # Shutdown
+    sys.exit(0)
+
+# Time to actually begin execution
+# Install our signal handlers
+signal.signal(signal.SIGTERM,commenceShutdown)
+signal.signal(signal.SIGINT,commenceShutdown)
+
+
+try:
+  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+  database_path = sys.argv[2]
+except IndexError,e:
+  print 'Usage: syncrepl-client.py <LDAP URL> <pathname of database>'
+  sys.exit(1)
+except ValueError,e:
+  print 'Error parsing command-line arguments:',str(e)
+  sys.exit(1)
+
+while watcher_running:
+    print 'Connecting to LDAP server now...'
+    # Prepare the LDAP server connection (triggers the connection as well)
+    ldap_connection = SyncReplConsumer(database_path,ldap_url.initializeUrl())
+
+    # Now we login to the LDAP server
+    try:
+        ldap_connection.simple_bind_s(ldap_url.who,ldap_url.cred)
+    except ldap.INVALID_CREDENTIALS, e:
+        print 'Login to LDAP server failed: ', str(e)
+        sys.exit(1)
+    except ldap.SERVER_DOWN:
+        print 'LDAP server is down, going to retry.'
+        time.sleep(5)
+        continue
+
+    # Commence the syncing
+    print 'Commencing sync process'
+    ldap_search = ldap_connection.syncrepl_search(
+      ldap_url.dn or '',
+      ldap_url.scope or ldap.SCOPE_SUBTREE,
+      mode = 'refreshAndPersist',
+      filterstr = ldap_url.filterstr or '(objectClass=*)'
+    )
+
+    try:
+        while ldap_connection.syncrepl_poll( all = 1, msgid = ldap_search):
+            pass
+    except KeyboardInterrupt:
+        # User asked to exit
+        commenceShutdown()
+        pass
+    except Exception, e:
+        # Handle any exception
+        if watcher_running:
+            print 'Encountered a problem, going to retry. Error:', str(e)
+            time.sleep(5)
+        pass

From c57880be37fb9b6778c8b298063a4cfd7034ce8a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 9 Aug 2012 07:01:20 +0000
Subject: [PATCH 088/868] Removed class attrs from
 AuthorizationIdentityRequestControl.__doc__

---
 Lib/ldap/controls/simple.py | 147 ++++++++++++++++++++++++++++++++++++
 1 file changed, 147 insertions(+)
 create mode 100644 Lib/ldap/controls/simple.py

diff --git a/Lib/ldap/controls/simple.py b/Lib/ldap/controls/simple.py
new file mode 100644
index 0000000..30e7dd3
--- /dev/null
+++ b/Lib/ldap/controls/simple.py
@@ -0,0 +1,147 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.simple - classes for some very simple LDAP controls
+
+See http://www.python-ldap.org/ for details.
+
+$Id: simple.py,v 1.9 2012/08/09 07:01:20 stroeder Exp $
+"""
+
+import struct,ldap
+from ldap.controls import RequestControl,ResponseControl,LDAPControl,KNOWN_RESPONSE_CONTROLS
+
+
+class ValueLessRequestControl(RequestControl):
+  """
+  Base class for controls without a controlValue.
+  The presence of the control in a LDAPv3 request changes the server's
+  behaviour when processing the request simply based on the controlType.
+
+  controlType
+    OID of the request control
+  criticality
+    criticality request control
+  """
+
+  def __init__(self,controlType=None,criticality=False):
+    self.controlType = controlType
+    self.criticality = criticality
+
+  def encodeControlValue(self):
+    return None
+
+
+class OctetStringInteger(LDAPControl):
+  """
+  Base class with controlValue being unsigend integer values
+  
+  integerValue
+    Integer to be sent as OctetString
+  """
+
+  def __init__(self,controlType=None,criticality=False,integerValue=None):
+    self.controlType = controlType
+    self.criticality = criticality
+    self.integerValue = integerValue
+
+  def encodeControlValue(self):
+    return struct.pack('!Q',self.integerValue)
+
+  def decodeControlValue(self,encodedControlValue):
+    self.integerValue = struct.unpack('!Q',encodedControlValue)[0]
+    
+
+class BooleanControl(LDAPControl):
+  """
+  Base class for simple request controls with boolean control value.
+
+  Constructor argument and class attribute:
+
+  booleanValue
+    Boolean (True/False or 1/0) which is the boolean controlValue.
+  """
+  boolean2ber = { 1:'\x01\x01\xFF', 0:'\x01\x01\x00' }
+  ber2boolean = { '\x01\x01\xFF':1, '\x01\x01\x00':0 }
+
+  def __init__(self,controlType=None,criticality=False,booleanValue=False):
+    self.controlType = controlType
+    self.criticality = criticality
+    self.booleanValue = booleanValue
+
+  def encodeControlValue(self):
+    return self.boolean2ber[int(self.booleanValue)]
+
+  def decodeControlValue(self,encodedControlValue):
+    self.booleanValue = self.ber2boolean[encodedControlValue]
+
+
+class ManageDSAITControl(ValueLessRequestControl):
+  """
+  Manage DSA IT Control
+  """
+
+  def __init__(self,criticality=False):
+    ValueLessRequestControl.__init__(self,ldap.CONTROL_MANAGEDSAIT,criticality=False)
+
+KNOWN_RESPONSE_CONTROLS[ldap.CONTROL_MANAGEDSAIT] = ManageDSAITControl
+
+
+class RelaxRulesControl(ValueLessRequestControl):
+  """
+  Relax Rules Control
+  """
+
+  def __init__(self,criticality=False):
+    ValueLessRequestControl.__init__(self,ldap.CONTROL_RELAX,criticality=False)
+
+KNOWN_RESPONSE_CONTROLS[ldap.CONTROL_RELAX] = RelaxRulesControl
+
+
+class ProxyAuthzControl(RequestControl):
+  """
+  Proxy Authorization Control
+  
+  authzId
+    string containing the authorization ID indicating the identity
+    on behalf which the server should process the request
+  """
+
+  def __init__(self,criticality,authzId):
+    RequestControl.__init__(self,ldap.CONTROL_PROXY_AUTHZ,criticality,authzId)
+
+
+class AuthorizationIdentityRequestControl(ValueLessRequestControl):
+  """
+  Authorization Identity Request and Response Controls
+  """
+  controlType = '2.16.840.1.113730.3.4.16'
+
+  def __init__(self,criticality):
+    ValueLessRequestControl.__init__(self,self.controlType,criticality)
+
+
+class AuthorizationIdentityResponseControl(ResponseControl):
+  """
+  Authorization Identity Request and Response Controls
+  
+  Class attributes:
+  
+  authzId
+    decoded authorization identity
+  """
+  controlType = '2.16.840.1.113730.3.4.15'
+
+  def decodeControlValue(self,encodedControlValue):
+    self.authzId = encodedControlValue
+
+
+KNOWN_RESPONSE_CONTROLS[AuthorizationIdentityResponseControl.controlType] = AuthorizationIdentityResponseControl
+
+
+class GetEffectiveRightsControl(RequestControl):
+  """
+  Get Effective Rights Control
+  """
+
+  def __init__(self,criticality,authzId=None):
+    RequestControl.__init__(self,'1.3.6.1.4.1.42.2.27.9.5.2',criticality,authzId)

From 2702f93074ca3f454443c8dbb4ad08467e38cf8c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 9 Aug 2012 07:18:31 +0000
Subject: [PATCH 089/868] Fixes for Sphinx doc generator

---
 Lib/ldap/syncrepl.py | 469 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 469 insertions(+)
 create mode 100644 Lib/ldap/syncrepl.py

diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
new file mode 100644
index 0000000..1d79bef
--- /dev/null
+++ b/Lib/ldap/syncrepl.py
@@ -0,0 +1,469 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.syncrepl - for implementing syncrepl consumer (see RFC 4533)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: syncrepl.py,v 1.3 2012/08/09 07:18:31 stroeder Exp $
+"""
+
+#__all__ = [
+#  '',
+#  '',
+#]
+
+from uuid import UUID
+
+# Imports from python-ldap 2.4+
+import ldap.ldapobject
+from ldap.controls import RequestControl,ResponseControl,KNOWN_RESPONSE_CONTROLS
+
+# Imports from pyasn1
+from pyasn1.type import tag,namedtype,namedval,univ,constraint
+from pyasn1.codec.ber import encoder,decoder
+
+__all__ = [ 'SyncreplConsumer' ]
+
+# RFC 4533:
+#
+#       syncUUID ::= OCTET STRING (SIZE(16))
+#       syncCookie ::= OCTET STRING
+
+class syncUUID(univ.OctetString):
+    subtypeSpec = constraint.ValueSizeConstraint(16,16)
+
+class syncCookie(univ.OctetString):
+    pass
+
+# 2.2.  Sync Request Control
+#
+#    The Sync Request Control is an LDAP Control [RFC4511] where the
+#    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.1 and the
+#    controlValue, an OCTET STRING, contains a BER-encoded
+#    syncRequestValue.  The criticality field is either TRUE or FALSE.
+#
+#       syncRequestValue ::= SEQUENCE {
+#           mode ENUMERATED {
+#               -- 0 unused
+#               refreshOnly       (1),
+#               -- 2 reserved
+#               refreshAndPersist (3)
+#           },
+#           cookie     syncCookie OPTIONAL,
+#           reloadHint BOOLEAN DEFAULT FALSE
+#       }
+#
+#    The Sync Request Control is only applicable to the SearchRequest
+#    Message.
+
+class syncRequestMode(univ.Enumerated):
+    namedValues = namedval.NamedValues(
+        ('refreshOnly', 1),
+        ('refreshAndPersist', 3)
+    )
+    subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(1,3)
+
+class syncRequestValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('mode', syncRequestMode()),
+        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.DefaultedNamedType('reloadHint', univ.Boolean(False))
+    )
+
+class SyncRequestControl(RequestControl):
+    controlType = '1.3.6.1.4.1.4203.1.9.1.1'
+
+    def __init__(self, criticality=1, cookie=None, mode='refreshOnly', reloadHint=False):
+        self.criticality = criticality
+        self.cookie = cookie
+        self.mode = mode
+        self.reloadHint = reloadHint
+
+    def encodeControlValue(self):
+        r = syncRequestValue()
+        r.setComponentByName('mode', syncRequestMode(self.mode))
+        if self.cookie is not None:
+            r.setComponentByName('cookie', syncCookie(self.cookie))
+        if self.reloadHint:
+            r.setComponentbyName('reloadHint', univ.Boolean(self.reloadHint))
+        return encoder.encode(r)
+
+# 2.3.  Sync State Control
+#
+#    The Sync State Control is an LDAP Control [RFC4511] where the
+#    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.2 and the
+#    controlValue, an OCTET STRING, contains a BER-encoded syncStateValue.
+#    The criticality is FALSE.
+#
+#       syncStateValue ::= SEQUENCE {
+#           state ENUMERATED {
+#               present (0),
+#               add (1),
+#               modify (2),
+#               delete (3)
+#           },
+#           entryUUID syncUUID,
+#           cookie    syncCookie OPTIONAL
+#       }
+#
+#    The Sync State Control is only applicable to SearchResultEntry and
+#    SearchResultReference Messages.
+
+class syncStateOp(univ.Enumerated):
+    namedValues = namedval.NamedValues(
+        ('present', 0),
+        ('add', 1),
+        ('modify', 2),
+        ('delete', 3)
+    )
+    subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(0,1,2,3)
+
+class syncStateValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('state', syncStateOp()),
+        namedtype.NamedType('entryUUID', syncUUID()),
+        namedtype.OptionalNamedType('cookie', syncCookie())
+    )
+
+class SyncStateControl(ResponseControl):
+    controlType = '1.3.6.1.4.1.4203.1.9.1.2'
+    opnames = ( 'present', 'add', 'modify', 'delete' )
+
+    def decodeControlValue(self, encodedControlValue):
+        d = decoder.decode(encodedControlValue, asn1Spec = syncStateValue())
+        state = d[0].getComponentByName('state')
+        uuid = UUID(bytes=d[0].getComponentByName('entryUUID'))
+        self.cookie = d[0].getComponentByName('cookie')
+        self.state = self.__class__.opnames[int(state)]
+        self.entryUUID = str(uuid)
+        if self.cookie is not None:
+            self.cookie = str(self.cookie)
+
+KNOWN_RESPONSE_CONTROLS[SyncStateControl.controlType] = SyncStateControl
+
+# 2.4.  Sync Done Control
+#
+#    The Sync Done Control is an LDAP Control [RFC4511] where the
+#    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.3 and the
+#    controlValue contains a BER-encoded syncDoneValue.  The criticality
+#    is FALSE (and hence absent).
+#
+#       syncDoneValue ::= SEQUENCE {
+#           cookie          syncCookie OPTIONAL,
+#           refreshDeletes  BOOLEAN DEFAULT FALSE
+#       }
+#
+#    The Sync Done Control is only applicable to the SearchResultDone
+#    Message.
+
+class syncDoneValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.DefaultedNamedType('refreshDeletes', univ.Boolean(False))
+    )
+
+class SyncDoneControl(ResponseControl):
+    controlType = '1.3.6.1.4.1.4203.1.9.1.3'
+
+    def decodeControlValue(self, encodedControlValue):
+        d = decoder.decode(encodedControlValue, asn1Spec = syncDoneValue())
+        self.cookie = d[0].getComponentByName('cookie')
+        self.refreshDeletes = d[0].getComponentByName('refreshDeletes')
+        if self.cookie is not None:
+            self.cookie = str(self.cookie)
+        if self.refreshDeletes is not None:
+            self.refreshDeletes = bool(self.refreshDeletes)
+
+KNOWN_RESPONSE_CONTROLS[SyncDoneControl.controlType] = SyncDoneControl
+
+
+# 2.5.  Sync Info Message
+#
+#    The Sync Info Message is an LDAP Intermediate Response Message
+#    [RFC4511] where responseName is the object identifier
+#    1.3.6.1.4.1.4203.1.9.1.4 and responseValue contains a BER-encoded
+#    syncInfoValue.  The criticality is FALSE (and hence absent).
+#
+#       syncInfoValue ::= CHOICE {
+#           newcookie      [0] syncCookie,
+#           refreshDelete  [1] SEQUENCE {
+#               cookie         syncCookie OPTIONAL,
+#               refreshDone    BOOLEAN DEFAULT TRUE
+#           },
+#           refreshPresent [2] SEQUENCE {
+#               cookie         syncCookie OPTIONAL,
+#               refreshDone    BOOLEAN DEFAULT TRUE
+#           },
+#           syncIdSet      [3] SEQUENCE {
+#               cookie         syncCookie OPTIONAL,
+#               refreshDeletes BOOLEAN DEFAULT FALSE,
+#               syncUUIDs      SET OF syncUUID
+#           }
+#       }
+#
+
+class refreshDelete(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.DefaultedNamedType('refreshDone', univ.Boolean(True))
+    )
+
+class refreshPresent(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.DefaultedNamedType('refreshDone', univ.Boolean(True))
+    )
+
+class syncUUIDs(univ.SetOf):
+    componentType = syncUUID()
+
+class syncIdSet(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.DefaultedNamedType('refreshDeletes', univ.Boolean(False)),
+        namedtype.NamedType('syncUUIDs', syncUUIDs())
+    )
+
+class syncInfoValue(univ.Choice):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType(
+            'newcookie',
+            syncCookie().subtype(
+                implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)
+            )
+        ),
+        namedtype.NamedType(
+            'refreshDelete',
+            refreshDelete().subtype(
+                implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)
+            )
+        ),
+        namedtype.NamedType(
+            'refreshPresent',
+            refreshPresent().subtype(
+                implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2)
+            )
+        ),
+        namedtype.NamedType(
+            'syncIdSet',
+            syncIdSet().subtype(
+                implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3)
+            )
+        )
+    )
+
+class SyncInfoMessage:
+    responseName = '1.3.6.1.4.1.4203.1.9.1.4'
+
+    def __init__(self, encodedMessage):
+        d = decoder.decode(encodedMessage, asn1Spec = syncInfoValue())
+        self.newcookie = None
+        self.refreshDelete = None
+        self.refreshPresent = None
+        self.syncIdSet = None
+
+        for attr in [ 'newcookie', 'refreshDelete', 'refreshPresent', 'syncIdSet']:
+            comp = d[0].getComponentByName(attr)
+
+            if comp is not None:
+
+                if attr == 'newcookie':
+                    self.newcookie = str(comp)
+                    return
+
+                val = dict()
+
+                cookie = comp.getComponentByName('cookie')
+                if cookie is not None:
+                    val['cookie'] = str(cookie)
+
+                if attr.startswith('refresh'):
+                    val['refreshDone'] = bool(comp.getComponentByName('refreshDone'))
+                elif attr == 'syncIdSet':
+                    uuids = []
+                    ids = comp.getComponentByName('syncUUIDs')
+                    for i in range(len(ids)):
+                        uuid = UUID(bytes=str(ids.getComponentByPosition(i)))
+                        uuids.append(str(uuid))
+                    val['syncUUIDs'] = uuids
+                    val['refreshDeletes'] = bool(comp.getComponentByName('refreshDeletes'))
+
+                setattr(self,attr,val)
+                return
+
+
+class SyncreplConsumer:
+    """
+    SyncreplConsumer - LDAP syncrepl consumer object.
+    """
+
+    def syncrepl_search(self, base, scope, mode='refreshOnly', cookie=None, **search_args):
+        """
+        Starts syncrepl search operation.
+
+        base, scope, and search_args are passed along to
+        self.search_ext unmodified (aside from adding a Sync
+        Request control to any serverctrls provided).
+
+        mode provides syncrepl mode. Can be 'refreshOnly'
+        to finish after synchronization, or
+        'refreshAndPersist' to persist (continue to
+        receive updates) after synchronization.
+
+        cookie: an opaque value representing the replication
+        state of the client.  Subclasses should override
+        the syncrepl_set_cookie() and syncrepl_get_cookie()
+        methods to store the cookie appropriately, rather than
+        passing it.
+
+        """
+        if cookie is None:
+            cookie = self.syncrepl_get_cookie()
+
+        syncreq = SyncRequestControl(cookie=cookie, mode=mode)
+
+        if 'serverctrls' in search_args:
+            search_args['serverctrls'] += [syncreq]
+        else:
+            search_args['serverctrls'] = [syncreq]
+
+        self.__refreshDone = False
+        return self.search_ext(base, scope, **search_args)
+
+
+    def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
+        """
+        polls for and processes responses to the syncrepl_search() operation.
+        Returns False when operation finishes, True if it is in progress, or
+        raises an exception on error.
+
+        If timeout is specified, raises ldap.TIMEOUT in the event of a timeout.
+
+        If all is set to a nonzero value, poll() will return only when finished
+        or when an exception is raised.
+
+        """
+        while True:
+            type, msg, mid, ctrls, n, v = self.result4(
+                    msgid=msgid, timeout=timeout,
+                    add_intermediates=1, add_ctrls=1, all = 0
+                    )
+
+            if type == 101:
+                # search result. This marks the end of a refreshOnly session.
+                # look for a SyncDone control, save the cookie, and if necessary
+                # delete non-present entries.
+                for c in ctrls:
+                    if c.__class__.__name__ != 'SyncDoneControl':
+                        continue
+                    self.syncrepl_present(None,refreshDeletes=c.refreshDeletes)
+                    if c.cookie is not None:
+                        self.syncrepl_set_cookie(c.cookie)
+
+                return False
+
+            elif type == 100:
+                # search entry with associated SyncState control
+                for m in msg:
+                    dn, attrs, ctrls = m
+                    for c in ctrls:
+                        if c.__class__.__name__ != 'SyncStateControl':
+                            continue
+                        if c.state == 'present':
+                            self.syncrepl_present([c.entryUUID])
+                        elif c.state == 'delete':
+                            self.syncrepl_delete([c.entryUUID])
+                        else:
+                            self.syncrepl_entry(dn, attrs, c.entryUUID)
+                            if self.__refreshDone is False:
+                                self.syncrepl_present([c.entryUUID])
+                        if c.cookie is not None:
+                            self.syncrepl_set_cookie(c.cookie)
+                        break
+
+            elif type == 121:
+                # Intermediate message. If it is a SyncInfoMessage, parse it
+                for m in msg:
+                    rname, resp, ctrls = m
+                    if rname != SyncInfoMessage.responseName:
+                        continue
+                    sim = SyncInfoMessage(resp)
+                    if sim.newcookie is not None:
+                        self.syncrepl_set_cookie(sim.newcookie)
+                    elif sim.refreshPresent is not None:
+                        self.syncrepl_present(None, refreshDeletes=False)
+                        if 'cookie' in sim.refreshPresent:
+                            self.syncrepl_set_cookie(sim.refreshPresent['cookie'])
+                        self.__refreshDone=sim.refreshPresent['refreshDone']
+                    elif sim.refreshDelete is not None:
+                        self.syncrepl_present(None, refreshDeletes=True)
+                        if 'cookie' in sim.refreshDelete:
+                            self.syncrepl_set_cookie(sim.refreshDelete['cookie'])
+                        self.__refreshDone=sim.refreshDelete['refreshDone']
+                    elif sim.syncIdSet is not None:
+                        if sim.syncIdSet['refreshDeletes'] is True:
+                            self.syncrepl_delete(sim.syncIdSet['syncUUIDs'])
+                        else:
+                            self.syncrepl_present(sim.syncIdSet['syncUUIDs'])
+                        if 'cookie' in sim.syncIdSet:
+                            self.syncrepl_set_cookie(sim.syncIdSet['cookie'])
+                        pass
+
+            if all == 0:
+                return True
+
+
+    # virtual methods -- subclass must override these to do useful work
+
+    def syncrepl_set_cookie(self, cookie):
+        """
+        Called by syncrepl_poll() to store a new cookie provided by the server.
+        """
+        pass
+
+    def syncrepl_get_cookie(self):
+        """
+        Called by syncrepl_search() to retreive the cookie stored by syncrepl_set_cookie()
+        """
+        pass
+
+    def syncrepl_present(self, uuids, refreshDeletes=False):
+        """
+        Called by syncrepl_poll() whenever entry UUIDs are presented to the client.
+        syncrepl_present() is given a list of entry UUIDs (uuids) and a flag
+        (refreshDeletes) which indicates whether the server explicitly deleted
+        non-present entries during the refresh operation.
+
+        If called with a list of uuids, the syncrepl_present() implementation
+        should record those uuids as present in the directory.
+
+        If called with uuids set to None and refreshDeletes set to False,
+        syncrepl_present() should delete all non-present entries from the local
+        mirror, and reset the list of recorded uuids.
+
+        If called with uuids set to None and refreshDeletes set to True,
+        syncrepl_present() should reset the list of recorded uuids, without
+        deleting any entries.
+
+        """
+        pass
+
+    def syncrepl_delete(self, uuids):
+        """
+        Called by syncrepl_poll() to delete entries. A list
+        of UUIDs of the entries to be deleted is given in the
+        uuids parameter.
+
+        """
+        pass
+
+    def syncrepl_entry(self, dn, attrs, uuid):
+        """
+        Called by syncrepl_poll() for any added or modified entries.
+
+        The provided uuid is used to identify the provided entry in
+        any future modification (including dn modification), deletion,
+        and presentation operations.
+
+        """
+        pass

From 2e6a9164ddc4e4d20862d9f09a20783fbfae4121 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 9 Aug 2012 07:19:12 +0000
Subject: [PATCH 090/868] release = '2.4.10.0

---
 Doc/conf.py | 135 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 135 insertions(+)
 create mode 100644 Doc/conf.py

diff --git a/Doc/conf.py b/Doc/conf.py
new file mode 100644
index 0000000..e46e992
--- /dev/null
+++ b/Doc/conf.py
@@ -0,0 +1,135 @@
+# -*- coding: utf-8 -*-
+#
+# python-ldap documentation build configuration file, created by
+# sphinx-quickstart on Sat Mar 29 15:08:17 2008.
+#
+# This file is execfile()d with the current directory set to its containing dir.
+#
+# The contents of this file are pickled, so don't put values in the namespace
+# that aren't pickleable (module imports are okay, they're removed automatically).
+#
+# All configuration values have a default value; values that are commented out
+# serve to show the default value.
+#
+# $Id: conf.py,v 1.18 2012/08/09 07:19:12 stroeder Exp $
+
+import sys
+
+# If your extensions are in another directory, add it here.
+#sys.path.append('some/directory')
+
+# General configuration
+# ---------------------
+
+# Add any Sphinx extension module names here, as strings. They can be extensions
+# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
+extensions = ['sphinx.ext.autodoc']
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['.templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General substitutions.
+project = 'python-ldap'
+copyright = '2008-2011, python-ldap project team'
+
+# The default replacements for |version| and |release|, also used in various
+# other places throughout the built documents.
+#
+# The short X.Y version.
+version = '2.4'
+# The full version, including alpha/beta/rc tags.
+release = '2.4.10.0'
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+#today = ''
+# Else, today_fmt is used as the format for a strftime call.
+today_fmt = '%B %d, %Y'
+
+# List of documents that shouldn't be included in the build.
+#unused_docs = []
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+#add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+#add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+#show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+
+# Options for HTML output
+# -----------------------
+
+# The style sheet to use for HTML and HTML Help pages. A file of that name
+# must exist either in Sphinx' static/ path, or in one of the custom paths
+# given in html_static_path.
+html_style = 'default.css'
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['.static']
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+html_last_updated_fmt = '%b %d, %Y'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+#html_use_smartypants = True
+
+# Content template for the index page.
+#html_index = ''
+
+# Custom sidebar templates, maps document names to template names.
+#html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+#html_additional_pages = {}
+
+# If false, no module index is generated.
+html_use_modindex = True
+
+# If true, the reST sources are included in the HTML build as _sources/<name>.
+#html_copy_source = True
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'python-ldap-doc'
+
+
+# Options for LaTeX output
+# ------------------------
+
+# The paper size ('letter' or 'a4').
+#latex_paper_size = 'letter'
+
+# The font size ('10pt', '11pt' or '12pt').
+#latex_font_size = '10pt'
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title, author, document class [howto/manual]).
+latex_documents = [('index', 'python-ldap.tex', 'python-ldap Documentation',
+                    'python-ldap project', 'manual')]
+
+# Additional stuff for the LaTeX preamble.
+#latex_preamble = ''
+
+# Documents to append as an appendix to all manuals.
+#latex_appendices = []
+
+# If false, no module index is generated.
+latex_use_modindex = True

From b4be8404755924e3b88594c7f47bc86ca6185319 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 9 Aug 2012 07:19:30 +0000
Subject: [PATCH 091/868] Fixed class names

---
 Doc/ldap-controls.rst | 211 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 211 insertions(+)
 create mode 100644 Doc/ldap-controls.rst

diff --git a/Doc/ldap-controls.rst b/Doc/ldap-controls.rst
new file mode 100644
index 0000000..00266e6
--- /dev/null
+++ b/Doc/ldap-controls.rst
@@ -0,0 +1,211 @@
+.. % $Id: ldap-controls.rst,v 1.11 2012/08/09 07:19:30 stroeder Exp $
+
+
+*********************************************************************
+:py:mod:`ldap.controls` High-level access to LDAPv3 extended controls
+*********************************************************************
+
+.. py:module:: ldap.controls
+   :synopsis: High-level access to LDAPv3 extended controls.
+.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+
+
+Variables
+=========
+
+.. py:data:: KNOWN_RESPONSE_CONTROLS
+
+   Dictionary mapping the OIDs of known response controls to the accompanying
+   :py:class:`ResponseControl` classes. This is used
+   by :py:func:`DecodeControlTuples` to automatically decode control values.
+   Calling application can also register their custom :py:class:`ResponseControl`
+   classes in this dictionary possibly overriding pre-registered classes.
+
+
+Classes
+=======
+
+This module defines the following classes:
+
+
+.. autoclass:: ldap.controls.RequestControl
+   :members:
+
+.. autoclass:: ldap.controls.ResponseControl
+   :members:
+
+.. autoclass:: ldap.controls.LDAPControl
+   :members:
+
+
+Functions
+=========
+
+This module defines the following functions:
+
+
+.. autofunction:: ldap.controls.RequestControlTuples
+
+.. autofunction:: ldap.controls.DecodeControlTuples
+
+
+Sub-modules
+===========
+
+Various sub-modules implement specific LDAPv3 extended controls. The classes
+therein are derived from the base-classes :py:class:`ldap.controls.RequestControl`,
+:py:class:`ldap.controls.ResponseControl` or :py:class:`ldap.controls.LDAPControl`.
+
+Some of them require :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed:
+
+Usually the names of the method arguments and the class attributes match
+the ASN.1 identifiers used in the specification. So looking at the referenced
+RFC or Internet-Draft is very helpful to understand the API.
+
+
+:py:mod:`ldap.controls.simple` Very simple controls
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.controls.simple
+   :synopsis: simple request and response controls implemented in pure Python
+
+
+.. autoclass:: ldap.controls.simple.ValueLessRequestControl
+   :members:
+
+.. autoclass:: ldap.controls.simple.OctetStringInteger
+   :members:
+
+.. autoclass:: ldap.controls.simple.BooleanControl
+   :members:
+
+.. autoclass:: ldap.controls.simple.ManageDSAITControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`3296` - Named Subordinate References in Lightweight Directory Access Protocol (LDAP) Directories
+
+.. autoclass:: ldap.controls.simple.RelaxRulesControl
+   :members:
+
+   .. seealso::
+
+      http://tools.ietf.org/draft/draft-zeilenga-ldap-relax/
+
+.. autoclass:: ldap.controls.simple.ProxyAuthzControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`4370` - Lightweight Directory Access Protocol (LDAP): Proxied Authorization Control
+
+.. autoclass:: ldap.controls.simple.AuthorizationIdentityRequestControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`3829` - Lightweight Directory Access Protocol (LDAP): Authorization Identity Request and Response Controls
+
+.. autoclass:: ldap.controls.simple.AuthorizationIdentityResponseControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`3829` - Lightweight Directory Access Protocol (LDAP): Authorization Identity Request and Response Controls
+
+.. autoclass:: ldap.controls.simple.GetEffectiveRightsControl
+   :members:
+
+
+
+:py:mod:`ldap.controls.libldap` Various controls implemented in OpenLDAP libs
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+
+.. py:module:: ldap.controls.libldap
+   :synopsis: request and response controls implemented by OpenLDAP libs
+
+This module wraps C functions in OpenLDAP client libs which implement various
+request and response controls into Python classes.
+
+
+.. autoclass:: ldap.controls.libldap.AssertionControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`4528` - Lightweight Directory Access Protocol (LDAP) Assertion Control
+
+
+.. autoclass:: ldap.controls.libldap.MatchedValuesControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`3876` - Returning Matched Values with the Lightweight Directory Access Protocol version 3 (LDAPv3)
+
+
+.. autoclass:: ldap.controls.libldap.SimplePagedResultsControl
+   :members:
+
+   .. seealso::
+
+      :rfc:`2696` - LDAP Control Extension for Simple Paged Results Manipulation
+
+
+:py:mod:`ldap.controls.psearch` LDAP Persistent Search
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.controls.psearch
+   :synopsis: request and response controls for LDAP persistent search
+
+This module implements request and response controls for LDAP persistent
+search.
+
+.. seealso::
+
+   http://tools.ietf.org/html/draft-ietf-ldapext-psearch
+
+
+.. autoclass:: ldap.controls.psearch.PersistentSearchControl
+   :members:
+
+.. autoclass:: ldap.controls.psearch.EntryChangeNotificationControl
+   :members:
+
+
+:py:mod:`ldap.controls.sessiontrack` Session tracking control
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.controls.sessiontrack
+   :synopsis: request control for session tracking
+
+.. seealso::
+
+   http://tools.ietf.org/html/draft-wahl-ldap-session
+
+
+.. autoclass:: ldap.controls.sessiontrack.SessionTrackingControl
+   :members:
+
+
+:py:mod:`ldap.controls.readentry` Read entry control
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.controls.readentry
+   :synopsis: read entryrequest and response controls
+
+.. seealso::
+
+   :rfc:`4527` - Lightweight Directory Access Protocol (LDAP): Read Entry Controls
+
+
+.. autoclass:: ldap.controls.readentry.ReadEntryControl
+   :members:
+
+.. autoclass:: ldap.controls.readentry.PreReadControl
+   :members:
+
+.. autoclass:: ldap.controls.readentry.PostReadControl
+   :members:

From 9f23f3e06c36f1109b7371d0a65f47730ea3fbcb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 13 Dec 2012 08:22:48 +0000
Subject: [PATCH 092/868] Corrected description for class attribute 'kind' in
 ldap.schema.models.ObjectClass.__doc__

---
 Lib/ldap/schema/models.py | 742 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 742 insertions(+)
 create mode 100644 Lib/ldap/schema/models.py

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
new file mode 100644
index 0000000..0d52e39
--- /dev/null
+++ b/Lib/ldap/schema/models.py
@@ -0,0 +1,742 @@
+"""
+schema.py - support for subSchemaSubEntry information
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: models.py,v 1.46 2012/12/13 08:22:48 stroeder Exp $
+"""
+
+import UserDict,ldap.cidict
+
+from ldap.schema.tokenizer import split_tokens,extract_tokens
+
+if __debug__:
+  from types import TupleType,StringType,IntType
+  try:
+    from types import BooleanType
+  except ImportError:
+    BooleanType = IntType
+
+
+NOT_HUMAN_READABLE_LDAP_SYNTAXES = {
+  '1.3.6.1.4.1.1466.115.121.1.4':None,  # Audio
+  '1.3.6.1.4.1.1466.115.121.1.5':None,  # Binary
+  '1.3.6.1.4.1.1466.115.121.1.8':None,  # Certificate
+  '1.3.6.1.4.1.1466.115.121.1.9':None,  # Certificate List
+  '1.3.6.1.4.1.1466.115.121.1.10':None, # Certificate Pair
+  '1.3.6.1.4.1.1466.115.121.1.23':None, # G3 FAX
+  '1.3.6.1.4.1.1466.115.121.1.28':None, # JPEG
+  '1.3.6.1.4.1.1466.115.121.1.40':None, # Octet String
+  '1.3.6.1.4.1.1466.115.121.1.49':None, # Supported Algorithm
+}
+
+
+class SchemaElement:
+  """
+  Base class for all schema element classes. Not used directly!
+
+  Arguments:
+  
+  schema_element_str
+    String which contains the schema element description to be parsed.
+
+  Class attributes:
+
+  schema_attribute
+    LDAP attribute type containing a certain schema element description
+  token_defaults
+    Dictionary internally used by the schema element parser
+    containing the defaults for certain schema description key-words
+  """
+  token_defaults = {
+    'DESC':(None,),
+  }
+  
+  def __init__(self,schema_element_str=None):
+    if schema_element_str:
+      l = split_tokens(schema_element_str,self.token_defaults)
+      self.set_id(l[1])
+      d = extract_tokens(l,self.token_defaults)
+      self._set_attrs(l,d)
+
+  def _set_attrs(self,l,d):
+    self.desc = d['DESC'][0]
+    return
+
+  def set_id(self,element_id):
+    self.oid = element_id
+
+  def get_id(self):
+    return self.oid
+
+  def key_attr(self,key,value,quoted=0):
+    assert value is None or type(value)==StringType,TypeError("value has to be of StringType, was %s" % repr(value))
+    if value:
+      if quoted:        
+        return " %s '%s'" % (key,value.replace("'","\\'"))
+      else:
+        return " %s %s" % (key,value)
+    else:
+      return ""
+
+  def key_list(self,key,values,sep=' ',quoted=0):
+    assert type(values)==TupleType,TypeError("values has to be of ListType")
+    if not values:
+      return ''
+    if quoted:
+      quoted_values = [ "'%s'" % value.replace("'","\\'") for value in values ]
+    else:
+      quoted_values = values
+    if len(values)==1:
+      return ' %s %s' % (key,quoted_values[0])
+    else:
+      return ' %s ( %s )' % (key,sep.join(quoted_values))
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    return '( %s )' % ''.join(result)
+
+
+class ObjectClass(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an ObjectClassDescription
+
+  Class attributes:
+
+  oid
+    OID assigned to the object class
+  names
+    This list of strings contains all NAMEs of the object class
+  desc
+    This string contains description text (DESC) of the object class
+  obsolete
+    Integer flag (0 or 1) indicating whether the object class is marked
+    as OBSOLETE in the schema
+  must
+    This list of strings contains NAMEs or OIDs of all attributes
+    an entry of the object class must have
+  may
+    This list of strings contains NAMEs or OIDs of additional attributes
+    an entry of the object class may have
+  kind
+    Kind of an object class:
+    0 = STRUCTURAL,
+    1 = ABSTRACT,
+    2 = AUXILIARY
+  sup
+    This list of strings contains NAMEs or OIDs of object classes
+    this object class is derived from
+  """
+  schema_attribute = 'objectClasses'
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'SUP':(()),
+    'STRUCTURAL':None,
+    'AUXILIARY':None,
+    'ABSTRACT':None,
+    'MUST':(()),
+    'MAY':()
+  }
+
+  def _set_attrs(self,l,d):
+    self.obsolete = d['OBSOLETE']!=None
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.must = d['MUST']
+    self.may = d['MAY']
+    # Default is STRUCTURAL, see RFC2552 or draft-ietf-ldapbis-syntaxes
+    self.kind = 0
+    if d['ABSTRACT']!=None:
+      self.kind = 1
+    elif d['AUXILIARY']!=None:
+      self.kind = 2
+    if self.kind==0 and not d['SUP'] and self.oid!='2.5.6.0':
+      # STRUCTURAL object classes are sub-classes of 'top' by default
+      self.sup = ('top',)
+    else:
+      self.sup = d['SUP']
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert type(self.sup)==TupleType
+    assert type(self.kind)==IntType
+    assert type(self.must)==TupleType
+    assert type(self.may)==TupleType
+    return
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append(self.key_list('SUP',self.sup,sep=' $ '))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append({0:' STRUCTURAL',1:' ABSTRACT',2:' AUXILIARY'}[self.kind])
+    result.append(self.key_list('MUST',self.must,sep=' $ '))
+    result.append(self.key_list('MAY',self.may,sep=' $ '))
+    return '( %s )' % ''.join(result)
+
+
+AttributeUsage = ldap.cidict.cidict({
+  'userApplication':0, # work-around for non-compliant schema
+  'userApplications':0,
+  'directoryOperation':1,
+  'distributedOperation':2,
+  'dSAOperation':3,
+})
+
+
+class AttributeType(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an AttributeTypeDescription
+
+  Class attributes:
+
+  oid
+    OID assigned to the attribute type
+  names
+    This list of strings contains all NAMEs of the attribute type
+  desc
+    This string contains description text (DESC) of the attribute type
+  obsolete
+    Integer flag (0 or 1) indicating whether the attribute type is marked
+    as OBSOLETE in the schema
+  single_value
+    Integer flag (0 or 1) indicating whether the attribute must
+    have only one value
+  syntax
+    String contains OID of the LDAP syntax assigned to the attribute type
+  no_user_mod
+    Integer flag (0 or 1) indicating whether the attribute is modifiable
+    by a client application
+  equality
+    String contains NAME or OID of the matching rule used for
+    checking whether attribute values are equal
+  substr
+    String contains NAME or OID of the matching rule used for
+    checking whether an attribute value contains another value
+  ordering
+    String contains NAME or OID of the matching rule used for
+    checking whether attribute values are lesser-equal than
+  usage
+    USAGE of an attribute type:
+    0 = userApplications
+    1 = directoryOperation,
+    2 = distributedOperation,
+    3 = dSAOperation
+  sup
+    This list of strings contains NAMEs or OIDs of attribute types
+    this attribute type is derived from
+  """
+  schema_attribute = 'attributeTypes'
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'SUP':(()),
+    'EQUALITY':(None,),
+    'ORDERING':(None,),
+    'SUBSTR':(None,),
+    'SYNTAX':(None,),
+    'SINGLE-VALUE':None,
+    'COLLECTIVE':None,
+    'NO-USER-MODIFICATION':None,
+    'USAGE':('userApplications',)
+  }
+
+  def _set_attrs(self,l,d):
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.obsolete = d['OBSOLETE']!=None
+    self.sup = d['SUP']
+    self.equality = d['EQUALITY'][0]
+    self.ordering = d['ORDERING'][0]
+    self.substr = d['SUBSTR'][0]
+    try:
+      syntax = d['SYNTAX'][0]
+    except IndexError:
+      self.syntax = None
+      self.syntax_len = None
+    else:
+      if syntax is None:
+        self.syntax = None
+        self.syntax_len = None
+      else:
+        try:
+          self.syntax,syntax_len = d['SYNTAX'][0].split("{")
+        except ValueError:
+          self.syntax = d['SYNTAX'][0]
+          self.syntax_len = None
+          for i in l:
+            if i.startswith("{") and i.endswith("}"):
+              self.syntax_len=long(i[1:-1])
+        else:
+          self.syntax_len = long(syntax_len[:-1])
+    self.single_value = d['SINGLE-VALUE']!=None
+    self.collective = d['COLLECTIVE']!=None
+    self.no_user_mod = d['NO-USER-MODIFICATION']!=None
+    self.usage = AttributeUsage.get(d['USAGE'][0],0)
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.sup)==TupleType,'attribute sup has type %s' % (type(self.sup))
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert type(self.single_value)==BooleanType and (self.single_value==0 or self.single_value==1)
+    assert type(self.no_user_mod)==BooleanType and (self.no_user_mod==0 or self.no_user_mod==1)
+    assert self.syntax is None or type(self.syntax)==StringType
+    assert self.syntax_len is None or type(self.syntax_len)==type(0L)
+    return
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append(self.key_list('SUP',self.sup,sep=' $ '))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append(self.key_attr('EQUALITY',self.equality))
+    result.append(self.key_attr('ORDERING',self.ordering))
+    result.append(self.key_attr('SUBSTR',self.substr))
+    result.append(self.key_attr('SYNTAX',self.syntax))
+    if self.syntax_len!=None:
+      result.append(('{%d}' % (self.syntax_len))*(self.syntax_len>0))
+    result.append({0:'',1:' SINGLE-VALUE'}[self.single_value])
+    result.append({0:'',1:' COLLECTIVE'}[self.collective])
+    result.append({0:'',1:' NO-USER-MODIFICATION'}[self.no_user_mod])
+    result.append(
+      {
+        0:"",
+        1:" USAGE directoryOperation",
+        2:" USAGE distributedOperation",
+        3:" USAGE dSAOperation",
+      }[self.usage]
+    )
+    return '( %s )' % ''.join(result)
+
+
+class LDAPSyntax(SchemaElement):
+  """
+  SyntaxDescription
+
+  oid
+    OID assigned to the LDAP syntax
+  desc
+    This string contains description text (DESC) of the LDAP syntax
+  not_human_readable
+    Integer flag (0 or 1) indicating whether the attribute type is marked
+    as not human-readable (X-NOT-HUMAN-READABLE)  
+  """
+  schema_attribute = 'ldapSyntaxes'
+  token_defaults = {
+    'DESC':(None,),
+    'X-NOT-HUMAN-READABLE':(None,),
+  }
+
+  def _set_attrs(self,l,d):
+    self.desc = d['DESC'][0]
+    self.not_human_readable = \
+      NOT_HUMAN_READABLE_LDAP_SYNTAXES.has_key(self.oid) or \
+      d['X-NOT-HUMAN-READABLE'][0]=='TRUE'
+    assert self.desc is None or type(self.desc)==StringType
+    return
+                                  
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append(
+      {0:'',1:" X-NOT-HUMAN-READABLE 'TRUE'"}[self.not_human_readable]
+    )
+    return '( %s )' % ''.join(result)
+
+
+class MatchingRule(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an MatchingRuleDescription
+
+  Class attributes:
+
+  oid
+    OID assigned to the matching rule
+  names
+    This list of strings contains all NAMEs of the matching rule
+  desc
+    This string contains description text (DESC) of the matching rule
+  obsolete
+    Integer flag (0 or 1) indicating whether the matching rule is marked
+    as OBSOLETE in the schema
+  syntax
+    String contains OID of the LDAP syntax this matching rule is usable with
+  """
+  schema_attribute = 'matchingRules'
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'SYNTAX':(None,),
+  }
+
+  def _set_attrs(self,l,d):
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.obsolete = d['OBSOLETE']!=None
+    self.syntax = d['SYNTAX'][0]
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert self.syntax is None or type(self.syntax)==StringType
+    return
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append(self.key_attr('SYNTAX',self.syntax))
+    return '( %s )' % ''.join(result)
+
+
+class MatchingRuleUse(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an MatchingRuleUseDescription
+
+  Class attributes:
+
+  oid
+    OID of the accompanying matching rule
+  names
+    This list of strings contains all NAMEs of the matching rule
+  desc
+    This string contains description text (DESC) of the matching rule
+  obsolete
+    Integer flag (0 or 1) indicating whether the matching rule is marked
+    as OBSOLETE in the schema
+  applies
+    This list of strings contains NAMEs or OIDs of attribute types
+    for which this matching rule is used
+  """
+  schema_attribute = 'matchingRuleUse'
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'APPLIES':(()),
+  }
+
+  def _set_attrs(self,l,d):
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.obsolete = d['OBSOLETE']!=None
+    self.applies = d['APPLIES']
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert type(self.applies)==TupleType
+    return
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append(self.key_list('APPLIES',self.applies,sep=' $ '))
+    return '( %s )' % ''.join(result)
+
+
+class DITContentRule(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an DITContentRuleDescription
+
+  Class attributes:
+
+  oid
+    OID of the accompanying structural object class
+  names
+    This list of strings contains all NAMEs of the DIT content rule
+  desc
+    This string contains description text (DESC) of the DIT content rule
+  obsolete
+    Integer flag (0 or 1) indicating whether the DIT content rule is marked
+    as OBSOLETE in the schema
+  aux
+    This list of strings contains NAMEs or OIDs of all auxiliary
+    object classes usable in an entry of the object class
+  must
+    This list of strings contains NAMEs or OIDs of all attributes
+    an entry of the object class must have which may extend the
+    list of required attributes of the object classes of an entry
+  may
+    This list of strings contains NAMEs or OIDs of additional attributes
+    an entry of the object class may have which may extend the
+    list of optional attributes of the object classes of an entry
+  nots
+    This list of strings contains NAMEs or OIDs of attributes which
+    may not be present in an entry of the object class
+  """
+  schema_attribute = 'dITContentRules'
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'AUX':(()),
+    'MUST':(()),
+    'MAY':(()),
+    'NOT':(()),
+  }
+
+  def _set_attrs(self,l,d):
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.obsolete = d['OBSOLETE']!=None
+    self.aux = d['AUX']
+    self.must = d['MUST']
+    self.may = d['MAY']
+    self.nots = d['NOT']
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert type(self.aux)==TupleType
+    assert type(self.must)==TupleType
+    assert type(self.may)==TupleType
+    assert type(self.nots)==TupleType
+    return
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append(self.key_list('AUX',self.aux,sep=' $ '))
+    result.append(self.key_list('MUST',self.must,sep=' $ '))
+    result.append(self.key_list('MAY',self.may,sep=' $ '))
+    result.append(self.key_list('NOT',self.nots,sep=' $ '))
+    return '( %s )' % ''.join(result)
+
+
+class DITStructureRule(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an DITStructureRuleDescription
+
+  Class attributes:
+
+  ruleid
+    rule ID of the DIT structure rule (only locally unique)
+  names
+    This list of strings contains all NAMEs of the DIT structure rule
+  desc
+    This string contains description text (DESC) of the DIT structure rule
+  obsolete
+    Integer flag (0 or 1) indicating whether the DIT content rule is marked
+    as OBSOLETE in the schema
+  form
+    List of strings with NAMEs or OIDs of associated name forms
+  sup
+    List of strings with NAMEs or OIDs of allowed structural object classes
+    of superior entries in the DIT
+  """
+  schema_attribute = 'dITStructureRules'
+
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'FORM':(None,),
+    'SUP':(()),
+  }
+
+  def set_id(self,element_id):
+    self.ruleid = element_id
+
+  def get_id(self):
+    return self.ruleid
+
+  def _set_attrs(self,l,d):
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.obsolete = d['OBSOLETE']!=None
+    self.form = d['FORM'][0]
+    self.sup = d['SUP']
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert type(self.form)==StringType
+    assert type(self.sup)==TupleType
+    return
+
+  def __str__(self):
+    result = [str(self.ruleid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append(self.key_attr('FORM',self.form,quoted=0))
+    result.append(self.key_list('SUP',self.sup,sep=' $ '))
+    return '( %s )' % ''.join(result)
+
+
+class NameForm(SchemaElement):
+  """
+  Arguments:
+  
+  schema_element_str
+    String containing an NameFormDescription
+
+  Class attributes:
+
+  oid
+    OID of the name form
+  names
+    This list of strings contains all NAMEs of the name form
+  desc
+    This string contains description text (DESC) of the name form
+  obsolete
+    Integer flag (0 or 1) indicating whether the name form is marked
+    as OBSOLETE in the schema
+  form
+    List of strings with NAMEs or OIDs of associated name forms
+  oc
+    String with NAME or OID of structural object classes this name form
+    is usable with
+  must
+    This list of strings contains NAMEs or OIDs of all attributes
+    an RDN must contain
+  may
+    This list of strings contains NAMEs or OIDs of additional attributes
+    an RDN may contain
+  """
+  schema_attribute = 'nameForms'
+  token_defaults = {
+    'NAME':(()),
+    'DESC':(None,),
+    'OBSOLETE':None,
+    'OC':(None,),
+    'MUST':(()),
+    'MAY':(()),
+  }
+
+  def _set_attrs(self,l,d):
+    self.names = d['NAME']
+    self.desc = d['DESC'][0]
+    self.obsolete = d['OBSOLETE']!=None
+    self.oc = d['OC'][0]
+    self.must = d['MUST']
+    self.may = d['MAY']
+    assert type(self.names)==TupleType
+    assert self.desc is None or type(self.desc)==StringType
+    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
+    assert type(self.oc)==StringType
+    assert type(self.must)==TupleType
+    assert type(self.may)==TupleType
+    return
+
+  def __str__(self):
+    result = [str(self.oid)]
+    result.append(self.key_list('NAME',self.names,quoted=1))
+    result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append({0:'',1:' OBSOLETE'}[self.obsolete])
+    result.append(self.key_attr('OC',self.oc))
+    result.append(self.key_list('MUST',self.must,sep=' $ '))
+    result.append(self.key_list('MAY',self.may,sep=' $ '))
+    return '( %s )' % ''.join(result)
+
+
+class Entry(UserDict.UserDict):
+  """
+  Schema-aware implementation of an LDAP entry class.
+  
+  Mainly it holds the attributes in a string-keyed dictionary with
+  the OID as key.
+  """
+
+  def __init__(self,schema,dn,entry):
+    self._keytuple2attrtype = {}
+    self._attrtype2keytuple = {}
+    self._s = schema
+    self.dn = dn
+    UserDict.UserDict.__init__(self,{})
+    self.update(entry)
+
+  def _at2key(self,nameoroid):
+    """
+    Return tuple of OID and all sub-types of attribute type specified
+    in nameoroid.
+    """
+    try:
+      # Mapping already in cache
+      return self._attrtype2keytuple[nameoroid]
+    except KeyError:
+      # Mapping has to be constructed
+      oid = self._s.getoid(ldap.schema.AttributeType,nameoroid)
+      l = nameoroid.lower().split(';')
+      l[0] = oid
+      t = tuple(l)
+      self._attrtype2keytuple[nameoroid] = t
+      return t
+
+  def update(self,dict):
+    for key in dict.keys():
+      self[key] = dict[key]
+
+  def __contains__(self,key):
+    return self.has_key(key)
+
+  def __getitem__(self,nameoroid):
+    return self.data[self._at2key(nameoroid)]
+
+  def __setitem__(self,nameoroid,attr_values):
+    k = self._at2key(nameoroid)
+    self._keytuple2attrtype[k] = nameoroid
+    self.data[k] = attr_values
+
+  def __delitem__(self,nameoroid):
+    k = self._at2key(nameoroid)
+    del self.data[k]
+    del self._attrtype2keytuple[nameoroid]
+    del self._keytuple2attrtype[k]
+
+  def has_key(self,nameoroid):
+    k = self._at2key(nameoroid)
+    return self.data.has_key(k)
+
+  def get(self,nameoroid,failobj):
+    try:
+      return self[nameoroid]
+    except KeyError:
+      return failobj
+
+  def keys(self):
+    return self._keytuple2attrtype.values()
+
+  def items(self):
+    return [
+      (k,self[k])
+      for k in self.keys()
+    ]
+
+  def attribute_types(
+    self,attr_type_filter=None,raise_keyerror=1
+  ):
+    """
+    Convenience wrapper around SubSchema.attribute_types() which
+    passes object classes of this particular entry as argument to
+    SubSchema.attribute_types()
+    """
+    return self._s.attribute_types(
+      self.get('objectClass',[]),attr_type_filter,raise_keyerror
+    )

From d8c7ae1f48acb788d273e961cb38115d235c591f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 27 May 2013 08:05:46 +0000
Subject: [PATCH 093/868] White-space cleaning

---
 Demo/paged_search_ext_s.py | 107 +++++++++++++++++++++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 Demo/paged_search_ext_s.py

diff --git a/Demo/paged_search_ext_s.py b/Demo/paged_search_ext_s.py
new file mode 100644
index 0000000..d0e0982
--- /dev/null
+++ b/Demo/paged_search_ext_s.py
@@ -0,0 +1,107 @@
+url = "ldap://localhost:1390/"
+base = "dc=stroeder,dc=de"
+search_flt = r'(objectClass=*)'
+
+searchreq_attrlist=['cn','entryDN','entryUUID','mail','objectClass']
+
+from ldap.ldapobject import ReconnectLDAPObject
+
+import ldap,pprint
+from ldap.controls import SimplePagedResultsControl
+
+
+class PagedResultsSearchObject:
+  page_size = 50
+
+  def paged_search_ext_s(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
+    """
+    Behaves exactly like LDAPObject.search_ext_s() but internally uses the
+    simple paged results control to retrieve search results in chunks.
+
+    This is non-sense for really large results sets which you would like
+    to process one-by-one
+    """
+
+    while True: # loop for reconnecting if necessary
+
+      req_ctrl = SimplePagedResultsControl(True,size=self.page_size,cookie='')
+
+      try:
+
+        # Send first search request
+        msgid = self.search_ext(
+          base,
+          scope,
+          filterstr=filterstr,
+          attrlist=attrlist,
+          attrsonly=attrsonly,
+          serverctrls=(serverctrls or [])+[req_ctrl],
+          clientctrls=clientctrls,
+          timeout=timeout,
+          sizelimit=sizelimit
+        )
+
+        result_pages = 0
+        all_results = []
+
+        while True:
+          rtype, rdata, rmsgid, rctrls = self.result3(msgid)
+          all_results.extend(rdata)
+          result_pages += 1
+          # Extract the simple paged results response control
+          pctrls = [
+            c
+            for c in rctrls
+            if c.controlType == SimplePagedResultsControl.controlType
+          ]
+          if pctrls:
+            if pctrls[0].cookie:
+                # Copy cookie from response control to request control
+                req_ctrl.cookie = pctrls[0].cookie
+                msgid = self.search_ext(
+                  base,
+                  scope,
+                  filterstr=filterstr,
+                  attrlist=attrlist,
+                  attrsonly=attrsonly,
+                  serverctrls=(serverctrls or [])+[req_ctrl],
+                  clientctrls=clientctrls,
+                  timeout=timeout,
+                  sizelimit=sizelimit
+                )
+            else:
+              break # no more pages available
+
+      except ldap.SERVER_DOWN,e:
+        try:
+          self.reconnect(self._uri)
+        except AttributeError:
+          raise e
+
+      else:
+        return result_pages,all_results
+
+
+class MyLDAPObject(ReconnectLDAPObject,PagedResultsSearchObject):
+  pass
+
+
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldap.set_option(ldap.OPT_REFERRALS, 0)
+l = MyLDAPObject(url,trace_level=2,retry_max=100,retry_delay=2)
+l.protocol_version = 3
+l.simple_bind_s("", "")
+l.page_size=10
+
+# Send search request
+result_pages,all_results = l.paged_search_ext_s(
+  base,
+  ldap.SCOPE_SUBTREE,
+  search_flt,
+  attrlist=searchreq_attrlist,
+  serverctrls=None
+)
+
+l.unbind_s()
+
+print 'Received %d results in %d pages.' % (len(all_results),result_pages)

From 42486839342f9c3612ae90e43739cb90adf41b7c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 29 May 2013 20:27:32 +0000
Subject: [PATCH 094/868] ldap.controls: Truly optional import of PyAsn1Error
 exception

---
 Lib/ldap/controls/__init__.py | 158 ++++++++++++++++++++++++++++++++++
 1 file changed, 158 insertions(+)
 create mode 100644 Lib/ldap/controls/__init__.py

diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
new file mode 100644
index 0000000..e7c400d
--- /dev/null
+++ b/Lib/ldap/controls/__init__.py
@@ -0,0 +1,158 @@
+# -*- coding: utf-8 -*-
+"""
+controls.py - support classes for LDAP controls
+
+See http://www.python-ldap.org/ for details.
+
+$Id: __init__.py,v 1.9 2013/05/29 20:27:32 stroeder Exp $
+
+Description:
+The ldap.controls module provides LDAPControl classes.
+Each class provides support for a certain control.
+"""
+
+from ldap import __version__
+
+__all__ = [
+  'KNOWN_RESPONSE_CONTROLS',
+  # Classes
+  'AssertionControl',
+  'BooleanControl',
+  'LDAPControl',
+  'ManageDSAITControl',
+  'MatchedValuesControl',
+  'RelaxRulesControl',
+  'RequestControl',
+  'ResponseControl',
+  'SimplePagedResultsControl',
+  'ValueLessRequestControl',
+  # Functions
+  'RequestControlTuples',
+  'DecodeControlTuples',
+]
+
+# response control OID to class registry
+KNOWN_RESPONSE_CONTROLS = {}
+
+import _ldap,ldap
+
+try:
+  from pyasn1.error import PyAsn1Error
+except ImportError:
+  PyAsn1Error = None
+
+
+class RequestControl:
+  """
+  Base class for all request controls
+  
+  controlType
+      OID as string of the LDAPv3 extended request control
+  criticality
+      sets the criticality of the control (boolean)
+  encodedControlValue
+      control value of the LDAPv3 extended request control
+      (here it is the BER-encoded ASN.1 control value)
+  """
+
+  def __init__(self,controlType=None,criticality=False,encodedControlValue=None):
+    self.controlType = controlType
+    self.criticality = criticality
+    self.encodedControlValue = encodedControlValue
+
+  def encodeControlValue(self):
+    """
+    sets class attribute encodedControlValue to the BER-encoded ASN.1
+    control value composed by class attributes set before
+    """
+    return self.encodedControlValue
+
+
+class ResponseControl:
+  """
+  Base class for all response controls
+
+  controlType
+      OID as string of the LDAPv3 extended response control
+  criticality
+      sets the criticality of the received control (boolean)
+  """
+
+  def __init__(self,controlType=None,criticality=False):
+    self.controlType = controlType
+    self.criticality = criticality
+
+  def decodeControlValue(self,encodedControlValue):
+    """
+    decodes the BER-encoded ASN.1 control value and sets the appropriate
+    class attributes
+    """
+    self.encodedControlValue = encodedControlValue
+
+
+class LDAPControl(RequestControl,ResponseControl):
+  """
+  Base class for combined request/response controls mainly
+  for backward-compability to python-ldap 2.3.x
+  """
+
+  def __init__(self,controlType=None,criticality=False,controlValue=None,encodedControlValue=None):
+    self.controlType = controlType
+    self.criticality = criticality
+    self.controlValue = controlValue
+    self.encodedControlValue = encodedControlValue
+
+
+def RequestControlTuples(ldapControls):
+  """
+  Return list of readily encoded 3-tuples which can be directly
+  passed to C module _ldap
+
+  ldapControls
+      sequence-type of RequestControl objects
+  """
+  if ldapControls is None:
+    return None
+  else:
+    result = [
+      (c.controlType,c.criticality,c.encodeControlValue())
+      for c in ldapControls
+    ]
+    return result
+
+
+def DecodeControlTuples(ldapControlTuples,knownLDAPControls=None):
+  """
+  Returns list of readily decoded ResponseControl objects
+
+  ldapControlTuples
+      Sequence-type of 3-tuples returned by _ldap.result4() containing
+      the encoded ASN.1 control values of response controls.
+  knownLDAPControls
+      Dictionary mapping extended control's OID to ResponseControl class
+      of response controls known by the application. If None
+      ldap.controls.KNOWN_RESPONSE_CONTROLS is used here.
+  """
+  knownLDAPControls = knownLDAPControls or KNOWN_RESPONSE_CONTROLS
+  result = []
+  for controlType,criticality,encodedControlValue in ldapControlTuples or []:
+    try:
+      control = knownLDAPControls[controlType]()
+    except KeyError:
+      if criticality:
+        raise ldap.UNAVAILABLE_CRITICAL_EXTENSION('Received unexpected critical response control with controlType %s' % (repr(controlType)))
+    else:
+      control.controlType,control.criticality = controlType,criticality
+      try:
+        control.decodeControlValue(encodedControlValue)
+      except PyAsn1Error,e:
+        if criticality:
+          raise e
+      else:
+        result.append(control)
+  return result
+
+
+# Import the standard sub-modules
+from ldap.controls.simple import *
+from ldap.controls.libldap import *

From 63505a63b822e74c3dd3c10b84f86a0579dcdd6b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Jun 2013 17:36:03 +0000
Subject: [PATCH 095/868] Several other fixes for
 ldapobject.ReconnectLDAPObject

---
 Lib/ldap/ldapobject.py | 881 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 881 insertions(+)
 create mode 100644 Lib/ldap/ldapobject.py

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
new file mode 100644
index 0000000..74ee238
--- /dev/null
+++ b/Lib/ldap/ldapobject.py
@@ -0,0 +1,881 @@
+"""
+ldapobject.py - wraps class _ldap.LDAPObject
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: ldapobject.py,v 1.135 2013/06/25 17:36:03 stroeder Exp $
+
+Compability:
+- Tested with Python 2.0+ but should work with Python 1.5.x
+- LDAPObject class should be exactly the same like _ldap.LDAPObject
+
+Usage:
+Directly imported by ldap/__init__.py. The symbols of _ldap are
+overridden.
+
+Thread-lock:
+Basically calls into the LDAP lib are serialized by the module-wide
+lock self._ldap_object_lock.
+"""
+
+from ldap import __version__
+
+__all__ = [
+  'LDAPObject',
+  'SimpleLDAPObject',
+  'NonblockingLDAPObject',
+  'ReconnectLDAPObject',
+]
+
+
+if __debug__:
+  # Tracing is only supported in debugging mode
+  import traceback
+
+import sys,time,pprint,_ldap,ldap,ldap.functions
+
+from ldap.schema import SCHEMA_ATTRS
+from ldap.controls import LDAPControl,DecodeControlTuples,RequestControlTuples
+from ldap.extop import ExtendedRequest,ExtendedResponse
+
+from ldap import LDAPError
+
+
+class SimpleLDAPObject:
+  """
+  Drop-in wrapper class around _ldap.LDAPObject
+  """
+
+  CLASSATTR_OPTION_MAPPING = {
+    "protocol_version":   ldap.OPT_PROTOCOL_VERSION,
+    "deref":              ldap.OPT_DEREF,
+    "referrals":          ldap.OPT_REFERRALS,
+    "timelimit":          ldap.OPT_TIMELIMIT,
+    "sizelimit":          ldap.OPT_SIZELIMIT,
+    "network_timeout":    ldap.OPT_NETWORK_TIMEOUT,
+    "error_number":ldap.OPT_ERROR_NUMBER,
+    "error_string":ldap.OPT_ERROR_STRING,
+    "matched_dn":ldap.OPT_MATCHED_DN,
+  }
+
+  def __init__(
+    self,uri,
+    trace_level=0,trace_file=None,trace_stack_limit=5
+  ):
+    self._trace_level = trace_level
+    self._trace_file = trace_file or sys.stdout
+    self._trace_stack_limit = trace_stack_limit
+    self._uri = uri
+    self._ldap_object_lock = self._ldap_lock()
+    self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
+    self.timeout = -1
+    self.protocol_version = ldap.VERSION3
+
+  def _ldap_lock(self):
+    if ldap.LIBLDAP_R:
+      return ldap.LDAPLock(desc=self._uri)
+    else:
+      return ldap._ldap_module_lock
+
+  def _ldap_call(self,func,*args,**kwargs):
+    """
+    Wrapper method mainly for serializing calls into OpenLDAP libs
+    and trace logs
+    """
+    self._ldap_object_lock.acquire()
+    if __debug__:
+      if self._trace_level>=1:
+        self._trace_file.write('*** %s %s - %s\n%s\n' % (
+          repr(self),
+          self._uri,
+          '.'.join((self.__class__.__name__,func.__name__)),
+          pprint.pformat((args,kwargs))
+        ))
+        if self._trace_level>=9:
+          traceback.print_stack(limit=self._trace_stack_limit,file=self._trace_file)
+    diagnostic_message_success = None
+    try:
+      try:
+        result = func(*args,**kwargs)
+        if __debug__ and self._trace_level>=2:
+          if func.__name__!="unbind_ext":
+            diagnostic_message_success = self._l.get_option(ldap.OPT_DIAGNOSTIC_MESSAGE)
+      finally:
+        self._ldap_object_lock.release()
+    except LDAPError,e:
+      if __debug__ and self._trace_level>=2:
+        self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
+      raise
+    else:
+      if __debug__ and self._trace_level>=2:
+        if not diagnostic_message_success is None:
+          self._trace_file.write('=> diagnosticMessage: %s\n' % (repr(diagnostic_message_success)))
+        self._trace_file.write('=> result:\n%s\n' % (pprint.pformat(result)))
+    return result
+
+  def __setattr__(self,name,value):
+    if self.CLASSATTR_OPTION_MAPPING.has_key(name):
+      self.set_option(self.CLASSATTR_OPTION_MAPPING[name],value)
+    else:
+      self.__dict__[name] = value
+
+  def __getattr__(self,name):
+    if self.CLASSATTR_OPTION_MAPPING.has_key(name):
+      return self.get_option(self.CLASSATTR_OPTION_MAPPING[name])
+    elif self.__dict__.has_key(name):
+      return self.__dict__[name]
+    else:
+      raise AttributeError,'%s has no attribute %s' % (
+        self.__class__.__name__,repr(name)
+      )
+
+  def abandon_ext(self,msgid,serverctrls=None,clientctrls=None):
+    """
+    abandon_ext(msgid[,serverctrls=None[,clientctrls=None]]) -> None
+    abandon(msgid) -> None
+        Abandons or cancels an LDAP operation in progress. The msgid should
+        be the message id of an outstanding LDAP operation as returned
+        by the asynchronous methods search(), modify() etc.  The caller
+        can expect that the result of an abandoned operation will not be
+        returned from a future call to result().
+    """
+    return self._ldap_call(self._l.abandon_ext,msgid,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def abandon(self,msgid):
+    return self.abandon_ext(msgid,None,None)
+
+  def cancel(self,cancelid,serverctrls=None,clientctrls=None):
+    """
+    cancel(cancelid[,serverctrls=None[,clientctrls=None]]) -> int
+        Send cancels extended operation for an LDAP operation specified by cancelid.
+        The cancelid should be the message id of an outstanding LDAP operation as returned
+        by the asynchronous methods search(), modify() etc.  The caller
+        can expect that the result of an abandoned operation will not be
+        returned from a future call to result().
+        In opposite to abandon() this extended operation gets an result from
+        the server and thus should be preferred if the server supports it.
+    """
+    return self._ldap_call(self._l.cancel,cancelid,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def cancel_s(self,cancelid,serverctrls=None,clientctrls=None):
+    msgid = self.cancel(cancelid,serverctrls,clientctrls)
+    try:
+      res = self.result(msgid,all=1,timeout=self.timeout)
+    except (ldap.CANCELLED,ldap.SUCCESS):
+      res = None
+    return res
+
+  def add_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
+    """
+    add_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
+        This function adds a new entry with a distinguished name
+        specified by dn which means it must not already exist.
+        The parameter modlist is similar to the one passed to modify(),
+        except that no operation integer need be included in the tuples.
+    """
+    return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def add_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
+    msgid = self.add_ext(dn,modlist,serverctrls,clientctrls)
+    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+    return resp_type, resp_data, resp_msgid, resp_ctrls
+
+  def add(self,dn,modlist):
+    """
+    add(dn, modlist) -> int
+        This function adds a new entry with a distinguished name
+        specified by dn which means it must not already exist.
+        The parameter modlist is similar to the one passed to modify(),
+        except that no operation integer need be included in the tuples.
+    """
+    return self.add_ext(dn,modlist,None,None)
+
+  def add_s(self,dn,modlist):
+    msgid = self.add(dn,modlist)
+    return self.result(msgid,all=1,timeout=self.timeout)
+
+  def simple_bind(self,who='',cred='',serverctrls=None,clientctrls=None):
+    """
+    simple_bind([who='' [,cred='']]) -> int
+    """
+    return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def simple_bind_s(self,who='',cred='',serverctrls=None,clientctrls=None):
+    """
+    simple_bind_s([who='' [,cred='']]) -> 4-tuple
+    """
+    msgid = self.simple_bind(who,cred,serverctrls,clientctrls)
+    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+    return resp_type, resp_data, resp_msgid, resp_ctrls
+
+  def bind(self,who,cred,method=ldap.AUTH_SIMPLE):
+    """
+    bind(who, cred, method) -> int
+    """
+    assert method==ldap.AUTH_SIMPLE,'Only simple bind supported in LDAPObject.bind()'
+    return self.simple_bind(who,cred)
+
+  def bind_s(self,who,cred,method=ldap.AUTH_SIMPLE):
+    """
+    bind_s(who, cred, method) -> None
+    """
+    msgid = self.bind(who,cred,method)
+    return self.result(msgid,all=1,timeout=self.timeout)
+
+  def sasl_interactive_bind_s(self,who,auth,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+    """
+    sasl_interactive_bind_s(who, auth [,serverctrls=None[,clientctrls=None[,sasl_flags=ldap.SASL_QUIET]]]) -> None
+    """
+    return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
+
+  def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
+    """
+    compare_ext(dn, attr, value [,serverctrls=None[,clientctrls=None]]) -> int
+    compare_ext_s(dn, attr, value [,serverctrls=None[,clientctrls=None]]) -> int
+    compare(dn, attr, value) -> int
+    compare_s(dn, attr, value) -> int
+        Perform an LDAP comparison between the attribute named attr of
+        entry dn, and the value value. The synchronous form returns 0
+        for false, or 1 for true.  The asynchronous form returns the
+        message id of the initiates request, and the result of the
+        asynchronous compare can be obtained using result().
+
+        Note that this latter technique yields the answer by raising
+        the exception objects COMPARE_TRUE or COMPARE_FALSE.
+
+        A design bug in the library prevents value from containing
+        nul characters.
+    """
+    return self._ldap_call(self._l.compare_ext,dn,attr,value,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
+    msgid = self.compare_ext(dn,attr,value,serverctrls,clientctrls)
+    try:
+      resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+    except ldap.COMPARE_TRUE:
+      return 1
+    except ldap.COMPARE_FALSE:
+      return 0
+    return None
+
+  def compare(self,dn,attr,value):
+    return self.compare_ext(dn,attr,value,None,None)
+
+  def compare_s(self,dn,attr,value):
+    return self.compare_ext_s(dn,attr,value,None,None)
+
+  def delete_ext(self,dn,serverctrls=None,clientctrls=None):
+    """
+    delete(dn) -> int
+    delete_s(dn) -> None
+    delete_ext(dn[,serverctrls=None[,clientctrls=None]]) -> int
+    delete_ext_s(dn[,serverctrls=None[,clientctrls=None]]) -> None
+        Performs an LDAP delete operation on dn. The asynchronous
+        form returns the message id of the initiated request, and the
+        result can be obtained from a subsequent call to result().
+    """
+    return self._ldap_call(self._l.delete_ext,dn,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def delete_ext_s(self,dn,serverctrls=None,clientctrls=None):
+    msgid = self.delete_ext(dn,serverctrls,clientctrls)
+    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+    return resp_type, resp_data, resp_msgid, resp_ctrls
+
+  def delete(self,dn):
+    return self.delete_ext(dn,None,None)
+
+  def delete_s(self,dn):
+    return self.delete_ext_s(dn,None,None)
+
+  def extop(self,extreq,serverctrls=None,clientctrls=None):
+    """
+    extop(extreq[,serverctrls=None[,clientctrls=None]]]) -> int
+    extop_s(extreq[,serverctrls=None[,clientctrls=None[,extop_resp_class=None]]]]) ->
+        (respoid,respvalue)
+        Performs an LDAP extended operation. The asynchronous
+        form returns the message id of the initiated request, and the
+        result can be obtained from a subsequent call to extop_result().
+        The extreq is an instance of class ldap.extop.ExtendedRequest.
+
+        If argument extop_resp_class is set to a sub-class of
+        ldap.extop.ExtendedResponse this class is used to return an
+        object of this class instead of a raw BER value in respvalue.
+    """
+    return self._ldap_call(self._l.extop,extreq.requestName,extreq.encodedRequestValue(),RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def extop_result(self,msgid=ldap.RES_ANY,all=1,timeout=None):
+    resulttype,msg,msgid,respctrls,respoid,respvalue = self.result4(msgid,all=1,timeout=self.timeout,add_ctrls=1,add_intermediates=1,add_extop=1)
+    return (respoid,respvalue)
+
+  def extop_s(self,extreq,serverctrls=None,clientctrls=None,extop_resp_class=None):
+    msgid = self.extop(extreq,serverctrls,clientctrls)
+    res = self.extop_result(msgid,all=1,timeout=self.timeout)
+    if extop_resp_class:
+      respoid,respvalue = res
+      if extop_resp_class.responseName!=respoid:
+        raise ldap.PROTOCOL_ERROR("Wrong OID in extended response! Expected %s, got %s" % (extop_resp_class.responseName,respoid))
+      return extop_resp_class(extop_resp_class.responseName,respvalue)
+    else:
+      return res
+
+  def modify_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
+    """
+    modify_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
+    """
+    return self._ldap_call(self._l.modify_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def modify_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
+    msgid = self.modify_ext(dn,modlist,serverctrls,clientctrls)
+    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+    return resp_type, resp_data, resp_msgid, resp_ctrls
+
+  def modify(self,dn,modlist):
+    """
+    modify(dn, modlist) -> int
+    modify_s(dn, modlist) -> None
+    modify_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
+    modify_ext_s(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> None
+        Performs an LDAP modify operation on an entry's attributes.
+        dn is the DN of the entry to modify, and modlist is the list
+        of modifications to make to the entry.
+
+        Each element of the list modlist should be a tuple of the form
+        (mod_op,mod_type,mod_vals), where mod_op is the operation (one of
+        MOD_ADD, MOD_DELETE, MOD_INCREMENT or MOD_REPLACE), mod_type is a
+        string indicating the attribute type name, and mod_vals is either a
+        string value or a list of string values to add, delete, increment by or
+        replace respectively.  For the delete operation, mod_vals may be None
+        indicating that all attributes are to be deleted.
+
+        The asynchronous modify() returns the message id of the
+        initiated request.
+    """
+    return self.modify_ext(dn,modlist,None,None)
+
+  def modify_s(self,dn,modlist):
+    msgid = self.modify(dn,modlist)
+    return self.result(msgid,all=1,timeout=self.timeout)
+
+  def modrdn(self,dn,newrdn,delold=1):
+    """
+    modrdn(dn, newrdn [,delold=1]) -> int
+    modrdn_s(dn, newrdn [,delold=1]) -> None
+        Perform a modify RDN operation. These routines take dn, the
+        DN of the entry whose RDN is to be changed, and newrdn, the
+        new RDN to give to the entry. The optional parameter delold
+        is used to specify whether the old RDN should be kept as
+        an attribute of the entry or not.  The asynchronous version
+        returns the initiated message id.
+
+        This operation is emulated by rename() and rename_s() methods
+        since the modrdn2* routines in the C library are deprecated.
+    """
+    return self.rename(dn,newrdn,None,delold)
+
+  def modrdn_s(self,dn,newrdn,delold=1):
+    return self.rename_s(dn,newrdn,None,delold)
+
+  def passwd(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
+    return self._ldap_call(self._l.passwd,user,oldpw,newpw,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def passwd_s(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
+    msgid = self.passwd(user,oldpw,newpw,serverctrls,clientctrls)
+    return self.extop_result(msgid,all=1,timeout=self.timeout)
+
+  def rename(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls=None):
+    """
+    rename(dn, newrdn [, newsuperior=None [,delold=1][,serverctrls=None[,clientctrls=None]]]) -> int
+    rename_s(dn, newrdn [, newsuperior=None] [,delold=1][,serverctrls=None[,clientctrls=None]]) -> None
+        Perform a rename entry operation. These routines take dn, the
+        DN of the entry whose RDN is to be changed, newrdn, the
+        new RDN, and newsuperior, the new parent DN, to give to the entry.
+        If newsuperior is None then only the RDN is modified.
+        The optional parameter delold is used to specify whether the
+        old RDN should be kept as an attribute of the entry or not.
+        The asynchronous version returns the initiated message id.
+
+        This actually corresponds to the rename* routines in the
+        LDAP-EXT C API library.
+    """
+    return self._ldap_call(self._l.rename,dn,newrdn,newsuperior,delold,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def rename_s(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls=None):
+    msgid = self.rename(dn,newrdn,newsuperior,delold,serverctrls,clientctrls)
+    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+    return resp_type, resp_data, resp_msgid, resp_ctrls
+
+  def result(self,msgid=ldap.RES_ANY,all=1,timeout=None):
+    """
+    result([msgid=RES_ANY [,all=1 [,timeout=None]]]) -> (result_type, result_data)
+
+        This method is used to wait for and return the result of an
+        operation previously initiated by one of the LDAP asynchronous
+        operation routines (eg search(), modify(), etc.) They all
+        returned an invocation identifier (a message id) upon successful
+        initiation of their operation. This id is guaranteed to be
+        unique across an LDAP session, and can be used to request the
+        result of a specific operation via the msgid parameter of the
+        result() method.
+
+        If the result of a specific operation is required, msgid should
+        be set to the invocation message id returned when the operation
+        was initiated; otherwise RES_ANY should be supplied.
+
+        The all parameter only has meaning for search() responses
+        and is used to select whether a single entry of the search
+        response should be returned, or to wait for all the results
+        of the search before returning.
+
+        A search response is made up of zero or more search entries
+        followed by a search result. If all is 0, search entries will
+        be returned one at a time as they come in, via separate calls
+        to result(). If all is 1, the search response will be returned
+        in its entirety, i.e. after all entries and the final search
+        result have been received.
+
+        For all set to 0, result tuples
+        trickle in (with the same message id), and with the result type
+        RES_SEARCH_ENTRY, until the final result which has a result
+        type of RES_SEARCH_RESULT and a (usually) empty data field.
+        When all is set to 1, only one result is returned, with a
+        result type of RES_SEARCH_RESULT, and all the result tuples
+        listed in the data field.
+
+        The method returns a tuple of the form (result_type,
+        result_data).  The result_type is one of the constants RES_*.
+
+        See search() for a description of the search result's
+        result_data, otherwise the result_data is normally meaningless.
+
+        The result() method will block for timeout seconds, or
+        indefinitely if timeout is negative.  A timeout of 0 will effect
+        a poll. The timeout can be expressed as a floating-point value.
+        If timeout is None the default in self.timeout is used.
+
+        If a timeout occurs, a TIMEOUT exception is raised, unless
+        polling (timeout = 0), in which case (None, None) is returned.
+    """
+    resp_type, resp_data, resp_msgid = self.result2(msgid,all,timeout)
+    return resp_type, resp_data
+
+  def result2(self,msgid=ldap.RES_ANY,all=1,timeout=None):
+    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all,timeout)
+    return resp_type, resp_data, resp_msgid
+
+  def result3(self,msgid=ldap.RES_ANY,all=1,timeout=None,resp_ctrl_classes=None):
+    resp_type, resp_data, resp_msgid, decoded_resp_ctrls, retoid, retval = self.result4(
+      msgid,all,timeout,
+      add_ctrls=0,add_intermediates=0,add_extop=0,
+      resp_ctrl_classes=resp_ctrl_classes
+    )
+    return resp_type, resp_data, resp_msgid, decoded_resp_ctrls
+
+  def result4(self,msgid=ldap.RES_ANY,all=1,timeout=None,add_ctrls=0,add_intermediates=0,add_extop=0,resp_ctrl_classes=None):
+    if timeout is None:
+      timeout = self.timeout
+    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
+    if ldap_result is None:
+        resp_type, resp_data, resp_msgid, resp_ctrls, resp_name, resp_value = (None,None,None,None,None,None)
+    else:
+      if len(ldap_result)==4:
+        resp_type, resp_data, resp_msgid, resp_ctrls = ldap_result
+        resp_name, resp_value = None,None
+      else:
+        resp_type, resp_data, resp_msgid, resp_ctrls, resp_name, resp_value = ldap_result
+      if add_ctrls:
+        resp_data = [ (t,r,DecodeControlTuples(c,resp_ctrl_classes)) for t,r,c in resp_data ]
+    decoded_resp_ctrls = DecodeControlTuples(resp_ctrls,resp_ctrl_classes)
+    return resp_type, resp_data, resp_msgid, decoded_resp_ctrls, resp_name, resp_value
+
+  def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
+    """
+    search(base, scope [,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0]]]) -> int
+    search_s(base, scope [,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0]]])
+    search_st(base, scope [,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0 [,timeout=-1]]]])
+    search_ext(base,scope,[,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0 [,serverctrls=None [,clientctrls=None [,timeout=-1 [,sizelimit=0]]]]]]])
+    search_ext_s(base,scope,[,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0 [,serverctrls=None [,clientctrls=None [,timeout=-1 [,sizelimit=0]]]]]]])
+
+        Perform an LDAP search operation, with base as the DN of
+        the entry at which to start the search, scope being one of
+        SCOPE_BASE (to search the object itself), SCOPE_ONELEVEL
+        (to search the object's immediate children), or SCOPE_SUBTREE
+        (to search the object and all its descendants).
+
+        filter is a string representation of the filter to
+        apply in the search (see RFC 4515).
+
+        Each result tuple is of the form (dn,entry), where dn is a
+        string containing the DN (distinguished name) of the entry, and
+        entry is a dictionary containing the attributes.
+        Attributes types are used as string dictionary keys and attribute
+        values are stored in a list as dictionary value.
+
+        The DN in dn is extracted using the underlying ldap_get_dn(),
+        which may raise an exception of the DN is malformed.
+
+        If attrsonly is non-zero, the values of attrs will be
+        meaningless (they are not transmitted in the result).
+
+        The retrieved attributes can be limited with the attrlist
+        parameter.  If attrlist is None, all the attributes of each
+        entry are returned.
+
+        serverctrls=None
+
+        clientctrls=None
+
+        The synchronous form with timeout, search_st() or search_ext_s(),
+        will block for at most timeout seconds (or indefinitely if
+        timeout is negative). A TIMEOUT exception is raised if no result is
+        received within the time.
+
+        The amount of search results retrieved can be limited with the
+        sizelimit parameter if non-zero.
+    """
+    return self._ldap_call(
+      self._l.search_ext,
+      base,scope,filterstr,
+      attrlist,attrsonly,
+      RequestControlTuples(serverctrls),
+      RequestControlTuples(clientctrls),
+      timeout,sizelimit,
+    )
+
+  def search_ext_s(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
+    msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
+    return self.result(msgid,all=1,timeout=timeout)[1]
+
+  def search(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0):
+    return self.search_ext(base,scope,filterstr,attrlist,attrsonly,None,None)
+
+  def search_s(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0):
+    return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
+
+  def search_st(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,timeout=-1):
+    return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout)
+
+  def start_tls_s(self):
+    """
+    start_tls_s() -> None
+    Negotiate TLS with server. The `version' attribute must have been
+    set to VERSION3 before calling start_tls_s.
+    If TLS could not be started an exception will be raised.
+    """
+    return self._ldap_call(self._l.start_tls_s)
+
+  def unbind_ext(self,serverctrls=None,clientctrls=None):
+    """
+    unbind() -> int
+    unbind_s() -> None
+    unbind_ext() -> int
+    unbind_ext_s() -> None
+        This call is used to unbind from the directory, terminate
+        the current association, and free resources. Once called, the
+        connection to the LDAP server is closed and the LDAP object
+        is invalid. Further invocation of methods on the object will
+        yield an exception.
+
+        The unbind and unbind_s methods are identical, and are
+        synchronous in nature
+    """
+    return self._ldap_call(self._l.unbind_ext,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
+  def unbind_ext_s(self,serverctrls=None,clientctrls=None):
+    msgid = self.unbind_ext(serverctrls,clientctrls)
+    if msgid!=None:
+      resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+      return resp_type, resp_data, resp_msgid, resp_ctrls
+
+  def unbind(self):
+    return self.unbind_ext(None,None)
+
+  def unbind_s(self):
+    return self.unbind_ext_s(None,None)
+
+  def whoami_s(self,serverctrls=None,clientctrls=None):
+    return self._ldap_call(self._l.whoami_s,serverctrls,clientctrls)
+
+  def get_option(self,option):
+    result = self._ldap_call(self._l.get_option,option)
+    if option==ldap.OPT_SERVER_CONTROLS or option==ldap.OPT_CLIENT_CONTROLS:
+      result = DecodeControlTuples(result)
+    return result
+
+  def set_option(self,option,invalue):
+    if option==ldap.OPT_SERVER_CONTROLS or option==ldap.OPT_CLIENT_CONTROLS:
+      invalue = RequestControlTuples(invalue)
+    return self._ldap_call(self._l.set_option,option,invalue)
+
+  def search_subschemasubentry_s(self,dn=''):
+    """
+    Returns the distinguished name of the sub schema sub entry
+    for a part of a DIT specified by dn.
+
+    None as result indicates that the DN of the sub schema sub entry could
+    not be determined.
+    """
+    try:
+      r = self.search_s(
+        dn,ldap.SCOPE_BASE,'(objectClass=*)',['subschemaSubentry']
+      )
+    except (ldap.NO_SUCH_OBJECT,ldap.NO_SUCH_ATTRIBUTE,ldap.INSUFFICIENT_ACCESS):
+      r = []
+    except ldap.UNDEFINED_TYPE:
+      return None
+    try:
+      if r:
+        e = ldap.cidict.cidict(r[0][1])
+        search_subschemasubentry_dn = e.get('subschemaSubentry',[None])[0]
+        if search_subschemasubentry_dn is None:
+          if dn:
+            # Try to find sub schema sub entry in root DSE
+            return self.search_subschemasubentry_s(dn='')
+          else:
+            # If dn was already root DSE we can return here
+            return None
+        else:
+          return search_subschemasubentry_dn
+    except IndexError:
+      return None
+
+  def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
+    """
+    Returns the sub schema sub entry's data
+    """
+    attrs = attrs or SCHEMA_ATTRS
+    try:
+      r = self.search_s(
+        subschemasubentry_dn,ldap.SCOPE_BASE,
+        '(objectClass=subschema)',
+        attrs
+      )
+    except ldap.NO_SUCH_OBJECT:
+      return None
+    else:
+      if r:
+        return r[0][1]
+      else:
+        return None
+
+
+class NonblockingLDAPObject(SimpleLDAPObject):
+
+  def __init__(self,uri,trace_level=0,trace_file=None,result_timeout=-1):
+    self._result_timeout = result_timeout
+    SimpleLDAPObject.__init__(self,uri,trace_level,trace_file)
+
+  def result(self,msgid=ldap.RES_ANY,all=1,timeout=-1):
+    """
+    """
+    ldap_result = self._ldap_call(self._l.result,msgid,0,self._result_timeout)
+    if not all:
+      return ldap_result
+    start_time = time.time()
+    all_results = []
+    while all:
+      while ldap_result[0] is None:
+        if (timeout>=0) and (time.time()-start_time>timeout):
+          self._ldap_call(self._l.abandon,msgid)
+          raise ldap.TIMEOUT(
+            "LDAP time limit (%d secs) exceeded." % (timeout)
+          )
+        time.sleep(0.00001)
+        ldap_result = self._ldap_call(self._l.result,msgid,0,self._result_timeout)
+      if ldap_result[1] is None:
+        break
+      all_results.extend(ldap_result[1])
+      ldap_result = None,None
+    return all_results
+
+  def search_st(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,timeout=-1):
+    msgid = self.search(base,scope,filterstr,attrlist,attrsonly)
+    return self.result(msgid,all=1,timeout=timeout)
+
+
+class ReconnectLDAPObject(SimpleLDAPObject):
+  """
+  In case of server failure (ldap.SERVER_DOWN) the implementations
+  of all synchronous operation methods (search_s() etc.) are doing
+  an automatic reconnect and rebind and will retry the very same
+  operation.
+
+  This is very handy for broken LDAP server implementations
+  (e.g. in Lotus Domino) which drop connections very often making
+  it impossible to have a long-lasting control flow in the
+  application.
+  """
+
+  __transient_attrs__ = {
+    '_l':None,
+    '_ldap_object_lock':None,
+    '_trace_file':None,
+  }
+
+  def __init__(
+    self,uri,
+    trace_level=0,trace_file=None,trace_stack_limit=5,
+    retry_max=1,retry_delay=60.0
+  ):
+    """
+    Parameters like SimpleLDAPObject.__init__() with these
+    additional arguments:
+
+    retry_max
+        Maximum count of reconnect trials
+    retry_delay
+        Time span to wait between two reconnect trials
+    """
+    self._uri = uri
+    self._options = []
+    self._last_bind = None
+    self._pending_reconnect = 0
+    SimpleLDAPObject.__init__(self,uri,trace_level,trace_file,trace_stack_limit)
+    self._retry_max = retry_max
+    self._retry_delay = retry_delay
+    self._start_tls = 0
+    self._reconnects_done = 0L
+
+  def __getstate__(self):
+    """return data representation for pickled object"""
+    d = {}
+    for k,v in self.__dict__.items():
+      if not self.__transient_attrs__.has_key(k):
+        d[k] = v
+    return d
+
+  def __setstate__(self,d):
+    """set up the object from pickled data"""
+    self.__dict__.update(d)
+    self._ldap_object_lock = self._ldap_lock()
+    self._trace_file = sys.stdout
+    self.reconnect(self._uri)
+
+  def _apply_last_bind(self):
+    if self._last_bind!=None:
+      func,args,kwargs = self._last_bind
+      func(self,*args,**kwargs)
+    else:
+      # Send explicit anon simple bind request to provoke ldap.SERVER_DOWN in method reconnect()
+      SimpleLDAPObject.simple_bind_s(self,'','')
+
+  def _restore_options(self):
+    """Restore all recorded options"""
+    for k,v in self._options:
+      SimpleLDAPObject.set_option(self,k,v)
+
+  def reconnect(self,uri):
+    # Drop and clean up old connection completely
+    # Reconnect
+    while self._pending_reconnect:
+      time.sleep(0.01)
+    else:
+      self._pending_reconnect = 1
+    reconnect_counter = self._retry_max
+    while reconnect_counter:
+      if __debug__ and self._trace_level>=1:
+        self._trace_file.write('*** Try %d. reconnect to %s...\n' % (
+          self._retry_max-reconnect_counter+1,uri
+        ))
+      try:
+        # Do the connect
+        self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
+        self._restore_options()
+        # StartTLS extended operation in case this was called before
+        if self._start_tls:
+          self.start_tls_s()
+        # Repeat last simple or SASL bind
+        self._apply_last_bind()
+      except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:
+        if __debug__ and self._trace_level>=1:
+          self._trace_file.write('*** %d. reconnect to %s failed\n' % (
+            self._retry_max-reconnect_counter+1,uri
+          ))
+        reconnect_counter = reconnect_counter-1
+        if not reconnect_counter:
+          raise
+        if __debug__ and self._trace_level>=1:
+          self._trace_file.write('=> delay %s...\n' % (self._retry_delay))
+        time.sleep(self._retry_delay)
+        SimpleLDAPObject.unbind_s(self)
+        del self._l
+      else:
+        if __debug__ and self._trace_level>=1:
+          self._trace_file.write('*** %d. reconnect to %s successful, last operation will be repeated\n' % (
+            self._retry_max-reconnect_counter+1,uri
+          ))
+        self._reconnects_done = self._reconnects_done + 1L
+        break
+    self._pending_reconnect = 0
+    return # reconnect()
+
+  def _apply_method_s(self,func,*args,**kwargs):
+    if not self.__dict__.has_key('_l'):
+      self.reconnect(self._uri)
+    try:
+      return func(self,*args,**kwargs)
+    except ldap.SERVER_DOWN:
+      SimpleLDAPObject.unbind_s(self)
+      del self._l
+      # Try to reconnect
+      self.reconnect(self._uri)
+      # Re-try last operation
+      return func(self,*args,**kwargs)
+
+  def set_option(self,option,invalue):
+    self._options.append((option,invalue))
+    return SimpleLDAPObject.set_option(self,option,invalue)
+
+  def bind_s(self,*args,**kwargs):
+    res = self._apply_method_s(SimpleLDAPObject.bind_s,*args,**kwargs)
+    self._last_bind = (self.bind_s,args,kwargs)
+    return res
+
+  def simple_bind_s(self,*args,**kwargs):
+    res = self._apply_method_s(SimpleLDAPObject.simple_bind_s,*args,**kwargs)
+    self._last_bind = (SimpleLDAPObject.simple_bind_s,args,kwargs)
+    return res
+
+  def start_tls_s(self,*args,**kwargs):
+    res = self._apply_method_s(SimpleLDAPObject.start_tls_s,*args,**kwargs)
+    self._start_tls = 1
+    return res
+
+  def sasl_interactive_bind_s(self,*args,**kwargs):
+    """
+    sasl_interactive_bind_s(who, auth) -> None
+    """
+    res = self._apply_method_s(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
+    self._last_bind = (SimpleLDAPObject.sasl_interactive_bind_s,args,kwargs)
+    return res
+
+  def add_ext_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.add_ext_s,*args,**kwargs)
+
+  def cancel_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.cancel_s,*args,**kwargs)
+
+  def compare_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.compare_s,*args,**kwargs)
+
+  def delete_ext_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.delete_ext_s,*args,**kwargs)
+
+  def extop_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.extop_s,*args,**kwargs)
+
+  def modify_ext_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.modify_ext_s,*args,**kwargs)
+
+  def rename_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.rename_s,*args,**kwargs)
+
+  def search_ext_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.search_ext_s,*args,**kwargs)
+
+  def whoami_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.whoami_s,*args,**kwargs)
+
+
+# The class called LDAPObject will be used as default for
+# ldap.open() and ldap.initialize()
+LDAPObject = SimpleLDAPObject

From ade32bcc8aa8c3cb1d4b942b8f04775de243b337 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 4 Jul 2013 16:06:53 +0000
Subject: [PATCH 096/868] Started 2.4.14

---
 Lib/dsml.py          | 297 ++++++++++++++++++++++++++++
 Lib/ldap/__init__.py |  94 +++++++++
 Lib/ldif.py          | 453 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 844 insertions(+)
 create mode 100644 Lib/dsml.py
 create mode 100644 Lib/ldap/__init__.py
 create mode 100644 Lib/ldif.py

diff --git a/Lib/dsml.py b/Lib/dsml.py
new file mode 100644
index 0000000..260da63
--- /dev/null
+++ b/Lib/dsml.py
@@ -0,0 +1,297 @@
+"""
+dsml - generate and parse DSMLv1 data
+(see http://www.oasis-open.org/committees/dsml/)
+
+See http://www.python-ldap.org/ for details.
+
+$Id: dsml.py,v 1.31 2013/07/04 16:06:53 stroeder Exp $
+
+Python compability note:
+Tested with Python 2.0+.
+"""
+
+__version__ = '2.4.14'
+
+import string,base64
+
+
+special_entities = (
+  ('&','&amp;'),
+  ('<','&lt;'),
+  ('"','&quot;'),
+  ("'",'&apos;'),
+)
+
+
+def replace_char(s):
+  for char,entity in special_entities:
+    s = string.replace(s,char,entity)
+  return s
+
+
+class DSMLWriter:
+  """
+  Class for writing LDAP entry records to a DSMLv1 file.
+
+  Arguments:
+
+  f
+      File object for output.
+  base64_attrs
+      Attribute types to be base64-encoded.
+  dsml_comment
+      Text placed in comment lines behind <dsml:dsml>.
+  indent
+      String used for indentiation of next nested level.
+  """
+
+  def __init__(
+    self,f,base64_attrs=[],dsml_comment='',indent='    '
+  ):
+    self._output_file = f
+    self._base64_attrs = {}.fromkeys(map(string.lower,base64_attrs))
+    self._dsml_comment = dsml_comment
+    self._indent = indent
+
+  def _needs_base64_encoding(self,attr_type,attr_value):
+    if self._base64_attrs:
+      return self._base64_attrs.has_key(string.lower(attr_type))
+    else:
+      try:
+        unicode(attr_value,'utf-8')
+      except UnicodeError:
+        return 1
+      else:
+        return 0
+
+  def writeHeader(self):
+    """
+    Write the header
+    """
+    self._output_file.write('\n'.join([
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE root PUBLIC "dsml.dtd" "http://www.dsml.org/1.0/dsml.dtd">',
+        '<dsml:dsml xmlns:dsml="http://www.dsml.org/DSML">',
+        '%s<dsml:directory-entries>\n' % (self._indent),
+      ])
+    )
+    if self._dsml_comment:
+      self._output_file.write('%s<!--\n' % (self._indent))
+      self._output_file.write('%s%s\n' % (self._indent,self._dsml_comment))
+      self._output_file.write('%s-->\n' % (self._indent))
+
+  def writeFooter(self):
+    """
+    Write the footer
+    """
+    self._output_file.write('%s</dsml:directory-entries>\n' % (self._indent))
+    self._output_file.write('</dsml:dsml>\n')
+
+  def unparse(self,dn,entry):
+    return self.writeRecord(dn,entry)
+
+  def writeRecord(self,dn,entry):
+    """
+    dn
+          string-representation of distinguished name
+    entry
+          dictionary holding the LDAP entry {attr:data}
+    """
+
+    # Write line dn: first
+    self._output_file.write(
+      '%s<dsml:entry dn="%s">\n' % (
+        self._indent*2,replace_char(dn)
+      )
+    )
+
+    objectclasses = entry.get('objectclass',entry.get('objectClass',[]))
+
+    self._output_file.write('%s<dsml:objectclass>\n' % (self._indent*3))
+    for oc in objectclasses:
+      self._output_file.write('%s<dsml:oc-value>%s</dsml:oc-value>\n' % (self._indent*4,oc))
+    self._output_file.write('%s</dsml:objectclass>\n' % (self._indent*3))
+
+    attr_types = entry.keys()[:]
+    try:
+      attr_types.remove('objectclass')
+      attr_types.remove('objectClass')
+    except ValueError:
+      pass
+    attr_types.sort()
+    for attr_type in attr_types:
+      self._output_file.write('%s<dsml:attr name="%s">\n' % (self._indent*3,attr_type))
+      for attr_value_item in entry[attr_type]:
+        needs_base64_encoding = self._needs_base64_encoding(
+          attr_type,attr_value_item
+        )
+        if needs_base64_encoding:
+          attr_value_item = base64.encodestring(attr_value_item)
+        else:
+          attr_value_item = replace_char(attr_value_item)
+        self._output_file.write('%s<dsml:value%s>\n' % (
+            self._indent*4,
+            ' encoding="base64"'*needs_base64_encoding
+          )
+        )
+        self._output_file.write('%s%s\n' % (
+            self._indent*5,
+            attr_value_item
+          )
+        )
+        self._output_file.write('%s</dsml:value>\n' % (
+            self._indent*4,
+          )
+        )
+      self._output_file.write('%s</dsml:attr>\n' % (self._indent*3))
+    self._output_file.write('%s</dsml:entry>\n' % (self._indent*2))
+    return
+
+
+try:
+
+  import xml.sax,xml.sax.handler
+
+except ImportError:
+  pass
+
+else:
+
+  class DSMLv1Handler(xml.sax.handler.ContentHandler):
+    """
+    Content handler class for DSMLv1
+    """
+
+    def __init__(self,parser_instance):
+      self._parser_instance = parser_instance
+      xml.sax.handler.ContentHandler.__init__(self)
+
+    def startDocument(self):
+      pass
+
+    def endDocument(self):
+      pass
+
+    def startElement(self,raw_name,attrs):
+      assert raw_name.startswith(''),'Illegal name'
+      name = raw_name[5:]
+      if name=='dsml':
+        pass
+      elif name=='directory-entries':
+        self._parsing_entries = 1
+      elif name=='entry':
+        self._dn = attrs['dn']
+        self._entry = {}
+      elif name=='attr':
+        self._attr_type = attrs['name'].encode('utf-8')
+        self._attr_values = []
+      elif name=='value':
+        self._attr_value = ''
+        self._base64_encoding = attrs.get('encoding','').lower()=='base64'
+      # Handle object class tags
+      elif name=='objectclass':
+        self._object_classes = []
+      elif name=='oc-value':
+        self._oc_value = ''
+      # Unhandled tags
+      else:
+        raise ValueError,'Unknown tag %s' % (raw_name)
+
+    def endElement(self,raw_name):
+      assert raw_name.startswith('dsml:'),'Illegal name'
+      name = raw_name[5:]
+      if name=='dsml':
+        pass
+      elif name=='directory-entries':
+        self._parsing_entries = 0
+      elif name=='entry':
+        self._parser_instance.handle(self._dn,self._entry)
+        del self._dn
+        del self._entry
+      elif name=='attr':
+        self._entry[self._attr_type] = self._attr_values
+        del self._attr_type
+        del self._attr_values
+      elif name=='value':
+        if self._base64_encoding:
+          attr_value = base64.decodestring(self._attr_value.strip())
+        else:
+          attr_value = self._attr_value.strip().encode('utf-8')
+        self._attr_values.append(attr_value)
+        del attr_value
+        del self._attr_value
+        del self._base64_encoding
+      # Handle object class tags
+      elif name=='objectclass':
+        self._entry['objectClass'] = self._object_classes
+        del self._object_classes
+      elif name=='oc-value':
+        self._object_classes.append(self._oc_value.strip().encode('utf-8'))
+        del self._oc_value
+      # Unhandled tags
+      else:
+        raise ValueError,'Unknown tag %s' % (raw_name)
+
+    def characters(self,ch):
+      if self.__dict__.has_key('_oc_value'):
+        self._oc_value = self._oc_value + ch
+      elif self.__dict__.has_key('_attr_value'):
+        self._attr_value = self._attr_value + ch
+      else:
+        pass
+
+
+  class DSMLParser:
+    """
+    Base class for a DSMLv1 parser. Applications should sub-class this
+    class and override method handle() to implement something meaningful.
+
+    Public class attributes:
+
+    records_read
+        Counter for records processed so far
+
+    Arguments:
+
+    input_file
+        File-object to read the DSMLv1 input from
+    ignored_attr_types
+        Attributes with these attribute type names will be ignored.
+    max_entries
+        If non-zero specifies the maximum number of entries to be
+        read from f.
+    line_sep
+        String used as line separator
+    """
+
+    def __init__(
+      self,
+      input_file,
+      ContentHandlerClass,
+      ignored_attr_types=None,
+      max_entries=0,
+    ):
+      self._input_file = input_file
+      self._max_entries = max_entries
+      self._ignored_attr_types = {}.fromkeys(map(string.lower,(ignored_attr_types or [])))
+      self._current_record = None,None
+      self.records_read = 0
+      self._parser = xml.sax.make_parser()
+      self._parser.setFeature(xml.sax.handler.feature_namespaces,0)
+      content_handler = ContentHandlerClass(self)
+      self._parser.setContentHandler(content_handler)
+
+    def handle(self,*args,**kwargs):
+      """
+      Process a single DSMLv1 entry record. This method should be
+      implemented by applications using DSMLParser.
+      """
+      import pprint
+      pprint.pprint(args)
+      pprint.pprint(kwargs)
+
+    def parse(self):
+      """
+      Continously read and parse DSML records
+      """
+      self._parser.parse(self._input_file)
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
new file mode 100644
index 0000000..d641a44
--- /dev/null
+++ b/Lib/ldap/__init__.py
@@ -0,0 +1,94 @@
+"""
+ldap - base module
+
+See http://www.python-ldap.org/ for details.
+
+$Id: __init__.py,v 1.87 2013/07/04 16:06:53 stroeder Exp $
+"""
+
+# This is also the overall release version number
+
+__version__ = '2.4.14'
+
+import sys
+
+if __debug__:
+  # Tracing is only supported in debugging mode
+  import traceback
+  _trace_level = 0
+  _trace_file = sys.stderr
+  _trace_stack_limit = None
+
+import _ldap
+from _ldap import *
+
+OPT_NAMES_DICT = {}
+for k,v in vars(_ldap).items():
+  if k.startswith('OPT_'):
+    OPT_NAMES_DICT[v]=k
+
+class DummyLock:
+  """Define dummy class with methods compatible to threading.Lock"""
+  def __init__(self):
+    pass
+  def acquire(self):
+    pass
+  def release(self):
+    pass
+
+try:
+  # Check if Python installation was build with thread support
+  import thread
+except ImportError:
+  LDAPLockBaseClass = DummyLock
+else:
+  import threading
+  LDAPLockBaseClass = threading.Lock
+
+
+class LDAPLock:
+  """
+  Mainly a wrapper class to log all locking events.
+  Note that this cumbersome approach with _lock attribute was taken
+  since threading.Lock is not suitable for sub-classing.
+  """
+  _min_trace_level = 3
+
+  def __init__(self,lock_class=None,desc=''):
+    """
+    lock_class
+        Class compatible to threading.Lock
+    desc
+        Description shown in debug log messages
+    """
+    self._desc = desc
+    self._lock = (lock_class or LDAPLockBaseClass)()
+
+  def acquire(self):
+    if __debug__:
+      global _trace_level
+      if _trace_level>=self._min_trace_level:
+        _trace_file.write('***%s %s.acquire()\n' % (self._desc,self.__class__.__name__))
+    return self._lock.acquire()
+
+  def release(self):
+    if __debug__:
+      global _trace_level
+      if _trace_level>=self._min_trace_level:
+        _trace_file.write('***%s %s.release()\n' % (self._desc,self.__class__.__name__))
+    return self._lock.release()
+
+
+# Create module-wide lock for serializing all calls into underlying LDAP lib
+_ldap_module_lock = LDAPLock(desc='Module wide')
+
+from functions import open,initialize,init,get_option,set_option
+
+from ldap.dn import explode_dn,explode_rdn,str2dn,dn2str
+del str2dn
+del dn2str
+
+# More constants
+
+# For compability of 2.3 and 2.4 OpenLDAP API
+OPT_DIAGNOSTIC_MESSAGE = OPT_ERROR_STRING
diff --git a/Lib/ldif.py b/Lib/ldif.py
new file mode 100644
index 0000000..19cbf11
--- /dev/null
+++ b/Lib/ldif.py
@@ -0,0 +1,453 @@
+"""
+ldif - generate and parse LDIF data (see RFC 2849)
+
+See http://www.python-ldap.org/ for details.
+
+$Id: ldif.py,v 1.73 2013/07/04 16:06:53 stroeder Exp $
+
+Python compability note:
+Tested with Python 2.0+, but should work with Python 1.5.2+.
+"""
+
+__version__ = '2.4.14'
+
+__all__ = [
+  # constants
+  'ldif_pattern',
+  # functions
+  'AttrTypeandValueLDIF','CreateLDIF','ParseLDIF',
+  # classes
+  'LDIFWriter',
+  'LDIFParser',
+  'LDIFRecordList',
+  'LDIFCopy',
+]
+
+import urlparse,urllib,base64,re,types
+
+try:
+  from cStringIO import StringIO
+except ImportError:
+  from StringIO import StringIO
+
+attrtype_pattern = r'[\w;.-]+(;[\w_-]+)*'
+attrvalue_pattern = r'(([^,]|\\,)+|".*?")'
+attrtypeandvalue_pattern = attrtype_pattern + r'[ ]*=[ ]*' + attrvalue_pattern
+rdn_pattern   = attrtypeandvalue_pattern + r'([ ]*\+[ ]*' + attrtypeandvalue_pattern + r')*[ ]*'
+dn_pattern   = rdn_pattern + r'([ ]*,[ ]*' + rdn_pattern + r')*[ ]*'
+dn_regex   = re.compile('^%s$' % dn_pattern)
+
+ldif_pattern = '^((dn(:|::) %(dn_pattern)s)|(%(attrtype_pattern)s(:|::) .*)$)+' % vars()
+
+MOD_OP_INTEGER = {
+  'add':0,'delete':1,'replace':2
+}
+
+MOD_OP_STR = {
+  0:'add',1:'delete',2:'replace'
+}
+
+CHANGE_TYPES = ['add','delete','modify','modrdn']
+valid_changetype_dict = {}
+for c in CHANGE_TYPES:
+  valid_changetype_dict[c]=None
+
+
+def is_dn(s):
+  """
+  returns 1 if s is a LDAP DN
+  """
+  if s=='':
+    return 1
+  rm = dn_regex.match(s)
+  return rm!=None and rm.group(0)==s
+
+
+SAFE_STRING_PATTERN = '(^(\000|\n|\r| |:|<)|[\000\n\r\200-\377]+|[ ]+$)'
+safe_string_re = re.compile(SAFE_STRING_PATTERN)
+
+def list_dict(l):
+  """
+  return a dictionary with all items of l being the keys of the dictionary
+  """
+  return dict([(i,None) for i in l])
+
+
+class LDIFWriter:
+  """
+  Write LDIF entry or change records to file object
+  Copy LDIF input to a file output object containing all data retrieved
+  via URLs
+  """
+
+  def __init__(self,output_file,base64_attrs=None,cols=76,line_sep='\n'):
+    """
+    output_file
+        file object for output
+    base64_attrs
+        list of attribute types to be base64-encoded in any case
+    cols
+        Specifies how many columns a line may have before it's
+        folded into many lines.
+    line_sep
+        String used as line separator
+    """
+    self._output_file = output_file
+    self._base64_attrs = list_dict([a.lower() for a in (base64_attrs or [])])
+    self._cols = cols
+    self._line_sep = line_sep
+    self.records_written = 0
+
+  def _unfoldLDIFLine(self,line):
+    """
+    Write string line as one or more folded lines
+    """
+    # Check maximum line length
+    line_len = len(line)
+    if line_len<=self._cols:
+      self._output_file.write(line)
+      self._output_file.write(self._line_sep)
+    else:
+      # Fold line
+      pos = self._cols
+      self._output_file.write(line[0:min(line_len,self._cols)])
+      self._output_file.write(self._line_sep)
+      while pos<line_len:
+        self._output_file.write(' ')
+        self._output_file.write(line[pos:min(line_len,pos+self._cols-1)])
+        self._output_file.write(self._line_sep)
+        pos = pos+self._cols-1
+    return # _unfoldLDIFLine()
+
+  def _needs_base64_encoding(self,attr_type,attr_value):
+    """
+    returns 1 if attr_value has to be base-64 encoded because
+    of special chars or because attr_type is in self._base64_attrs
+    """
+    return self._base64_attrs.has_key(attr_type.lower()) or \
+           not safe_string_re.search(attr_value) is None
+
+  def _unparseAttrTypeandValue(self,attr_type,attr_value):
+    """
+    Write a single attribute type/value pair
+
+    attr_type
+          attribute type
+    attr_value
+          attribute value
+    """
+    if self._needs_base64_encoding(attr_type,attr_value):
+      # Encode with base64
+      self._unfoldLDIFLine(':: '.join([attr_type,base64.encodestring(attr_value).replace('\n','')]))
+    else:
+      self._unfoldLDIFLine(': '.join([attr_type,attr_value]))
+    return # _unparseAttrTypeandValue()
+
+  def _unparseEntryRecord(self,entry):
+    """
+    entry
+        dictionary holding an entry
+    """
+    attr_types = entry.keys()[:]
+    attr_types.sort()
+    for attr_type in attr_types:
+      for attr_value in entry[attr_type]:
+        self._unparseAttrTypeandValue(attr_type,attr_value)
+
+  def _unparseChangeRecord(self,modlist):
+    """
+    modlist
+        list of additions (2-tuple) or modifications (3-tuple)
+    """
+    mod_len = len(modlist[0])
+    if mod_len==2:
+      changetype = 'add'
+    elif mod_len==3:
+      changetype = 'modify'
+    else:
+      raise ValueError,"modlist item of wrong length"
+    self._unparseAttrTypeandValue('changetype',changetype)
+    for mod in modlist:
+      if mod_len==2:
+        mod_type,mod_vals = mod
+      elif mod_len==3:
+        mod_op,mod_type,mod_vals = mod
+        self._unparseAttrTypeandValue(MOD_OP_STR[mod_op],mod_type)
+      else:
+        raise ValueError,"Subsequent modlist item of wrong length"
+      if mod_vals:
+        for mod_val in mod_vals:
+          self._unparseAttrTypeandValue(mod_type,mod_val)
+      if mod_len==3:
+        self._output_file.write('-'+self._line_sep)
+
+  def unparse(self,dn,record):
+    """
+    dn
+          string-representation of distinguished name
+    record
+          Either a dictionary holding the LDAP entry {attrtype:record}
+          or a list with a modify list like for LDAPObject.modify().
+    """
+    # Start with line containing the distinguished name
+    self._unparseAttrTypeandValue('dn',dn)
+    # Dispatch to record type specific writers
+    if isinstance(record,types.DictType):
+      self._unparseEntryRecord(record)
+    elif isinstance(record,types.ListType):
+      self._unparseChangeRecord(record)
+    else:
+      raise ValueError, "Argument record must be dictionary or list"
+    # Write empty line separating the records
+    self._output_file.write(self._line_sep)
+    # Count records written
+    self.records_written = self.records_written+1
+    return # unparse()
+
+
+def CreateLDIF(dn,record,base64_attrs=None,cols=76):
+  """
+  Create LDIF single formatted record including trailing empty line.
+  This is a compability function. Use is deprecated!
+
+  dn
+        string-representation of distinguished name
+  record
+        Either a dictionary holding the LDAP entry {attrtype:record}
+        or a list with a modify list like for LDAPObject.modify().
+  base64_attrs
+        list of attribute types to be base64-encoded in any case
+  cols
+        Specifies how many columns a line may have before it's
+        folded into many lines.
+  """
+  f = StringIO()
+  ldif_writer = LDIFWriter(f,base64_attrs,cols,'\n')
+  ldif_writer.unparse(dn,record)
+  s = f.getvalue()
+  f.close()
+  return s
+
+
+class LDIFParser:
+  """
+  Base class for a LDIF parser. Applications should sub-class this
+  class and override method handle() to implement something meaningful.
+
+  Public class attributes:
+
+  records_read
+        Counter for records processed so far
+  """
+
+  def _stripLineSep(self,s):
+    """
+    Strip trailing line separators from s, but no other whitespaces
+    """
+    if s[-2:]=='\r\n':
+      return s[:-2]
+    elif s[-1:]=='\n':
+      return s[:-1]
+    else:
+      return s
+
+  def __init__(
+    self,
+    input_file,
+    ignored_attr_types=None,
+    max_entries=0,
+    process_url_schemes=None,
+    line_sep='\n'
+  ):
+    """
+    Parameters:
+    input_file
+        File-object to read the LDIF input from
+    ignored_attr_types
+        Attributes with these attribute type names will be ignored.
+    max_entries
+        If non-zero specifies the maximum number of entries to be
+        read from f.
+    process_url_schemes
+        List containing strings with URLs schemes to process with urllib.
+        An empty list turns off all URL processing and the attribute
+        is ignored completely.
+    line_sep
+        String used as line separator
+    """
+    self._input_file = input_file
+    self._max_entries = max_entries
+    self._process_url_schemes = list_dict([s.lower() for s in (process_url_schemes or [])])
+    self._ignored_attr_types = list_dict([a.lower() for a in (ignored_attr_types or [])])
+    self._line_sep = line_sep
+    self.records_read = 0
+
+  def handle(self,dn,entry):
+    """
+    Process a single content LDIF record. This method should be
+    implemented by applications using LDIFParser.
+    """
+
+  def _unfoldLDIFLine(self):
+    """
+    Unfold several folded lines with trailing space into one line
+    """
+    unfolded_lines = [ self._stripLineSep(self._line) ]
+    self._line = self._input_file.readline()
+    while self._line and self._line[0]==' ':
+      unfolded_lines.append(self._stripLineSep(self._line[1:]))
+      self._line = self._input_file.readline()
+    return ''.join(unfolded_lines)
+
+  def _parseAttrTypeandValue(self):
+    """
+    Parse a single attribute type and value pair from one or
+    more lines of LDIF data
+    """
+    # Reading new attribute line
+    unfolded_line = self._unfoldLDIFLine()
+    # Ignore comments which can also be folded
+    while unfolded_line and unfolded_line[0]=='#':
+      unfolded_line = self._unfoldLDIFLine()
+    if not unfolded_line or unfolded_line=='\n' or unfolded_line=='\r\n':
+      return None,None
+    try:
+      colon_pos = unfolded_line.index(':')
+    except ValueError:
+      # Treat malformed lines without colon as non-existent
+      return None,None
+    attr_type = unfolded_line[0:colon_pos]
+    # if needed attribute value is BASE64 decoded
+    value_spec = unfolded_line[colon_pos:colon_pos+2]
+    if value_spec=='::':
+      # attribute value needs base64-decoding
+      attr_value = base64.decodestring(unfolded_line[colon_pos+2:])
+    elif value_spec==':<':
+      # fetch attribute value from URL
+      url = unfolded_line[colon_pos+2:].strip()
+      attr_value = None
+      if self._process_url_schemes:
+        u = urlparse.urlparse(url)
+        if self._process_url_schemes.has_key(u[0]):
+          attr_value = urllib.urlopen(url).read()
+    elif value_spec==':\r\n' or value_spec=='\n':
+      attr_value = ''
+    else:
+      attr_value = unfolded_line[colon_pos+2:].lstrip()
+    return attr_type,attr_value
+
+  def parse(self):
+    """
+    Continously read and parse LDIF records
+    """
+    self._line = self._input_file.readline()
+
+    while self._line and \
+          (not self._max_entries or self.records_read<self._max_entries):
+
+      # Reset record
+      version = None; dn = None; changetype = None; modop = None; entry = {}
+
+      attr_type,attr_value = self._parseAttrTypeandValue()
+
+      while attr_type!=None and attr_value!=None:
+        if attr_type=='dn':
+          # attr type and value pair was DN of LDIF record
+          if dn!=None:
+            raise ValueError, 'Two lines starting with dn: in one record.'
+          if not is_dn(attr_value):
+            raise ValueError, 'No valid string-representation of distinguished name %s.' % (repr(attr_value))
+          dn = attr_value
+        elif attr_type=='version' and dn is None:
+          version = 1
+        elif attr_type=='changetype':
+          # attr type and value pair was DN of LDIF record
+          if dn is None:
+            raise ValueError, 'Read changetype: before getting valid dn: line.'
+          if changetype!=None:
+            raise ValueError, 'Two lines starting with changetype: in one record.'
+          if not valid_changetype_dict.has_key(attr_value):
+            raise ValueError, 'changetype value %s is invalid.' % (repr(attr_value))
+          changetype = attr_value
+        elif attr_value!=None and \
+             not self._ignored_attr_types.has_key(attr_type.lower()):
+          # Add the attribute to the entry if not ignored attribute
+          if entry.has_key(attr_type):
+            entry[attr_type].append(attr_value)
+          else:
+            entry[attr_type]=[attr_value]
+
+        # Read the next line within an entry
+        attr_type,attr_value = self._parseAttrTypeandValue()
+
+      if entry:
+        # append entry to result list
+        self.handle(dn,entry)
+        self.records_read = self.records_read+1
+
+    return # parse()
+
+
+class LDIFRecordList(LDIFParser):
+  """
+  Collect all records of LDIF input into a single list.
+  of 2-tuples (dn,entry). It can be a memory hog!
+  """
+
+  def __init__(
+    self,
+    input_file,
+    ignored_attr_types=None,max_entries=0,process_url_schemes=None
+  ):
+    """
+    See LDIFParser.__init__()
+
+    Additional Parameters:
+    all_records
+        List instance for storing parsed records
+    """
+    LDIFParser.__init__(self,input_file,ignored_attr_types,max_entries,process_url_schemes)
+    self.all_records = []
+
+  def handle(self,dn,entry):
+    """
+    Append single record to dictionary of all records.
+    """
+    self.all_records.append((dn,entry))
+
+
+class LDIFCopy(LDIFParser):
+  """
+  Copy LDIF input to LDIF output containing all data retrieved
+  via URLs
+  """
+
+  def __init__(
+    self,
+    input_file,output_file,
+    ignored_attr_types=None,max_entries=0,process_url_schemes=None,
+    base64_attrs=None,cols=76,line_sep='\n'
+  ):
+    """
+    See LDIFParser.__init__() and LDIFWriter.__init__()
+    """
+    LDIFParser.__init__(self,input_file,ignored_attr_types,max_entries,process_url_schemes)
+    self._output_ldif = LDIFWriter(output_file,base64_attrs,cols,line_sep)
+
+  def handle(self,dn,entry):
+    """
+    Write single LDIF record to output file.
+    """
+    self._output_ldif.unparse(dn,entry)
+
+
+def ParseLDIF(f,ignore_attrs=None,maxentries=0):
+  """
+  Parse LDIF records read from file.
+  This is a compability function. Use is deprecated!
+  """
+  ldif_parser = LDIFRecordList(
+    f,ignored_attr_types=ignore_attrs,max_entries=maxentries,process_url_schemes=0
+  )
+  ldif_parser.parse()
+  return ldif_parser.all_records

From 7ad8afb26e9fe867897849aab78cdc27fa1b907d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 4 Jul 2013 16:20:06 +0000
Subject: [PATCH 097/868] Removed obsolete shee-bang

---
 Lib/ldap/controls/sessiontrack.py | 63 +++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 Lib/ldap/controls/sessiontrack.py

diff --git a/Lib/ldap/controls/sessiontrack.py b/Lib/ldap/controls/sessiontrack.py
new file mode 100644
index 0000000..285c637
--- /dev/null
+++ b/Lib/ldap/controls/sessiontrack.py
@@ -0,0 +1,63 @@
+"""
+ldap.controls.sessiontrack - class for session tracking control
+(see draft-wahl-ldap-session)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: sessiontrack.py,v 1.4 2013/07/04 16:20:06 stroeder Exp $
+"""
+
+from ldap.controls import RequestControl
+
+from pyasn1.type import namedtype,univ
+from pyasn1.codec.ber import encoder
+from pyasn1_modules.rfc2251 import LDAPString,LDAPOID
+
+
+# OID constants
+SESSION_TRACKING_CONTROL_OID = "1.3.6.1.4.1.21008.108.63.1"
+SESSION_TRACKING_FORMAT_OID_RADIUS_ACCT_SESSION_ID = SESSION_TRACKING_CONTROL_OID+".1"
+SESSION_TRACKING_FORMAT_OID_RADIUS_ACCT_MULTI_SESSION_ID = SESSION_TRACKING_CONTROL_OID+".2"
+SESSION_TRACKING_FORMAT_OID_USERNAME = SESSION_TRACKING_CONTROL_OID+".3"
+
+
+class SessionTrackingControl(RequestControl):
+  """
+  Class for Session Tracking Control
+
+  Because criticality MUST be false for this control it cannot be set
+  from the application.
+
+  sessionSourceIp
+    IP address of the request source as string
+  sessionSourceName
+    Name of the request source as string
+  formatOID
+    OID as string specifying the format
+  sessionTrackingIdentifier
+    String containing a specific tracking ID
+  """
+
+  class SessionIdentifierControlValue(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+      namedtype.NamedType('sessionSourceIp',LDAPString()),
+      namedtype.NamedType('sessionSourceName',LDAPString()),
+      namedtype.NamedType('formatOID',LDAPOID()),
+      namedtype.NamedType('sessionTrackingIdentifier',LDAPString()),
+    )
+
+  controlType = SESSION_TRACKING_CONTROL_OID
+
+  def __init__(self,sessionSourceIp,sessionSourceName,formatOID,sessionTrackingIdentifier):
+    # criticality MUST be false for this control
+    self.criticality = False
+    self.sessionSourceIp,self.sessionSourceName,self.formatOID,self.sessionTrackingIdentifier = \
+      sessionSourceIp,sessionSourceName,formatOID,sessionTrackingIdentifier
+
+  def encodeControlValue(self):
+    s = self.SessionIdentifierControlValue()
+    s.setComponentByName('sessionSourceIp',LDAPString(self.sessionSourceIp))
+    s.setComponentByName('sessionSourceName',LDAPString(self.sessionSourceName))
+    s.setComponentByName('formatOID',LDAPOID(self.formatOID))
+    s.setComponentByName('sessionTrackingIdentifier',LDAPString(self.sessionTrackingIdentifier))
+    return encoder.encode(s)

From b2495dc0df74d123b1f7776badd381e734591dbd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Jul 2013 16:57:25 +0000
Subject: [PATCH 098/868] Added ldap.controls.openldap.SearchNoOpControl

---
 Demo/pyasn1/noopsearch.py     | 71 +++++++++++++++++++++++++++++++++++
 Lib/ldap/controls/openldap.py | 44 ++++++++++++++++++++++
 2 files changed, 115 insertions(+)
 create mode 100644 Demo/pyasn1/noopsearch.py
 create mode 100644 Lib/ldap/controls/openldap.py

diff --git a/Demo/pyasn1/noopsearch.py b/Demo/pyasn1/noopsearch.py
new file mode 100644
index 0000000..a22f394
--- /dev/null
+++ b/Demo/pyasn1/noopsearch.py
@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*-
+"""
+Demo script for counting searching with OpenLDAP's no-op control
+
+See http://www.python-ldap.org/ for project details.
+This needs the following software:
+Python
+pyasn1
+pyasn1-modules
+python-ldap 2.4+
+"""
+
+import sys,ldap,ldapurl,getpass
+
+from ldap.controls.openldap import SearchNoOpControl
+
+LDAPLimitErrors = (ldap.TIMEOUT,ldap.TIMELIMIT_EXCEEDED,ldap.SIZELIMIT_EXCEEDED,ldap.ADMINLIMIT_EXCEEDED)
+
+SEARCH_TIMEOUT=30.0
+
+try:
+  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+except IndexError:
+  print 'Usage: noopsearch.py <LDAP URL>'
+  sys.exit(1)
+
+# Set debugging level
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 2
+ldapmodule_trace_file = sys.stderr
+
+ldap_conn = ldap.ldapobject.LDAPObject(
+  ldap_url.initializeUrl(),
+  trace_level=ldapmodule_trace_level,
+  trace_file=ldapmodule_trace_file
+)
+
+if ldap_url.who and ldap_url.cred is None:
+  print 'Password for %s:' % (repr(ldap_url.who))
+  ldap_url.cred = getpass.getpass()
+
+try:
+  ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
+
+except ldap.INVALID_CREDENTIALS,e:
+  print 'Simple bind failed:',str(e)
+  sys.exit(1)
+
+try:
+  msg_id = ldap_conn.search_ext(
+    ldap_url.dn,
+    ldap_url.scope,
+    filterstr=ldap_url.filterstr or '(objectClass=*)',
+    attrlist=['1.1'],
+    timeout=SEARCH_TIMEOUT,
+    serverctrls=[SearchNoOpControl(criticality=True)],
+  )
+  _,_,_,search_response_ctrls = ldap_conn.result3(msg_id,all=1,timeout=SEARCH_TIMEOUT)
+except LDAPLimitErrors,e:
+  ldap_conn.abandon(msg_id)
+  sys.exit(1)
+
+
+noop_srch_ctrl = [
+  c
+  for c in search_response_ctrls
+  if c.controlType==SearchNoOpControl.controlType
+][0]
+
+print 'Number of search results: %d' % noop_srch_ctrl.numSearchResults
+print 'Number of search continuations: %d' % noop_srch_ctrl.numSearchContinuations
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
new file mode 100644
index 0000000..a8ed001
--- /dev/null
+++ b/Lib/ldap/controls/openldap.py
@@ -0,0 +1,44 @@
+"""
+ldap.controls.openldap - classes for OpenLDAP-specific controls
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: openldap.py,v 1.1 2013/07/05 16:57:25 stroeder Exp $
+"""
+
+import ldap.controls
+from ldap.controls import ValueLessRequestControl,ResponseControl
+
+from pyasn1.type import univ
+from pyasn1.codec.ber import decoder
+
+
+__all__ = [
+  'SearchNoOpControl'
+]
+
+
+class SearchNoOpControl(ValueLessRequestControl,ResponseControl):
+  """
+  No-op control attached to search operations implementing sort of a
+  count operation
+
+  see http://www.openldap.org/its/index.cgi?findid=6598
+  """
+  controlType = '1.3.6.1.4.1.4203.666.5.18'
+
+  def __init__(self,criticality=False):
+    self.criticality = criticality
+
+  class SearchNoOpControlValue(univ.Sequence):
+    pass
+
+  def decodeControlValue(self,encodedControlValue):
+    decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=self.SearchNoOpControlValue())
+    self.resultCode = int(decodedValue[0])
+    self.numSearchResults = int(decodedValue[1])
+    self.numSearchContinuations = int(decodedValue[2])
+
+
+ldap.controls.KNOWN_RESPONSE_CONTROLS[SearchNoOpControl.controlType] = SearchNoOpControl
+

From 30622a4a3e59fa7c5fba6bd4f5939c0a91550ad5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 13 Aug 2013 12:33:08 +0000
Subject: [PATCH 099/868] updated reference to RFC 4516 in comment

---
 Lib/ldapurl.py | 433 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 433 insertions(+)
 create mode 100644 Lib/ldapurl.py

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
new file mode 100644
index 0000000..af501a4
--- /dev/null
+++ b/Lib/ldapurl.py
@@ -0,0 +1,433 @@
+"""
+ldapurl - handling of LDAP URLs as described in RFC 4516
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: ldapurl.py,v 1.63 2013/08/13 12:33:08 stroeder Exp $
+
+Python compability note:
+This module only works with Python 2.0+ since
+1. string methods are used instead of module string and
+2. list comprehensions are used.
+"""
+
+__version__ = '2.4.14'
+
+__all__ = [
+  # constants
+  'SEARCH_SCOPE','SEARCH_SCOPE_STR',
+  'LDAP_SCOPE_BASE','LDAP_SCOPE_ONELEVEL','LDAP_SCOPE_SUBTREE',
+  # functions
+  'isLDAPUrl',
+  # classes
+  'LDAPUrlExtension','LDAPUrlExtensions','LDAPUrl'
+]
+
+import UserDict
+
+from urllib import quote,unquote
+
+LDAP_SCOPE_BASE = 0
+LDAP_SCOPE_ONELEVEL = 1
+LDAP_SCOPE_SUBTREE = 2
+
+SEARCH_SCOPE_STR = {None:'',0:'base',1:'one',2:'sub'}
+
+SEARCH_SCOPE = {
+  '':None,
+  # the search scope strings defined in RFC 4516
+  'base':LDAP_SCOPE_BASE,
+  'one':LDAP_SCOPE_ONELEVEL,
+  'sub':LDAP_SCOPE_SUBTREE,
+}
+
+# Some widely used types
+StringType = type('')
+TupleType=type(())
+
+
+def isLDAPUrl(s):
+  """
+  Returns 1 if s is a LDAP URL, 0 else
+  """
+  s_lower = s.lower()
+  return \
+    s_lower.startswith('ldap://') or \
+    s_lower.startswith('ldaps://') or \
+    s_lower.startswith('ldapi://')
+
+
+def ldapUrlEscape(s):
+  """Returns URL encoding of string s"""
+  return quote(s).replace(',','%2C').replace('/','%2F')
+
+
+class LDAPUrlExtension:
+  """
+  Class for parsing and unparsing LDAP URL extensions
+  as described in RFC 4516.
+
+  Usable class attributes:
+    critical
+          Boolean integer marking the extension as critical
+    extype    
+          Type of extension
+    exvalue
+          Value of extension
+  """
+
+  def __init__(self,extensionStr=None,critical=0,extype=None,exvalue=None):
+    self.critical = critical
+    self.extype = extype
+    self.exvalue = exvalue
+    if extensionStr:
+      self._parse(extensionStr)
+
+  def _parse(self,extension):
+    extension = extension.strip()
+    if not extension:
+      # Don't parse empty strings
+      self.extype,self.exvalue = None,None
+      return
+    self.critical = extension[0]=='!'
+    if extension[0]=='!':
+      extension = extension[1:].strip()
+    try:
+      self.extype,self.exvalue = extension.split('=',1)
+    except ValueError:
+      # No value, just the extype
+      self.extype,self.exvalue = extension,None
+    else:
+      self.exvalue = unquote(self.exvalue.strip())
+    self.extype = self.extype.strip()
+
+  def unparse(self):
+    if self.exvalue is None:
+      return '%s%s' % ('!'*(self.critical>0),self.extype)
+    else:
+      return '%s%s=%s' % (
+        '!'*(self.critical>0),
+        self.extype,quote(self.exvalue or '')
+      )
+    
+  def __str__(self):
+    return self.unparse()
+
+  def __repr__(self):
+    return '<%s.%s instance at %s: %s>' % (
+      self.__class__.__module__,
+      self.__class__.__name__,
+      hex(id(self)),
+      self.__dict__
+    )
+
+  def __eq__(self,other):
+    return \
+      (self.critical==other.critical) and \
+      (self.extype==other.extype) and \
+      (self.exvalue==other.exvalue)
+
+  def __ne__(self,other):
+    return not self.__eq__(other)
+
+
+class LDAPUrlExtensions(UserDict.UserDict):
+  """
+  Models a collection of LDAP URL extensions as
+  dictionary type
+  """
+
+  def __init__(self,default=None):
+    UserDict.UserDict.__init__(self)
+    for k,v in (default or {}).items():
+      self[k]=v
+
+  def __setitem__(self,name,value):
+    """
+    value
+        Either LDAPUrlExtension instance, (critical,exvalue)
+        or string'ed exvalue
+    """
+    assert isinstance(value,LDAPUrlExtension)
+    assert name==value.extype
+    self.data[name] = value
+
+  def values(self):
+    return [
+      self[k]
+      for k in self.keys()
+    ]
+
+  def __str__(self):
+    return ','.join(map(str,self.values()))
+
+  def __repr__(self):
+    return '<%s.%s instance at %s: %s>' % (
+      self.__class__.__module__,
+      self.__class__.__name__,
+      hex(id(self)),
+      self.data
+    )
+
+  def __eq__(self,other):
+    assert isinstance(other,self.__class__),TypeError(
+      "other has to be instance of %s" % (self.__class__)
+    )
+    return self.data==other.data
+    
+  def parse(self,extListStr):
+    for extension_str in extListStr.strip().split(','):
+      if extension_str:
+        e = LDAPUrlExtension(extension_str)
+        self[e.extype] = e
+
+  def unparse(self):
+    return ','.join([ v.unparse() for v in self.values() ])
+
+
+class LDAPUrl:
+  """
+  Class for parsing and unparsing LDAP URLs
+  as described in RFC 4516.
+
+  Usable class attributes:
+    urlscheme
+        URL scheme (either ldap, ldaps or ldapi)
+    hostport
+        LDAP host (default '')
+    dn
+        String holding distinguished name (default '')
+    attrs
+        list of attribute types (default None)
+    scope
+        integer search scope for ldap-module
+    filterstr
+        String representation of LDAP Search Filters
+        (see RFC 4515)
+    extensions
+        Dictionary used as extensions store
+    who
+        Maps automagically to bindname LDAP URL extension
+    cred
+        Maps automagically to X-BINDPW LDAP URL extension
+  """
+
+  attr2extype = {'who':'bindname','cred':'X-BINDPW'}
+
+  def __init__(
+    self,
+    ldapUrl=None,
+    urlscheme='ldap',
+    hostport='',dn='',attrs=None,scope=None,filterstr=None,
+    extensions=None,
+    who=None,cred=None
+  ):
+    self.urlscheme=urlscheme
+    self.hostport=hostport
+    self.dn=dn
+    self.attrs=attrs
+    self.scope=scope
+    self.filterstr=filterstr
+    self.extensions=(extensions or LDAPUrlExtensions({}))
+    if ldapUrl!=None:
+      self._parse(ldapUrl)
+    if who!=None:
+      self.who = who
+    if cred!=None:
+      self.cred = cred
+
+  def __eq__(self,other):
+    return \
+      self.urlscheme==other.urlscheme and \
+      self.hostport==other.hostport and \
+      self.dn==other.dn and \
+      self.attrs==other.attrs and \
+      self.scope==other.scope and \
+      self.filterstr==other.filterstr and \
+      self.extensions==other.extensions
+
+  def __ne__(self,other):
+    return not self.__eq__(other)
+
+  def _parse(self,ldap_url):
+    """
+    parse a LDAP URL and set the class attributes
+    urlscheme,host,dn,attrs,scope,filterstr,extensions
+    """
+    if not isLDAPUrl(ldap_url):
+      raise ValueError,'Parameter ldap_url does not seem to be a LDAP URL.'
+    scheme,rest = ldap_url.split('://',1)
+    self.urlscheme = scheme.strip()
+    if not self.urlscheme in ['ldap','ldaps','ldapi']:
+      raise ValueError,'LDAP URL contains unsupported URL scheme %s.' % (self.urlscheme)
+    slash_pos = rest.find('/')
+    qemark_pos = rest.find('?')
+    if (slash_pos==-1) and (qemark_pos==-1):
+      # No / and ? found at all
+      self.hostport = unquote(rest)
+      self.dn = ''
+      return
+    else:
+      if slash_pos!=-1 and (qemark_pos==-1 or (slash_pos<qemark_pos)):
+        # Slash separates DN from hostport
+        self.hostport = unquote(rest[:slash_pos])
+        # Eat the slash from rest
+        rest = rest[slash_pos+1:]
+      elif qemark_pos!=1 and (slash_pos==-1 or (slash_pos>qemark_pos)):
+        # Question mark separates hostport from rest, DN is assumed to be empty
+        self.hostport = unquote(rest[:qemark_pos])
+        # Do not eat question mark
+        rest = rest[qemark_pos:]
+      else:
+        raise ValueError,'Something completely weird happened!'
+    paramlist=rest.split('?',4)
+    paramlist_len = len(paramlist)
+    if paramlist_len>=1:
+      self.dn = unquote(paramlist[0]).strip()
+    if (paramlist_len>=2) and (paramlist[1]):
+      self.attrs = unquote(paramlist[1].strip()).split(',')
+    if paramlist_len>=3:
+      scope = paramlist[2].strip()
+      try:
+        self.scope = SEARCH_SCOPE[scope]
+      except KeyError:
+        raise ValueError,"Search scope must be either one of base, one or sub. LDAP URL contained %s" % (repr(scope))
+    if paramlist_len>=4:
+      filterstr = paramlist[3].strip()
+      if not filterstr:
+        self.filterstr = None
+      else:
+        self.filterstr = unquote(filterstr)
+    if paramlist_len>=5:
+      if paramlist[4]:
+        self.extensions = LDAPUrlExtensions()
+        self.extensions.parse(paramlist[4])
+      else:
+        self.extensions = None
+    return
+
+  def applyDefaults(self,defaults):
+    """
+    Apply defaults to all class attributes which are None.
+
+    defaults
+        Dictionary containing a mapping from class attributes
+        to default values
+    """
+    for k in defaults.keys():
+      if getattr(self,k) is None:
+        setattr(self,k,defaults[k])
+
+  def initializeUrl(self):
+    """
+    Returns LDAP URL suitable to be passed to ldap.initialize()
+    """
+    if self.urlscheme=='ldapi':
+      # hostport part might contain slashes when ldapi:// is used
+      hostport = ldapUrlEscape(self.hostport)
+    else:
+      hostport = self.hostport
+    return '%s://%s' % (self.urlscheme,hostport)
+
+  def unparse(self):
+    """
+    Returns LDAP URL depending on class attributes set.
+    """
+    if self.attrs is None:
+      attrs_str = ''
+    else:
+      attrs_str = ','.join(self.attrs)
+    scope_str = SEARCH_SCOPE_STR[self.scope]
+    if self.filterstr is None:
+      filterstr = ''
+    else:
+      filterstr = ldapUrlEscape(self.filterstr)
+    dn = ldapUrlEscape(self.dn)
+    if self.urlscheme=='ldapi':
+      # hostport part might contain slashes when ldapi:// is used
+      hostport = ldapUrlEscape(self.hostport)
+    else:
+      hostport = self.hostport
+    ldap_url = '%s://%s/%s?%s?%s?%s' % (
+      self.urlscheme,
+      hostport,dn,attrs_str,scope_str,filterstr
+    )
+    if self.extensions:
+      ldap_url = ldap_url+'?'+self.extensions.unparse()
+    return ldap_url
+  
+  def htmlHREF(self,urlPrefix='',hrefText=None,hrefTarget=None):
+    """
+    Returns a string with HTML link for this LDAP URL.
+    
+    urlPrefix
+        Prefix before LDAP URL (e.g. for addressing another web-based client)
+    hrefText
+        link text/description
+    hrefTarget
+        string added as link target attribute
+    """
+    assert type(urlPrefix)==StringType, "urlPrefix must be StringType"
+    if hrefText is None:
+      hrefText = self.unparse()
+    assert type(hrefText)==StringType, "hrefText must be StringType"
+    if hrefTarget is None:
+      target = ''
+    else:
+      assert type(hrefTarget)==StringType, "hrefTarget must be StringType"
+      target = ' target="%s"' % hrefTarget
+    return '<a%s href="%s%s">%s</a>' % (
+      target,urlPrefix,self.unparse(),hrefText
+    )
+
+  def __str__(self):
+    return self.unparse()
+
+  def __repr__(self):
+    return '<%s.%s instance at %s: %s>' % (
+      self.__class__.__module__,
+      self.__class__.__name__,
+      hex(id(self)),
+      self.__dict__
+    )
+
+  def __getattr__(self,name):
+    if self.attr2extype.has_key(name):
+      extype = self.attr2extype[name]
+      if self.extensions and \
+         self.extensions.has_key(extype) and \
+         not self.extensions[extype].exvalue is None:
+        result = unquote(self.extensions[extype].exvalue)
+      else:
+        return None
+    else:
+      raise AttributeError,"%s has no attribute %s" % (
+        self.__class__.__name__,name
+      )
+    return result # __getattr__()
+
+  def __setattr__(self,name,value):
+    if self.attr2extype.has_key(name):
+      extype = self.attr2extype[name]
+      if value is None:
+        # A value of None means that extension is deleted
+        delattr(self,name)
+      elif value!=None:
+        # Add appropriate extension
+        self.extensions[extype] = LDAPUrlExtension(
+          extype=extype,exvalue=unquote(value)
+        )
+    else:
+      self.__dict__[name] = value
+
+  def __delattr__(self,name):
+    if self.attr2extype.has_key(name):
+      extype = self.attr2extype[name]
+      if self.extensions:
+        try:
+          del self.extensions[extype]
+        except KeyError:
+          pass
+    else:
+      del self.__dict__[name]
+

From 71024518dbc9c539a5bab834080e3792ac4dbfe9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 11 Sep 2013 08:16:27 +0000
Subject: [PATCH 100/868] Added support for
 LDAPObject.get_option(ldap.OPT_X_TLS_VERSION)

---
 Demo/initialize.py  |  95 +++++++++++
 Modules/constants.c | 378 +++++++++++++++++++++++++++++++++++++++++++
 Modules/options.c   | 382 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 855 insertions(+)
 create mode 100644 Demo/initialize.py
 create mode 100644 Modules/constants.c
 create mode 100644 Modules/options.c

diff --git a/Demo/initialize.py b/Demo/initialize.py
new file mode 100644
index 0000000..ab2647e
--- /dev/null
+++ b/Demo/initialize.py
@@ -0,0 +1,95 @@
+"""
+Various examples how to connect to a LDAP host with the new
+factory function ldap.initialize() introduced in OpenLDAP 2 API.
+
+Assuming you have LDAP servers running on
+ldap://localhost:1390 (LDAP with StartTLS)
+ldaps://localhost:1391 (LDAP over SSL)
+ldapi://%2ftmp%2fopenldap2 (domain socket /tmp/openldap2)
+"""
+
+import sys,os,ldap
+
+# Switch off processing .ldaprc or ldap.conf
+os.environ['LDAPNOINIT']='1'
+
+# Set debugging level
+#ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
+ldapmodule_trace_level = 1
+ldapmodule_trace_file = sys.stderr
+
+ldap._trace_level = ldapmodule_trace_level
+
+# Complete path name of the file containing all trusted CA certs
+CACERTFILE='/etc/ssl/ca-bundle.pem'
+
+print """##################################################################
+# LDAPv3 connection with StartTLS ext. op.
+##################################################################
+"""
+
+# Create LDAPObject instance
+l = ldap.initialize('ldap://localhost:1390',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
+
+# Set LDAP protocol version used
+l.protocol_version=ldap.VERSION3
+
+# Force cert validation
+l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND)
+# Set path name of file containing all trusted CA certificates
+l.set_option(ldap.OPT_X_TLS_CACERTFILE,CACERTFILE)
+# Force libldap to create a new SSL context (must be last TLS option!)
+l.set_option(ldap.OPT_X_TLS_NEWCTX,0)
+
+# Now try StartTLS extended operation
+l.start_tls_s()
+
+print '***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION)
+print '***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER)
+
+# Try an explicit anon bind to provoke failure
+l.simple_bind_s('','')
+
+# Close connection
+l.unbind_s()
+
+print """##################################################################
+# LDAPv3 connection over SSL
+##################################################################
+"""
+
+# Create LDAPObject instance
+l = ldap.initialize('ldaps://localhost:1391',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
+
+# Set LDAP protocol version used
+l.protocol_version=ldap.VERSION3
+
+# Force cert validation
+l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND)
+# Set path name of file containing all trusted CA certificates
+l.set_option(ldap.OPT_X_TLS_CACERTFILE,CACERTFILE)
+# Force libldap to create a new SSL context (must be last TLS option!)
+l.set_option(ldap.OPT_X_TLS_NEWCTX,0)
+
+# Try an explicit anon bind to provoke failure
+l.simple_bind_s('','')
+
+print '***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION)
+print '***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER)
+
+# Close connection
+l.unbind_s()
+
+print """##################################################################
+# LDAPv3 connection over Unix domain socket
+##################################################################
+"""
+
+# Create LDAPObject instance
+l = ldap.initialize('ldapi://%2ftmp%2fopenldap-socket',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
+# Set LDAP protocol version used
+l.protocol_version=ldap.VERSION3
+# Try an explicit anon bind to provoke failure
+l.simple_bind_s('','')
+# Close connection
+l.unbind_s()
diff --git a/Modules/constants.c b/Modules/constants.c
new file mode 100644
index 0000000..d815edd
--- /dev/null
+++ b/Modules/constants.c
@@ -0,0 +1,378 @@
+/* constants defined for LDAP
+ * See http://www.python-ldap.org/ for details.
+ * $Id: constants.c,v 1.57 2013/09/11 08:16:27 stroeder Exp $ */
+
+#include "common.h"
+#include "constants.h"
+#include "lber.h"
+#include "ldap.h"
+
+static PyObject* reverse;
+static PyObject* forward;
+
+/* convert an result integer into a Python string */
+
+PyObject*
+LDAPconstant( int val ) {
+    PyObject *i = PyInt_FromLong( val );
+    PyObject *s = PyObject_GetItem( reverse, i );
+    if (s == NULL) {
+      PyErr_Clear();
+  return i;
+    }
+    Py_DECREF(i);
+    return s;
+}
+
+/* initialise the module constants */
+
+void
+LDAPinit_constants( PyObject* d )
+{
+  PyObject *zero, *author,*obj;
+
+  reverse = PyDict_New();
+  forward = PyDict_New();
+  
+  PyDict_SetItemString( d, "_reverse", reverse );
+  PyDict_SetItemString( d, "_forward", forward );
+
+#define add_int(d, name) \
+  { \
+    PyObject *i = PyInt_FromLong(LDAP_##name); \
+    PyDict_SetItemString( d, #name, i ); \
+    Py_DECREF(i); \
+  }
+
+  /* simple constants */
+
+  add_int(d,API_VERSION);
+  add_int(d,VENDOR_VERSION);
+
+        add_int(d,PORT);
+  add_int(d,VERSION1);
+  add_int(d,VERSION2);
+  add_int(d,VERSION3);
+  add_int(d,VERSION_MIN);
+  add_int(d,VERSION);
+  add_int(d,VERSION_MAX);
+  add_int(d,TAG_MESSAGE);
+  add_int(d,TAG_MSGID);
+
+  add_int(d,REQ_BIND);
+  add_int(d,REQ_UNBIND);
+  add_int(d,REQ_SEARCH);
+  add_int(d,REQ_MODIFY);
+  add_int(d,REQ_ADD);
+  add_int(d,REQ_DELETE);
+  add_int(d,REQ_MODRDN);
+  add_int(d,REQ_COMPARE);
+  add_int(d,REQ_ABANDON);
+
+  add_int(d,TAG_LDAPDN);
+  add_int(d,TAG_LDAPCRED);
+  add_int(d,TAG_CONTROLS);
+  add_int(d,TAG_REFERRAL);
+
+  add_int(d,REQ_EXTENDED);
+#if LDAP_API_VERSION >= 2004
+  add_int(d,TAG_NEWSUPERIOR);
+  add_int(d,TAG_EXOP_REQ_OID);
+  add_int(d,TAG_EXOP_REQ_VALUE);
+  add_int(d,TAG_EXOP_RES_OID);
+  add_int(d,TAG_EXOP_RES_VALUE);
+#ifdef HAVE_SASL
+  add_int(d,TAG_SASL_RES_CREDS);
+#endif
+#endif
+
+  add_int(d,SASL_AUTOMATIC);
+  add_int(d,SASL_INTERACTIVE);
+  add_int(d,SASL_QUIET);
+
+  /* reversibles */
+
+  zero = PyInt_FromLong( 0 );
+  PyDict_SetItem( reverse, zero, Py_None );
+  Py_DECREF( zero );
+
+  add_int(d,RES_BIND);
+  add_int(d,RES_SEARCH_ENTRY);
+  add_int(d,RES_SEARCH_RESULT);
+  add_int(d,RES_MODIFY);
+  add_int(d,RES_ADD);
+  add_int(d,RES_DELETE);
+  add_int(d,RES_MODRDN);
+  add_int(d,RES_COMPARE);
+  add_int(d,RES_ANY);
+
+  add_int(d,RES_SEARCH_REFERENCE);
+  add_int(d,RES_EXTENDED);
+  add_int(d,RES_UNSOLICITED);
+
+  add_int(d,RES_INTERMEDIATE);
+
+  /* non-reversibles */
+
+  add_int(d,AUTH_NONE);
+  add_int(d,AUTH_SIMPLE);
+  add_int(d,SCOPE_BASE);
+  add_int(d,SCOPE_ONELEVEL);
+  add_int(d,SCOPE_SUBTREE);
+  add_int(d,MOD_ADD);
+  add_int(d,MOD_DELETE);
+  add_int(d,MOD_REPLACE);
+  add_int(d,MOD_INCREMENT);
+  add_int(d,MOD_BVALUES);
+
+  add_int(d,MSG_ONE);
+  add_int(d,MSG_ALL);
+  add_int(d,MSG_RECEIVED);
+
+  /* (errors.c contains the error constants) */
+
+  add_int(d,DEREF_NEVER);
+  add_int(d,DEREF_SEARCHING);
+  add_int(d,DEREF_FINDING);
+  add_int(d,DEREF_ALWAYS);
+  add_int(d,NO_LIMIT);
+
+  add_int(d,OPT_API_INFO);
+  add_int(d,OPT_DEREF);
+  add_int(d,OPT_SIZELIMIT);
+  add_int(d,OPT_TIMELIMIT);
+#ifdef LDAP_OPT_REFERRALS
+  add_int(d,OPT_REFERRALS);
+#endif
+  add_int(d,OPT_ERROR_NUMBER);
+  add_int(d,OPT_RESTART);
+  add_int(d,OPT_PROTOCOL_VERSION);
+  add_int(d,OPT_SERVER_CONTROLS);
+  add_int(d,OPT_CLIENT_CONTROLS);
+  add_int(d,OPT_API_FEATURE_INFO);
+  add_int(d,OPT_HOST_NAME);
+
+  add_int(d,OPT_DIAGNOSTIC_MESSAGE);
+
+  add_int(d,OPT_ERROR_STRING);
+  add_int(d,OPT_MATCHED_DN);
+  add_int(d,OPT_DEBUG_LEVEL);
+  add_int(d,OPT_TIMEOUT);
+  add_int(d,OPT_REFHOPLIMIT);
+  add_int(d,OPT_NETWORK_TIMEOUT);
+  add_int(d,OPT_URI);
+#ifdef LDAP_OPT_DEFBASE
+  add_int(d,OPT_DEFBASE);
+#endif
+#ifdef HAVE_TLS
+  add_int(d,OPT_X_TLS);
+#ifdef LDAP_OPT_X_TLS_NEWCTX
+  add_int(d,OPT_X_TLS_CTX);
+#endif
+  add_int(d,OPT_X_TLS_CACERTFILE);
+  add_int(d,OPT_X_TLS_CACERTDIR);
+  add_int(d,OPT_X_TLS_CERTFILE);
+  add_int(d,OPT_X_TLS_KEYFILE);
+  add_int(d,OPT_X_TLS_REQUIRE_CERT);
+  add_int(d,OPT_X_TLS_CIPHER_SUITE);
+  add_int(d,OPT_X_TLS_RANDOM_FILE);
+  add_int(d,OPT_X_TLS_DHFILE);
+  add_int(d,OPT_X_TLS_NEVER);
+  add_int(d,OPT_X_TLS_HARD);
+  add_int(d,OPT_X_TLS_DEMAND);
+  add_int(d,OPT_X_TLS_ALLOW);
+  add_int(d,OPT_X_TLS_TRY);
+#ifdef LDAP_OPT_X_TLS_PEERCERT
+  add_int(d,OPT_X_TLS_PEERCERT);
+#endif
+#ifdef LDAP_OPT_X_TLS_VERSION
+  add_int(d,OPT_X_TLS_VERSION);
+#endif
+#ifdef LDAP_OPT_X_TLS_CIPHER
+  add_int(d,OPT_X_TLS_CIPHER);
+#endif
+#ifdef LDAP_OPT_X_TLS_CRLCHECK
+  /* only available if OpenSSL supports it => might cause backward compability problems */
+  add_int(d,OPT_X_TLS_CRLCHECK);
+#ifdef LDAP_OPT_X_TLS_CRLFILE
+  add_int(d,OPT_X_TLS_CRLFILE);
+#endif
+  add_int(d,OPT_X_TLS_CRL_NONE);
+  add_int(d,OPT_X_TLS_CRL_PEER);
+  add_int(d,OPT_X_TLS_CRL_ALL);
+#endif
+#ifdef LDAP_OPT_X_TLS_NEWCTX
+  add_int(d,OPT_X_TLS_NEWCTX);
+#endif
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+  add_int(d,OPT_X_TLS_PROTOCOL_MIN);
+#endif
+#ifdef LDAP_OPT_X_TLS_PACKAGE
+  add_int(d,OPT_X_TLS_PACKAGE);
+#endif
+#endif
+  add_int(d,OPT_X_SASL_MECH);
+  add_int(d,OPT_X_SASL_REALM);
+  add_int(d,OPT_X_SASL_AUTHCID);
+  add_int(d,OPT_X_SASL_AUTHZID);
+  add_int(d,OPT_X_SASL_SSF);
+  add_int(d,OPT_X_SASL_SSF_EXTERNAL);
+  add_int(d,OPT_X_SASL_SECPROPS);
+  add_int(d,OPT_X_SASL_SSF_MIN);
+  add_int(d,OPT_X_SASL_SSF_MAX);
+#ifdef LDAP_OPT_X_SASL_NOCANON
+  add_int(d,OPT_X_SASL_NOCANON);
+#endif
+#ifdef LDAP_OPT_X_SASL_USERNAME
+  add_int(d,OPT_X_SASL_USERNAME);
+#endif
+#ifdef LDAP_OPT_CONNECT_ASYNC
+  add_int(d,OPT_CONNECT_ASYNC);
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_IDLE
+  add_int(d,OPT_X_KEEPALIVE_IDLE);
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_PROBES
+  add_int(d,OPT_X_KEEPALIVE_PROBES);
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_INTERVAL
+  add_int(d,OPT_X_KEEPALIVE_INTERVAL);
+#endif
+
+  add_int(d,DN_FORMAT_LDAP);
+  add_int(d,DN_FORMAT_LDAPV3);
+  add_int(d,DN_FORMAT_LDAPV2);
+  add_int(d,DN_FORMAT_DCE);
+  add_int(d,DN_FORMAT_UFN);
+  add_int(d,DN_FORMAT_AD_CANONICAL);
+  /* add_int(d,DN_FORMAT_LBER); */    /* "for testing only" */
+  add_int(d,DN_FORMAT_MASK);
+  add_int(d,DN_PRETTY);
+  add_int(d,DN_SKIP);
+  add_int(d,DN_P_NOLEADTRAILSPACES);
+  add_int(d,DN_P_NOSPACEAFTERRDN);
+  add_int(d,DN_PEDANTIC);
+
+  add_int(d,AVA_NULL);
+  add_int(d,AVA_STRING);
+  add_int(d,AVA_BINARY);
+  add_int(d,AVA_NONPRINTABLE);
+  
+  /*add_int(d,OPT_ON);*/
+  obj = PyInt_FromLong(1);
+  PyDict_SetItemString( d, "OPT_ON", obj );
+  Py_DECREF(obj);
+  /*add_int(d,OPT_OFF);*/
+  obj = PyInt_FromLong(0);
+  PyDict_SetItemString( d, "OPT_OFF", obj );      
+  Py_DECREF(obj);
+  
+  add_int(d,OPT_SUCCESS);
+
+  /* XXX - these belong in errors.c */
+
+  add_int(d,URL_ERR_BADSCOPE);
+  add_int(d,URL_ERR_MEM);
+
+  /* author */
+
+  author = PyString_FromString("python-ldap Project");
+  PyDict_SetItemString(d, "__author__", author);
+  Py_DECREF(author);
+
+  /* add_int(d,LIBLDAP_R); */
+#ifdef HAVE_LIBLDAP_R
+  obj = PyInt_FromLong(1);
+#else
+  obj = PyInt_FromLong(0);
+#endif
+  PyDict_SetItemString( d, "LIBLDAP_R", obj );
+  Py_DECREF(obj);
+
+  /* add_int(d,SASL); */
+#ifdef HAVE_SASL
+  obj = PyInt_FromLong(1);
+#else
+  obj = PyInt_FromLong(0);
+#endif
+  PyDict_SetItemString( d, "SASL_AVAIL", obj );
+  Py_DECREF(obj);
+
+  /* add_int(d,TLS); */
+#ifdef HAVE_TLS
+  obj = PyInt_FromLong(1);
+#else
+  obj = PyInt_FromLong(0);
+#endif
+  PyDict_SetItemString( d, "TLS_AVAIL", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_MANAGEDSAIT);
+  PyDict_SetItemString( d, "CONTROL_MANAGEDSAIT", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_PROXY_AUTHZ);
+  PyDict_SetItemString( d, "CONTROL_PROXY_AUTHZ", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_SUBENTRIES);
+  PyDict_SetItemString( d, "CONTROL_SUBENTRIES", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_VALUESRETURNFILTER);
+  PyDict_SetItemString( d, "CONTROL_VALUESRETURNFILTER", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_ASSERT);
+  PyDict_SetItemString( d, "CONTROL_ASSERT", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_PRE_READ);
+  PyDict_SetItemString( d, "CONTROL_PRE_READ", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_POST_READ);
+  PyDict_SetItemString( d, "CONTROL_POST_READ", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_SORTREQUEST);
+  PyDict_SetItemString( d, "CONTROL_SORTREQUEST", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_SORTRESPONSE);
+  PyDict_SetItemString( d, "CONTROL_SORTRESPONSE", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_PAGEDRESULTS);
+  PyDict_SetItemString( d, "CONTROL_PAGEDRESULTS", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_SYNC);
+  PyDict_SetItemString( d, "CONTROL_SYNC", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_SYNC_STATE);
+  PyDict_SetItemString( d, "CONTROL_SYNC_STATE", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_SYNC_DONE);
+  PyDict_SetItemString( d, "CONTROL_SYNC_DONE", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_SYNC_INFO);
+  PyDict_SetItemString( d, "SYNC_INFO", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_PASSWORDPOLICYREQUEST);
+  PyDict_SetItemString( d, "CONTROL_PASSWORDPOLICYREQUEST", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_PASSWORDPOLICYRESPONSE);
+  PyDict_SetItemString( d, "CONTROL_PASSWORDPOLICYRESPONSE", obj );
+  Py_DECREF(obj);
+
+  obj = PyString_FromString(LDAP_CONTROL_RELAX);
+  PyDict_SetItemString( d, "CONTROL_RELAX", obj );
+  Py_DECREF(obj);
+
+}
diff --git a/Modules/options.c b/Modules/options.c
new file mode 100644
index 0000000..9cad581
--- /dev/null
+++ b/Modules/options.c
@@ -0,0 +1,382 @@
+/* See http://www.python-ldap.org/ for details.
+ * $Id: options.c,v 1.41 2013/09/11 08:16:27 stroeder Exp $ */
+
+#include "common.h"
+#include "errors.h"
+#include "LDAPObject.h"
+#include "ldapcontrol.h"
+#include "options.h"
+
+void
+set_timeval_from_double( struct timeval *tv, double d ) {
+	tv->tv_usec = (long) ( fmod(d, 1.0) * 1000000.0 );
+	tv->tv_sec = (long) floor(d);
+}
+
+/**
+ * Converts a return code from ldap_set_option() or ldap_get_option()
+ * into a python error, and returns NULL.
+ */
+static PyObject *
+option_error(int res, const char *fn)
+{
+    if (res == LDAP_OPT_ERROR)
+        PyErr_SetString(PyExc_ValueError, "option error");
+    else if (res == LDAP_PARAM_ERROR)
+        PyErr_SetString(PyExc_ValueError, "parameter error");
+    else if (res == LDAP_NO_MEMORY) 
+        PyErr_NoMemory();
+    else
+        PyErr_Format(PyExc_SystemError, "error %d from %s", res, fn);
+    return NULL;
+}
+
+/**
+ * Sets an LDAP option.
+ * Returns 0 on failure, 1 on success
+ */
+int
+LDAP_set_option(LDAPObject *self, int option, PyObject *value)
+{
+    int res;
+    int intval;
+    double doubleval;
+    char *strval;
+    struct timeval tv;
+    void *ptr;
+    LDAP *ld;
+    LDAPControl **controls = NULL;
+
+    ld = self ? self->ldap : NULL;
+
+    switch(option) {
+    case LDAP_OPT_API_INFO:
+    case LDAP_OPT_API_FEATURE_INFO:
+#ifdef HAVE_SASL
+    case LDAP_OPT_X_SASL_SSF:
+#endif
+	    /* Read-only options */
+	    PyErr_SetString(PyExc_ValueError, "read-only option");
+	    return 0;
+    case LDAP_OPT_REFERRALS:
+    case LDAP_OPT_RESTART:
+#ifdef LDAP_OPT_X_SASL_NOCANON
+    case LDAP_OPT_X_SASL_NOCANON:
+#endif
+#ifdef LDAP_OPT_CONNECT_ASYNC
+    case LDAP_OPT_CONNECT_ASYNC:
+#endif
+	    /* Truth-value options */
+	    ptr = PyObject_IsTrue(value) ? LDAP_OPT_ON : LDAP_OPT_OFF;
+	    break;
+
+    case LDAP_OPT_DEREF:
+    case LDAP_OPT_SIZELIMIT:
+    case LDAP_OPT_TIMELIMIT:
+    case LDAP_OPT_PROTOCOL_VERSION:
+    case LDAP_OPT_ERROR_NUMBER:
+    case LDAP_OPT_DEBUG_LEVEL:
+#ifdef HAVE_TLS
+    case LDAP_OPT_X_TLS:
+    case LDAP_OPT_X_TLS_REQUIRE_CERT:
+#ifdef LDAP_OPT_X_TLS_CRLCHECK
+    case LDAP_OPT_X_TLS_CRLCHECK:
+#endif
+#ifdef LDAP_OPT_X_TLS_NEWCTX
+    case LDAP_OPT_X_TLS_NEWCTX:
+#endif
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+    case LDAP_OPT_X_TLS_PROTOCOL_MIN:
+#endif
+#endif
+#ifdef HAVE_SASL
+    case LDAP_OPT_X_SASL_SSF_MIN:
+    case LDAP_OPT_X_SASL_SSF_MAX:
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_IDLE
+    case LDAP_OPT_X_KEEPALIVE_IDLE:
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_PROBES
+    case LDAP_OPT_X_KEEPALIVE_PROBES:
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_INTERVAL
+    case LDAP_OPT_X_KEEPALIVE_INTERVAL:
+#endif
+
+	    /* integer value options */
+	    if (!PyArg_Parse(value, "i:set_option", &intval))
+		return 0;
+	    ptr = &intval;
+	    break;
+    case LDAP_OPT_HOST_NAME:
+    case LDAP_OPT_URI:
+#ifdef LDAP_OPT_DEFBASE
+    case LDAP_OPT_DEFBASE:
+#endif
+    case LDAP_OPT_ERROR_STRING:
+    case LDAP_OPT_MATCHED_DN:
+#ifdef HAVE_TLS
+    case LDAP_OPT_X_TLS_CACERTFILE:
+    case LDAP_OPT_X_TLS_CACERTDIR:
+    case LDAP_OPT_X_TLS_CERTFILE:
+    case LDAP_OPT_X_TLS_KEYFILE:
+    case LDAP_OPT_X_TLS_CIPHER_SUITE:
+    case LDAP_OPT_X_TLS_RANDOM_FILE:
+    case LDAP_OPT_X_TLS_DHFILE:
+#ifdef LDAP_OPT_X_TLS_CRLFILE
+    case LDAP_OPT_X_TLS_CRLFILE:
+#endif
+#endif
+#ifdef HAVE_SASL
+    case LDAP_OPT_X_SASL_SECPROPS:
+#endif
+	    /* String valued options */
+	    if (!PyArg_Parse(value, "s:set_option", &strval))
+		return 0;
+	    ptr = strval;
+	    break;
+    case LDAP_OPT_TIMEOUT:
+    case LDAP_OPT_NETWORK_TIMEOUT:
+	    /* Float valued timeval options */
+	    if (!PyArg_Parse(value, "d:set_option", &doubleval))
+		return 0;
+            if (doubleval >= 0) {
+	        set_timeval_from_double( &tv, doubleval );
+                ptr = &tv;
+            } else {
+    	        ptr = NULL;
+            }
+	    break;
+    case LDAP_OPT_SERVER_CONTROLS:
+    case LDAP_OPT_CLIENT_CONTROLS:
+            if (!LDAPControls_from_object(value, &controls))
+                return 0;
+            ptr = controls;
+            break;
+    default:
+	    PyErr_Format(PyExc_ValueError, "unknown option %d", option);
+	    return 0;
+    }
+	
+    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+    res = ldap_set_option(ld, option, ptr);
+    if (self) LDAP_END_ALLOW_THREADS(self);
+
+    if ((option == LDAP_OPT_SERVER_CONTROLS) || (option == LDAP_OPT_CLIENT_CONTROLS))
+        LDAPControl_List_DEL(controls);
+    
+    if (res != LDAP_OPT_SUCCESS) {
+        option_error(res, "ldap_set_option");
+        return 0;
+    }
+
+    return 1;
+}
+
+PyObject *
+LDAP_get_option(LDAPObject *self, int option)
+{
+    int res;
+    int intval;
+    struct timeval *tv;
+    LDAPAPIInfo apiinfo;
+    LDAPControl **lcs;
+    LDAPControl *lc;
+    char *strval;
+    PyObject *extensions, *v, *tup;
+    Py_ssize_t i, num_extensions, num_controls;
+    LDAP *ld;
+
+    ld = self ? self->ldap : NULL;
+
+    switch(option) {
+    case LDAP_OPT_API_INFO:
+	    apiinfo.ldapai_info_version = LDAP_API_INFO_VERSION;
+	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+	    res = ldap_get_option( ld, option, &apiinfo );
+	    if (self) LDAP_END_ALLOW_THREADS(self);
+	    if (res != LDAP_OPT_SUCCESS)
+		return option_error(res, "ldap_get_option");
+    
+	    /* put the extensions into tuple form */
+	    num_extensions = 0;
+	    while (apiinfo.ldapai_extensions[num_extensions])
+		num_extensions++;
+	    extensions = PyTuple_New(num_extensions);
+	    for (i = 0; i < num_extensions; i++)
+		PyTuple_SET_ITEM(extensions, i,
+		    PyString_FromString(apiinfo.ldapai_extensions[i]));
+
+	    /* return api info as a dictionary */
+	    v = Py_BuildValue("{s:i, s:i, s:i, s:s, s:i, s:O}",
+		    "info_version",     apiinfo.ldapai_info_version,
+		    "api_version",      apiinfo.ldapai_api_version,
+		    "protocol_version", apiinfo.ldapai_protocol_version,
+		    "vendor_name",      apiinfo.ldapai_vendor_name,
+		    "vendor_version",   apiinfo.ldapai_vendor_version,
+		    "extensions",       extensions);
+
+	    if (apiinfo.ldapai_vendor_name)
+		ldap_memfree(apiinfo.ldapai_vendor_name);
+	    for (i = 0; i < num_extensions; i++)
+		ldap_memfree(apiinfo.ldapai_extensions[i]);
+	    ldap_memfree(apiinfo.ldapai_extensions);
+	    Py_DECREF(extensions);
+
+	    return v;
+
+#ifdef HAVE_SASL
+    case LDAP_OPT_X_SASL_SSF:
+#endif
+    case LDAP_OPT_REFERRALS:
+    case LDAP_OPT_RESTART:
+    case LDAP_OPT_DEREF:
+    case LDAP_OPT_SIZELIMIT:
+    case LDAP_OPT_TIMELIMIT:
+    case LDAP_OPT_PROTOCOL_VERSION:
+    case LDAP_OPT_ERROR_NUMBER:
+    case LDAP_OPT_DEBUG_LEVEL:
+#ifdef HAVE_TLS
+    case LDAP_OPT_X_TLS:
+    case LDAP_OPT_X_TLS_REQUIRE_CERT:
+#ifdef LDAP_OPT_X_TLS_CRLCHECK
+    case LDAP_OPT_X_TLS_CRLCHECK:
+#endif
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+    case LDAP_OPT_X_TLS_PROTOCOL_MIN:
+#endif
+#endif
+#ifdef HAVE_SASL
+    case LDAP_OPT_X_SASL_SSF_MIN:
+    case LDAP_OPT_X_SASL_SSF_MAX:
+#endif
+#ifdef LDAP_OPT_X_SASL_NOCANON
+    case LDAP_OPT_X_SASL_NOCANON:
+#endif
+#ifdef LDAP_OPT_CONNECT_ASYNC
+    case LDAP_OPT_CONNECT_ASYNC:
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_IDLE
+    case LDAP_OPT_X_KEEPALIVE_IDLE:
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_PROBES
+    case LDAP_OPT_X_KEEPALIVE_PROBES:
+#endif
+#ifdef LDAP_OPT_X_KEEPALIVE_INTERVAL
+    case LDAP_OPT_X_KEEPALIVE_INTERVAL:
+#endif
+	    /* Integer-valued options */
+	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+	    res = ldap_get_option(ld, option, &intval);
+	    if (self) LDAP_END_ALLOW_THREADS(self);
+	    if (res != LDAP_OPT_SUCCESS)
+		return option_error(res, "ldap_get_option");
+	    return PyInt_FromLong(intval);
+
+    case LDAP_OPT_HOST_NAME:
+    case LDAP_OPT_URI:
+#ifdef LDAP_OPT_DEFBASE
+    case LDAP_OPT_DEFBASE:
+#endif
+    case LDAP_OPT_ERROR_STRING:
+    case LDAP_OPT_MATCHED_DN:
+#ifdef HAVE_TLS
+    case LDAP_OPT_X_TLS_CACERTFILE:
+    case LDAP_OPT_X_TLS_CACERTDIR:
+    case LDAP_OPT_X_TLS_CERTFILE:
+    case LDAP_OPT_X_TLS_KEYFILE:
+    case LDAP_OPT_X_TLS_CIPHER_SUITE:
+    case LDAP_OPT_X_TLS_RANDOM_FILE:
+    case LDAP_OPT_X_TLS_DHFILE:
+#ifdef LDAP_OPT_X_TLS_CRLFILE
+    case LDAP_OPT_X_TLS_CRLFILE:
+#endif
+#ifdef LDAP_OPT_X_TLS_VERSION
+    case LDAP_OPT_X_TLS_VERSION:
+#endif
+#ifdef LDAP_OPT_X_TLS_CIPHER
+    case LDAP_OPT_X_TLS_CIPHER:
+#endif
+#ifdef LDAP_OPT_X_TLS_PACKAGE
+    case LDAP_OPT_X_TLS_PACKAGE:
+#endif
+#endif
+#ifdef HAVE_SASL
+    case LDAP_OPT_X_SASL_SECPROPS:
+    case LDAP_OPT_X_SASL_MECH:
+    case LDAP_OPT_X_SASL_REALM:
+    case LDAP_OPT_X_SASL_AUTHCID:
+    case LDAP_OPT_X_SASL_AUTHZID:
+#ifdef LDAP_OPT_X_SASL_USERNAME
+    case LDAP_OPT_X_SASL_USERNAME:
+#endif
+#endif
+	    /* String-valued options */
+	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+	    res = ldap_get_option(ld, option, &strval);
+	    if (self) LDAP_END_ALLOW_THREADS(self);
+	    if (res != LDAP_OPT_SUCCESS)
+		return option_error(res, "ldap_get_option");
+	    if (strval == NULL) {
+		Py_INCREF(Py_None);
+		return Py_None;
+	    }
+	    v = PyString_FromString(strval);
+	    ldap_memfree(strval);
+	    return v;
+
+    case LDAP_OPT_TIMEOUT:
+    case LDAP_OPT_NETWORK_TIMEOUT:
+	    /* Double-valued timeval options */
+	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+	    res = ldap_get_option(ld, option, &tv);
+	    if (self) LDAP_END_ALLOW_THREADS(self);
+	    if (res != LDAP_OPT_SUCCESS)
+		return option_error(res, "ldap_get_option");
+	    if (tv == NULL) {
+		Py_INCREF(Py_None);
+		return Py_None;
+	    }
+	    v = PyFloat_FromDouble(
+              (double) tv->tv_sec + ( (double) tv->tv_usec / 1000000.0 )
+            );
+	    ldap_memfree(tv);
+	    return v;
+
+    case LDAP_OPT_SERVER_CONTROLS:
+    case LDAP_OPT_CLIENT_CONTROLS:
+	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+	    res = ldap_get_option(ld, option, &lcs);
+	    if (self) LDAP_END_ALLOW_THREADS(self);
+
+	    if (res != LDAP_OPT_SUCCESS)
+		return option_error(res, "ldap_get_option");
+
+            if (lcs == NULL)
+                return PyList_New(0);
+            
+            /* Get the number of controls */
+            num_controls = 0;
+            while (lcs[num_controls])
+                num_controls++;
+
+            /* We'll build a list of controls, with each control a tuple */
+            v = PyList_New(num_controls);
+            for (i = 0; i < num_controls; i++) {
+                lc = lcs[i];
+                tup = Py_BuildValue("(sbs)", 
+                                    lc->ldctl_oid,
+                                    lc->ldctl_iscritical,
+                                    lc->ldctl_value.bv_val);
+                PyList_SET_ITEM(v, i, tup);
+            }
+            
+            ldap_controls_free(lcs);
+
+            return v;
+            
+    default:
+	    PyErr_Format(PyExc_ValueError, "unknown option %d", option);
+	    return NULL;
+    }
+}

From 8c3d0bc13fa3fe7175c0b4954d41053c5117a4f5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 13 Sep 2013 18:02:47 +0000
Subject: [PATCH 101/868] urlfetch(): Work-around for mix-cased attribute type
 namesy

---
 Lib/ldap/schema/subentry.py | 497 ++++++++++++++++++++++++++++++++++++
 1 file changed, 497 insertions(+)
 create mode 100644 Lib/ldap/schema/subentry.py

diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
new file mode 100644
index 0000000..4674d3d
--- /dev/null
+++ b/Lib/ldap/schema/subentry.py
@@ -0,0 +1,497 @@
+"""
+ldap.schema.subentry -  subschema subentry handling
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: subentry.py,v 1.34 2013/09/13 18:02:47 stroeder Exp $
+"""
+
+import ldap.cidict,ldap.schema
+
+from ldap.schema.models import *
+
+from UserDict import UserDict
+
+SCHEMA_CLASS_MAPPING = ldap.cidict.cidict()
+SCHEMA_ATTR_MAPPING = {}
+
+for _name in dir():
+  o = eval(_name)
+  if hasattr(o,'schema_attribute'):
+    SCHEMA_CLASS_MAPPING[o.schema_attribute] = o
+    SCHEMA_ATTR_MAPPING[o] = o.schema_attribute
+
+SCHEMA_ATTRS = SCHEMA_CLASS_MAPPING.keys()
+
+
+class SubschemaError(ValueError):
+  pass
+
+
+class OIDNotUnique(SubschemaError):
+
+  def __init__(self,desc):
+    self.desc = desc
+
+  def __str__(self):
+    return 'OID not unique for %s' % (self.desc)
+
+
+class NameNotUnique(SubschemaError):
+
+  def __init__(self,desc):
+    self.desc = desc
+
+  def __str__(self):
+    return 'NAME not unique for %s' % (self.desc)
+
+
+class SubSchema:
+  """
+  Arguments:
+
+  sub_schema_sub_entry
+      Dictionary usually returned by LDAP search or the LDIF parser
+      containing the sub schema sub entry
+
+  check_uniqueness
+      Defines whether uniqueness of OIDs and NAME is checked.
+
+      0
+        no check
+      1
+        check but add schema description with work-around
+      2
+        check and raise exception if non-unique OID or NAME is found
+
+  Class attributes:
+
+  sed
+    Dictionary holding the subschema information as pre-parsed
+    SchemaElement objects (do not access directly!)
+  name2oid
+    Dictionary holding the mapping from NAMEs to OIDs
+    (do not access directly!)
+  non_unique_oids
+    List of OIDs used at least twice in the subschema
+  non_unique_names
+    List of NAMEs used at least twice in the subschema for the same schema element 
+  """
+
+  def __init__(self,sub_schema_sub_entry,check_uniqueness=1):
+
+    # Initialize all dictionaries
+    self.name2oid = {}
+    self.sed = {}
+    self.non_unique_oids = {}
+    self.non_unique_names = {}
+    for c in SCHEMA_CLASS_MAPPING.values():
+      self.name2oid[c] = ldap.cidict.cidict()
+      self.sed[c] = {}
+      self.non_unique_names[c] = ldap.cidict.cidict()
+
+    # Transform entry dict to case-insensitive dict
+    e = ldap.cidict.cidict(sub_schema_sub_entry)
+
+    # Build the schema registry in dictionaries
+    for attr_type in SCHEMA_ATTRS:
+
+      for attr_value in filter(None,e.get(attr_type,[])):
+
+        se_class = SCHEMA_CLASS_MAPPING[attr_type]
+        se_instance = se_class(attr_value)
+        se_id = se_instance.get_id()
+
+        if check_uniqueness and se_id in self.sed[se_class]:
+            self.non_unique_oids[se_id] = None
+            if check_uniqueness==1:
+              # Add to subschema by adding suffix to ID
+              suffix_counter = 1
+              new_se_id = se_id
+              while new_se_id in self.sed[se_class]:
+                new_se_id = ';'.join((se_id,str(suffix_counter)))
+                suffix_counter += 1
+              else:
+                se_id = new_se_id
+            elif check_uniqueness>=2:
+              raise OIDNotUnique(attr_value)
+
+        # Store the schema element instance in the central registry
+        self.sed[se_class][se_id] = se_instance
+
+        if hasattr(se_instance,'names'):
+          for name in ldap.cidict.cidict({}.fromkeys(se_instance.names)).keys():
+            if check_uniqueness and name in self.name2oid[se_class]:
+              self.non_unique_names[se_class][se_id] = None
+              raise NameNotUnique(attr_value)
+            else:
+              self.name2oid[se_class][name] = se_id
+
+    # Turn dict into list maybe more handy for applications
+    self.non_unique_oids = self.non_unique_oids.keys()
+
+    return # subSchema.__init__()
+
+
+  def ldap_entry(self):
+    """
+    Returns a dictionary containing the sub schema sub entry
+    """
+    # Initialize the dictionary with empty lists
+    entry = {}
+    # Collect the schema elements and store them in
+    # entry's attributes
+    for se_class in self.sed.keys():
+      for se in self.sed[se_class].values():
+        se_str = str(se)
+        try:
+          entry[SCHEMA_ATTR_MAPPING[se_class]].append(se_str)
+        except KeyError:
+          entry[SCHEMA_ATTR_MAPPING[se_class]] = [ se_str ]
+    return entry
+
+  def listall(self,schema_element_class,schema_element_filters=None):
+    """
+    Returns a list of OIDs of all available schema
+    elements of a given schema element class.
+    """
+    avail_se = self.sed[schema_element_class]
+    if schema_element_filters:
+      result = []
+      for se_key in avail_se.keys():
+        se = avail_se[se_key]
+        for fk,fv in schema_element_filters:
+          try:
+            if getattr(se,fk) in fv:
+              result.append(se_key)
+          except AttributeError:
+            pass
+    else:
+      result = avail_se.keys()
+    return result
+
+
+  def tree(self,schema_element_class,schema_element_filters=None):
+    """
+    Returns a ldap.cidict.cidict dictionary representing the
+    tree structure of the schema elements.
+    """
+    assert schema_element_class in [ObjectClass,AttributeType]
+    avail_se = self.listall(schema_element_class,schema_element_filters)
+    top_node = '_'
+    tree = ldap.cidict.cidict({top_node:[]})
+    # 1. Pass: Register all nodes
+    for se in avail_se:
+      tree[se] = []
+    # 2. Pass: Register all sup references
+    for se_oid in avail_se:
+      se_obj = self.get_obj(schema_element_class,se_oid,None)
+      if se_obj.__class__!=schema_element_class:
+        # Ignore schema elements not matching schema_element_class.
+        # This helps with falsely assigned OIDs.
+        continue
+      assert se_obj.__class__==schema_element_class, \
+        "Schema element referenced by %s must be of class %s but was %s" % (
+          se_oid,schema_element_class.__name__,se_obj.__class__
+        )
+      for s in se_obj.sup or ('_',):
+        sup_oid = self.getoid(schema_element_class,s)
+        try:
+          tree[sup_oid].append(se_oid)
+        except:
+          pass
+    return tree
+
+
+  def getoid(self,se_class,nameoroid,raise_keyerror=0):
+    """
+    Get an OID by name or OID
+    """
+    nameoroid_stripped = nameoroid.split(';')[0].strip()
+    if nameoroid_stripped in self.sed[se_class]:
+      # name_or_oid is already a registered OID
+      return nameoroid_stripped
+    else:
+      try:
+        result_oid = self.name2oid[se_class][nameoroid_stripped]
+      except KeyError:
+        if raise_keyerror:
+          raise KeyError('No registered %s-OID for nameoroid %s' % (se_class.__name__,repr(nameoroid_stripped)))
+        else:
+          result_oid = nameoroid_stripped
+    return result_oid
+
+
+  def get_inheritedattr(self,se_class,nameoroid,name):
+    """
+    Get a possibly inherited attribute specified by name
+    of a schema element specified by nameoroid.
+    Returns None if class attribute is not set at all.
+
+    Raises KeyError if no schema element is found by nameoroid.
+    """
+    se = self.sed[se_class][self.getoid(se_class,nameoroid)]
+    try:
+      result = getattr(se,name)
+    except AttributeError:
+      result = None
+    if result is None and se.sup:
+      result = self.get_inheritedattr(se_class,se.sup[0],name)
+    return result
+
+
+  def get_obj(self,se_class,nameoroid,default=None,raise_keyerror=0):
+    """
+    Get a schema element by name or OID
+    """
+    se_oid = self.getoid(se_class,nameoroid)
+    try:
+      se_obj = self.sed[se_class][se_oid]
+    except KeyError:
+      if raise_keyerror:
+        raise KeyError('No ldap.schema.%s instance with nameoroid %s and se_oid %s' % (
+          se_class.__name__,repr(nameoroid),repr(se_oid))
+        )
+      else:
+        se_obj = default
+    return se_obj
+
+
+  def get_inheritedobj(self,se_class,nameoroid,inherited=None):
+    """
+    Get a schema element by name or OID with all class attributes
+    set including inherited class attributes
+    """
+    import copy
+    inherited = inherited or []
+    se = copy.copy(self.sed[se_class].get(self.getoid(se_class,nameoroid)))
+    if se and hasattr(se,'sup'):
+      for class_attr_name in inherited:
+        setattr(se,class_attr_name,self.get_inheritedattr(se_class,nameoroid,class_attr_name))
+    return se
+
+
+  def get_syntax(self,nameoroid):
+    """
+    Get the syntax of an attribute type specified by name or OID
+    """
+    at_oid = self.getoid(AttributeType,nameoroid)
+    try:
+      at_obj = self.get_inheritedobj(AttributeType,at_oid)
+    except KeyError:
+      return None
+    else:
+      return at_obj.syntax
+
+
+  def get_structural_oc(self,oc_list):
+    """
+    Returns OID of structural object class in oc_list
+    if any is present. Returns None else.
+    """
+    # Get tree of all STRUCTURAL object classes
+    oc_tree = self.tree(ObjectClass,[('kind',[0])])
+    # Filter all STRUCTURAL object classes
+    struct_ocs = {}
+    for oc_nameoroid in oc_list:
+      oc_se = self.get_obj(ObjectClass,oc_nameoroid,None)
+      if oc_se and oc_se.kind==0:
+        struct_ocs[oc_se.oid] = None
+    result = None
+    struct_oc_list = struct_ocs.keys()
+    while struct_oc_list:
+      oid = struct_oc_list.pop()
+      for child_oid in oc_tree[oid]:
+        if struct_ocs.has_key(self.getoid(ObjectClass,child_oid)):
+          break
+      else:
+        result = oid
+    return result
+
+
+  def get_applicable_aux_classes(self,nameoroid):
+    """
+    Return a list of the applicable AUXILIARY object classes
+    for a STRUCTURAL object class specified by 'nameoroid'
+    if the object class is governed by a DIT content rule.
+    If there's no DIT content rule all available AUXILIARY
+    object classes are returned.
+    """
+    content_rule = self.get_obj(DITContentRule,nameoroid)
+    if content_rule:
+      # Return AUXILIARY object classes from DITContentRule instance
+      return content_rule.aux
+    else:
+      # list all AUXILIARY object classes
+      return self.listall(ObjectClass,[('kind',[2])])
+
+  def attribute_types(
+    self,object_class_list,attr_type_filter=None,raise_keyerror=1,ignore_dit_content_rule=0
+  ):
+    """
+    Returns a 2-tuple of all must and may attributes including
+    all inherited attributes of superior object classes
+    by walking up classes along the SUP attribute.
+
+    The attributes are stored in a ldap.cidict.cidict dictionary.
+
+    object_class_list
+        list of strings specifying object class names or OIDs
+    attr_type_filter
+        list of 2-tuples containing lists of class attributes
+        which has to be matched
+    raise_keyerror
+        All KeyError exceptions for non-existent schema elements
+        are ignored
+    ignore_dit_content_rule
+        A DIT content rule governing the structural object class
+        is ignored
+    """
+    AttributeType = ldap.schema.AttributeType
+    ObjectClass = ldap.schema.ObjectClass
+
+    # Map object_class_list to object_class_oids (list of OIDs)
+    object_class_oids = [
+      self.getoid(ObjectClass,o)
+      for o in object_class_list
+    ]
+    # Initialize
+    oid_cache = {}
+
+    r_must,r_may = ldap.cidict.cidict(),ldap.cidict.cidict()
+    if '1.3.6.1.4.1.1466.101.120.111' in object_class_oids:
+      # Object class 'extensibleObject' MAY carry every attribute type
+      for at_obj in self.sed[AttributeType].values():
+        r_may[at_obj.oid] = at_obj
+
+    # Loop over OIDs of all given object classes
+    while object_class_oids:
+      object_class_oid = object_class_oids.pop(0)
+      # Check whether the objectClass with this OID
+      # has already been processed
+      if oid_cache.has_key(object_class_oid):
+        continue
+      # Cache this OID as already being processed
+      oid_cache[object_class_oid] = None
+      try:
+        object_class = self.sed[ObjectClass][object_class_oid]
+      except KeyError:
+        if raise_keyerror:
+          raise
+        # Ignore this object class
+        continue
+      assert isinstance(object_class,ObjectClass)
+      assert hasattr(object_class,'must'),ValueError(object_class_oid)
+      assert hasattr(object_class,'may'),ValueError(object_class_oid)
+      for a in object_class.must:
+        se_oid = self.getoid(AttributeType,a,raise_keyerror=raise_keyerror)
+        r_must[se_oid] = self.get_obj(AttributeType,se_oid,raise_keyerror=raise_keyerror)
+      for a in object_class.may:
+        se_oid = self.getoid(AttributeType,a,raise_keyerror=raise_keyerror)
+        r_may[se_oid] = self.get_obj(AttributeType,se_oid,raise_keyerror=raise_keyerror)
+
+      object_class_oids.extend([
+        self.getoid(ObjectClass,o)
+        for o in object_class.sup
+      ])
+
+    # Process DIT content rules
+    if not ignore_dit_content_rule:
+      structural_oc = self.get_structural_oc(object_class_list)
+      if structural_oc:
+        # Process applicable DIT content rule
+        try:
+          dit_content_rule = self.get_obj(DITContentRule,structural_oc,raise_keyerror=1)
+        except KeyError:
+          # Not DIT content rule found for structural objectclass
+          pass
+        else:
+          for a in dit_content_rule.must:
+            se_oid = self.getoid(AttributeType,a,raise_keyerror=raise_keyerror)
+            r_must[se_oid] = self.get_obj(AttributeType,se_oid,raise_keyerror=raise_keyerror)
+          for a in dit_content_rule.may:
+            se_oid = self.getoid(AttributeType,a,raise_keyerror=raise_keyerror)
+            r_may[se_oid] = self.get_obj(AttributeType,se_oid,raise_keyerror=raise_keyerror)
+          for a in dit_content_rule.nots:
+            a_oid = self.getoid(AttributeType,a,raise_keyerror=raise_keyerror)
+            try:
+              del r_may[a_oid]
+            except KeyError:
+              pass
+
+    # Remove all mandantory attribute types from
+    # optional attribute type list
+    for a in r_may.keys():
+      if r_must.has_key(a):
+        del r_may[a]
+
+    # Apply attr_type_filter to results
+    if attr_type_filter:
+      for l in [r_must,r_may]:
+        for a in l.keys():
+          for afk,afv in attr_type_filter:
+            try:
+              schema_attr_type = self.sed[AttributeType][a]
+            except KeyError:
+              if raise_keyerror:
+                raise KeyError,'No attribute type found in sub schema by name %s' % (a)
+              # If there's no schema element for this attribute type
+              # but still KeyError is to be ignored we filter it away
+              del l[a]
+              break
+            else:
+              if not getattr(schema_attr_type,afk) in afv:
+                del l[a]
+                break
+
+    return r_must,r_may # attribute_types()
+
+
+def urlfetch(uri,trace_level=0):
+  """
+  Fetches a parsed schema entry by uri.
+
+  If uri is a LDAP URL the LDAP server is queried directly.
+  Otherwise uri is assumed to point to a LDIF file which
+  is loaded with urllib.
+  """
+  uri = uri.strip()
+  if uri.startswith('ldap:') or uri.startswith('ldaps:') or uri.startswith('ldapi:'):
+    import ldapurl
+    ldap_url = ldapurl.LDAPUrl(uri)
+    l=ldap.initialize(ldap_url.initializeUrl(),trace_level)
+    l.protocol_version = ldap.VERSION3
+    l.simple_bind_s(ldap_url.who or '', ldap_url.cred or '')
+    subschemasubentry_dn = l.search_subschemasubentry_s(ldap_url.dn)
+    if subschemasubentry_dn is None:
+      s_temp = None
+    else:
+      if ldap_url.attrs is None:
+        schema_attrs = SCHEMA_ATTRS
+      else:
+        schema_attrs = ldap_url.attrs
+      s_temp = l.read_subschemasubentry_s(
+        subschemasubentry_dn,attrs=schema_attrs
+      )
+    l.unbind_s()
+    del l
+  else:
+    import urllib,ldif
+    ldif_file = urllib.urlopen(uri)
+    ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
+    ldif_parser.parse()
+    subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
+  # Work-around for mixed-cased attribute names
+  subschemasubentry_entry = ldap.cidict.cidict()
+  for at,av in s_temp.items():
+    if at in SCHEMA_CLASS_MAPPING:
+      try:
+        subschemasubentry_entry[at].extend(av)
+      except KeyError:
+        subschemasubentry_entry[at] = av
+  # Finally parse the schema
+  if subschemasubentry_dn!=None:
+    parsed_sub_schema = ldap.schema.SubSchema(subschemasubentry_entry)
+  else:
+    parsed_sub_schema = None
+  return subschemasubentry_dn, parsed_sub_schema

From 58672dcf8031e321dc1911d6f6bdbeaf98d7085c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 21 Sep 2013 03:55:37 +0000
Subject: [PATCH 102/868] New method
 ldap.async.AsyncSearchHandler.afterFirstResult()

---
 CHANGES           | 1071 +++++++++++++++++++++++++++++++++++++++++++++
 Lib/ldap/async.py |  317 ++++++++++++++
 2 files changed, 1388 insertions(+)
 create mode 100644 CHANGES
 create mode 100644 Lib/ldap/async.py

diff --git a/CHANGES b/CHANGES
new file mode 100644
index 0000000..54a6f4b
--- /dev/null
+++ b/CHANGES
@@ -0,0 +1,1071 @@
+----------------------------------------------------------------
+Released 2.4.14 2013-xx-xx
+
+Changes since 2.4.13:
+
+Lib/
+* Added ldap.controls.openldap.SearchNoOpControl
+* New method ldap.async.AsyncSearchHandler.afterFirstResult()
+  for doing something right after successfully receiving but before 
+  processing first result
+
+Modules/
+* Added support for retrieving negotiated TLS version/cipher
+  with LDAPObject.get_option() with the help of upcoming OpenLDAP libs
+
+----------------------------------------------------------------
+Released 2.4.13 2013-06-27
+
+Changes since 2.4.12:
+
+Lib/
+* ldapobject.ReconnectLDAPObject._apply_last_bind() now sends
+  anonymous simple bind request even if the calling application
+  did not to provoke ldap.SERVER_DOWN in method reconnect()
+* ldapobject.ReconnectLDAPObject.reconnect() now also catches
+  ldap.TIMEOUT exception after reconnection attempt
+* Several other fixes for ldapobject.ReconnectLDAPObject
+  (thanks to Jonathan Giannuzzi)
+
+----------------------------------------------------------------
+Released 2.4.12 2013-06-01
+
+Changes since 2.4.11:
+
+Lib/
+* Truly optional import of PyAsn1Error exception which should
+  not fail anymore if pyasn1 is not installed
+
+----------------------------------------------------------------
+Released 2.4.11 2013-05-27
+
+Changes since 2.4.10:
+
+Lib/
+* ldap.controls.DecodeControlTuples() now simply ignores
+  PyAsn1Error exception raised during decoding malformed
+  response control values in case of non-critical controls.
+* ldif.LDIFWriter.unparse() does not simply skip empty
+  records anymore.
+
+----------------------------------------------------------------
+Released 2.4.10 2012-06-07
+
+Changes since 2.4.9:
+
+Lib/
+* ldapobject.ReconnectLDAPObject.reconnect() now preserves
+  order of options set with LDAPObject.set_option before.
+  This is needed e.g. for setting connection-specific TLS options.
+
+Demo/
+* Better version of Demo/pyasn1/syncrepl.py
+  (thanks to Ben Cooksley)
+
+----------------------------------------------------------------
+Released 2.4.9 2012-03-14
+
+Changes since 2.4.8:
+
+Lib/
+* ldapobject.ReconnectLDAPObject.reconnect() now does kind of
+  an internal locking to pause other threads while reconnecting
+  is pending.
+* Changes to bind- and startTLS-related operation methods of
+  class ReconnectLDAPObject for more robustness
+* New constant ldap.OPT_NAMES_DICT contains mapping from
+  integer to variable name for all option-related constants.
+
+----------------------------------------------------------------
+Released 2.4.8 2012-02-21
+
+Changes since 2.4.7:
+
+Lib/
+* Fixed overzealous check for non-unique NAMEs in
+  ldap.schema.subentry.SubSchema.__init__()
+* Fixed typos in control decoding method
+  ldap.controls.simple.OctetStringInteger.decodeControlValue()
+* Added experimental support for draft-vchu-ldap-pwd-policy
+
+----------------------------------------------------------------
+Released 2.4.7 2012-12-19
+
+Changes since 2.4.6:
+
+Lib/
+* Separate classes for request/response controls for RFC 3829
+* Fixed ldap.schema.subentry.SubSchema.attribute_types() to
+  also eliminate double attribute types in MAY clause of
+  DIT content rule
+
+Modules/
+* Fixed memory leak (thanks to David Malcolm)
+
+----------------------------------------------------------------
+Released 2.4.6 2011-11-27
+
+Changes since 2.4.5:
+
+Lib/
+* ldap.controls.ppolicy:
+  Another fix for decoding the password policy response control
+
+----------------------------------------------------------------
+Released 2.4.5 2011-11-25
+
+Changes since 2.4.4:
+
+Installation:
+* defines for SASL and SSL in setup.cfg to be more friendly to
+  Python setup tools (easy_install)
+
+Lib/
+* Fixed typo in ldap.functions._ldap_function_call() which
+  always released ldap._ldap_module_lock instead of local lock
+* ldap.controls.ppolicy:
+  Fixed decoding the password policy response control
+
+Demo/
+* Demo script for ldap.controls.ppolicy
+
+----------------------------------------------------------------
+Released 2.4.4 2011-10-26
+
+Changes since 2.4.3:
+
+Modules/
+* Format intermediate messages as 3-tuples instead of
+  4-tuples to match the format of other response messages.
+  (thanks to Chris Mikkelson)
+* Fixes for memory leaks (thanks to Chris Mikkelson)
+
+Lib/
+* New experimental(!) sub-module ldap.syncrepl implementing syncrepl
+  consumer (see RFC 4533, thanks to Chris Mikkelson)
+
+Doc/
+* Cleaned up rst files
+* Added missing classes
+
+----------------------------------------------------------------
+Released 2.4.3 2011-07-23
+
+Changes since 2.4.2:
+
+Lib/
+* Mostly corrected/updated __doc__ strings
+
+Doc/
+* Corrected rst files
+* Added missing modules, functions, classes, methods, parameters etc.
+  at least as auto-generated doc
+
+----------------------------------------------------------------
+Released 2.4.2 2011-07-21
+
+Changes since 2.4.1:
+
+Lib/
+
+Logging:
+* pprint.pformat() is now used when writing method/function
+  arguments to the trace log
+
+ldap.schema.subentry:
+* SubSchema.__init__() now has new key-word argument check_uniqueness
+  which enables checking whether OIDs are unique in the subschema subentry
+* Code-cleaning: consequent use of method SubSchema.getoid() instead of
+  accessing SubSchema.name2oid directly.
+* SubSchema.getoid() and SubSchema.getoid() now have key-word argument
+  raise_keyerror=0 and raise KeyError with appropriate description.
+
+----------------------------------------------------------------
+Released 2.4.1 2011-07-05
+
+Changes since 2.4.0:
+
+Modules:
+* New LDAP option OPT_X_TLS_PACKAGE available in OpenLDAP 2.4.26+
+  to determine the name of the SSL/TLS package OpenLDAP was
+  built with
+
+Lib/
+* ldap.modlist.modifyModlist(): New key-word argument
+  case_ignore_attr_types used to define attribute types for which
+  comparison of old and new values should be case-insensitive
+* Minor changes to which data is sent to debug output for various
+  trace levels
+* Now tag [1] is used in ldap.extop.dds.RefreshResponse in
+  compliance with RFC 2589 (fix available for OpenLDAP ITS#6886)
+* New sub-module ldap.controls.sessiontrack implements request control
+  as described in draft-wahl-ldap-session (needs pyasn1_modules)
+
+----------------------------------------------------------------
+Released 2.4.0 2011-06-02
+
+Changes since 2.3.13:
+
+* OpenLDAP 2.4.11+ required to build
+* Support for extracting LDAPv3 extended controls in
+  LDAP_RES_SEARCH_ENTRY responses
+  (see SF#2829057, thanks to Rich)
+* Generic support for LDAPv3 extended operations (thanks to Rich)
+
+Lib/
+* new class API in ldap.controls, not backwards-compatible!
+* new sub-modules for ldap.controls, some require pyasn1 and pyasn1_modules
+* New methods LDAPObject.result4() and LDAPObject.extop_result()
+* New (optional) class ldap.controls.AssertionControl
+* New helper module ldap.logger contains file-like object which
+  sends trace messages to logging.log()
+* Removed non-functional method LDAPObject.set_cache_options()
+* Removed unused dictionary ldap.controls.knownLDAPControls
+
+Modules/
+* ldapcontrol.c: Fixed encode_assertion_control() and function is no longer
+  hidden behind ifdef-statement
+
+----------------------------------------------------------------
+Released 2.3.13 2011-02-19
+
+Changes since 2.3.12:
+
+Modules/
+* Correct #ifdef-statement for LDAP_OPT_X_TLS_CRLFILE in
+  constants.c fixes build with older OpenLDAP libs
+* Support for LDAP_OPT_DEFBASE (see SF#3072016, thanks to Johannes)
+
+----------------------------------------------------------------
+Released 2.3.12 2010-08-05
+
+Changes since 2.3.11:
+
+Lib/
+* Removed tabs from various modules to make things work with python -tt.
+* Quick fix to ldif.is_dn() to let multi-valued RDNs pass as valid.
+  Is too liberal in some corner-cases though...
+* Fix to ldif.is_dn() to allow dashes in attribute type (see SF#3020292)
+* ldap.open() now outputs a deprecation warning
+* module-wide locking is now limited to calling _ldap.initialize().
+  Still ldap.functions._ldap_function_call() is used to wrap all
+  calls for writing debug log.
+
+Modules/
+* New LDAP options available in OpenLDAP 2.4.18+ supported in
+  LDAPObject.get/set_option():
+  ldap.OPT_X_KEEPALIVE_IDLE, ldap.OPT_X_KEEPALIVE_PROBES,
+  ldap.OPT_X_KEEPALIVE_INTERVAL,
+  ldap.OPT_X_TLS_CRLCHECK, ldap.OPT_X_TLS_CRLFILE
+
+Doc/
+* Various small updates/improvements
+
+----------------------------------------------------------------
+Released 2.3.11 2010-02-26
+
+Changes since 2.3.10:
+
+Lib/
+* Fixed LDAP URL parsing with four ? but no real extensions
+* ldap.ldapobject.LDAPObject.rename_s() now also accepts arguments
+  serverctrls and clientctrls
+* Removed untested and undocumented class ldap.ldapobject.SmartLDAPObject
+* Removed broken method ldap.ldapobject.LDAPObject.manage_dsa_it()
+
+Modules/
+* Make use of LDAP_OPT_X_TLS_NEWCTX only if available in
+  OpenLDAP libs used for the build
+* Fixed #ifdef-statements for OPT_X_TLS_PROTOCOL_MIN
+
+Doc/
+* Some updates and corrections regarding description of use of
+  LDAPv3 controls
+* Some more descriptions for constants
+* Removed comments related to old LaTeX-based documentation system
+
+----------------------------------------------------------------
+Released 2.3.10 2009-10-30
+
+Changes since 2.3.9:
+
+Lib/
+* The diagnosticMessage returned by a server is written to the trace
+  output also for successful operations.
+* Fixed handling of LDAP URL extensions with implicit value None which are
+  mapped to class attributes of LDAPUrl.
+* Fixed handling of LDAP URLs with ? being part of extensions.
+* Fixed exceptions raised by get_option/set_option (SF#1964993)
+* ldap.functions: Fixed import trace-related variables from base-module ldap
+* Fixed ldap.resiter missing in RPMs built with python setup.py bdist_rpm
+* Fix in class ldap.schema.models.SchemaElement:
+  repr() was liberally used in methods key_attr() and key_list() to enclose
+  values in quotes.
+
+Modules/
+* Changed internal API List_to_LDAPControls() to LDAPControls_from_object()
+* Supported was added for retrieving the SASL username during SASL bind with
+  ldap_get_option(LDAP_OPT_X_SASL_USERNAME) if available in libldap.
+* New LDAP option constant ldap.OPT_X_TLS_NEWCTX supported
+  in LDAPObject.set_option()
+* New LDAP option constants supported in LDAPObject.get/set_option():
+  ldap.OPT_X_TLS_PROTOCOL_MIN, ldap.OPT_CONNECT_ASYNC, ldap.OPT_X_TLS_DHFILE
+* Fixed setting _ldap.OPT_ON and _ldap.OPT_OFF
+* l_ldap_result3(): controls are now parsed for all response types (SF#2829057)
+
+Doc/
+* Added example for ldap.resiter
+
+----------------------------------------------------------------
+Released 2.3.9 2009-07-26
+
+Changes since 2.3.8:
+
+Lib/
+* All modules (ldap, ldif, dsml and ldapurl) have common version number now
+* Non-exported function ldif.needs_base64() was abandoned and is now
+  implemented as method LDIFWriter._needs_base64_encoding().
+  This allows sub-classes of LDIFWriter to implement determining whether
+  attribute values have to be base64-encoded in a different manner and is
+  the same approach like in class dsml.DSMLWriter.
+* LDAPUrlExtension._parse() now gracefully handles LDAP URL extensions
+  without explicit exvalue as being set with implicit value None.
+
+Modules/
+* New LDAP option constant ldap.OPT_X_SASL_NOCANON supported
+  in LDAPObject.get/set_option()
+
+----------------------------------------------------------------
+Released 2.3.8 2009-04-30
+
+Changes since 2.3.7:
+
+Lib/
+* ldap.schema.models: More fault-tolerant parsing of SYNTAX in
+  AttributeTypeDescription
+* ldap.schema.tokenizer.split_tokens():
+  More tolerant parsing of items separated only with a DOLLAR without
+  surrounding white-spaces (because WSP is declared as zero or more spaces
+  in RFC 4512)
+
+----------------------------------------------------------------
+Released 2.3.7 2009-04-09
+
+Changes since 2.3.6:
+
+Lib/
+* urllib.quote() is now used in LDAPUrlExtension.unparse() to quote
+  all special URL characters in extension values
+
+Modules/
+* Fixed ldapcontrol.c not to raise ldap.ENCODING_ERROR in
+  function encode_rfc2696() on 64-bit systems
+* Fixed seg fault if error code in a LDAP response was outside
+  the known error codes and could not be mapped to a specific
+  exception class (thanks to Sean)
+* errors.c: LDAP_ERROR_MAX set to LDAP_PROXIED_AUTHORIZATION_DENIED
+  if available in OpenLDAP header
+* new exception class ldap.PROXIED_AUTHORIZATION_DENIED
+  if available in OpenLDAP header
+* Fixed functions.c not to raise ldap.ENCODING_ERROR in
+  function l_ldap_str2dn() on 64-bit systems (see SF#2725356)
+
+----------------------------------------------------------------
+Released 2.3.6 2009-02-22
+
+Changes since 2.3.5:
+
+Lib/
+* Importing ldap.str2dn() which directly imported _ldap.str2dn()
+  is prohibited now (see SF#2181141)
+
+Modules/
+* get_option(): Added support for reading more SASL options.
+  (OPT_X_SASL_MECH, OPT_X_SASL_REALM, OPT_X_SASL_AUTHCID and
+  OPT_X_SASL_AUTHZID)
+* Added some explicit type casts to fix issues while building
+  with SunStudio
+* Fixed compiling issue with GCC 4.4
+  (see SF#2555793, thanks to Matej and Martin)
+
+Doc/
+* Clarified not to use ldap_get_dn() directly
+* Fixed description of ldap.SASL_AVAIL and ldap.TLS_AVAIL
+  (see SF#2555804, thanks to Matej and Martin)
+
+----------------------------------------------------------------
+Released 2.3.5 2008-07-06
+
+Changes since 2.3.4:
+
+Lib/
+* Fixed methods ldap.cidict.__contains__() and
+  ldap.schema.models.Entry.__contains__()
+* FWIW method LDAPObject.cancel_s() returns a result now
+* Fixed ldap.schema.models.NameForm: Class attribute oc is now
+  of type string, not tuple to be compliant with RFC 4512
+----------------------------------------------------------------
+Released 2.3.4 2008-03-29
+
+Changes since 2.3.3:
+
+Modules/
+* Fixed seg fault when calling LDAPObject.get_option()
+  (see SF#1926507, thanks to Matej)
+
+----------------------------------------------------------------
+Released 2.3.3 2008-03-26
+
+Changes since 2.3.2:
+
+Fixed backward-compability when building with OpenLDAP 2.3.x libs.
+
+----------------------------------------------------------------
+Released 2.3.2 2008-03-26
+
+Changes since 2.3.1:
+
+Lib/
+* ldap.dn.escape_dn_chars() now really adheres to
+  RFC 4514 section 2.4 by escaping null characters and a
+  space occurring at the beginning of the string
+* New method ldap.cidict.cidict.__contains__()
+* ldap.dn.explode_dn() and ldap.dn.explode_rdn()
+  have a new optional key-word argument flags which is
+  passed to ldap.dn.str2dn().
+
+Modules/
+* Removed unused OPT_PRIVATE_EXTENSION_BASE from constants.c
+
+Doc/
+* Various additions, updates, polishing (thanks to James).
+
+----------------------------------------------------------------
+Released 2.3.1 2007-07-25
+
+Changes since 2.3.0:
+
+* Support for setuptools (building .egg, thanks to Torsten)
+* Support for matched values control (RFC 3876, thanks to Andreas)
+
+Lib/
+* Fixed ldif (see SF#1709111, thanks to Dmitry)
+* ldap.schema.models:
+  SUP now separated by $ (method __str__() of classes
+  AttributeType, ObjectClass and DITStructureRule, thanks to Stefan)
+
+Modules/
+* Added constant MOD_INCREMENT to support
+  modify+increment extension (see RFC 4525, thanks to Andreas)
+----------------------------------------------------------------
+Released 2.3.0 2007-03-27
+
+Changes since 2.2.1:
+
+* OpenLDAP 2.3+ required now to build.
+* Added support for Cancel operation ext. op. if supported
+in OpenLDAP API of the libs used for the build.
+
+Modules/
+* Removed deprecated code for setting options by name
+* Added l_ldap_cancel()
+* Some modifications related to PEP 353 for
+  Python 2.5 on 64-bit platforms (see SF#1467529, thanks to Matej)
+* Added new function l_ldap_str2dn(), removed functions
+  l_ldap_explode_dn() and l_ldap_explode_rdn()
+  (see SF#1657848, thanks to David)
+
+Lib/
+* Added method ldapobject.LDAPObject.cancel()
+* ldap.schema.subentry.urlfetch() now can do non-anonymous
+  simple bind if the LDAP URL provided contains extensions
+  'bindname' and 'X-BINDPW'. (see SF#1589206)
+* ldap.filter.escape_filter_chars() has new a key-word argument
+  escape_mode now which defines which chars to be escaped
+  (see SF#1193271).
+* Various important fixes to ldapobject.ReconnectLDAPObject
+* Moved all DN-related functions to sub-module ldap.dn,
+  import them in ldap.functions for backward compability
+* ldap.dn.explode_dn() and ldap.dn.explode_rdn() use the new
+  wrapper function ldap.dn.str2dn() (related to SF#1657848)
+* changetype issue partially fixed (see SF#1683746)
+
+----------------------------------------------------------------
+Released 2.2.1 2006-11-15
+
+Changes since 2.2.0:
+
+Modules/
+* Fix for Python 2.5 free(): invalid pointer (see SF#1575329)
+* passwd() accepts None for arguments user, oldpw, newpw
+  (see SF#1440151)
+
+Lib/
+* ldif.LDIFWriter.unparse() now accepts instances of
+  derived dict and list classes (see SF#1489898)
+
+----------------------------------------------------------------
+Released 2.2.0 2006-04-10
+
+Changes since 2.0.11:
+
+* OpenLDAP 2.2+ required now to build.
+
+Modules/
+* Dropped all occurences of '#ifdef #LDAP_VENDOR_VERSION'.
+* Fixed wrong tuple size in l_ldap_result3() (see SF#1368108)
+* Fixed get_option(ldap.OPT_API_INFO) (see SF#1440165)
+* Fixed memory leak in l_ldap_result3() when all=0
+  (see SF#1457325)
+* Fixed memory leak in l_ldap_result3() in error cases
+  (see SF#1464085)
+
+Lib/
+* Fixed ldap.schema.models.DITStructureRule.__str__() to
+  separate SUP rule-ids with a single space instead of ' $ '
+* Fixed ldap.async.Dict
+* Added ldap.async.IndexedDict
+* ldap.schema.subentry.SubSchema.attribute_types() has new
+  key-word argument ignore_dit_content_rule
+----------------------------------------------------------------
+Released 2.0.11 2005-11-07
+
+Changes since 2.0.10:
+
+Lib/
+* Class ldap.ldapobject.LDAPObject:
+  Each method returns a result now
+* Class ldap.ldapobject.ReconnectLDAPObject:
+  Some methods called the wrong methods of LDAPObject. Fixed.
+* Added new class ldap.async.Dict
+* Slightly cleaned up ldap.schema.subentry.attribute_types()
+* New sub-module ldap.resiter which simply provides a mix-in
+  class for ldap.ldapobject.LDAPObject with a generator method
+  allresults().
+  Obviously this only works with Python 2.3+. And
+  it's still experimental.
+
+----------------------------------------------------------------
+Released 2.0.10 2005-09-23
+
+Changes since 2.0.9:
+
+Lib/
+* Switched back to old implementation of
+  ldap.schema.tokenizer.split_tokens() since the new one
+  had a bug which deletes the spaces from DESC
+* ldap.INSUFFICIENT_ACCESS is now ignored in
+  ldap.ldapobject.LDAPObject.search_subschemasubentry_s()
+
+----------------------------------------------------------------
+Released 2.0.9 2005-07-28
+
+Changes since 2.0.8:
+
+Modules/
+* Removed __doc__ strings from ldapcontrol.c to "fix"
+  build problems with Python versions 2.2 and earlier.
+
+----------------------------------------------------------------
+Released 2.0.8 2005-06-22 at Linuxtag 2005, Karlsruhe, Germany
+
+Changes since 2.0.7:
+
+* Preliminary support for receiving LDAP controls added.
+  Contributor:
+  - Andreas Ames
+
+Lib/
+- Added classes in module ldif to ldif.__all__ to fix
+  from ldif import *
+- Removed BitString syntax from
+  ldap.schema.models.NOT_HUMAN_READABLE_LDAP_SYNTAXES
+  since the LDAP encoding is in fact human-readable
+- ldapurl.LDAPUrlExtension.unparse() outputs empty string
+  if LDAPUrlExtension.exvalue is None
+- Added ldap.controls.SimplePagedResultsControl
+
+----------------------------------------------------------------
+Released 2.0.7 2005-04-29
+
+Changes since 2.0.6:
+
+* Added preliminary support for sending LDAP controls
+  with a request.
+  Contributors:
+  - Deepak Giridharagopal
+  - Ingo Steuwer
+  (Receiving controls in LDAP results still not supported.)
+
+Modules:
+* LDAPObject.c: removed l_ldap_manage_dsa_it()
+* LDAPObject.c: Added missing #ifdef around l_ldap_passwd()
+  for compability with older OpenLDAP libs.
+
+Lib/
+* New algorithm in ldap.schema.tokenizer.split_tokens()
+  contributed by Wido Depping which is more robust
+  when parsing very broken schema elements
+  (e.g. Oracle's OID).
+* Fixed argument list (position of timeout) when calling
+  LDAPObject.search_ext_s() from search_st() and search_s().
+* LDAPObject.search_ext_s() correctly calls search_ext_s() now.
+* Re-implemented LDAPObject.manage_dsa_it() without calling _ldap.
+
+----------------------------------------------------------------
+Released 2.0.6 2004-12-03
+
+Changes since 2.0.5:
+
+Lib/
+* Added sub-module ldap.dn
+* Added function ldap.dn.escape_dn_chars()
+* Special check when implicitly setting SUP 'top' to
+  structural object classes without SUP defined to avoid
+  a loop in the super class chain.
+
+----------------------------------------------------------------
+Released 2.0.5 2004-11-11
+
+Changes since 2.0.4:
+
+Some small improvements for SASL:
+The noisy output during SASL bind is avoided now. Interaction
+with output on stderr can be enabled by the calling application
+by explicitly defining SASL flags.
+
+Removed obsolete directory Win32/.
+
+Lib/
+* Make sure that ldap.sasl.sasl.cb_value_dict is a dictionary
+  even when the caller passes in None to argument cb_value_dict
+* Added new key-word arg sasl_flags to method
+  LDAPObject.sasl_interactive_bind_s()
+
+Modules/
+* l_ldap_sasl_interactive_bind_s():
+  New key-word arg sasl_flags passed to
+  ldap_sasl_interactive_bind_s()
+
+----------------------------------------------------------------
+Released 2.0.4 2004-10-27
+
+Changes since 2.0.3:
+
+Modules/
+* Applied some fixes for 64-bit platforms to LDAPObject.c
+* Constants ldap.TLS_AVAIL and ldap.SASL_AVAIL will indicate
+  whether python-ldap was built with support for SSL/TLS
+  and/or SASL
+
+setup.py and Modules/
+* Applied some fixes for building under Win32
+
+----------------------------------------------------------------
+Released 2.0.3 2004-10-06
+
+Changes since 2.0.2:
+
+* Added support for LDAP Password Modify Extended Operation
+  (see RFC 3062)
+
+Demo/:
+* Added passwd_ext_op.py
+
+Modules/
+* Added l_ldap_passwd() in LDAPObject.c
+
+Lib/
+* Added methods passwd() and passwd_s() to
+  ldap.ldapobject.LDAPObject
+
+----------------------------------------------------------------
+Released 2.0.2 2004-07-29
+
+Changes since 2.0.1:
+
+Modules/
+* Fixed detecting appropriate OpenLDAP libs version for
+  determining whether ldap_whoami_s() is available or not.
+  This fixes build problems with OpenLDAP libs 2.1.0 up
+  to 2.1.12.
+
+----------------------------------------------------------------
+Released 2.0.1 2004-06-29
+
+Changes since 2.0.0:
+
+dsml:
+* Fixed wrong exception message format string
+
+ldap.schema.models:
+* Fixed Entry.__delitem__() to delete really everything
+  when deleting an attribute dictionary item.
+
+----------------------------------------------------------------
+Released 2.0.0 2004-05-18
+
+Changes since 2.0.0pre21:
+
+ldif:
+* Empty records are simply ignored in ldif.LDIFWriter.unparse()
+
+Modules/
+* New method result2() returns 3-tuple containing the msgid
+  of the outstanding operation.
+
+ldap.ldapobject:
+* New _ldap wrapper method LDAPObject.result2() (see above)
+  which is now used by LDAPObject.result().
+
+----------------------------------------------------------------
+Released 2.0.0pre21 2004-03-29
+
+Changes since 2.0.0pre20:
+
+setup.py:
+* runtime_library_dirs is set
+
+Modules/
+* (Hopefully) fixed building with OpenLDAP 2.2 libs in errors.c
+* Removed meaningless repr() function from LDAPObject.c
+* Removed setting LDAP_OPT_PROTOCOL_VERSION in l_ldap_sasl_bind_s()
+* Modified string handling via berval instead of *char
+  in l_ldap_compare_ext() makes it possible to compare attribute
+  values with null chars.
+* Wrapped ldap_sasl_bind() for simple binds instead of ldap_bind()
+  since 1. the latter is marked deprecated and 2. ldap_sasl_bind()
+  allows password credentials with null chars.
+* Removed unused sources linkedlist.c and linkedlist.h
+* Function l_ldap_whoami_s() only added if built against
+  OpenLDAP 2.1.x+ libs (should preserve compability with 2.0 libs)
+
+ldap.ldapobject:
+* LDAPObject.bind() only allows simple binds since Kerberos V4
+  binds of LDAPv2 are not supported anymore. An assert statement
+  was added to make the coder aware of that.
+* Renamed former LDAPObject.sasl_bind_s() to
+  LDAPObject.sasl_interactive_bind_s() since it wraps OpenLDAP's
+  ldap_sasl_interactive_bind_s()
+
+----------------------------------------------------------------
+Released 2.0.0pre20 2004-03-19
+
+Changes since 2.0.0pre19:
+
+Modules/
+* Removed doc strings from functions.c
+* Removed probably unused wrapper function l_ldap_dn2ufn() since
+  ldap_dn2ufn() is deprecated in OpenLDAP 2.1+
+* Removed wrapper function l_ldap_is_ldap_url().
+* Removed macro add_int_r() from constants.c since it caused
+  incompability issues with OpenLDAP 2.2 libs
+  (Warning: all result types are Integers now! Use the constants!)
+* New wrapper function l_ldap_whoami_s()
+
+ldap.ldapobject:
+* New wrapper method LDAPObject.whoami_s()
+
+ldap.functions:
+* Removed is_ldap_url(). The more general function
+  ldapurl.isLDAPUrl() should be used instead.
+
+ldap.sasl:
+* Added class cram_md5 (for SASL mech CRAM-MD5)
+
+ldap.async:
+* Use constants for search result types (see note about
+  add_int_r() above).
+
+----------------------------------------------------------------
+Released 2.0.0pre19 2004-01-22
+
+Changes since 2.0.0pre18:
+
+Modules/
+* LDAPObject.c:
+  Most deprecated functions of OpenLDAP C API are not used anymore.
+* functions.c:
+  Removed unused default_ldap_port().
+* constants.c:
+  Removed unused or silly constants
+  AUTH_KRBV4, AUTH_KRBV41, AUTH_KRBV42, URL_ERR_BADSCOPE, URL_ERR_MEM
+* errors.c:
+  Fixed building with OpenLDAP 2.2.x
+  (errors caused by negative error constants in ldap.h)
+
+ldap.ldapobject.LDAPObject:
+* Removed unused wrapper methods uncache_entry(), uncache_request(),
+  url_search(), url_search_st() and url_search_s()
+* New wrapper methods for all the _ext() methods in _ldap.LDAPObject.
+
+ldap.modlist:
+* Some performance optimizations and simplifications
+  in function modifyModlist()
+
+----------------------------------------------------------------
+Released 2.0.0pre18 2003-12-09
+
+Changes since 2.0.0pre17:
+
+ldap.ldapobject:
+* Fixed missing ldap._ldap_function_call() in
+  ReconnectLDAPObject.reconnect()
+
+----------------------------------------------------------------
+Released 2.0.0pre17 2003-12-03
+
+Changes since 2.0.0pre16:
+
+ldap.functions:
+* Fixed ImportError when running python -O
+
+----------------------------------------------------------------
+Released 2.0.0pre16 2003-12-02
+
+Changes since 2.0.0pre15:
+
+Modules/
+* Removed definition of unused constant RES_EXTENDED_PARTIAL since
+  the corresponding symbol LDAP_RES_EXTENDED_PARTIAL seems to not
+  be available in OpenLDAP-HEAD (pre 2.2) anymore.
+
+All in Lib/
+* Fixed some subtle bugs/oddities mentioned by pychecker.
+
+dsml:
+* Renamed DSMLWriter._f to DSMLWriter._output_file
+* Added wrapper method DSMLWriter.unparse() which simply
+  calls DSMLWriter.writeRecord()
+
+ldap.ldapobject:
+* Simplified LDAPObject.search_subschemasubentry_s()
+
+ldap.functions:
+* Moved ldap._ldap_function_call() into ldap.functions.
+* apply() is not used anymore since it seems deprecated
+
+ldap.async:
+* Added class DSMLWriter
+
+ldap.schema:
+* Removed unused key-word argument strict from
+  ldap.schema.subentry.SubSchema.attribute_types()
+* Fixed backward compability issue (for Python prior to 2.2) in
+  ldap.schema.subentry.SubSchema.listall()
+----------------------------------------------------------------
+Released 2.0.0pre15 2003-11-11
+
+Changes since 2.0.0pre14:
+
+Modules/
+Follow rule "Always include Python.h first"
+
+ldap.schema.subentry:
+* Added new method SubSchema.get_structural_oc()
+* Added new method SubSchema.get_applicable_aux_classes()
+* Methods SubSchema.listall() and SubSchema.tree() have
+  new key-word argument schema_element_filters
+* Support for DIT content rules in SubSchema.attribute_types()
+
+----------------------------------------------------------------
+Released 2.0.0pre14 2003-10-03
+
+Changes since 2.0.0pre13:
+
+setup.py:
+* Some modifications to ease building for Win32
+* Added directory Build/ mainly intended for platform-specific
+  examples of setup.cfg
+* Fixed installing ldap.filter
+
+ldap.ldapobject:
+* Added class attribute LDAPObject.network_timeout mapped to
+  set_option(ldap.OPT_NETWORK_TIMEOUT,..)
+* LDAPObject.search_ext(): Pass arguments serverctrls,clientctrls
+  to _ldap.search_ext()
+
+ldap.sasl:
+* Added class ldap.sasl.external for handling
+  the SASL mechanism EXTERNAL
+* Dictionary ldap.sasl.saslmech_handler_class built during import
+  for all the known SASL mechanisms derived from class definitions
+
+ldap.schema:
+* More graceful handling of KeyError in SubSchema.attribute_types()
+* New method SubSchema.get_inheritedattr() for retrieving inherited
+  class attributes
+* New method SubSchema.get_inheritedobj() for retrieving a
+  schema element instance including all inherited class attributes
+
+----------------------------------------------------------------
+Released 2.0.0pre13 2003-06-02
+
+Changes since 2.0.0pre12:
+
+ldap.async:
+* Checking type of argument writer_obj relaxed in
+  LDIFWriter.__init__() since file-like objects are
+  not necessarily an instance of file.
+
+ldap.schema:
+* ldap.schema.subentry.SubSchema.attribute_types() now correctly
+  handles attribute types without NAME set
+* If SUP is not defined for a structural object class 'top' is
+  assumed to be the only super-class by default
+* '_' is now the abstract top node in SubSchema.tree() for all
+  schema element classes since ABSTRACT and AUXILIARY object
+  classes are not derived from 'top' by default
+
+----------------------------------------------------------------
+Released 2.0.0pre12 2003-05-27
+
+Changes since 2.0.0pre11:
+
+New sub-module ldap.filter:
+* Added functions escape_filter_chars() and filter_format()
+
+ldap.ldapobject:
+* Trace log writes LDAP URI of connection instead of module name
+* search_s() passes self.timeout as argument timeout when
+  calling search_ext_s()
+* Key-word arguments for simple_bind() and simple_bind_s()
+  with defaults for anonymous bind.
+* LDAPObject.protocol_version is set to LDAPv3 as default
+  (this might make code changes necessary in a real LDAPv2
+   environment)
+* Default for key-word argument trace_stack_limit passed to
+  __init__() is 5
+* Updated __doc__ strings
+* Aligned and tested ReconnectLDAPObject and SmartLDAPObject
+
+ldap.async:
+* LDIFWriter uses ldif.LDIFWriter instead of calling
+  function ldif.CreateLDIF
+* LDIFWriter accepts either file-like object or ldif.LDIFWriter
+  instance as argument for specifying the output
+
+ldif:
+* Abandoned argument all_records of LDIFRecordList.__init__()
+
+ldapurl:
+* urllib.unquote() used instead of urllib.unquote_plus()
+
+----------------------------------------------------------------
+Released 2.0.0pre11 2003-05-02
+
+Changes since 2.0.0pre10:
+
+ldap.ldapobject:
+* Cosmetic change: Named argument list for LDAPObject.compare()
+  instead of *args,**kwargs.
+* Fixed bug in ReconnectLDAPObject._apply_method_s() affecting
+  compability with Python 2.0. The bug was introduced with
+  2.0.0pre09 by dropping use of apply().
+
+ldap.modlist:
+* modifyModlist(): Only None is filtered from attribute value lists,
+  '' is preserved as valid attribute value. But filtering applies
+  to old_value and new_value now.
+
+ldap.schema:
+* Zero-length attribute values for schema elements are ignored
+  (needed on e.g. Active Directory)
+
+dsml:
+Added support for parsing and generating DSMLv1.
+Still experimental though.
+
+
+----------------------------------------------------------------
+Released 2.0.0pre10 2003-04-19
+
+Changes since 2.0.0pre09:
+
+ldap.schema:
+* Emulate BooleanType for compability with Python2.3 in assert
+  statements
+
+----------------------------------------------------------------
+Released 2.0.0pre09 2003-04-19
+
+Changes since 2.0.0pre08:
+
+Modified setup.py to support Cyrus-SASL 2.x.
+
+ldap.ldapobject:
+* apply() is not used anymore since it seems deprecated
+* Fixed __setstate__() and __getstate__() of ReconnectLDAPObject
+
+ldap.schema:
+* Completed classes for nameForms, dITStructureRules and
+  dITContentRules
+
+----------------------------------------------------------------
+Released 2.0.0pre08 2003-04-11
+
+Changes since 2.0.0pre07:
+
+ldap.schema:
+* For backward compability with Python versions prior to 2.2
+  Lib/ldap/schema/tokenizer.py and Lib/ldap/schema/models.py use
+  (()) instead of tuple() for creating empty tuples.
+
+----------------------------------------------------------------
+Released 2.0.0pre07 2003-04-03
+
+Changes since 2.0.0pre06:
+
+LDAPObject.c:
+  * Wrapped OpenLDAP's ldap_search_ext()
+  * Removed empty __doc__ strings
+  * Removed fileno
+  * Removed all stuff related to caching in OpenLDAP libs
+
+ldap.ldapobject:
+  * Fixed SASL rebind in ldap.ldapobject.ReconnectLDAPObject
+  * use search_ext() instead ldap_search()
+  * new class attribute timeout for setting a global time-out
+    value for all synchronous operations
+
+ldap.schema:
+* Fixed two typos in ldap.schema.models
+* Some attempts to improve performance of parser/tokenizer
+* Completely reworked to have separate OID dictionaries for
+  the different schema element classes
+* Fixed the Demo/schema*.py to reflect changes to ldap.schema
+
+Documentation updates and various __doc__ string modifications.
+
+ldapurl:
+  * Removed all Unicode stuff from module ldapurl
+  * Consistent URL encoding in module ldapurl
+
+ldif:
+  * Removed ldif.FileWriter
+  * Proper handling of FILL (see RFC 2849)
+
+----------------------------------------------------------------
+Released 2.0.0pre06 2002-09-23
+
+Changes since 2.0.0pre05:
+- Fine-grained locking when linking against libldap_r
+- New wrapper class ldap.ReconnectLDAPObject
+- Security fix to module ldapurl
+- Other fixes and improvements to whole package
+- LDAPv3 schema support
+  (still somewhat premature and undocumented)
+
+----------------------------------------------------------------
+Released 2.0.0pre05 2002-07-20
+
+----------------------------------------------------------------
+Released 2.0.0pre04 2002-02-09
+
+----------------------------------------------------------------
+Released 2.0.0pre02 2002-02-01
+
+----------------------------------------------------------------
+Released 1.10alpha3 2000-09-19
+
+$Id: CHANGES,v 1.306 2013/09/21 03:55:37 stroeder Exp $
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
new file mode 100644
index 0000000..97ec14b
--- /dev/null
+++ b/Lib/ldap/async.py
@@ -0,0 +1,317 @@
+"""
+ldap.async - handle async LDAP operations
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: async.py,v 1.33 2013/09/21 03:55:38 stroeder Exp $
+
+Python compability note:
+Tested on Python 2.0+ but should run on Python 1.5.x.
+"""
+
+import ldap
+
+from ldap import __version__
+
+
+_searchResultTypes={
+  ldap.RES_SEARCH_ENTRY:None,
+  ldap.RES_SEARCH_RESULT:None,
+  ldap.RES_SEARCH_REFERENCE:None,
+}
+
+_entryResultTypes={
+  ldap.RES_SEARCH_ENTRY:None,
+  ldap.RES_SEARCH_RESULT:None,
+}
+
+
+class WrongResultType(Exception):
+
+  def __init__(self,receivedResultType,expectedResultTypes):
+    self.receivedResultType = receivedResultType
+    self.expectedResultTypes = expectedResultTypes
+    Exception.__init__(self)
+
+  def __str__(self):
+    return 'Received wrong result type %s (expected one of %s).' % (
+      self.receivedResultType,
+      ', '.join(self.expectedResultTypes),
+    )
+
+
+class AsyncSearchHandler:
+  """
+  Class for stream-processsing LDAP search results
+
+  Arguments:
+
+  l
+    LDAPObject instance
+  """
+
+  def __init__(self,l):
+    self._l = l
+    self._msgId = None
+    self._afterFirstResult = 1
+
+  def startSearch(
+    self,
+    searchRoot,
+    searchScope,
+    filterStr,
+    attrList=None,
+    attrsOnly=0,
+    timeout=-1,
+    sizelimit=0,
+    serverctrls=None,
+    clientctrls=None
+  ):
+    """
+    searchRoot
+        See parameter base of method LDAPObject.search()
+    searchScope
+        See parameter scope of method LDAPObject.search()
+    filterStr
+        See parameter filter of method LDAPObject.search()
+    attrList=None
+        See parameter attrlist of method LDAPObject.search()
+    attrsOnly
+        See parameter attrsonly of method LDAPObject.search()
+    timeout
+        Maximum time the server shall use for search operation
+    sizelimit
+        Maximum number of entries a server should return
+        (request client-side limit)
+    serverctrls
+        list of server-side LDAP controls
+    clientctrls
+        list of client-side LDAP controls
+    """
+    self._msgId = self._l.search_ext(
+      searchRoot,searchScope,filterStr,
+      attrList,attrsOnly,serverctrls,clientctrls,timeout,sizelimit
+    )
+    self._afterFirstResult = 1
+    return # startSearch()
+
+  def preProcessing(self):
+    """
+    Do anything you want after starting search but
+    before receiving and processing results
+    """
+
+  def afterFirstResult(self):
+    """
+    Do anything you want right after successfully receiving but before 
+    processing first result
+    """
+
+  def postProcessing(self):
+    """
+    Do anything you want after receiving and processing all results
+    """
+
+  def processResults(self,ignoreResultsNumber=0,processResultsCount=0,timeout=-1):
+    """
+    ignoreResultsNumber
+        Don't process the first ignoreResultsNumber results.
+    processResultsCount
+        If non-zero this parameters indicates the number of results
+        processed is limited to processResultsCount.
+    timeout
+        See parameter timeout of ldap.LDAPObject.result()
+    """
+    self.preProcessing()
+    result_counter = 0
+    end_result_counter = ignoreResultsNumber+processResultsCount
+    go_ahead = 1
+    partial = 0
+    self.beginResultsDropped = 0
+    self.endResultBreak = result_counter
+    try:
+      result_type,result_list = None,None
+      while go_ahead:
+        while result_type is None and not result_list:
+          result_type,result_list,result_msgid,result_serverctrls = self._l.result3(self._msgId,0,timeout)
+          if self._afterFirstResult:
+            self.afterFirstResult()
+            self._afterFirstResult = 0
+        if not result_list:
+          break
+        if not _searchResultTypes.has_key(result_type):
+          raise WrongResultType(result_type,_searchResultTypes.keys())
+        # Loop over list of search results
+        for result_item in result_list:
+          if result_counter<ignoreResultsNumber:
+            self.beginResultsDropped = self.beginResultsDropped+1
+          elif processResultsCount==0 or result_counter<end_result_counter:
+            self._processSingleResult(result_type,result_item)
+          else:
+            go_ahead = 0 # break-out from while go_ahead
+            partial = 1
+            break # break-out from this for-loop
+          result_counter = result_counter+1
+        result_type,result_list = None,None
+        self.endResultBreak = result_counter
+    finally:
+      if partial and self._msgId!=None:
+        self._l.abandon(self._msgId)
+    self.postProcessing()
+    return partial # processResults()
+
+  def _processSingleResult(self,resultType,resultItem):
+    """
+    Process single entry
+
+    resultType
+        result type
+    resultItem
+        Single item of a result list
+    """
+    pass
+
+
+class List(AsyncSearchHandler):
+  """
+  Class for collecting all search results.
+
+  This does not seem to make sense in the first place but think
+  of retrieving exactly a certain portion of the available search
+  results.
+  """
+
+  def __init__(self,l):
+    AsyncSearchHandler.__init__(self,l)
+    self.allResults = []
+
+  def _processSingleResult(self,resultType,resultItem):
+    self.allResults.append((resultType,resultItem))
+
+
+class Dict(AsyncSearchHandler):
+  """
+  Class for collecting all search results into a dictionary {dn:entry}
+  """
+
+  def __init__(self,l):
+    AsyncSearchHandler.__init__(self,l)
+    self.allEntries = {}
+
+  def _processSingleResult(self,resultType,resultItem):
+    if _entryResultTypes.has_key(resultType):
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self.allEntries[dn] = entry
+
+
+class IndexedDict(Dict):
+  """
+  Class for collecting all search results into a dictionary {dn:entry}
+  and maintain case-sensitive equality indexes to entries
+  """
+
+  def __init__(self,l,indexed_attrs=None):
+    Dict.__init__(self,l)
+    self.indexed_attrs = indexed_attrs or tuple()
+    self.index = {}.fromkeys(self.indexed_attrs,{})
+
+  def _processSingleResult(self,resultType,resultItem):
+    if _entryResultTypes.has_key(resultType):
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self.allEntries[dn] = entry
+      for a in self.indexed_attrs:
+        if entry.has_key(a):
+          for v in entry[a]:
+            try:
+              self.index[a][v].append(dn)
+            except KeyError:
+              self.index[a][v] = [ dn ]
+
+
+class FileWriter(AsyncSearchHandler):
+  """
+  Class for writing a stream of LDAP search results to a file object
+
+  Arguments:
+  l
+    LDAPObject instance
+  f
+    File object instance where the LDIF data is written to
+  """
+
+  def __init__(self,l,f,headerStr='',footerStr=''):
+    AsyncSearchHandler.__init__(self,l)
+    self._f = f
+    self.headerStr = headerStr
+    self.footerStr = footerStr
+
+  def preProcessing(self):
+    """
+    The headerStr is written to output after starting search but
+    before receiving and processing results.
+    """
+    self._f.write(self.headerStr)
+
+  def postProcessing(self):
+    """
+    The footerStr is written to output after receiving and
+    processing results.
+    """
+    self._f.write(self.footerStr)
+
+
+class LDIFWriter(FileWriter):
+  """
+  Class for writing a stream LDAP search results to a LDIF file
+
+  Arguments:
+
+  l
+    LDAPObject instance
+  writer_obj
+    Either a file-like object or a ldif.LDIFWriter instance used for output
+  """
+
+  def __init__(self,l,writer_obj,headerStr='',footerStr=''):
+    import ldif
+    if isinstance(writer_obj,ldif.LDIFWriter):
+      self._ldif_writer = writer_obj
+    else:
+      self._ldif_writer = ldif.LDIFWriter(writer_obj)
+    FileWriter.__init__(self,l,self._ldif_writer._output_file,headerStr,footerStr)
+
+  def _processSingleResult(self,resultType,resultItem):
+    if _entryResultTypes.has_key(resultType):
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self._ldif_writer.unparse(dn,entry)
+
+
+class DSMLWriter(FileWriter):
+  """
+  Class for writing a stream LDAP search results to a DSML file
+
+  Arguments:
+
+  l
+    LDAPObject instance
+  writer_obj
+    Either a file-like object or a dsml.DSMLWriter instance used for output
+  """
+
+  def __init__(self,l,writer_obj,headerStr='',footerStr=''):
+    import dsml
+    if isinstance(writer_obj,dsml.DSMLWriter):
+      self._dsml_writer = writer_obj
+    else:
+      self._dsml_writer = dsml.DSMLWriter(writer_obj)
+    FileWriter.__init__(self,l,self._dsml_writer._output_file,headerStr,footerStr)
+
+  def _processSingleResult(self,resultType,resultItem):
+    if _entryResultTypes.has_key(resultType):
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self._dsml_writer.unparse(dn,entry)
+

From e6b1677774ffaf69ea234956d61d871f38fe85fe Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 23 Nov 2013 14:09:59 +0000
Subject: [PATCH 103/868] More log data in LDAPLock.acquire() and
 LDAPLock.release()

---
 CHANGES              | 4 +++-
 Lib/ldap/__init__.py | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 54a6f4b..feb6ff0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,8 @@ Lib/
 * New method ldap.async.AsyncSearchHandler.afterFirstResult()
   for doing something right after successfully receiving but before 
   processing first result
+* Better log data written when invoking ldap.LDAPLock.acquire() and
+  ldap.LDAPLock.release()
 
 Modules/
 * Added support for retrieving negotiated TLS version/cipher
@@ -1068,4 +1070,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.306 2013/09/21 03:55:37 stroeder Exp $
+$Id: CHANGES,v 1.307 2013/11/23 14:11:18 stroeder Exp $
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index d641a44..84431bf 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.87 2013/07/04 16:06:53 stroeder Exp $
+$Id: __init__.py,v 1.88 2013/11/23 14:09:59 stroeder Exp $
 """
 
 # This is also the overall release version number
@@ -68,14 +68,14 @@ def acquire(self):
     if __debug__:
       global _trace_level
       if _trace_level>=self._min_trace_level:
-        _trace_file.write('***%s %s.acquire()\n' % (self._desc,self.__class__.__name__))
+        _trace_file.write('***%s.acquire() %s %s\n' % (self.__class__.__name__,repr(self),self._desc))
     return self._lock.acquire()
 
   def release(self):
     if __debug__:
       global _trace_level
       if _trace_level>=self._min_trace_level:
-        _trace_file.write('***%s %s.release()\n' % (self._desc,self.__class__.__name__))
+        _trace_file.write('***%s.release() %s %s\n' % (self.__class__.__name__,repr(self),self._desc))
     return self._lock.release()
 
 

From 68a06d0f1f60f00ea3b4f9ae3e24e245196ac644 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 23 Nov 2013 14:15:33 +0000
Subject: [PATCH 104/868] * LDAPObject and friends now pass `desc' to
 ldap.LDAPLock() which   results in better logging *
 ldapobject.ReconnectLDAPObject now uses internal class-wide   lock for
 serializing reconnects

---
 CHANGES                |  6 ++-
 Lib/ldap/ldapobject.py | 92 +++++++++++++++++++++---------------------
 2 files changed, 52 insertions(+), 46 deletions(-)

diff --git a/CHANGES b/CHANGES
index feb6ff0..5e878a0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,10 @@ Lib/
   processing first result
 * Better log data written when invoking ldap.LDAPLock.acquire() and
   ldap.LDAPLock.release()
+* LDAPObject and friends now pass `desc' to ldap.LDAPLock() which
+  results in better logging
+* ldapobject.ReconnectLDAPObject now uses internal class-wide
+  lock for serializing reconnects
 
 Modules/
 * Added support for retrieving negotiated TLS version/cipher
@@ -1070,4 +1074,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.307 2013/11/23 14:11:18 stroeder Exp $
+$Id: CHANGES,v 1.308 2013/11/23 14:15:33 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 74ee238..5b09117 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.135 2013/06/25 17:36:03 stroeder Exp $
+\$Id: ldapobject.py,v 1.136 2013/11/23 14:15:33 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -66,14 +66,14 @@ def __init__(
     self._trace_file = trace_file or sys.stdout
     self._trace_stack_limit = trace_stack_limit
     self._uri = uri
-    self._ldap_object_lock = self._ldap_lock()
+    self._ldap_object_lock = self._ldap_lock('opcall')
     self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
     self.timeout = -1
     self.protocol_version = ldap.VERSION3
 
-  def _ldap_lock(self):
+  def _ldap_lock(self,desc=''):
     if ldap.LIBLDAP_R:
-      return ldap.LDAPLock(desc=self._uri)
+      return ldap.LDAPLock(desc='%s within %s' %(desc,repr(self)))
     else:
       return ldap._ldap_module_lock
 
@@ -728,8 +728,8 @@ def __init__(
     self._uri = uri
     self._options = []
     self._last_bind = None
-    self._pending_reconnect = 0
     SimpleLDAPObject.__init__(self,uri,trace_level,trace_file,trace_stack_limit)
+    self._reconnect_lock = self._ldap_lock(desc='reconnect')
     self._retry_max = retry_max
     self._retry_delay = retry_delay
     self._start_tls = 0
@@ -750,6 +750,9 @@ def __setstate__(self,d):
     self._trace_file = sys.stdout
     self.reconnect(self._uri)
 
+  def _store_last_bind(self,method,*args,**kwargs):
+    self._last_bind = (method,args,kwargs)
+
   def _apply_last_bind(self):
     if self._last_bind!=None:
       func,args,kwargs = self._last_bind
@@ -766,46 +769,45 @@ def _restore_options(self):
   def reconnect(self,uri):
     # Drop and clean up old connection completely
     # Reconnect
-    while self._pending_reconnect:
-      time.sleep(0.01)
-    else:
-      self._pending_reconnect = 1
-    reconnect_counter = self._retry_max
-    while reconnect_counter:
-      if __debug__ and self._trace_level>=1:
-        self._trace_file.write('*** Try %d. reconnect to %s...\n' % (
-          self._retry_max-reconnect_counter+1,uri
-        ))
-      try:
-        # Do the connect
-        self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
-        self._restore_options()
-        # StartTLS extended operation in case this was called before
-        if self._start_tls:
-          self.start_tls_s()
-        # Repeat last simple or SASL bind
-        self._apply_last_bind()
-      except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:
-        if __debug__ and self._trace_level>=1:
-          self._trace_file.write('*** %d. reconnect to %s failed\n' % (
-            self._retry_max-reconnect_counter+1,uri
-          ))
-        reconnect_counter = reconnect_counter-1
-        if not reconnect_counter:
-          raise
-        if __debug__ and self._trace_level>=1:
-          self._trace_file.write('=> delay %s...\n' % (self._retry_delay))
-        time.sleep(self._retry_delay)
-        SimpleLDAPObject.unbind_s(self)
-        del self._l
-      else:
+    self._reconnect_lock.acquire()
+    try:
+      reconnect_counter = self._retry_max
+      while reconnect_counter:
         if __debug__ and self._trace_level>=1:
-          self._trace_file.write('*** %d. reconnect to %s successful, last operation will be repeated\n' % (
+          self._trace_file.write('*** Try %d. reconnect to %s...\n' % (
             self._retry_max-reconnect_counter+1,uri
           ))
-        self._reconnects_done = self._reconnects_done + 1L
-        break
-    self._pending_reconnect = 0
+        try:
+          # Do the connect
+          self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
+          self._restore_options()
+          # StartTLS extended operation in case this was called before
+          if self._start_tls:
+            self.start_tls_s()
+          # Repeat last simple or SASL bind
+          self._apply_last_bind()
+        except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:
+          if __debug__ and self._trace_level>=1:
+            self._trace_file.write('*** %d. reconnect to %s failed\n' % (
+              self._retry_max-reconnect_counter+1,uri
+            ))
+          reconnect_counter = reconnect_counter-1
+          if not reconnect_counter:
+            raise
+          if __debug__ and self._trace_level>=1:
+            self._trace_file.write('=> delay %s...\n' % (self._retry_delay))
+          time.sleep(self._retry_delay)
+          SimpleLDAPObject.unbind_s(self)
+          del self._l
+        else:
+          if __debug__ and self._trace_level>=1:
+            self._trace_file.write('*** %d. reconnect to %s successful, last operation will be repeated\n' % (
+              self._retry_max-reconnect_counter+1,uri
+            ))
+          self._reconnects_done = self._reconnects_done + 1L
+          break
+    finally:
+      self._reconnect_lock.release()
     return # reconnect()
 
   def _apply_method_s(self,func,*args,**kwargs):
@@ -827,12 +829,12 @@ def set_option(self,option,invalue):
 
   def bind_s(self,*args,**kwargs):
     res = self._apply_method_s(SimpleLDAPObject.bind_s,*args,**kwargs)
-    self._last_bind = (self.bind_s,args,kwargs)
+    self._store_last_bind(SimpleLDAPObject.bind_s,*args,**kwargs)
     return res
 
   def simple_bind_s(self,*args,**kwargs):
     res = self._apply_method_s(SimpleLDAPObject.simple_bind_s,*args,**kwargs)
-    self._last_bind = (SimpleLDAPObject.simple_bind_s,args,kwargs)
+    self._store_last_bind(SimpleLDAPObject.simple_bind_s,*args,**kwargs)
     return res
 
   def start_tls_s(self,*args,**kwargs):
@@ -845,7 +847,7 @@ def sasl_interactive_bind_s(self,*args,**kwargs):
     sasl_interactive_bind_s(who, auth) -> None
     """
     res = self._apply_method_s(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
-    self._last_bind = (SimpleLDAPObject.sasl_interactive_bind_s,args,kwargs)
+    self._store_last_bind(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
     return res
 
   def add_ext_s(self,*args,**kwargs):

From 998400bf665ef467867ff59195fb441eab4fa8b2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 23 Nov 2013 15:44:32 +0000
Subject: [PATCH 105/868] * Method signature of ReconnectLDAPObject.reconnect()
 changed to be able   to call it with separate retry_max and retry_delay
 values

---
 CHANGES                |  4 +++-
 Lib/ldap/ldapobject.py | 26 +++++++++++++-------------
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5e878a0..f836324 100644
--- a/CHANGES
+++ b/CHANGES
@@ -14,6 +14,8 @@ Lib/
   results in better logging
 * ldapobject.ReconnectLDAPObject now uses internal class-wide
   lock for serializing reconnects
+* Method signature of ReconnectLDAPObject.reconnect() changed to be able
+  to call it with separate retry_max and retry_delay values
 
 Modules/
 * Added support for retrieving negotiated TLS version/cipher
@@ -1074,4 +1076,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.308 2013/11/23 14:15:33 stroeder Exp $
+$Id: CHANGES,v 1.309 2013/11/23 15:44:32 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 5b09117..41007dd 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.136 2013/11/23 14:15:33 stroeder Exp $
+\$Id: ldapobject.py,v 1.137 2013/11/23 15:44:32 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -766,16 +766,16 @@ def _restore_options(self):
     for k,v in self._options:
       SimpleLDAPObject.set_option(self,k,v)
 
-  def reconnect(self,uri):
+  def reconnect(self,uri,retry_max=1,retry_delay=60.0):
     # Drop and clean up old connection completely
     # Reconnect
     self._reconnect_lock.acquire()
     try:
-      reconnect_counter = self._retry_max
+      reconnect_counter = retry_max
       while reconnect_counter:
         if __debug__ and self._trace_level>=1:
-          self._trace_file.write('*** Try %d. reconnect to %s...\n' % (
-            self._retry_max-reconnect_counter+1,uri
+          self._trace_file.write('*** Trying %d. (of %d) reconnect to %s...\n' % (
+            retry_max-reconnect_counter+1,retry_max,uri
           ))
         try:
           # Do the connect
@@ -788,21 +788,21 @@ def reconnect(self,uri):
           self._apply_last_bind()
         except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('*** %d. reconnect to %s failed\n' % (
-              self._retry_max-reconnect_counter+1,uri
+            self._trace_file.write('*** %d. (of %d) reconnect to %s failed\n' % (
+              self._retry_max-reconnect_counter+1,retry_max,uri
             ))
           reconnect_counter = reconnect_counter-1
           if not reconnect_counter:
             raise
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('=> delay %s...\n' % (self._retry_delay))
-          time.sleep(self._retry_delay)
+            self._trace_file.write('=> delay %s...\n' % (retry_delay))
+          time.sleep(retry_delay)
           SimpleLDAPObject.unbind_s(self)
           del self._l
         else:
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('*** %d. reconnect to %s successful, last operation will be repeated\n' % (
-              self._retry_max-reconnect_counter+1,uri
+            self._trace_file.write('*** %d. (of %d) reconnect to %s successful, last operation will be repeated\n' % (
+              self._retry_max-reconnect_counter+1,retry_max,uri
             ))
           self._reconnects_done = self._reconnects_done + 1L
           break
@@ -812,14 +812,14 @@ def reconnect(self,uri):
 
   def _apply_method_s(self,func,*args,**kwargs):
     if not self.__dict__.has_key('_l'):
-      self.reconnect(self._uri)
+      self.reconnect(self._uri,retry_max=self._retry_max,retry_delay=self._retry_delay)
     try:
       return func(self,*args,**kwargs)
     except ldap.SERVER_DOWN:
       SimpleLDAPObject.unbind_s(self)
       del self._l
       # Try to reconnect
-      self.reconnect(self._uri)
+      self.reconnect(self._uri,retry_max=self._retry_max,retry_delay=self._retry_delay)
       # Re-try last operation
       return func(self,*args,**kwargs)
 

From 7395e6711fed08e386d6753eeaa13230bc4ba0ac Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 31 Jan 2014 17:21:15 +0000
Subject: [PATCH 106/868] Release 2.4.14 now

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index f836324..4769cff 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.14 2013-xx-xx
+Released 2.4.14 2014-01-31
 
 Changes since 2.4.13:
 
@@ -1076,4 +1076,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.309 2013/11/23 15:44:32 stroeder Exp $
+$Id: CHANGES,v 1.310 2014/01/31 17:21:15 stroeder Exp $

From 6622ce384c6431a7a071826843a535555ae51d6c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 19 Feb 2014 20:05:57 +0000
Subject: [PATCH 107/868] Cleaned up reconnect logging a bit

---
 Lib/ldap/ldapobject.py | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 41007dd..3293ff0 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.137 2013/11/23 15:44:32 stroeder Exp $
+\$Id: ldapobject.py,v 1.138 2014/02/19 20:05:57 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -729,7 +729,7 @@ def __init__(
     self._options = []
     self._last_bind = None
     SimpleLDAPObject.__init__(self,uri,trace_level,trace_file,trace_stack_limit)
-    self._reconnect_lock = self._ldap_lock(desc='reconnect')
+    self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
     self._retry_max = retry_max
     self._retry_delay = retry_delay
     self._start_tls = 0
@@ -773,9 +773,10 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
     try:
       reconnect_counter = retry_max
       while reconnect_counter:
+        counter_text = '%d. (of %d)' % (retry_max-reconnect_counter+1,retry_max)
         if __debug__ and self._trace_level>=1:
-          self._trace_file.write('*** Trying %d. (of %d) reconnect to %s...\n' % (
-            retry_max-reconnect_counter+1,retry_max,uri
+          self._trace_file.write('*** Trying %s reconnect to %s...\n' % (
+            counter_text,uri
           ))
         try:
           # Do the connect
@@ -788,12 +789,12 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
           self._apply_last_bind()
         except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('*** %d. (of %d) reconnect to %s failed\n' % (
-              self._retry_max-reconnect_counter+1,retry_max,uri
+            self._trace_file.write('*** %s reconnect to %s failed\n' % (
+              counter_text,uri
             ))
           reconnect_counter = reconnect_counter-1
           if not reconnect_counter:
-            raise
+            raise e
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('=> delay %s...\n' % (retry_delay))
           time.sleep(retry_delay)
@@ -801,8 +802,8 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
           del self._l
         else:
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('*** %d. (of %d) reconnect to %s successful, last operation will be repeated\n' % (
-              self._retry_max-reconnect_counter+1,retry_max,uri
+            self._trace_file.write('*** %s reconnect to %s successful => repeat last operation\n' % (
+              counter_text,uri
             ))
           self._reconnects_done = self._reconnects_done + 1L
           break

From 35ba85657e51795862b7460b08d83371a7d4db2b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 20:27:33 +0000
Subject: [PATCH 108/868] Started 2.4.15

---
 CHANGES | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 4769cff..55182ab 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+----------------------------------------------------------------
+Released 2.4.15 2014-03-13
+
+Changes since 2.4.14:
+
+Lib/
+
+Modules/
+
 ----------------------------------------------------------------
 Released 2.4.14 2014-01-31
 
@@ -1076,4 +1085,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.310 2014/01/31 17:21:15 stroeder Exp $
+$Id: CHANGES,v 1.311 2014/03/12 20:27:33 stroeder Exp $

From 84d5d2b28368a7b077dabb4b9f5f9f95a2836d95 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 20:29:23 +0000
Subject: [PATCH 109/868] Added missing modules ldap.controls.openldap and
 ldap.controls.pwdpolicy to setup.py

---
 CHANGES  | 4 +++-
 setup.py | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 55182ab..ca9b7a1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,8 @@ Released 2.4.15 2014-03-13
 Changes since 2.4.14:
 
 Lib/
+* Added missing modules ldap.controls.openldap and 
+  ldap.controls.pwdpolicy to setup.py
 
 Modules/
 
@@ -1085,4 +1087,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.311 2014/03/12 20:27:33 stroeder Exp $
+$Id: CHANGES,v 1.312 2014/03/12 20:29:23 stroeder Exp $
diff --git a/setup.py b/setup.py
index a9a6219..b2fe367 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.71 2011/10/26 19:42:25 stroeder Exp $
+$Id: setup.py,v 1.72 2014/03/12 20:29:23 stroeder Exp $
 """
 
 has_setuptools = False
@@ -151,8 +151,10 @@ class OpenLDAP2:
     'ldap.async',
     'ldap.controls',
     'ldap.controls.libldap',
+    'ldap.controls.openldap',
     'ldap.controls.ppolicy',
     'ldap.controls.psearch',
+    'ldap.controls.pwdpolicy',
     'ldap.controls.readentry',
     'ldap.controls.sessiontrack',
     'ldap.controls.simple',

From d7db8e332c090baa3e8d43893246f7064511cd4d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 20:30:50 +0000
Subject: [PATCH 110/868] Added missing imports to ldap.controls.pwdpolicy

---
 CHANGES                        | 3 ++-
 Lib/ldap/controls/pwdpolicy.py | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index ca9b7a1..aa418ae 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ Changes since 2.4.14:
 Lib/
 * Added missing modules ldap.controls.openldap and 
   ldap.controls.pwdpolicy to setup.py
+* Added missing imports to ldap.controls.pwdpolicy
 
 Modules/
 
@@ -1087,4 +1088,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.312 2014/03/12 20:29:23 stroeder Exp $
+$Id: CHANGES,v 1.313 2014/03/12 20:30:50 stroeder Exp $
diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index 81e4330..85a99d8 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -5,16 +5,19 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: pwdpolicy.py,v 1.1 2012/02/21 16:51:55 stroeder Exp $
+$Id: pwdpolicy.py,v 1.2 2014/03/12 20:30:50 stroeder Exp $
 """
 
 __all__ = [
   'ExpirationWarningControl'
 ]
 
+import struct
+
 # Imports from python-ldap 2.4+
 import ldap.controls
 from ldap.controls import RequestControl,ResponseControl,ValueLessRequestControl,KNOWN_RESPONSE_CONTROLS
+from ldap.controls.simple import OctetStringInteger
 
 
 class PasswordExpiringControl(OctetStringInteger):

From 7e45d77a5fe2b9fa8436f85a3000ac889282c2a7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 21:16:05 +0000
Subject: [PATCH 111/868] Fixed ldap.controls.pwdpolicy.decodeControlValue() to
 decode string of digits

---
 CHANGES                        | 4 +++-
 Lib/ldap/controls/pwdpolicy.py | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index aa418ae..4d08239 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,8 @@ Lib/
 * Added missing modules ldap.controls.openldap and 
   ldap.controls.pwdpolicy to setup.py
 * Added missing imports to ldap.controls.pwdpolicy
+* Fixed ldap.controls.pwdpolicy.decodeControlValue() to decode
+  string of digits
 
 Modules/
 
@@ -1088,4 +1090,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.313 2014/03/12 20:30:50 stroeder Exp $
+$Id: CHANGES,v 1.314 2014/03/12 21:16:05 stroeder Exp $
diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index 85a99d8..52027bd 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: pwdpolicy.py,v 1.2 2014/03/12 20:30:50 stroeder Exp $
+$Id: pwdpolicy.py,v 1.3 2014/03/12 21:16:05 stroeder Exp $
 """
 
 __all__ = [
@@ -27,7 +27,7 @@ class PasswordExpiringControl(OctetStringInteger):
   controlType = '2.16.840.1.113730.3.4.5'
 
   def decodeControlValue(self,encodedControlValue):
-    self.gracePeriod = struct.unpack('!Q',encodedControlValue)[0]
+    self.gracePeriod = int(encodedControlValue)
 
 KNOWN_RESPONSE_CONTROLS[PasswordExpiringControl.controlType] = PasswordExpiringControl
 

From be4bb3c7b9b297b9381e4f68625327b7dd8bb185 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 21:34:07 +0000
Subject: [PATCH 112/868] Removed unneeded imports

---
 Lib/ldap/controls/pwdpolicy.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index 52027bd..0cb4260 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -5,22 +5,19 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: pwdpolicy.py,v 1.3 2014/03/12 21:16:05 stroeder Exp $
+$Id: pwdpolicy.py,v 1.4 2014/03/12 21:34:07 stroeder Exp $
 """
 
 __all__ = [
   'ExpirationWarningControl'
 ]
 
-import struct
-
 # Imports from python-ldap 2.4+
 import ldap.controls
 from ldap.controls import RequestControl,ResponseControl,ValueLessRequestControl,KNOWN_RESPONSE_CONTROLS
-from ldap.controls.simple import OctetStringInteger
 
 
-class PasswordExpiringControl(OctetStringInteger):
+class PasswordExpiringControl(ResponseControl):
   """
   Indicates time in seconds when password will expire
   """

From 543582fcf0dd06d8c5bb153e2bfa8679c1f3d5da Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 21:44:10 +0000
Subject: [PATCH 113/868] Support for X-SUBST in schema element class
 LDAPSyntax; Support for X-ORDERED and X-ORIGIN in schema element class
 AttributeType

---
 CHANGES                   |  8 +++++---
 Lib/ldap/schema/models.py | 15 +++++++++++++--
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4d08239..1abeaac 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,11 +4,13 @@ Released 2.4.15 2014-03-13
 Changes since 2.4.14:
 
 Lib/
-* Added missing modules ldap.controls.openldap and 
+* Added missing modules ldap.controls.openldap and
   ldap.controls.pwdpolicy to setup.py
 * Added missing imports to ldap.controls.pwdpolicy
 * Fixed ldap.controls.pwdpolicy.decodeControlValue() to decode
   string of digits
+* Support for X-SUBST in schema element class LDAPSyntax
+* Support for X-ORDERED and X-ORIGIN in schema element class AttributeType
 
 Modules/
 
@@ -20,7 +22,7 @@ Changes since 2.4.13:
 Lib/
 * Added ldap.controls.openldap.SearchNoOpControl
 * New method ldap.async.AsyncSearchHandler.afterFirstResult()
-  for doing something right after successfully receiving but before 
+  for doing something right after successfully receiving but before
   processing first result
 * Better log data written when invoking ldap.LDAPLock.acquire() and
   ldap.LDAPLock.release()
@@ -1090,4 +1092,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.314 2014/03/12 21:16:05 stroeder Exp $
+$Id: CHANGES,v 1.315 2014/03/12 21:44:10 stroeder Exp $
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 0d52e39..a3e0041 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: models.py,v 1.46 2012/12/13 08:22:48 stroeder Exp $
+\$Id: models.py,v 1.47 2014/03/12 21:44:10 stroeder Exp $
 """
 
 import UserDict,ldap.cidict
@@ -249,7 +249,9 @@ class AttributeType(SchemaElement):
     'SINGLE-VALUE':None,
     'COLLECTIVE':None,
     'NO-USER-MODIFICATION':None,
-    'USAGE':('userApplications',)
+    'USAGE':('userApplications',),
+    'X-ORIGIN':(None,),
+    'X-ORDERED':(None,),
   }
 
   def _set_attrs(self,l,d):
@@ -260,6 +262,8 @@ def _set_attrs(self,l,d):
     self.equality = d['EQUALITY'][0]
     self.ordering = d['ORDERING'][0]
     self.substr = d['SUBSTR'][0]
+    self.x_origin = d['X-ORIGIN'][0]
+    self.x_ordered = d['X-ORDERED'][0]
     try:
       syntax = d['SYNTAX'][0]
     except IndexError:
@@ -317,6 +321,8 @@ def __str__(self):
         3:" USAGE dSAOperation",
       }[self.usage]
     )
+    result.append(self.key_attr('X-ORIGIN',self.x_origin,quoted=1))
+    result.append(self.key_attr('X-ORDERED',self.x_ordered,quoted=1))
     return '( %s )' % ''.join(result)
 
 
@@ -336,19 +342,24 @@ class LDAPSyntax(SchemaElement):
   token_defaults = {
     'DESC':(None,),
     'X-NOT-HUMAN-READABLE':(None,),
+    'X-BINARY-TRANSFER-REQUIRED':(None,),
+    'X-SUBST':(None,),
   }
 
   def _set_attrs(self,l,d):
     self.desc = d['DESC'][0]
+    self.x_subst = d['X-SUBST'][0]
     self.not_human_readable = \
       NOT_HUMAN_READABLE_LDAP_SYNTAXES.has_key(self.oid) or \
       d['X-NOT-HUMAN-READABLE'][0]=='TRUE'
+    self.x_binary_transfer_required = d['X-BINARY-TRANSFER-REQUIRED'][0]=='TRUE'
     assert self.desc is None or type(self.desc)==StringType
     return
                                   
   def __str__(self):
     result = [str(self.oid)]
     result.append(self.key_attr('DESC',self.desc,quoted=1))
+    result.append(self.key_attr('X-SUBST',self.x_subst,quoted=1))
     result.append(
       {0:'',1:" X-NOT-HUMAN-READABLE 'TRUE'"}[self.not_human_readable]
     )

From 3ac949760c073c14ea5f921c714f79f9c75c04dc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 23:02:42 +0000
Subject: [PATCH 114/868] Support new scope value for
 draft-sermersheim-ldap-subordinate-scope

---
 CHANGES             | 6 +++++-
 Lib/ldapurl.py      | 7 +++++--
 Modules/constants.c | 8 +++++++-
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1abeaac..18e2632 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,8 +11,12 @@ Lib/
   string of digits
 * Support for X-SUBST in schema element class LDAPSyntax
 * Support for X-ORDERED and X-ORIGIN in schema element class AttributeType
+* ldapurl: New scope 'subordinates' defined in 
+  draft-sermersheim-ldap-subordinate-scope
 
 Modules/
+* New constant ldap.SCOPE_SUBORDINATE derived from ldap.h for 
+  draft-sermersheim-ldap-subordinate-scope
 
 ----------------------------------------------------------------
 Released 2.4.14 2014-01-31
@@ -1092,4 +1096,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.315 2014/03/12 21:44:10 stroeder Exp $
+$Id: CHANGES,v 1.316 2014/03/12 23:02:42 stroeder Exp $
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index af501a4..01a7703 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.63 2013/08/13 12:33:08 stroeder Exp $
+\$Id: ldapurl.py,v 1.64 2014/03/12 23:02:42 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -30,8 +30,9 @@
 LDAP_SCOPE_BASE = 0
 LDAP_SCOPE_ONELEVEL = 1
 LDAP_SCOPE_SUBTREE = 2
+LDAP_SCOPE_SUBORDINATES = 3
 
-SEARCH_SCOPE_STR = {None:'',0:'base',1:'one',2:'sub'}
+SEARCH_SCOPE_STR = {None:'',0:'base',1:'one',2:'sub',3:'subordinates'}
 
 SEARCH_SCOPE = {
   '':None,
@@ -39,6 +40,8 @@
   'base':LDAP_SCOPE_BASE,
   'one':LDAP_SCOPE_ONELEVEL,
   'sub':LDAP_SCOPE_SUBTREE,
+  # from draft-sermersheim-ldap-subordinate-scope
+  'subordinates':LDAP_SCOPE_SUBORDINATES,
 }
 
 # Some widely used types
diff --git a/Modules/constants.c b/Modules/constants.c
index d815edd..458ae09 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -1,6 +1,6 @@
 /* constants defined for LDAP
  * See http://www.python-ldap.org/ for details.
- * $Id: constants.c,v 1.57 2013/09/11 08:16:27 stroeder Exp $ */
+ * $Id: constants.c,v 1.58 2014/03/12 23:02:42 stroeder Exp $ */
 
 #include "common.h"
 #include "constants.h"
@@ -119,6 +119,9 @@ LDAPinit_constants( PyObject* d )
   add_int(d,SCOPE_BASE);
   add_int(d,SCOPE_ONELEVEL);
   add_int(d,SCOPE_SUBTREE);
+#ifdef LDAP_SCOPE_SUBORDINATE
+  add_int(d,SCOPE_SUBORDINATE);
+#endif
   add_int(d,MOD_ADD);
   add_int(d,MOD_DELETE);
   add_int(d,MOD_REPLACE);
@@ -191,6 +194,9 @@ LDAPinit_constants( PyObject* d )
 #ifdef LDAP_OPT_X_TLS_CIPHER
   add_int(d,OPT_X_TLS_CIPHER);
 #endif
+#ifdef LDAP_OPT_X_TLS_PEERCERT
+  add_int(d,OPT_X_TLS_PEERCERT);
+#endif
 #ifdef LDAP_OPT_X_TLS_CRLCHECK
   /* only available if OpenSSL supports it => might cause backward compability problems */
   add_int(d,OPT_X_TLS_CRLCHECK);

From df5f0eb43e52861faa35964de546bf476471271d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Mar 2014 23:11:26 +0000
Subject: [PATCH 115/868] __version__ = '2.4.15'

---
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/dsml.py b/Lib/dsml.py
index 260da63..7220cd3 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.31 2013/07/04 16:06:53 stroeder Exp $
+$Id: dsml.py,v 1.32 2014/03/12 23:11:26 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.14'
+__version__ = '2.4.15'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 84431bf..1fb9886 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.88 2013/11/23 14:09:59 stroeder Exp $
+$Id: __init__.py,v 1.89 2014/03/12 23:11:26 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.14'
+__version__ = '2.4.15'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 01a7703..7a4c347 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.64 2014/03/12 23:02:42 stroeder Exp $
+\$Id: ldapurl.py,v 1.65 2014/03/12 23:11:26 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.14'
+__version__ = '2.4.15'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 19cbf11..07dbcf1 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.73 2013/07/04 16:06:53 stroeder Exp $
+$Id: ldif.py,v 1.74 2014/03/12 23:11:26 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.14'
+__version__ = '2.4.15'
 
 __all__ = [
   # constants

From 53f0cb4584277e867bd965dcc6355cf89bda5062 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 23 Mar 2014 19:06:47 +0000
Subject: [PATCH 116/868] Fixed constant ldap.sasl.CB_GETREALM

---
 CHANGES          | 3 ++-
 Lib/ldap/sasl.py | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 18e2632..557aaf7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -17,6 +17,7 @@ Lib/
 Modules/
 * New constant ldap.SCOPE_SUBORDINATE derived from ldap.h for 
   draft-sermersheim-ldap-subordinate-scope
+* Fixed constant ldap.sasl.CB_GETREALM (thanks to Martin Pfeifer)
 
 ----------------------------------------------------------------
 Released 2.4.14 2014-01-31
@@ -1096,4 +1097,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.316 2014/03/12 23:02:42 stroeder Exp $
+$Id: CHANGES,v 1.317 2014/03/23 19:06:48 stroeder Exp $
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index 4e2d23c..39d6eb1 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: sasl.py,v 1.15 2009/07/26 11:09:58 stroeder Exp $
+\$Id: sasl.py,v 1.16 2014/03/23 19:06:47 stroeder Exp $
 
 Description:
 The ldap.sasl module provides SASL authentication classes.
@@ -31,7 +31,7 @@
 CB_PASS        = 0x4004
 CB_ECHOPROMPT  = 0x4005
 CB_NOECHOPROMPT= 0x4006
-CB_GETREALM    = 0x4007
+CB_GETREALM    = 0x4008
 
 class sasl:
     """This class handles SASL interactions for authentication.

From e927f2a4dacb1a50586910ffaea298083fdac169 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 24 Mar 2014 10:22:47 +0000
Subject: [PATCH 117/868] Release 2.4.15 today

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 557aaf7..2dbc707 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.15 2014-03-13
+Released 2.4.15 2014-03-24
 
 Changes since 2.4.14:
 
@@ -1097,4 +1097,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.317 2014/03/23 19:06:48 stroeder Exp $
+$Id: CHANGES,v 1.318 2014/03/24 10:22:47 stroeder Exp $

From 98c55a12b5c1cfb8f1b1457945a4cadea007995f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 2 May 2014 18:44:31 +0000
Subject: [PATCH 118/868] add command line example

---
 Demo/pyasn1/syncrepl.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 04fdc66..dbe9c4c 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -124,7 +124,14 @@ def commenceShutdown(signum, stack):
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
   database_path = sys.argv[2]
 except IndexError,e:
-  print 'Usage: syncrepl-client.py <LDAP URL> <pathname of database>'
+    print 'Usage:'
+    print sys.argv[0], '<LDAP URL> <pathname of database>'
+    print sys.argv[0], '\'ldap://127.0.0.1/cn=users,dc=test'\
+                       '?*'\
+                       '?sub'\
+                       '?(objectClass=*)'\
+                       '?bindname=uid=admin%2ccn=users%2cdc=test,'\
+                       'X-BINDPW=password\' db.shelve'
   sys.exit(1)
 except ValueError,e:
   print 'Error parsing command-line arguments:',str(e)

From dddeaa7d87f9df2657f60afc3dd2eddf59fbcccf Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 2 May 2014 18:47:46 +0000
Subject: [PATCH 119/868] __del__() is not called always which sometimes breaks
 database => use separate method SyncReplConsumer.close_db()

---
 Demo/pyasn1/syncrepl.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index dbe9c4c..0bf6a31 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -43,7 +43,7 @@ def __init__(self,db_path,*args,**kwargs):
         # We need this for later internal use
         self.__presentUUIDs = dict()
 
-    def __del__(self):
+    def close_db(self):
             # Close the data store properly to avoid corruption
             self.__data.close()
 
@@ -109,6 +109,7 @@ def commenceShutdown(signum, stack):
 
     # Tear down the server connection
     if( ldap_connection ):
+            ldap_connection.close_db()
             del ldap_connection
 
     # Shutdown

From 4f713542ab59eeac2b9f6bc575cd1db48bc2d002 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 2 May 2014 18:52:17 +0000
Subject: [PATCH 120/868] respect attribute list in LDAP URI

---
 Demo/pyasn1/syncrepl.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 0bf6a31..6481bed 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -160,6 +160,7 @@ def commenceShutdown(signum, stack):
       ldap_url.dn or '',
       ldap_url.scope or ldap.SCOPE_SUBTREE,
       mode = 'refreshAndPersist',
+      attrlist=ldap_url.attrs,
       filterstr = ldap_url.filterstr or '(objectClass=*)'
     )
 

From e317ba0d302953fc0678cd728c1883293bc98c54 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 20 May 2014 20:09:03 +0000
Subject: [PATCH 121/868] Started 2.4.16

---
 CHANGES              | 11 ++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2dbc707..83ae5c7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+----------------------------------------------------------------
+Released 2.4.16 2014-xx-xx
+
+Changes since 2.4.16:
+
+Lib/
+
+Modules/
+
 ----------------------------------------------------------------
 Released 2.4.15 2014-03-24
 
@@ -1097,4 +1106,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.318 2014/03/24 10:22:47 stroeder Exp $
+$Id: CHANGES,v 1.319 2014/05/20 20:09:03 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 7220cd3..b5c3e04 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.32 2014/03/12 23:11:26 stroeder Exp $
+$Id: dsml.py,v 1.33 2014/05/20 20:09:03 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.15'
+__version__ = '2.4.16'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 1fb9886..fc81a89 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.89 2014/03/12 23:11:26 stroeder Exp $
+$Id: __init__.py,v 1.90 2014/05/20 20:09:03 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.15'
+__version__ = '2.4.16'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7a4c347..d8e2e5c 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.65 2014/03/12 23:11:26 stroeder Exp $
+\$Id: ldapurl.py,v 1.66 2014/05/20 20:09:03 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.15'
+__version__ = '2.4.16'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 07dbcf1..d8c9ddc 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.74 2014/03/12 23:11:26 stroeder Exp $
+$Id: ldif.py,v 1.75 2014/05/20 20:09:03 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.15'
+__version__ = '2.4.16'
 
 __all__ = [
   # constants

From 05388fbfec4c1262ccdf276ee5fb1e1868087744 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 20 May 2014 20:15:15 +0000
Subject: [PATCH 122/868] New convenience function ldap.dn.is_dn()

---
 CHANGES        |  3 ++-
 Lib/ldap/dn.py | 15 ++++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 83ae5c7..a8c5148 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,7 @@ Released 2.4.16 2014-xx-xx
 Changes since 2.4.16:
 
 Lib/
+* New convenience function ldap.dn.is_dn()
 
 Modules/
 
@@ -1106,4 +1107,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.319 2014/05/20 20:09:03 stroeder Exp $
+$Id: CHANGES,v 1.320 2014/05/20 20:15:15 stroeder Exp $
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index b75a03f..0c5e5ab 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.11 2010/06/03 12:26:39 stroeder Exp $
+\$Id: dn.py,v 1.12 2014/05/20 20:15:15 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -108,3 +108,16 @@ def explode_rdn(rdn,notypes=0,flags=0):
     return [avalue or '' for atype,avalue,dummy in rdn_decomp]
   else:
     return ['='.join((atype,escape_dn_chars(avalue or ''))) for atype,avalue,dummy in rdn_decomp]
+
+
+def is_dn(s):
+  """
+  Returns True is `s' can be parsed by ldap.dn.dn2str() like as a
+  distinguished host_name (DN), otherwise False is returned.
+  """
+  try:
+    dn2str(s)
+  except Exception:
+    return False
+  else:
+    return True

From 2f1f4b8cee85b3a3be9825ff780fcf16943d762f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 20 May 2014 20:27:55 +0000
Subject: [PATCH 123/868] New convenience function ldap.escape_str()

---
 CHANGES               |  3 ++-
 Lib/ldap/__init__.py  |  4 ++--
 Lib/ldap/functions.py | 12 +++++++++++-
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index a8c5148..e1ec92d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,7 @@ Changes since 2.4.16:
 
 Lib/
 * New convenience function ldap.dn.is_dn()
+* New convenience function ldap.escape_str()
 
 Modules/
 
@@ -1107,4 +1108,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.320 2014/05/20 20:15:15 stroeder Exp $
+$Id: CHANGES,v 1.321 2014/05/20 20:27:55 stroeder Exp $
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index fc81a89..b8c9e32 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.90 2014/05/20 20:09:03 stroeder Exp $
+$Id: __init__.py,v 1.91 2014/05/20 20:27:55 stroeder Exp $
 """
 
 # This is also the overall release version number
@@ -82,7 +82,7 @@ def release(self):
 # Create module-wide lock for serializing all calls into underlying LDAP lib
 _ldap_module_lock = LDAPLock(desc='Module wide')
 
-from functions import open,initialize,init,get_option,set_option
+from functions import open,initialize,init,get_option,set_option,escape_string
 
 from ldap.dn import explode_dn,explode_rdn,str2dn,dn2str
 del str2dn
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 03157fe..7599e12 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.28 2011/11/23 17:27:46 stroeder Exp $
+\$Id: functions.py,v 1.29 2014/05/20 20:27:55 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -24,6 +24,7 @@
   'open','initialize','init',
   'explode_dn','explode_rdn',
   'get_option','set_option',
+  'escape_string',
 ]
 
 import sys,pprint,_ldap,ldap
@@ -130,3 +131,12 @@ def set_option(option,invalue):
   Set the value of an LDAP global option.
   """
   return _ldap_function_call(None,_ldap.set_option,option,invalue)
+
+
+def escape_str(escape_func,s,*args):
+  """
+  Applies escape_func() to all items of `args' and returns a string based 
+  on format string `s'.
+  """
+  escape_args = map(escape_func,args)
+  return s % tuple(escape_args)

From 78f49c0d548a663a4d0edd29c40d45907185b6a3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 20 May 2014 20:44:28 +0000
Subject: [PATCH 124/868] New convenience function ldap.escape_str()

---
 Lib/ldap/__init__.py  | 4 ++--
 Lib/ldap/functions.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index b8c9e32..5a69d0d 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.91 2014/05/20 20:27:55 stroeder Exp $
+$Id: __init__.py,v 1.92 2014/05/20 20:44:28 stroeder Exp $
 """
 
 # This is also the overall release version number
@@ -82,7 +82,7 @@ def release(self):
 # Create module-wide lock for serializing all calls into underlying LDAP lib
 _ldap_module_lock = LDAPLock(desc='Module wide')
 
-from functions import open,initialize,init,get_option,set_option,escape_string
+from functions import open,initialize,init,get_option,set_option,escape_str
 
 from ldap.dn import explode_dn,explode_rdn,str2dn,dn2str
 del str2dn
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 7599e12..1a92fbb 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.29 2014/05/20 20:27:55 stroeder Exp $
+\$Id: functions.py,v 1.30 2014/05/20 20:44:28 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -24,7 +24,7 @@
   'open','initialize','init',
   'explode_dn','explode_rdn',
   'get_option','set_option',
-  'escape_string',
+  'escape_str',
 ]
 
 import sys,pprint,_ldap,ldap

From 51480c856a20cc03fa547be320671f6da283a4e0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 25 Jul 2014 16:53:47 +0000
Subject: [PATCH 125/868] Fixed indentation

---
 Demo/pyasn1/syncrepl.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 6481bed..cc9bdea 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -133,10 +133,10 @@ def commenceShutdown(signum, stack):
                        '?(objectClass=*)'\
                        '?bindname=uid=admin%2ccn=users%2cdc=test,'\
                        'X-BINDPW=password\' db.shelve'
-  sys.exit(1)
+    sys.exit(1)
 except ValueError,e:
-  print 'Error parsing command-line arguments:',str(e)
-  sys.exit(1)
+    print 'Error parsing command-line arguments:',str(e)
+    sys.exit(1)
 
 while watcher_running:
     print 'Connecting to LDAP server now...'

From c4e7647c8b76da18f29f3068ba8fa166bf05ab6f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 25 Jul 2014 17:08:56 +0000
Subject: [PATCH 126/868] New convenience methods LDAPObject.read_s() and
 LDAPObject.find_unique_entry()

---
 CHANGES                |  4 ++-
 Lib/ldap/__init__.py   |  4 ++-
 Lib/ldap/ldapobject.py | 62 +++++++++++++++++++++++++++++++++++-------
 3 files changed, 58 insertions(+), 12 deletions(-)

diff --git a/CHANGES b/CHANGES
index e1ec92d..82881ae 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,8 @@ Changes since 2.4.16:
 Lib/
 * New convenience function ldap.dn.is_dn()
 * New convenience function ldap.escape_str()
+* New convenience methods LDAPObject.read_s() and
+  LDAPObject.find_unique_entry()
 
 Modules/
 
@@ -1108,4 +1110,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.321 2014/05/20 20:27:55 stroeder Exp $
+$Id: CHANGES,v 1.322 2014/07/25 17:08:56 stroeder Exp $
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 5a69d0d..e425b1f 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.92 2014/05/20 20:44:28 stroeder Exp $
+$Id: __init__.py,v 1.93 2014/07/25 17:08:56 stroeder Exp $
 """
 
 # This is also the overall release version number
@@ -84,6 +84,8 @@ def release(self):
 
 from functions import open,initialize,init,get_option,set_option,escape_str
 
+from ldapobject import NO_UNIQUE_ENTRY
+
 from ldap.dn import explode_dn,explode_rdn,str2dn,dn2str
 del str2dn
 del dn2str
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 3293ff0..7328006 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.138 2014/02/19 20:05:57 stroeder Exp $
+\$Id: ldapobject.py,v 1.139 2014/07/25 17:08:56 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -41,6 +41,13 @@
 from ldap import LDAPError
 
 
+class NO_UNIQUE_ENTRY(ldap.NO_SUCH_OBJECT):
+  """
+  Exception raised if a LDAP search returned more than entry entry
+  although assumed to return a unique single search result.
+  """
+
+
 class SimpleLDAPObject:
   """
   Drop-in wrapper class around _ldap.LDAPObject
@@ -638,24 +645,59 @@ def search_subschemasubentry_s(self,dn=''):
     except IndexError:
       return None
 
+  def read_s(self,dn,filterstr=None,attrlist=None,serverctrls=None,clientctrls=None,timeout=-1):
+    """
+    Reads and returns a single entry specified by `dn'.
+    
+    Other attributes just like those passed to `search_ext_s()'
+    """
+    r = self.search_ext_s(
+      dn,
+      ldap.SCOPE_BASE,
+      filterstr or '(objectClass=*)',
+      attrlist=attrlist,
+      serverctrls=serverctrls,
+      clientctrls=clientctrls,
+      timeout=timeout,
+    )
+    if r:
+      return r[0][1]
+    else:
+      return ldap.NO_SUCH_OBJECT('Empty search result reading %s' % (repr(dn)))
+
   def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     """
     Returns the sub schema sub entry's data
     """
-    attrs = attrs or SCHEMA_ATTRS
     try:
-      r = self.search_s(
-        subschemasubentry_dn,ldap.SCOPE_BASE,
-        '(objectClass=subschema)',
-        attrs
+      subschemasubentry = self.read_s(
+        subschemasubentry_dn,
+        filterstr='(objectClass=subschema)',
+        attrlist=attrs or SCHEMA_ATTRS
       )
     except ldap.NO_SUCH_OBJECT:
       return None
     else:
-      if r:
-        return r[0][1]
-      else:
-        return None
+      return subschemasubentry
+
+  def find_unique_entry(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1):
+    """
+    Returns a unique entry, raises exception if not unique
+    """
+    r = self.search_ext_s(
+      base,
+      scope,
+      filterstr,
+      attrlist=attrlist or ['*'],
+      attrsonly=attrsonly,
+      serverctrls=serverctrls,
+      clientctrls=clientctrls,
+      timeout=timeout,
+      sizelimit=2,
+    )
+    if len(r)!=1:
+      raise NO_UNIQUE_ENTRY('No or non-unique search result for %s' % (repr(filterstr)))
+    return r[0]
 
 
 class NonblockingLDAPObject(SimpleLDAPObject):

From 7a318bf2b50fa8440d234c31e31aaeb922111379 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 8 Sep 2014 19:48:11 +0000
Subject: [PATCH 127/868] ReconnectLDAPObject.reconnect(): Fixed invoking
 start_tls_s()

---
 CHANGES                | 4 +++-
 Lib/ldap/ldapobject.py | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 82881ae..1ffa6e1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,8 @@ Lib/
 * New convenience function ldap.escape_str()
 * New convenience methods LDAPObject.read_s() and
   LDAPObject.find_unique_entry()
+* Fixed invoking start_tls_s() in ReconnectLDAPObject.reconnect()
+  (thanks to Philipp Hahn)
 
 Modules/
 
@@ -1110,4 +1112,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.322 2014/07/25 17:08:56 stroeder Exp $
+$Id: CHANGES,v 1.323 2014/09/08 19:48:11 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 7328006..c2d4dde 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.139 2014/07/25 17:08:56 stroeder Exp $
+\$Id: ldapobject.py,v 1.140 2014/09/08 19:48:11 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -826,7 +826,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
           self._restore_options()
           # StartTLS extended operation in case this was called before
           if self._start_tls:
-            self.start_tls_s()
+            SimpleLDAPObject.start_tls_s()
           # Repeat last simple or SASL bind
           self._apply_last_bind()
         except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:

From 1de68de7e0a8c40f9429f6a4f4ca54b962e6fe4f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 9 Sep 2014 10:14:47 +0000
Subject: [PATCH 128/868] self

---
 Lib/ldap/ldapobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index c2d4dde..8c6a9a0 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.140 2014/09/08 19:48:11 stroeder Exp $
+\$Id: ldapobject.py,v 1.141 2014/09/09 10:14:47 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -826,7 +826,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
           self._restore_options()
           # StartTLS extended operation in case this was called before
           if self._start_tls:
-            SimpleLDAPObject.start_tls_s()
+            SimpleLDAPObject.start_tls_s(self)
           # Repeat last simple or SASL bind
           self._apply_last_bind()
         except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:

From 0d539658a3f162dd0206599adad860f7fc802df0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 10 Sep 2014 12:16:32 +0000
Subject: [PATCH 129/868] Release 2.4.16 now

---
 CHANGES | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1ffa6e1..99b16f6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,7 +1,7 @@
 ----------------------------------------------------------------
-Released 2.4.16 2014-xx-xx
+Released 2.4.16 2014-09-10
 
-Changes since 2.4.16:
+Changes since 2.4.15:
 
 Lib/
 * New convenience function ldap.dn.is_dn()
@@ -11,8 +11,6 @@ Lib/
 * Fixed invoking start_tls_s() in ReconnectLDAPObject.reconnect()
   (thanks to Philipp Hahn)
 
-Modules/
-
 ----------------------------------------------------------------
 Released 2.4.15 2014-03-24
 
@@ -1112,4 +1110,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.323 2014/09/08 19:48:11 stroeder Exp $
+$Id: CHANGES,v 1.324 2014/09/10 12:16:32 stroeder Exp $

From 315ca29c612afc072f8e28023b279bda5c775b49 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 12 Sep 2014 12:00:08 +0000
Subject: [PATCH 130/868] Started 2.4.17

---
 CHANGES              | 13 ++++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 99b16f6..436b789 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+----------------------------------------------------------------
+Released 2.4.17 2014-xx-xx
+
+Changes since 2.4.16:
+
+Lib/
+* 
+
+Modules/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.16 2014-09-10
 
@@ -1110,4 +1121,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.324 2014/09/10 12:16:32 stroeder Exp $
+$Id: CHANGES,v 1.325 2014/09/12 12:00:08 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index b5c3e04..d0f82d3 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.33 2014/05/20 20:09:03 stroeder Exp $
+$Id: dsml.py,v 1.34 2014/09/12 12:00:09 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.16'
+__version__ = '2.4.17'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index e425b1f..fe4d2ed 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.93 2014/07/25 17:08:56 stroeder Exp $
+$Id: __init__.py,v 1.94 2014/09/12 12:00:09 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.16'
+__version__ = '2.4.17'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index d8e2e5c..1ca288c 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.66 2014/05/20 20:09:03 stroeder Exp $
+\$Id: ldapurl.py,v 1.67 2014/09/12 12:00:09 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.16'
+__version__ = '2.4.17'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index d8c9ddc..78fdb52 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.75 2014/05/20 20:09:03 stroeder Exp $
+$Id: ldif.py,v 1.76 2014/09/12 12:00:09 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.16'
+__version__ = '2.4.17'
 
 __all__ = [
   # constants

From 805824b94e172c41839191b6e27a991fd7885d49 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 12 Sep 2014 12:02:21 +0000
Subject: [PATCH 131/868] Added support for getting file descriptor of
 connection with ldap.OPT_DESC

---
 CHANGES             | 5 +++--
 Modules/constants.c | 3 ++-
 Modules/options.c   | 3 ++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 436b789..442d431 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,7 +7,8 @@ Lib/
 * 
 
 Modules/
-* 
+* Added support for getting file descriptor of connection
+  with ldap.OPT_DESC
 
 ----------------------------------------------------------------
 Released 2.4.16 2014-09-10
@@ -1121,4 +1122,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.325 2014/09/12 12:00:08 stroeder Exp $
+$Id: CHANGES,v 1.326 2014/09/12 12:02:21 stroeder Exp $
diff --git a/Modules/constants.c b/Modules/constants.c
index 458ae09..58a8db5 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -1,6 +1,6 @@
 /* constants defined for LDAP
  * See http://www.python-ldap.org/ for details.
- * $Id: constants.c,v 1.58 2014/03/12 23:02:42 stroeder Exp $ */
+ * $Id: constants.c,v 1.59 2014/09/12 12:02:21 stroeder Exp $ */
 
 #include "common.h"
 #include "constants.h"
@@ -155,6 +155,7 @@ LDAPinit_constants( PyObject* d )
   add_int(d,OPT_API_FEATURE_INFO);
   add_int(d,OPT_HOST_NAME);
 
+  add_int(d,OPT_DESC);
   add_int(d,OPT_DIAGNOSTIC_MESSAGE);
 
   add_int(d,OPT_ERROR_STRING);
diff --git a/Modules/options.c b/Modules/options.c
index 9cad581..f7c97b1 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: options.c,v 1.41 2013/09/11 08:16:27 stroeder Exp $ */
+ * $Id: options.c,v 1.42 2014/09/12 12:02:21 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -236,6 +236,7 @@ LDAP_get_option(LDAPObject *self, int option)
     case LDAP_OPT_PROTOCOL_VERSION:
     case LDAP_OPT_ERROR_NUMBER:
     case LDAP_OPT_DEBUG_LEVEL:
+    case LDAP_OPT_DESC:
 #ifdef HAVE_TLS
     case LDAP_OPT_X_TLS:
     case LDAP_OPT_X_TLS_REQUIRE_CERT:

From 8cc2bc08fdceb57d7ad592767c5bcd1bb005d9dd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 25 Sep 2014 16:31:00 +0000
Subject: [PATCH 132/868] New hook syncrepl_refreshdone() in
 ldap.syncrepl.SyncReplConsumer (thanks to Petr Spacek)

---
 CHANGES                 |  5 +++--
 Demo/pyasn1/syncrepl.py |  7 +++++--
 Lib/ldap/syncrepl.py    | 20 +++++++++++++++++---
 3 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 442d431..494bad5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.17 2014-xx-xx
 Changes since 2.4.16:
 
 Lib/
-* 
+* New hook syncrepl_refreshdone() in ldap.syncrepl.SyncReplConsumer
+  (thanks to Petr Spacek)
 
 Modules/
 * Added support for getting file descriptor of connection
@@ -1122,4 +1123,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.326 2014/09/12 12:02:21 stroeder Exp $
+$Id: CHANGES,v 1.327 2014/09/25 16:31:00 stroeder Exp $
diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index cc9bdea..c1185e6 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -93,6 +93,9 @@ def syncrepl_present(self,uuids,refreshDeletes=False):
             for uuid in uuids:
                     self.__presentUUIDs[uuid] = True
 
+    def syncrepl_refreshdone(self):
+        print 'Initial synchronization is now done, persist phase begins'
+
     def perform_application_sync(self,dn,attributes,previous_attributes):
         print 'Performing application sync for:', dn
         return True
@@ -135,8 +138,8 @@ def commenceShutdown(signum, stack):
                        'X-BINDPW=password\' db.shelve'
     sys.exit(1)
 except ValueError,e:
-    print 'Error parsing command-line arguments:',str(e)
-    sys.exit(1)
+  print 'Error parsing command-line arguments:',str(e)
+  sys.exit(1)
 
 while watcher_running:
     print 'Connecting to LDAP server now...'
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 1d79bef..928aef5 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: syncrepl.py,v 1.3 2012/08/09 07:18:31 stroeder Exp $
+$Id: syncrepl.py,v 1.4 2014/09/25 16:31:00 stroeder Exp $
 """
 
 #__all__ = [
@@ -330,6 +330,11 @@ def syncrepl_search(self, base, scope, mode='refreshOnly', cookie=None, **search
         self.__refreshDone = False
         return self.search_ext(base, scope, **search_args)
 
+    def _syncrepl_update_refreshdone(self, newvalue):
+        callback = newvalue and not self.__refreshDone
+        self.__refreshDone = newvalue
+        if callback:
+            self.syncrepl_refreshdone()
 
     def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
         """
@@ -394,12 +399,12 @@ def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
                         self.syncrepl_present(None, refreshDeletes=False)
                         if 'cookie' in sim.refreshPresent:
                             self.syncrepl_set_cookie(sim.refreshPresent['cookie'])
-                        self.__refreshDone=sim.refreshPresent['refreshDone']
+                        self._syncrepl_update_refreshdone(sim.refreshPresent['refreshDone'])
                     elif sim.refreshDelete is not None:
                         self.syncrepl_present(None, refreshDeletes=True)
                         if 'cookie' in sim.refreshDelete:
                             self.syncrepl_set_cookie(sim.refreshDelete['cookie'])
-                        self.__refreshDone=sim.refreshDelete['refreshDone']
+                        self._syncrepl_update_refreshdone(sim.refreshDelete['refreshDone'])
                     elif sim.syncIdSet is not None:
                         if sim.syncIdSet['refreshDeletes'] is True:
                             self.syncrepl_delete(sim.syncIdSet['syncUUIDs'])
@@ -467,3 +472,12 @@ def syncrepl_entry(self, dn, attrs, uuid):
 
         """
         pass
+
+    def syncrepl_refreshdone(self):
+        """
+        Called by syncrepl_poll() between refresh and persist phase.
+
+        It indicates that initial synchronization is done and persist phase
+        follows.
+        """
+        pass

From 2fb024d0d8516ab235c8aea5983a372e64f47bfb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 26 Sep 2014 12:18:05 +0000
Subject: [PATCH 133/868] Different approach for syncrepl refresh done

---
 CHANGES              |  4 ++--
 Lib/ldap/syncrepl.py | 16 +++++++---------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 494bad5..cedcd07 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,7 +5,7 @@ Changes since 2.4.16:
 
 Lib/
 * New hook syncrepl_refreshdone() in ldap.syncrepl.SyncReplConsumer
-  (thanks to Petr Spacek)
+  (thanks to Petr Spacek and Chris Mikkelson)
 
 Modules/
 * Added support for getting file descriptor of connection
@@ -1123,4 +1123,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.327 2014/09/25 16:31:00 stroeder Exp $
+$Id: CHANGES,v 1.328 2014/09/26 12:18:05 stroeder Exp $
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 928aef5..7067770 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: syncrepl.py,v 1.4 2014/09/25 16:31:00 stroeder Exp $
+$Id: syncrepl.py,v 1.5 2014/09/26 12:18:05 stroeder Exp $
 """
 
 #__all__ = [
@@ -330,12 +330,6 @@ def syncrepl_search(self, base, scope, mode='refreshOnly', cookie=None, **search
         self.__refreshDone = False
         return self.search_ext(base, scope, **search_args)
 
-    def _syncrepl_update_refreshdone(self, newvalue):
-        callback = newvalue and not self.__refreshDone
-        self.__refreshDone = newvalue
-        if callback:
-            self.syncrepl_refreshdone()
-
     def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
         """
         polls for and processes responses to the syncrepl_search() operation.
@@ -399,12 +393,16 @@ def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
                         self.syncrepl_present(None, refreshDeletes=False)
                         if 'cookie' in sim.refreshPresent:
                             self.syncrepl_set_cookie(sim.refreshPresent['cookie'])
-                        self._syncrepl_update_refreshdone(sim.refreshPresent['refreshDone'])
+                        if sim.refreshPresent['refreshDone']:
+                            self.__refreshDone = True
+                            self.syncrepl_refreshdone()
                     elif sim.refreshDelete is not None:
                         self.syncrepl_present(None, refreshDeletes=True)
                         if 'cookie' in sim.refreshDelete:
                             self.syncrepl_set_cookie(sim.refreshDelete['cookie'])
-                        self._syncrepl_update_refreshdone(sim.refreshDelete['refreshDone'])
+                        if sim.refreshDelete['refreshDone']:
+                            self.__refreshDone = True
+                            self.syncrepl_refreshdone()
                     elif sim.syncIdSet is not None:
                         if sim.syncIdSet['refreshDeletes'] is True:
                             self.syncrepl_delete(sim.syncIdSet['syncUUIDs'])

From bc7e8f4b27a7a8d0f9e4b7170964fe3106160b3a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 26 Sep 2014 16:11:43 +0000
Subject: [PATCH 134/868] Note about single syncrepl limitation

---
 Lib/ldap/syncrepl.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 7067770..8426d73 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: syncrepl.py,v 1.5 2014/09/26 12:18:05 stroeder Exp $
+$Id: syncrepl.py,v 1.6 2014/09/26 16:11:43 stroeder Exp $
 """
 
 #__all__ = [
@@ -316,6 +316,10 @@ def syncrepl_search(self, base, scope, mode='refreshOnly', cookie=None, **search
         methods to store the cookie appropriately, rather than
         passing it.
 
+        Only a single syncrepl search may be active on a SyncreplConsumer 
+        object.  Multiple concurrent syncrepl searches require multiple 
+        separate SyncreplConsumer objects and thus multiple connections 
+        (LDAPObject instances).
         """
         if cookie is None:
             cookie = self.syncrepl_get_cookie()

From a6b71d03dacc96a61359ce5f093c6275e1757565 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 27 Sep 2014 09:39:58 +0000
Subject: [PATCH 135/868] Prepare release 2.4.17

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index cedcd07..6b01e7d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.17 2014-xx-xx
+Released 2.4.17 2014-09-27
 
 Changes since 2.4.16:
 
@@ -1123,4 +1123,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.328 2014/09/26 12:18:05 stroeder Exp $
+$Id: CHANGES,v 1.329 2014/09/27 09:39:58 stroeder Exp $

From 70c8d73d46d017a6ff3ac309e791add9bc8a4976 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 27 Sep 2014 10:18:04 +0000
Subject: [PATCH 136/868] Updated copyright and release

---
 Doc/conf.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index e46e992..cbcf361 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.18 2012/08/09 07:19:12 stroeder Exp $
+# $Id: conf.py,v 1.19 2014/09/27 10:18:04 stroeder Exp $
 
 import sys
 
@@ -36,7 +36,7 @@
 
 # General substitutions.
 project = 'python-ldap'
-copyright = '2008-2011, python-ldap project team'
+copyright = '2008-2014, python-ldap project team'
 
 # The default replacements for |version| and |release|, also used in various
 # other places throughout the built documents.
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.10.0'
+release = '2.4.17.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From 64cca81525e5a2215084c26f2bb38adf93371f28 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 8 Oct 2014 17:16:04 +0000
Subject: [PATCH 137/868] Started 2.4.18

---
 CHANGES              | 13 ++++++++++++-
 Doc/conf.py          |  4 ++--
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 6 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6b01e7d..c5586f3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+----------------------------------------------------------------
+Released 2.4.18 2014-xx-xx
+
+Changes since 2.4.17:
+
+Lib/
+* 
+
+Modules/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.17 2014-09-27
 
@@ -1123,4 +1134,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.329 2014/09/27 09:39:58 stroeder Exp $
+$Id: CHANGES,v 1.330 2014/10/08 17:16:04 stroeder Exp $
diff --git a/Doc/conf.py b/Doc/conf.py
index cbcf361..542324e 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.19 2014/09/27 10:18:04 stroeder Exp $
+# $Id: conf.py,v 1.20 2014/10/08 17:16:05 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.17.0'
+release = '2.4.18.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
diff --git a/Lib/dsml.py b/Lib/dsml.py
index d0f82d3..8814315 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.34 2014/09/12 12:00:09 stroeder Exp $
+$Id: dsml.py,v 1.35 2014/10/08 17:16:05 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.17'
+__version__ = '2.4.18'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index fe4d2ed..3dc356d 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.94 2014/09/12 12:00:09 stroeder Exp $
+$Id: __init__.py,v 1.95 2014/10/08 17:16:05 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.17'
+__version__ = '2.4.18'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 1ca288c..8b8a917 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.67 2014/09/12 12:00:09 stroeder Exp $
+\$Id: ldapurl.py,v 1.68 2014/10/08 17:16:05 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.17'
+__version__ = '2.4.18'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 78fdb52..92323dd 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.76 2014/09/12 12:00:09 stroeder Exp $
+$Id: ldif.py,v 1.77 2014/10/08 17:16:05 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.17'
+__version__ = '2.4.18'
 
 __all__ = [
   # constants

From 2983bffa7e8651b0e88a8b469666c147688319a8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 8 Oct 2014 17:27:06 +0000
Subject: [PATCH 138/868] Fixed raising exception in LDAPObject.read_s() when
 reading an entry returns empty search result

---
 CHANGES                | 5 +++--
 Lib/ldap/ldapobject.py | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index c5586f3..b2ded09 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.18 2014-xx-xx
 Changes since 2.4.17:
 
 Lib/
-* 
+* Fixed raising exception in LDAPObject.read_s() when reading
+  an entry returns empty search result
 
 Modules/
 * 
@@ -1134,4 +1135,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.330 2014/10/08 17:16:04 stroeder Exp $
+$Id: CHANGES,v 1.331 2014/10/08 17:27:06 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 8c6a9a0..492a90f 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.141 2014/09/09 10:14:47 stroeder Exp $
+\$Id: ldapobject.py,v 1.142 2014/10/08 17:27:06 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -663,7 +663,7 @@ def read_s(self,dn,filterstr=None,attrlist=None,serverctrls=None,clientctrls=Non
     if r:
       return r[0][1]
     else:
-      return ldap.NO_SUCH_OBJECT('Empty search result reading %s' % (repr(dn)))
+      raise ldap.NO_SUCH_OBJECT('Empty search result reading entry %s' % (repr(dn)))
 
   def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     """

From 731f0d7e559e5b6143647dc6fe0f3e8a364a109f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 9 Oct 2014 08:22:13 +0000
Subject: [PATCH 139/868] Release 2.4.18 now

---
 CHANGES | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index b2ded09..71e1322 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.18 2014-xx-xx
+Released 2.4.18 2014-10-09
 
 Changes since 2.4.17:
 
@@ -7,9 +7,6 @@ Lib/
 * Fixed raising exception in LDAPObject.read_s() when reading
   an entry returns empty search result
 
-Modules/
-* 
-
 ----------------------------------------------------------------
 Released 2.4.17 2014-09-27
 
@@ -1135,4 +1132,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.331 2014/10/08 17:27:06 stroeder Exp $
+$Id: CHANGES,v 1.332 2014/10/09 08:22:13 stroeder Exp $

From 66683502dc7c3f9c947b47fcb9f5fd8c20f449e5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 18 Nov 2014 08:27:22 +0000
Subject: [PATCH 140/868] Updated python-ldap homepage URL

---
 Build/build-openbsd/Makefile | 4 ++--
 Demo/resiter.py              | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Build/build-openbsd/Makefile b/Build/build-openbsd/Makefile
index fac650f..3636b95 100644
--- a/Build/build-openbsd/Makefile
+++ b/Build/build-openbsd/Makefile
@@ -1,4 +1,4 @@
-# $Id: Makefile,v 1.3 2000/08/20 15:04:23 leonard Exp $
+# $Id: Makefile,v 1.4 2014/11/18 08:27:23 stroeder Exp $
 
 WRKDIST=		${.CURDIR}/../..
 VERSION!=		sh ${WRKDIST}/Build/version.sh
@@ -7,7 +7,7 @@ PKGNAME=		python-ldap-${VERSION}
 RUN_DEPENDS=		python:lang/python
 CATEGORIES=		misc
 MAINATINER=		leonard@users.sourceforge.net
-HOMEPAGE=		http://python-ldap.sourceforge.net/
+HOMEPAGE=		http://www.python-ldap.org/
 
 FAKE=			Yes
 CONFIGURE_STYLE=	gnu
diff --git a/Demo/resiter.py b/Demo/resiter.py
index 4b49fae..9577d2c 100644
--- a/Demo/resiter.py
+++ b/Demo/resiter.py
@@ -2,9 +2,9 @@
 Demo for using ldap.resiter.ResultProcessor
 written by Michael Stroeder <michael@stroeder.com>
 
-See http://python-ldap.sourceforge.net for details.
+See http://www.python-ldap.org for details.
 
-\$Id: resiter.py,v 1.1 2005/11/07 11:24:25 stroeder Exp $
+\$Id: resiter.py,v 1.2 2014/11/18 08:27:22 stroeder Exp $
 
 Python compability note:
 Requires Python 2.3+

From dddd890954b3feb25aa29a579690f427fd67c79d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 18 Nov 2014 08:28:48 +0000
Subject: [PATCH 141/868] FWIW corrected typo in
 MAINTAINER=leonard@users.sourceforge.net

---
 Build/build-openbsd/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Build/build-openbsd/Makefile b/Build/build-openbsd/Makefile
index 3636b95..6808edc 100644
--- a/Build/build-openbsd/Makefile
+++ b/Build/build-openbsd/Makefile
@@ -1,4 +1,4 @@
-# $Id: Makefile,v 1.4 2014/11/18 08:27:23 stroeder Exp $
+# $Id: Makefile,v 1.5 2014/11/18 08:28:48 stroeder Exp $
 
 WRKDIST=		${.CURDIR}/../..
 VERSION!=		sh ${WRKDIST}/Build/version.sh
@@ -6,7 +6,7 @@ VERSION!=		sh ${WRKDIST}/Build/version.sh
 PKGNAME=		python-ldap-${VERSION}
 RUN_DEPENDS=		python:lang/python
 CATEGORIES=		misc
-MAINATINER=		leonard@users.sourceforge.net
+MAINTAINER=		leonard@users.sourceforge.net
 HOMEPAGE=		http://www.python-ldap.org/
 
 FAKE=			Yes

From 5a68a893a0cf9f9e330e0f06f9b08a4b8dc071cf Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 23 Nov 2014 18:49:13 +0000
Subject: [PATCH 142/868] Started 2.4.19

---
 CHANGES | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 71e1322..7a0b10b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.19 2014-xx-xx
+
+Changes since 2.4.18:
+
+Lib/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.18 2014-10-09
 
@@ -1132,4 +1140,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.332 2014/10/09 08:22:13 stroeder Exp $
+$Id: CHANGES,v 1.333 2014/11/23 18:49:13 stroeder Exp $

From 172da4def4e1fe9aa64a818375280f45f246a71f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 23 Nov 2014 18:51:53 +0000
Subject: [PATCH 143/868] SF#64: Fixed missing
 ReconnectLDAPObject._reconnect_lock when pickling

---
 CHANGES                | 5 +++--
 Lib/ldap/ldapobject.py | 4 +++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7a0b10b..0046ea0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.19 2014-xx-xx
 Changes since 2.4.18:
 
 Lib/
-* 
+* Fixed missing ReconnectLDAPObject._reconnect_lock when pickling
+  (see SF#64, thanks to Dan O'Reilly)
 
 ----------------------------------------------------------------
 Released 2.4.18 2014-10-09
@@ -1140,4 +1141,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.333 2014/11/23 18:49:13 stroeder Exp $
+$Id: CHANGES,v 1.334 2014/11/23 18:51:53 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 492a90f..97deccf 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.142 2014/10/08 17:27:06 stroeder Exp $
+\$Id: ldapobject.py,v 1.143 2014/11/23 18:51:53 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -751,6 +751,7 @@ class ReconnectLDAPObject(SimpleLDAPObject):
     '_l':None,
     '_ldap_object_lock':None,
     '_trace_file':None,
+    '_reconnect_lock':None,
   }
 
   def __init__(
@@ -789,6 +790,7 @@ def __setstate__(self,d):
     """set up the object from pickled data"""
     self.__dict__.update(d)
     self._ldap_object_lock = self._ldap_lock()
+    self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
     self._trace_file = sys.stdout
     self.reconnect(self._uri)
 

From 684e3cbdf14774a7c7fae3f35fd0e3fc2302dea3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 12 Dec 2014 09:59:40 +0000
Subject: [PATCH 144/868] Added sub-module ldap.controls.pagedresults

---
 CHANGES                           |  4 ++-
 Lib/ldap/controls/pagedresults.py | 53 +++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 Lib/ldap/controls/pagedresults.py

diff --git a/CHANGES b/CHANGES
index 0046ea0..0678ecb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,8 @@ Changes since 2.4.18:
 Lib/
 * Fixed missing ReconnectLDAPObject._reconnect_lock when pickling
   (see SF#64, thanks to Dan O'Reilly)
+* Added ldap.controls.pagedresults which as pure Python implementation of 
+  Simple Paged Results Control (see RFC 2696)
 
 ----------------------------------------------------------------
 Released 2.4.18 2014-10-09
@@ -1141,4 +1143,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.334 2014/11/23 18:51:53 stroeder Exp $
+$Id: CHANGES,v 1.335 2014/12/12 09:59:40 stroeder Exp $
diff --git a/Lib/ldap/controls/pagedresults.py b/Lib/ldap/controls/pagedresults.py
new file mode 100644
index 0000000..f5848d0
--- /dev/null
+++ b/Lib/ldap/controls/pagedresults.py
@@ -0,0 +1,53 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.paged - classes for Simple Paged control
+(see RFC 2696)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: pagedresults.py,v 1.1 2014/12/12 09:59:40 stroeder Exp $
+"""
+
+__all__ = [
+  'SimplePagedResultsControl'
+]
+
+# Imports from python-ldap 2.4+
+import ldap.controls
+from ldap.controls import RequestControl,ResponseControl,KNOWN_RESPONSE_CONTROLS
+
+# Imports from pyasn1
+from pyasn1.type import tag,namedtype,univ,constraint
+from pyasn1.codec.ber import encoder,decoder
+from pyasn1_modules.rfc2251 import LDAPString
+
+
+class PagedResultsControlValue(univ.Sequence):
+  componentType = namedtype.NamedTypes(
+    namedtype.NamedType('size',univ.Integer()),
+    namedtype.NamedType('cookie',LDAPString()),
+  )
+
+
+class SimplePagedResultsControl(RequestControl,ResponseControl):
+  controlType = '1.2.840.113556.1.4.319'
+
+  def __init__(self,criticality=False,size=10,cookie=''):
+    self.criticality = criticality
+    self.size = size
+    self.cookie = cookie or ''
+
+  def encodeControlValue(self):
+    pc = PagedResultsControlValue()
+    pc.setComponentByName('size',univ.Integer(self.size))
+    pc.setComponentByName('cookie',LDAPString(self.cookie))
+    return encoder.encode(pc)
+
+  def decodeControlValue(self,encodedControlValue):
+    print '***',self.__class__.__module__,self.__class__.__name__
+    decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=PagedResultsControlValue())
+    self.size = int(decodedValue.getComponentByName('size'))
+    self.cookie = str(decodedValue.getComponentByName('cookie'))
+
+
+KNOWN_RESPONSE_CONTROLS[SimplePagedResultsControl.controlType] = SimplePagedResultsControl

From 76c05ccc561716ccec0ec1e4c96d1ba275461138 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 12 Dec 2014 10:10:23 +0000
Subject: [PATCH 145/868] Removed debug print statement

---
 Lib/ldap/controls/pagedresults.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/pagedresults.py b/Lib/ldap/controls/pagedresults.py
index f5848d0..54c0ddf 100644
--- a/Lib/ldap/controls/pagedresults.py
+++ b/Lib/ldap/controls/pagedresults.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: pagedresults.py,v 1.1 2014/12/12 09:59:40 stroeder Exp $
+$Id: pagedresults.py,v 1.2 2014/12/12 10:10:23 stroeder Exp $
 """
 
 __all__ = [
@@ -44,7 +44,6 @@ def encodeControlValue(self):
     return encoder.encode(pc)
 
   def decodeControlValue(self,encodedControlValue):
-    print '***',self.__class__.__module__,self.__class__.__name__
     decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=PagedResultsControlValue())
     self.size = int(decodedValue.getComponentByName('size'))
     self.cookie = str(decodedValue.getComponentByName('cookie'))

From 8014f4c02f424122de01acda1b9c7baa4cb44cb7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 12 Dec 2014 10:32:47 +0000
Subject: [PATCH 146/868] More flexible vars

---
 Demo/page_control.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/Demo/page_control.py b/Demo/page_control.py
index 9d1a0e2..7cc6253 100644
--- a/Demo/page_control.py
+++ b/Demo/page_control.py
@@ -1,18 +1,24 @@
-url = "ldap://localhost:1390/"
+# -*- coding: utf-8 -*-
+
+url = "ldap://localhost:1390"
 base = "dc=stroeder,dc=de"
 search_flt = r'(objectClass=*)'
 page_size = 10
+binddn = ''
+bindpw = ''
+trace_level = 0
 
 import ldap,pprint
-from ldap.controls import SimplePagedResultsControl
+#from ldap.controls.libldap import SimplePagedResultsControl
+from ldap.controls.pagedresults import SimplePagedResultsControl
 
 searchreq_attrlist=['cn','entryDN','entryUUID','mail','objectClass']
 
 #ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
 ldap.set_option(ldap.OPT_REFERRALS, 0)
-l = ldap.initialize(url,trace_level=1)
+l = ldap.initialize(url,trace_level=trace_level)
 l.protocol_version = 3
-l.simple_bind_s("", "")
+l.simple_bind_s(binddn,bindpw)
 
 req_ctrl = SimplePagedResultsControl(True,size=page_size,cookie='')
 
@@ -32,11 +38,12 @@
 pages = 0
 while True:
     pages += 1
+    print '-'*60
     print "Getting page %d" % (pages)
     rtype, rdata, rmsgid, serverctrls = l.result3(msgid,resp_ctrl_classes=known_ldap_resp_ctrls)
     print '%d results' % len(rdata)
     print 'serverctrls=',pprint.pprint(serverctrls)
-#    pprint.pprint(rdata)
+    print 'rdata=',pprint.pprint(rdata)
     pctrls = [
       c
       for c in serverctrls

From d1b868809a6a626e0301cbf577a056801db2ff1e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 12 Dec 2014 10:34:20 +0000
Subject: [PATCH 147/868] Preferrably import from ldap.controls.pagedresults

---
 Demo/page_control.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Demo/page_control.py b/Demo/page_control.py
index 7cc6253..0fc904b 100644
--- a/Demo/page_control.py
+++ b/Demo/page_control.py
@@ -9,8 +9,11 @@
 trace_level = 0
 
 import ldap,pprint
-#from ldap.controls.libldap import SimplePagedResultsControl
-from ldap.controls.pagedresults import SimplePagedResultsControl
+
+try:
+  from ldap.controls.pagedresults import SimplePagedResultsControl
+except ImportError:
+  from ldap.controls.libldap import SimplePagedResultsControl
 
 searchreq_attrlist=['cn','entryDN','entryUUID','mail','objectClass']
 

From 4f227d9ab229950476a361ff0a9ec8508aa53e44 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 9 Jan 2015 23:27:39 +0000
Subject: [PATCH 148/868] typo

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 0678ecb..2830b75 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,7 +6,7 @@ Changes since 2.4.18:
 Lib/
 * Fixed missing ReconnectLDAPObject._reconnect_lock when pickling
   (see SF#64, thanks to Dan O'Reilly)
-* Added ldap.controls.pagedresults which as pure Python implementation of 
+* Added ldap.controls.pagedresults which is pure Python implementation of 
   Simple Paged Results Control (see RFC 2696)
 
 ----------------------------------------------------------------
@@ -1143,4 +1143,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.335 2014/12/12 09:59:40 stroeder Exp $
+$Id: CHANGES,v 1.336 2015/01/09 23:27:39 stroeder Exp $

From 0b441ce2bc314ae907257abe87de17c325e283a6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 10 Jan 2015 10:27:32 +0000
Subject: [PATCH 149/868] Mention reason for ldap.controls.pagedresults

---
 CHANGES | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2830b75..3d7473a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,7 +7,8 @@ Lib/
 * Fixed missing ReconnectLDAPObject._reconnect_lock when pickling
   (see SF#64, thanks to Dan O'Reilly)
 * Added ldap.controls.pagedresults which is pure Python implementation of 
-  Simple Paged Results Control (see RFC 2696)
+  Simple Paged Results Control (see RFC 2696) and delivers the correct 
+  result size
 
 ----------------------------------------------------------------
 Released 2.4.18 2014-10-09
@@ -1143,4 +1144,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.336 2015/01/09 23:27:39 stroeder Exp $
+$Id: CHANGES,v 1.337 2015/01/10 10:27:32 stroeder Exp $

From ce6c7b9b821b3ca89eccb748725112b26d59279c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 10 Jan 2015 16:58:52 +0000
Subject: [PATCH 150/868] Extract response controls in SASL bind responses

---
 TODO | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/TODO b/TODO
index d205eb7..fdee89e 100644
--- a/TODO
+++ b/TODO
@@ -9,6 +9,7 @@ Modules/
   - VLV control
   - server-side sorting control
 - Wrap libldif as faster drop-in replacement for module ldif?
+- Extract response controls in SASL bind responses
 - Attach response controls to LDAPError instances to deliver the
   controls to the calling application in case of an error
 - Attach more useful information to LDAPError instances, e.g. the filter used
@@ -27,4 +28,4 @@ Tests/
   holding the BLITS test data set
 
 ------------------------------------------------------------------
-$Id: TODO,v 1.38 2012/01/25 19:24:40 stroeder Exp $
+$Id: TODO,v 1.39 2015/01/10 16:58:52 stroeder Exp $

From 992d62cb6003da8d9663a697a8345ee34d398633 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 10 Jan 2015 17:08:52 +0000
Subject: [PATCH 151/868] prepare release 2.4.19

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 3d7473a..beb007b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.19 2014-xx-xx
+Released 2.4.19 2015-01-10
 
 Changes since 2.4.18:
 
@@ -1144,4 +1144,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.337 2015/01/10 10:27:32 stroeder Exp $
+$Id: CHANGES,v 1.338 2015/01/10 17:08:52 stroeder Exp $

From a774319c3a5fa444b3e67b30b4efb79f012647a0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 10 Jan 2015 17:18:13 +0000
Subject: [PATCH 152/868] Bump up version to 2.4.19

---
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/dsml.py b/Lib/dsml.py
index 8814315..d539d34 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.35 2014/10/08 17:16:05 stroeder Exp $
+$Id: dsml.py,v 1.36 2015/01/10 17:18:13 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.18'
+__version__ = '2.4.19'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 3dc356d..a5e1287 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.95 2014/10/08 17:16:05 stroeder Exp $
+$Id: __init__.py,v 1.96 2015/01/10 17:18:13 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.18'
+__version__ = '2.4.19'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 8b8a917..4b858ed 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.68 2014/10/08 17:16:05 stroeder Exp $
+\$Id: ldapurl.py,v 1.69 2015/01/10 17:18:13 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.18'
+__version__ = '2.4.19'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 92323dd..012e908 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.77 2014/10/08 17:16:05 stroeder Exp $
+$Id: ldif.py,v 1.78 2015/01/10 17:18:13 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.18'
+__version__ = '2.4.19'
 
 __all__ = [
   # constants

From 136ddaf102dcb5a61bc81fcc944f0bbb7aa88256 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 2 May 2015 16:19:23 +0000
Subject: [PATCH 153/868] New wrapping of OpenLDAP's function
 ldap_sasl_bind_s()

---
 CHANGES                | 10 +++++++-
 Lib/ldap/ldapobject.py | 21 +++++++++++++++-
 Modules/LDAPObject.c   | 56 +++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index beb007b..f9366df 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.20 2015-05-xx
+
+Changes since 2.4.19:
+
+* New wrapping of OpenLDAP's function ldap_sasl_bind_s() allows
+  to intercept the SASL handshake (thanks to René Kijewski)
+
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
 
@@ -1144,4 +1152,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.338 2015/01/10 17:08:52 stroeder Exp $
+$Id: CHANGES,v 1.339 2015/05/02 16:19:23 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 97deccf..7e2878f 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.143 2014/11/23 18:51:53 stroeder Exp $
+\$Id: ldapobject.py,v 1.144 2015/05/02 16:19:23 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -136,6 +136,14 @@ def __getattr__(self,name):
         self.__class__.__name__,repr(name)
       )
 
+  def fileno():
+    """
+    Returns file description of LDAP connection.
+    
+    Just a convenience wrapper for LDAPObject.get_option(ldap.OPT_DESC)
+    """
+    return self.get_option(ldap.OPT_DESC)
+
   def abandon_ext(self,msgid,serverctrls=None,clientctrls=None):
     """
     abandon_ext(msgid[,serverctrls=None[,clientctrls=None]]) -> None
@@ -235,6 +243,12 @@ def sasl_interactive_bind_s(self,who,auth,serverctrls=None,clientctrls=None,sasl
     """
     return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
 
+  def sasl_bind_s(self,dn,mechanism,cred,serverctrls=None,clientctrls=None):
+    """
+    sasl_bind_s(dn, mechanism, cred [,serverctrls=None[,clientctrls=None]]) -> int|str
+    """
+    return self._ldap_call(self._l.sasl_bind_s,dn,mechanism,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+
   def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
     """
     compare_ext(dn, attr, value [,serverctrls=None[,clientctrls=None]]) -> int
@@ -895,6 +909,11 @@ def sasl_interactive_bind_s(self,*args,**kwargs):
     self._store_last_bind(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
     return res
 
+  def sasl_bind_s(self,dn,mechanism,cred,serverctrls=None,clientctrls=None):
+    res = self._apply_method_s(SimpleLDAPObject.sasl_bind_s,*args,**kwargs)
+    self._store_last_bind(SimpleLDAPObject.sasl_bind_s,*args,**kwargs)
+    return res
+
   def add_ext_s(self,*args,**kwargs):
     return self._apply_method_s(SimpleLDAPObject.add_ext_s,*args,**kwargs)
 
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 1b2326a..eddd7e1 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.90 2011/04/11 11:29:59 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.91 2015/05/02 16:19:23 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -616,6 +616,59 @@ int py_ldap_sasl_interaction(   LDAP *ld,
   return LDAP_SUCCESS;
 }
 
+static PyObject*
+l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
+{
+    const char *dn;
+    const char *mechanism;
+    struct berval cred;
+    Py_ssize_t cred_len;
+
+    PyObject *serverctrls = Py_None;
+    PyObject *clientctrls = Py_None;
+    LDAPControl** server_ldcs = NULL;
+    LDAPControl** client_ldcs = NULL;
+
+    struct berval *servercred;
+    int ldaperror;
+
+    if (!PyArg_ParseTuple(args, "zzz#OO", &dn, &mechanism, &cred.bv_val, &cred_len, &serverctrls, &clientctrls ))
+        return NULL;
+
+    if (not_valid(self)) return NULL;
+
+    cred.bv_len = cred_len;
+
+    if (!PyNone_Check(serverctrls)) {
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+            return NULL;
+    }
+    if (!PyNone_Check(clientctrls)) {
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+            return NULL;
+    }
+
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_sasl_bind_s(self->ldap,
+                                 dn,
+                                 mechanism,
+                                 cred.bv_val ? &cred : NULL,
+                                 (LDAPControl**) server_ldcs, 
+                                 (LDAPControl**) client_ldcs,
+                                 &servercred);
+    LDAP_END_ALLOW_THREADS( self );
+
+    LDAPControl_List_DEL( server_ldcs );
+    LDAPControl_List_DEL( client_ldcs );
+
+    if (ldaperror == LDAP_SASL_BIND_IN_PROGRESS) {
+        if (servercred && servercred->bv_val && *servercred->bv_val)
+            return PyString_FromStringAndSize( servercred->bv_val, servercred->bv_len );
+    } else if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror( self->ldap, "l_ldap_sasl_bind_s" );
+    return PyInt_FromLong( ldaperror );
+}
+
 static PyObject* 
 l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
 {
@@ -1317,6 +1370,7 @@ static PyMethodDef methods[] = {
     {"simple_bind",     (PyCFunction)l_ldap_simple_bind,        METH_VARARGS },
 #ifdef HAVE_SASL
     {"sasl_interactive_bind_s", (PyCFunction)l_ldap_sasl_interactive_bind_s,    METH_VARARGS },
+    {"sasl_bind_s", (PyCFunction)l_ldap_sasl_bind_s,    METH_VARARGS },
 #endif
     {"compare_ext",     (PyCFunction)l_ldap_compare_ext,        METH_VARARGS },
     {"delete_ext",      (PyCFunction)l_ldap_delete_ext,         METH_VARARGS },

From d071d81f364b8df2e1c65119958d88a30b156b21 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Jun 2015 20:49:04 +0000
Subject: [PATCH 154/868] Added serverctrls and clientctrls arguments to
 LDAPObject.simple_bind() etc.

---
 Doc/ldap.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 5226c32..ef870bd 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.27 2012/01/10 23:28:08 stroeder Exp $
+.. % $Id: ldap.rst,v 1.28 2015/06/05 20:49:04 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -649,9 +649,9 @@ and wait for and return with the server's result, or with
 
 .. py:method:: LDAPObject.bind_s(who, cred, method) -> None
 
-.. py:method:: LDAPObject.simple_bind([who='' [, cred='']]) -> int
+.. py:method:: LDAPObject.simple_bind([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> int
 
-.. py:method:: LDAPObject.simple_bind_s([who='' [, cred='']]) -> None
+.. py:method:: LDAPObject.simple_bind_s([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> None
 
    After an LDAP object is created, and before any other operations can be
    attempted over the connection, a bind operation must be performed.

From a4c34000a83a0cccd6d74a1fd719777b8ee445cb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Jun 2015 20:55:05 +0000
Subject: [PATCH 155/868] Abandoned old syntax when raising ValueError in
 module ldif and more information in some exceptions.

---
 CHANGES     |  6 +++++-
 Lib/ldif.py | 18 +++++++++---------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index f9366df..0a004b5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,10 @@ Changes since 2.4.19:
 * New wrapping of OpenLDAP's function ldap_sasl_bind_s() allows
   to intercept the SASL handshake (thanks to René Kijewski)
 
+Lib/
+* Abandoned old syntax when raising ValueError in module ldif and
+  some more information in exceptions.
+
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
 
@@ -1152,4 +1156,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.339 2015/05/02 16:19:23 stroeder Exp $
+$Id: CHANGES,v 1.340 2015/06/05 20:55:05 stroeder Exp $
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 012e908..9ea1139 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.78 2015/01/10 17:18:13 stroeder Exp $
+$Id: ldif.py,v 1.79 2015/06/05 20:55:06 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -165,7 +165,7 @@ def _unparseChangeRecord(self,modlist):
     elif mod_len==3:
       changetype = 'modify'
     else:
-      raise ValueError,"modlist item of wrong length"
+      raise ValueError("modlist item of wrong length: %d" % (mod_len))
     self._unparseAttrTypeandValue('changetype',changetype)
     for mod in modlist:
       if mod_len==2:
@@ -174,7 +174,7 @@ def _unparseChangeRecord(self,modlist):
         mod_op,mod_type,mod_vals = mod
         self._unparseAttrTypeandValue(MOD_OP_STR[mod_op],mod_type)
       else:
-        raise ValueError,"Subsequent modlist item of wrong length"
+        raise ValueError("Subsequent modlist item of wrong length")
       if mod_vals:
         for mod_val in mod_vals:
           self._unparseAttrTypeandValue(mod_type,mod_val)
@@ -197,7 +197,7 @@ def unparse(self,dn,record):
     elif isinstance(record,types.ListType):
       self._unparseChangeRecord(record)
     else:
-      raise ValueError, "Argument record must be dictionary or list"
+      raise ValueError('Argument record must be dictionary or list instead of %s' % (repr(record)))
     # Write empty line separating the records
     self._output_file.write(self._line_sep)
     # Count records written
@@ -354,20 +354,20 @@ def parse(self):
         if attr_type=='dn':
           # attr type and value pair was DN of LDIF record
           if dn!=None:
-            raise ValueError, 'Two lines starting with dn: in one record.'
+            raise ValueError('Two lines starting with dn: in one record.')
           if not is_dn(attr_value):
-            raise ValueError, 'No valid string-representation of distinguished name %s.' % (repr(attr_value))
+            raise ValueError('No valid string-representation of distinguished name %s.' % (repr(attr_value)))
           dn = attr_value
         elif attr_type=='version' and dn is None:
           version = 1
         elif attr_type=='changetype':
           # attr type and value pair was DN of LDIF record
           if dn is None:
-            raise ValueError, 'Read changetype: before getting valid dn: line.'
+            raise ValueError('Read changetype: before getting valid dn: line.')
           if changetype!=None:
-            raise ValueError, 'Two lines starting with changetype: in one record.'
+            raise ValueError('Two lines starting with changetype: in one record.')
           if not valid_changetype_dict.has_key(attr_value):
-            raise ValueError, 'changetype value %s is invalid.' % (repr(attr_value))
+            raise ValueError('changetype value %s is invalid.' % (repr(attr_value)))
           changetype = attr_value
         elif attr_value!=None and \
              not self._ignored_attr_types.has_key(attr_type.lower()):

From 92ca8873580c538e5e271e5bef64d72eb1e36384 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Jun 2015 20:56:00 +0000
Subject: [PATCH 156/868] Wording

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 0a004b5..5d51572 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,7 +8,7 @@ Changes since 2.4.19:
 
 Lib/
 * Abandoned old syntax when raising ValueError in module ldif and
-  some more information in exceptions.
+  more information in some exceptions.
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1156,4 +1156,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.340 2015/06/05 20:55:05 stroeder Exp $
+$Id: CHANGES,v 1.341 2015/06/05 20:56:00 stroeder Exp $

From 62219a2d37f54d754003f857b457246d581d59b1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Jun 2015 21:03:06 +0000
Subject: [PATCH 157/868] Abandoned old syntax when raising exceptions in
 module ldapurl and more information in some exceptions.

---
 CHANGES        |  6 +++---
 Lib/ldapurl.py | 14 +++++++-------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5d51572..4b8b91d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,8 +7,8 @@ Changes since 2.4.19:
   to intercept the SASL handshake (thanks to René Kijewski)
 
 Lib/
-* Abandoned old syntax when raising ValueError in module ldif and
-  more information in some exceptions.
+* Abandoned old syntax when raising ValueError in modules ldif and
+  ldapurl, more information in some exceptions.
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1156,4 +1156,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.341 2015/06/05 20:56:00 stroeder Exp $
+$Id: CHANGES,v 1.342 2015/06/05 21:03:06 stroeder Exp $
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 4b858ed..7ebd4ba 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.69 2015/01/10 17:18:13 stroeder Exp $
+\$Id: ldapurl.py,v 1.70 2015/06/05 21:03:06 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -258,11 +258,11 @@ def _parse(self,ldap_url):
     urlscheme,host,dn,attrs,scope,filterstr,extensions
     """
     if not isLDAPUrl(ldap_url):
-      raise ValueError,'Parameter ldap_url does not seem to be a LDAP URL.'
+      raise ValueError('Value %s for ldap_url does not seem to be a LDAP URL.' % (repr(ldap_url)))
     scheme,rest = ldap_url.split('://',1)
     self.urlscheme = scheme.strip()
     if not self.urlscheme in ['ldap','ldaps','ldapi']:
-      raise ValueError,'LDAP URL contains unsupported URL scheme %s.' % (self.urlscheme)
+      raise ValueError('LDAP URL contains unsupported URL scheme %s.' % (self.urlscheme))
     slash_pos = rest.find('/')
     qemark_pos = rest.find('?')
     if (slash_pos==-1) and (qemark_pos==-1):
@@ -282,7 +282,7 @@ def _parse(self,ldap_url):
         # Do not eat question mark
         rest = rest[qemark_pos:]
       else:
-        raise ValueError,'Something completely weird happened!'
+        raise ValueError('Something completely weird happened!')
     paramlist=rest.split('?',4)
     paramlist_len = len(paramlist)
     if paramlist_len>=1:
@@ -294,7 +294,7 @@ def _parse(self,ldap_url):
       try:
         self.scope = SEARCH_SCOPE[scope]
       except KeyError:
-        raise ValueError,"Search scope must be either one of base, one or sub. LDAP URL contained %s" % (repr(scope))
+        raise ValueError('Invalid search scope %s' % (repr(scope)))
     if paramlist_len>=4:
       filterstr = paramlist[3].strip()
       if not filterstr:
@@ -404,9 +404,9 @@ def __getattr__(self,name):
       else:
         return None
     else:
-      raise AttributeError,"%s has no attribute %s" % (
+      raise AttributeError('%s has no attribute %s' % (
         self.__class__.__name__,name
-      )
+      ))
     return result # __getattr__()
 
   def __setattr__(self,name,value):

From 036700dadeac91bfb58af3e8f8430d86172ba84c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Jun 2015 21:04:58 +0000
Subject: [PATCH 158/868] Bump up version to 2.4.20

---
 Doc/conf.py          | 4 ++--
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 542324e..32babb6 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.20 2014/10/08 17:16:05 stroeder Exp $
+# $Id: conf.py,v 1.21 2015/06/05 21:05:37 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.18.0'
+release = '2.4.20.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
diff --git a/Lib/dsml.py b/Lib/dsml.py
index d539d34..1cc3b2f 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.36 2015/01/10 17:18:13 stroeder Exp $
+$Id: dsml.py,v 1.37 2015/06/05 21:04:58 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.19'
+__version__ = '2.4.20'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index a5e1287..466ec0d 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.96 2015/01/10 17:18:13 stroeder Exp $
+$Id: __init__.py,v 1.97 2015/06/05 21:04:58 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.19'
+__version__ = '2.4.20'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7ebd4ba..0345221 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.70 2015/06/05 21:03:06 stroeder Exp $
+\$Id: ldapurl.py,v 1.71 2015/06/05 21:04:58 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.19'
+__version__ = '2.4.20'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 9ea1139..bc47040 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.79 2015/06/05 20:55:06 stroeder Exp $
+$Id: ldif.py,v 1.80 2015/06/05 21:04:58 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.19'
+__version__ = '2.4.20'
 
 __all__ = [
   # constants

From 7248568cb3a89eb4f9e701df9e48244c33026def Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 6 Jun 2015 09:21:37 +0000
Subject: [PATCH 159/868] Stripped trailing white-spaces

---
 Lib/ldap/async.py             |  4 ++--
 Lib/ldap/controls/__init__.py |  4 ++--
 Lib/ldap/controls/libldap.py  | 10 +++++-----
 Lib/ldap/controls/ppolicy.py  |  4 ++--
 Lib/ldap/controls/simple.py   | 12 ++++++------
 Lib/ldap/dn.py                | 10 +++++-----
 Lib/ldap/filter.py            |  6 +++---
 Lib/ldap/functions.py         |  4 ++--
 Lib/ldap/ldapobject.py        |  6 +++---
 Lib/ldap/logger.py            |  2 +-
 Lib/ldap/sasl.py              |  6 +++---
 Lib/ldap/schema/models.py     | 28 ++++++++++++++--------------
 Lib/ldap/schema/subentry.py   |  4 ++--
 Lib/ldap/syncrepl.py          |  8 ++++----
 Lib/ldapurl.py                | 12 ++++++------
 15 files changed, 60 insertions(+), 60 deletions(-)

diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 97ec14b..680cdc9 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: async.py,v 1.33 2013/09/21 03:55:38 stroeder Exp $
+\$Id: async.py,v 1.34 2015/06/06 09:21:37 stroeder Exp $
 
 Python compability note:
 Tested on Python 2.0+ but should run on Python 1.5.x.
@@ -103,7 +103,7 @@ def preProcessing(self):
 
   def afterFirstResult(self):
     """
-    Do anything you want right after successfully receiving but before 
+    Do anything you want right after successfully receiving but before
     processing first result
     """
 
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index e7c400d..214d92c 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.9 2013/05/29 20:27:32 stroeder Exp $
+$Id: __init__.py,v 1.10 2015/06/06 09:21:38 stroeder Exp $
 
 Description:
 The ldap.controls module provides LDAPControl classes.
@@ -45,7 +45,7 @@
 class RequestControl:
   """
   Base class for all request controls
-  
+
   controlType
       OID as string of the LDAPv3 extended request control
   criticality
diff --git a/Lib/ldap/controls/libldap.py b/Lib/ldap/controls/libldap.py
index 0615d52..142840e 100644
--- a/Lib/ldap/controls/libldap.py
+++ b/Lib/ldap/controls/libldap.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: libldap.py,v 1.2 2011/07/23 07:42:04 stroeder Exp $
+$Id: libldap.py,v 1.3 2015/06/06 09:21:38 stroeder Exp $
 """
 
 import _ldap,ldap
@@ -20,8 +20,8 @@ class AssertionControl(RequestControl):
     LDAP filter string specifying which assertions have to match
     so that the server processes the operation
   """
-  
-  controlType = ldap.CONTROL_ASSERT    
+
+  controlType = ldap.CONTROL_ASSERT
   def __init__(self,criticality=True,filterstr='(objectClass=*)'):
     self.criticality = criticality
     self.filterstr = filterstr
@@ -40,9 +40,9 @@ class MatchedValuesControl(RequestControl):
     LDAP filter string specifying which attribute values
     should be returned
   """
-  
+
   controlType = ldap.CONTROL_VALUESRETURNFILTER
-  
+
   def __init__(self,criticality=False,filterstr='(objectClass=*)'):
     self.criticality = criticality
     self.filterstr = filterstr
diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index 7f8cc7f..fa7df78 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: ppolicy.py,v 1.3 2011/11/27 15:26:06 stroeder Exp $
+$Id: ppolicy.py,v 1.4 2015/06/06 09:21:38 stroeder Exp $
 """
 
 __all__ = [
@@ -91,6 +91,6 @@ def decodeControlValue(self,encodedControlValue):
       self.error = None
     else:
       self.error = int(error)
-      
+
 
 KNOWN_RESPONSE_CONTROLS[PasswordPolicyControl.controlType] = PasswordPolicyControl
diff --git a/Lib/ldap/controls/simple.py b/Lib/ldap/controls/simple.py
index 30e7dd3..a84d906 100644
--- a/Lib/ldap/controls/simple.py
+++ b/Lib/ldap/controls/simple.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: simple.py,v 1.9 2012/08/09 07:01:20 stroeder Exp $
+$Id: simple.py,v 1.10 2015/06/06 09:21:38 stroeder Exp $
 """
 
 import struct,ldap
@@ -34,7 +34,7 @@ def encodeControlValue(self):
 class OctetStringInteger(LDAPControl):
   """
   Base class with controlValue being unsigend integer values
-  
+
   integerValue
     Integer to be sent as OctetString
   """
@@ -49,7 +49,7 @@ def encodeControlValue(self):
 
   def decodeControlValue(self,encodedControlValue):
     self.integerValue = struct.unpack('!Q',encodedControlValue)[0]
-    
+
 
 class BooleanControl(LDAPControl):
   """
@@ -100,7 +100,7 @@ def __init__(self,criticality=False):
 class ProxyAuthzControl(RequestControl):
   """
   Proxy Authorization Control
-  
+
   authzId
     string containing the authorization ID indicating the identity
     on behalf which the server should process the request
@@ -123,9 +123,9 @@ def __init__(self,criticality):
 class AuthorizationIdentityResponseControl(ResponseControl):
   """
   Authorization Identity Request and Response Controls
-  
+
   Class attributes:
-  
+
   authzId
     decoded authorization identity
   """
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 0c5e5ab..e3dbca6 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.12 2014/05/20 20:15:15 stroeder Exp $
+\$Id: dn.py,v 1.13 2015/06/06 09:21:37 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -31,7 +31,7 @@ def escape_dn_chars(s):
     s = s.replace('>' ,'\\>')
     s = s.replace(';' ,'\\;')
     s = s.replace('=' ,'\\=')
-    s = s.replace('\000' ,'\\\000')    
+    s = s.replace('\000' ,'\\\000')
     if s[0]=='#' or s[0]==' ':
       s = ''.join(('\\',s))
     if s[-1]==' ':
@@ -43,7 +43,7 @@ def str2dn(dn,flags=0):
   """
   This function takes a DN as string as parameter and returns
   a decomposed DN. It's the inverse to dn2str().
-  
+
   flags describes the format of the dn
 
   See also the OpenLDAP man-page ldap_str2dn(3)
@@ -69,7 +69,7 @@ def dn2str(dn):
 def explode_dn(dn,notypes=0,flags=0):
   """
   explode_dn(dn [, notypes=0]) -> list
-  
+
   This function takes a DN and breaks it up into its component parts.
   The notypes parameter is used to specify that only the component's
   attribute values be returned and not the attribute types.
@@ -95,7 +95,7 @@ def explode_dn(dn,notypes=0,flags=0):
 def explode_rdn(rdn,notypes=0,flags=0):
   """
   explode_rdn(rdn [, notypes=0]) -> list
-  
+
   This function takes a RDN and breaks it up into its component parts
   if it is a multi-valued RDN.
   The notypes parameter is used to specify that only the component's
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index 23f34c6..46f957e 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: filter.py,v 1.9 2011/07/22 07:20:53 stroeder Exp $
+\$Id: filter.py,v 1.10 2015/06/06 09:21:37 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -16,7 +16,7 @@ def escape_filter_chars(assertion_value,escape_mode=0):
   """
   Replace all special characters found in assertion_value
   by quoted notation.
-  
+
   escape_mode
       If 0 only special chars mentioned in RFC 4515 are escaped.
       If 1 all NON-ASCII chars are escaped.
@@ -41,7 +41,7 @@ def escape_filter_chars(assertion_value,escape_mode=0):
     s = s.replace(r'(', r'\28')
     s = s.replace(r')', r'\29')
     s = s.replace('\x00', r'\00')
-  return s 
+  return s
 
 
 def filter_format(filter_template,assertion_values):
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 1a92fbb..8ba0130 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.30 2014/05/20 20:44:28 stroeder Exp $
+\$Id: functions.py,v 1.31 2015/06/06 09:21:37 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -135,7 +135,7 @@ def set_option(option,invalue):
 
 def escape_str(escape_func,s,*args):
   """
-  Applies escape_func() to all items of `args' and returns a string based 
+  Applies escape_func() to all items of `args' and returns a string based
   on format string `s'.
   """
   escape_args = map(escape_func,args)
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 7e2878f..a02130b 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.144 2015/05/02 16:19:23 stroeder Exp $
+\$Id: ldapobject.py,v 1.145 2015/06/06 09:21:38 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -139,7 +139,7 @@ def __getattr__(self,name):
   def fileno():
     """
     Returns file description of LDAP connection.
-    
+
     Just a convenience wrapper for LDAPObject.get_option(ldap.OPT_DESC)
     """
     return self.get_option(ldap.OPT_DESC)
@@ -662,7 +662,7 @@ def search_subschemasubentry_s(self,dn=''):
   def read_s(self,dn,filterstr=None,attrlist=None,serverctrls=None,clientctrls=None,timeout=-1):
     """
     Reads and returns a single entry specified by `dn'.
-    
+
     Other attributes just like those passed to `search_ext_s()'
     """
     r = self.search_ext_s(
diff --git a/Lib/ldap/logger.py b/Lib/ldap/logger.py
index a6083dc..16c4d63 100644
--- a/Lib/ldap/logger.py
+++ b/Lib/ldap/logger.py
@@ -9,7 +9,7 @@ class logging_file_class:
 
   def __init__(self,logging_level):
     self._logging_level = logging_level
-  
+
   def write(self,msg):
     logging.log(self._logging_level,msg[:-1])
 
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index 39d6eb1..1158671 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: sasl.py,v 1.16 2014/03/23 19:06:47 stroeder Exp $
+\$Id: sasl.py,v 1.17 2015/06/06 09:21:38 stroeder Exp $
 
 Description:
 The ldap.sasl module provides SASL authentication classes.
@@ -63,7 +63,7 @@ def callback(self,cb_id,challenge,prompt,defresult):
         useful for writing generic sasl GUIs, which would need to know all
         the questions to ask, before the answers are returned to the sasl
         lib (in contrast to one question at a time)."""
-        
+
         # The following print command might be useful for debugging
         # new sasl mechanisms. So it is left here
         cb_result = self.cb_value_dict.get(cb_id,defresult) or ''
@@ -73,7 +73,7 @@ def callback(self,cb_id,challenge,prompt,defresult):
                 cb_id, challenge, prompt, repr(defresult), repr(self.cb_value_dict.get(cb_result))
               ))
         return cb_result
-    
+
 
 class cram_md5(sasl):
     """This class handles SASL CRAM-MD5 authentication."""
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index a3e0041..f7a7bd5 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: models.py,v 1.47 2014/03/12 21:44:10 stroeder Exp $
+\$Id: models.py,v 1.48 2015/06/06 09:21:38 stroeder Exp $
 """
 
 import UserDict,ldap.cidict
@@ -36,7 +36,7 @@ class SchemaElement:
   Base class for all schema element classes. Not used directly!
 
   Arguments:
-  
+
   schema_element_str
     String which contains the schema element description to be parsed.
 
@@ -51,7 +51,7 @@ class SchemaElement:
   token_defaults = {
     'DESC':(None,),
   }
-  
+
   def __init__(self,schema_element_str=None):
     if schema_element_str:
       l = split_tokens(schema_element_str,self.token_defaults)
@@ -72,7 +72,7 @@ def get_id(self):
   def key_attr(self,key,value,quoted=0):
     assert value is None or type(value)==StringType,TypeError("value has to be of StringType, was %s" % repr(value))
     if value:
-      if quoted:        
+      if quoted:
         return " %s '%s'" % (key,value.replace("'","\\'"))
       else:
         return " %s %s" % (key,value)
@@ -101,7 +101,7 @@ def __str__(self):
 class ObjectClass(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an ObjectClassDescription
 
@@ -194,7 +194,7 @@ def __str__(self):
 class AttributeType(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an AttributeTypeDescription
 
@@ -336,7 +336,7 @@ class LDAPSyntax(SchemaElement):
     This string contains description text (DESC) of the LDAP syntax
   not_human_readable
     Integer flag (0 or 1) indicating whether the attribute type is marked
-    as not human-readable (X-NOT-HUMAN-READABLE)  
+    as not human-readable (X-NOT-HUMAN-READABLE)
   """
   schema_attribute = 'ldapSyntaxes'
   token_defaults = {
@@ -355,7 +355,7 @@ def _set_attrs(self,l,d):
     self.x_binary_transfer_required = d['X-BINARY-TRANSFER-REQUIRED'][0]=='TRUE'
     assert self.desc is None or type(self.desc)==StringType
     return
-                                  
+
   def __str__(self):
     result = [str(self.oid)]
     result.append(self.key_attr('DESC',self.desc,quoted=1))
@@ -369,7 +369,7 @@ def __str__(self):
 class MatchingRule(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an MatchingRuleDescription
 
@@ -418,7 +418,7 @@ def __str__(self):
 class MatchingRuleUse(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an MatchingRuleUseDescription
 
@@ -468,7 +468,7 @@ def __str__(self):
 class DITContentRule(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an DITContentRuleDescription
 
@@ -541,7 +541,7 @@ def __str__(self):
 class DITStructureRule(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an DITStructureRuleDescription
 
@@ -604,7 +604,7 @@ def __str__(self):
 class NameForm(SchemaElement):
   """
   Arguments:
-  
+
   schema_element_str
     String containing an NameFormDescription
 
@@ -670,7 +670,7 @@ def __str__(self):
 class Entry(UserDict.UserDict):
   """
   Schema-aware implementation of an LDAP entry class.
-  
+
   Mainly it holds the attributes in a string-keyed dictionary with
   the OID as key.
   """
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 4674d3d..60fca93 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: subentry.py,v 1.34 2013/09/13 18:02:47 stroeder Exp $
+\$Id: subentry.py,v 1.35 2015/06/06 09:21:38 stroeder Exp $
 """
 
 import ldap.cidict,ldap.schema
@@ -75,7 +75,7 @@ class SubSchema:
   non_unique_oids
     List of OIDs used at least twice in the subschema
   non_unique_names
-    List of NAMEs used at least twice in the subschema for the same schema element 
+    List of NAMEs used at least twice in the subschema for the same schema element
   """
 
   def __init__(self,sub_schema_sub_entry,check_uniqueness=1):
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 8426d73..a6e0258 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: syncrepl.py,v 1.6 2014/09/26 16:11:43 stroeder Exp $
+$Id: syncrepl.py,v 1.7 2015/06/06 09:21:38 stroeder Exp $
 """
 
 #__all__ = [
@@ -316,9 +316,9 @@ def syncrepl_search(self, base, scope, mode='refreshOnly', cookie=None, **search
         methods to store the cookie appropriately, rather than
         passing it.
 
-        Only a single syncrepl search may be active on a SyncreplConsumer 
-        object.  Multiple concurrent syncrepl searches require multiple 
-        separate SyncreplConsumer objects and thus multiple connections 
+        Only a single syncrepl search may be active on a SyncreplConsumer
+        object.  Multiple concurrent syncrepl searches require multiple
+        separate SyncreplConsumer objects and thus multiple connections
         (LDAPObject instances).
         """
         if cookie is None:
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 0345221..a43c59b 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.71 2015/06/05 21:04:58 stroeder Exp $
+\$Id: ldapurl.py,v 1.72 2015/06/06 09:21:37 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -73,7 +73,7 @@ class LDAPUrlExtension:
   Usable class attributes:
     critical
           Boolean integer marking the extension as critical
-    extype    
+    extype
           Type of extension
     exvalue
           Value of extension
@@ -112,7 +112,7 @@ def unparse(self):
         '!'*(self.critical>0),
         self.extype,quote(self.exvalue or '')
       )
-    
+
   def __str__(self):
     return self.unparse()
 
@@ -177,7 +177,7 @@ def __eq__(self,other):
       "other has to be instance of %s" % (self.__class__)
     )
     return self.data==other.data
-    
+
   def parse(self,extListStr):
     for extension_str in extListStr.strip().split(','):
       if extension_str:
@@ -358,11 +358,11 @@ def unparse(self):
     if self.extensions:
       ldap_url = ldap_url+'?'+self.extensions.unparse()
     return ldap_url
-  
+
   def htmlHREF(self,urlPrefix='',hrefText=None,hrefTarget=None):
     """
     Returns a string with HTML link for this LDAP URL.
-    
+
     urlPrefix
         Prefix before LDAP URL (e.g. for addressing another web-based client)
     hrefText

From 0b665e2b9bedaaddccce6450d70898b7b6d9a141 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 11 Jun 2015 15:13:43 +0000
Subject: [PATCH 160/868] ldap.ldapobject.LDAPObject: New convenience methods
 for SASL GSSAPI or EXTERNAL binds

---
 CHANGES                |  4 +++-
 Lib/ldap/ldapobject.py | 22 ++++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4b8b91d..86614c8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,8 @@ Changes since 2.4.19:
 Lib/
 * Abandoned old syntax when raising ValueError in modules ldif and
   ldapurl, more information in some exceptions.
+* ldap.ldapobject.LDAPObject:
+  New convenience methods for SASL GSSAPI or EXTERNAL binds
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1156,4 +1158,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.342 2015/06/05 21:03:06 stroeder Exp $
+$Id: CHANGES,v 1.343 2015/06/11 15:13:44 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index a02130b..f29d316 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.145 2015/06/06 09:21:38 stroeder Exp $
+\$Id: ldapobject.py,v 1.146 2015/06/11 15:13:43 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -32,7 +32,7 @@
   # Tracing is only supported in debugging mode
   import traceback
 
-import sys,time,pprint,_ldap,ldap,ldap.functions
+import sys,time,pprint,_ldap,ldap,ldap.sasl,ldap.functions
 
 from ldap.schema import SCHEMA_ATTRS
 from ldap.controls import LDAPControl,DecodeControlTuples,RequestControlTuples
@@ -243,6 +243,24 @@ def sasl_interactive_bind_s(self,who,auth,serverctrls=None,clientctrls=None,sasl
     """
     return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
 
+  def sasl_non_interactive_bind_s(self,sasl_mech,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+    """
+    Send a SASL bind request using a non-interactive SASL method (e.g. GSSAPI, EXTERNAL)
+    """
+    self.sasl_interactive_bind_s('',ldap.sasl.sasl({},sasl_mech))
+
+  def sasl_external_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+    """
+    Send SASL bind request using SASL mech EXTERNAL
+    """
+    self.sasl_non_interactive_bind_s('EXTERNAL',serverctrls,clientctrls,sasl_flags)
+
+  def sasl_gssapi_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+    """
+    Send SASL bind request using SASL mech GSSAPI
+    """
+    self.sasl_non_interactive_bind_s('GSSAPI',serverctrls,clientctrls,sasl_flags)
+
   def sasl_bind_s(self,dn,mechanism,cred,serverctrls=None,clientctrls=None):
     """
     sasl_bind_s(dn, mechanism, cred [,serverctrls=None[,clientctrls=None]]) -> int|str

From 65cc6fdb4d8caa83e70ae2b393615236697542ed Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 20 Jun 2015 14:09:45 +0000
Subject: [PATCH 161/868] Refactoring LDIFParser, especially added parsing of
 change records

---
 CHANGES     |  12 ++-
 Lib/ldif.py | 274 +++++++++++++++++++++++++++++++++++++---------------
 2 files changed, 208 insertions(+), 78 deletions(-)

diff --git a/CHANGES b/CHANGES
index 86614c8..d1eddd5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,16 @@ Lib/
   ldapurl, more information in some exceptions.
 * ldap.ldapobject.LDAPObject:
   New convenience methods for SASL GSSAPI or EXTERNAL binds
+* Refactored parts in ldif.LDIFParser:
+  - New class attributes line_counter and byte_counter contain
+    amount of LDIF data read so far
+  - Renamed some internally used methods
+  - Added support for parsing change records currently limited to
+    changetype: modify
+  - New separate methods parse_entry_records() (also called by parse())
+    and parse_change_records()
+  - Stricter order checking of dn:, changetype:, etc.
+  - Removed non-existent 'AttrTypeandValueLDIF' from ldif.__all__
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1158,4 +1168,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.343 2015/06/11 15:13:44 stroeder Exp $
+$Id: CHANGES,v 1.344 2015/06/20 14:09:45 stroeder Exp $
diff --git a/Lib/ldif.py b/Lib/ldif.py
index bc47040..cbe741e 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.80 2015/06/05 21:04:58 stroeder Exp $
+$Id: ldif.py,v 1.81 2015/06/20 14:09:45 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -15,7 +15,7 @@
   # constants
   'ldif_pattern',
   # functions
-  'AttrTypeandValueLDIF','CreateLDIF','ParseLDIF',
+  'CreateLDIF','ParseLDIF',
   # classes
   'LDIFWriter',
   'LDIFParser',
@@ -40,7 +40,9 @@
 ldif_pattern = '^((dn(:|::) %(dn_pattern)s)|(%(attrtype_pattern)s(:|::) .*)$)+' % vars()
 
 MOD_OP_INTEGER = {
-  'add':0,'delete':1,'replace':2
+  'add'    :0, # ldap.MOD_REPLACE
+  'delete' :1, # ldap.MOD_DELETE
+  'replace':2, # ldap.MOD_REPLACE
 }
 
 MOD_OP_STR = {
@@ -98,7 +100,7 @@ def __init__(self,output_file,base64_attrs=None,cols=76,line_sep='\n'):
     self._line_sep = line_sep
     self.records_written = 0
 
-  def _unfoldLDIFLine(self,line):
+  def _unfold_lines(self,line):
     """
     Write string line as one or more folded lines
     """
@@ -117,7 +119,7 @@ def _unfoldLDIFLine(self,line):
         self._output_file.write(line[pos:min(line_len,pos+self._cols-1)])
         self._output_file.write(self._line_sep)
         pos = pos+self._cols-1
-    return # _unfoldLDIFLine()
+    return # _unfold_lines()
 
   def _needs_base64_encoding(self,attr_type,attr_value):
     """
@@ -138,9 +140,9 @@ def _unparseAttrTypeandValue(self,attr_type,attr_value):
     """
     if self._needs_base64_encoding(attr_type,attr_value):
       # Encode with base64
-      self._unfoldLDIFLine(':: '.join([attr_type,base64.encodestring(attr_value).replace('\n','')]))
+      self._unfold_lines(':: '.join([attr_type,base64.encodestring(attr_value).replace('\n','')]))
     else:
-      self._unfoldLDIFLine(': '.join([attr_type,attr_value]))
+      self._unfold_lines(': '.join([attr_type,attr_value]))
     return # _unparseAttrTypeandValue()
 
   def _unparseEntryRecord(self,entry):
@@ -240,17 +242,6 @@ class and override method handle() to implement something meaningful.
         Counter for records processed so far
   """
 
-  def _stripLineSep(self,s):
-    """
-    Strip trailing line separators from s, but no other whitespaces
-    """
-    if s[-2:]=='\r\n':
-      return s[:-2]
-    elif s[-1:]=='\n':
-      return s[:-1]
-    else:
-      return s
-
   def __init__(
     self,
     input_file,
@@ -280,46 +271,61 @@ def __init__(
     self._process_url_schemes = list_dict([s.lower() for s in (process_url_schemes or [])])
     self._ignored_attr_types = list_dict([a.lower() for a in (ignored_attr_types or [])])
     self._line_sep = line_sep
+    self.line_counter = 0
+    self.byte_counter = 0
     self.records_read = 0
+    self._line = self._readline()
 
   def handle(self,dn,entry):
     """
     Process a single content LDIF record. This method should be
     implemented by applications using LDIFParser.
     """
+    pass
+
+  def _readline(self):
+    s = self._input_file.readline()
+    self.line_counter = self.line_counter + 1
+    self.byte_counter = self.byte_counter + len(s)
+    if s[-2:]=='\r\n':
+      return s[:-2]
+    elif s[-1:]=='\n':
+      return s[:-1]
+    else:
+      return s
 
-  def _unfoldLDIFLine(self):
+  def _unfold_lines(self):
     """
     Unfold several folded lines with trailing space into one line
     """
-    unfolded_lines = [ self._stripLineSep(self._line) ]
-    self._line = self._input_file.readline()
+    unfolded_lines = [ self._line ]
+    self._line = self._readline()
     while self._line and self._line[0]==' ':
-      unfolded_lines.append(self._stripLineSep(self._line[1:]))
-      self._line = self._input_file.readline()
+      unfolded_lines.append(self._line[1:])
+      self._line = self._readline()
     return ''.join(unfolded_lines)
 
-  def _parseAttrTypeandValue(self):
+  def _next_key_and_value(self):
     """
     Parse a single attribute type and value pair from one or
     more lines of LDIF data
     """
     # Reading new attribute line
-    unfolded_line = self._unfoldLDIFLine()
+    unfolded_line = self._unfold_lines()
     # Ignore comments which can also be folded
     while unfolded_line and unfolded_line[0]=='#':
-      unfolded_line = self._unfoldLDIFLine()
-    if not unfolded_line or unfolded_line=='\n' or unfolded_line=='\r\n':
-      return None,None
-    try:
-      colon_pos = unfolded_line.index(':')
-    except ValueError:
-      # Treat malformed lines without colon as non-existent
+      unfolded_line = self._unfold_lines()
+    if not unfolded_line:
       return None,None
+    if unfolded_line=='-':
+      return '-',None
+    colon_pos = unfolded_line.index(':')
     attr_type = unfolded_line[0:colon_pos]
     # if needed attribute value is BASE64 decoded
     value_spec = unfolded_line[colon_pos:colon_pos+2]
-    if value_spec=='::':
+    if value_spec==': ':
+      attr_value = unfolded_line[colon_pos+2:]
+    elif value_spec=='::':
       # attribute value needs base64-decoding
       attr_value = base64.decodestring(unfolded_line[colon_pos+2:])
     elif value_spec==':<':
@@ -332,60 +338,154 @@ def _parseAttrTypeandValue(self):
           attr_value = urllib.urlopen(url).read()
     elif value_spec==':\r\n' or value_spec=='\n':
       attr_value = ''
-    else:
-      attr_value = unfolded_line[colon_pos+2:].lstrip()
     return attr_type,attr_value
 
-  def parse(self):
+  def parse_entry_records(self):
     """
-    Continously read and parse LDIF records
+    Continously read and parse LDIF entry records
     """
-    self._line = self._input_file.readline()
+    k,v = self._next_key_and_value()
+    if k=='version':
+      self.version = v
+      k,v = self._next_key_and_value()
+      if k==v==None:
+        k,v = self._next_key_and_value()
+    else:
+      self.version = None
 
-    while self._line and \
+    # Loop for processing whole records
+    while k!=None and \
           (not self._max_entries or self.records_read<self._max_entries):
-
-      # Reset record
-      version = None; dn = None; changetype = None; modop = None; entry = {}
-
-      attr_type,attr_value = self._parseAttrTypeandValue()
-
-      while attr_type!=None and attr_value!=None:
-        if attr_type=='dn':
-          # attr type and value pair was DN of LDIF record
-          if dn!=None:
-            raise ValueError('Two lines starting with dn: in one record.')
-          if not is_dn(attr_value):
-            raise ValueError('No valid string-representation of distinguished name %s.' % (repr(attr_value)))
-          dn = attr_value
-        elif attr_type=='version' and dn is None:
-          version = 1
-        elif attr_type=='changetype':
-          # attr type and value pair was DN of LDIF record
-          if dn is None:
-            raise ValueError('Read changetype: before getting valid dn: line.')
-          if changetype!=None:
-            raise ValueError('Two lines starting with changetype: in one record.')
-          if not valid_changetype_dict.has_key(attr_value):
-            raise ValueError('changetype value %s is invalid.' % (repr(attr_value)))
-          changetype = attr_value
-        elif attr_value!=None and \
-             not self._ignored_attr_types.has_key(attr_type.lower()):
-          # Add the attribute to the entry if not ignored attribute
-          if entry.has_key(attr_type):
-            entry[attr_type].append(attr_value)
-          else:
-            entry[attr_type]=[attr_value]
-
-        # Read the next line within an entry
-        attr_type,attr_value = self._parseAttrTypeandValue()
-
+      # Consume first line which must start with "dn: "
+      if k!='dn':
+        raise ValueError('Line %d: First line of record does not start with "dn:": %s' % (self.line_counter,repr(k)))
+      if not is_dn(v):
+        raise ValueError('Line %d: Not a valid string-representation for dn: %s.' % (self.line_counter,repr(v)))
+      dn = v
+      entry = {}
+      # Consume second line of record
+      k,v = self._next_key_and_value()
+
+      # Loop for reading the attributes
+      while k!=None and \
+         not k.lower() in self._ignored_attr_types:
+        # Add the attribute to the entry if not ignored attribute
+        try:
+          entry[k].append(v)
+        except KeyError:
+          entry[k]=[v]
+        # Read the next line within the record
+        k,v = self._next_key_and_value()
+      # Consume empty separator line
+      k,v = self._next_key_and_value()
       if entry:
         # append entry to result list
         self.handle(dn,entry)
-        self.records_read = self.records_read+1
+      self.records_read = self.records_read + 1
 
-    return # parse()
+    return # parse_entry_records()
+
+  def parse(self):
+    """
+    Invokes LDIFParser.parse_entry_records() for backward compability
+    """
+    return self.parse_entry_records() # parse()
+
+  def handle_change_modify(self,dn,modops,controls=None):
+    """
+    Process a single LDIF record representing a single modify operation.
+    This method should be implemented by applications using LDIFParser.
+    """
+    controls = [] or None
+    pass
+
+  def parse_change_records(self):
+    self.changetype_counter = {}
+    k,v = self._next_key_and_value()
+    if k=='version':
+      self.version = v
+      k,v = self._next_key_and_value()
+      if k==v==None:
+        k,v = self._next_key_and_value()
+    else:
+      self.version = None
+
+    # Loop for processing whole records
+    while k!=None and \
+          (not self._max_entries or self.records_read<self._max_entries):
+
+      # Consume first line which must start with "dn: "
+      if k!='dn':
+        raise ValueError('Line %d: First line of record does not start with "dn:": %s' % (self.line_counter,repr(k)))
+      if not is_dn(v):
+        raise ValueError('Line %d: Not a valid string-representation for dn: %s' % (self.line_counter,repr(v)))
+      dn = v
+      # Read "control:" lines
+      controls = []
+      k,v = self._next_key_and_value()
+      while k=='control':
+        try:
+          control_type,criticality,control_value = v.split(' ',2)
+        except ValueError:
+          control_value = None
+          control_type,criticality = v.split(' ',1)
+        controls.append((control_type,criticality,control_value))
+        k,v = self._next_key_and_value()
+      # Determine changetype first, assuming changetype: as default
+      changetype = 'modify'
+      # Consume second line of record
+      if k=='changetype':
+        if not v in valid_changetype_dict:
+          raise ValueError('Invalid changetype: %s' % repr(v))
+        changetype = v
+        k,v = self._next_key_and_value()
+
+      if changetype=='modify':
+
+        # From here we assume a change record is read with changetype: modify
+        modops = []
+
+        # Loop for reading the list of modifications
+        while k!=None:
+          # Extract attribute mod-operation (add, delete, replace)
+          try:
+            modop = MOD_OP_INTEGER[k]
+          except KeyError:
+            raise ValueError('Line %d: Invalid mod-op string: %s' % (self.line_counter,repr(k)))
+          # we now have the attribute name to be modified
+          modattr = v
+          modvalues = []
+          k,v = self._next_key_and_value()
+          while k==modattr:
+            modvalues.append(v)
+            k,v = self._next_key_and_value()
+          modops.append((modop,modattr,modvalues or None))
+          k,v = self._next_key_and_value()
+          if k=='-':
+            # Consume next line
+            k,v = self._next_key_and_value()
+
+        if modops:
+          # append entry to result list
+          self.handle_modify(dn,modops,controls)
+
+      else:
+
+        # Consume the unhandled change record
+        while k!=None:
+          k,v = self._next_key_and_value()
+
+      # Consume empty separation line
+      k,v = self._next_key_and_value()
+
+      # Increment record counters
+      try:
+        self.changetype_counter[changetype] = self.changetype_counter[changetype] + 1
+      except KeyError:
+        self.changetype_counter[changetype] = 1
+      self.records_read = self.records_read + 1
+
+    return # parse_change_records()
 
 
 class LDIFRecordList(LDIFParser):
@@ -451,3 +551,23 @@ def ParseLDIF(f,ignore_attrs=None,maxentries=0):
   )
   ldif_parser.parse()
   return ldif_parser.all_records
+
+
+if __name__ == '__main__':
+  import sys,os,time,pprint
+  parser_class_name = sys.argv[1]
+  parser_class = vars()[parser_class_name]
+  parser_method_name = sys.argv[2]
+  for input_file_name in sys.argv[3:]:
+    input_file_size = os.stat(input_file_name).st_size
+    input_file = open(input_file_name,'rb')
+    ldif_parser = parser_class(input_file)
+    parser_method = getattr(ldif_parser,parser_method_name)
+    start_time = time.time()
+    parser_method()
+    end_time = time.time()
+    input_file.close()
+    print '***Time needed:',end_time-start_time,'seconds'
+    print '***Records read:',ldif_parser.records_read
+    print '***Lines read:',ldif_parser.line_counter
+    print '***Bytes read:',ldif_parser.byte_counter,'of',input_file_size

From 26b58aa261c43f235d135c038de11b1e07c7e594 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 21 Jun 2015 11:37:11 +0000
Subject: [PATCH 162/868] New values for library_dirs and include_dirs should
 work on most platforms

---
 setup.cfg | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 9ab58af..1ea653a 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,15 +1,15 @@
 # Example for setup.cfg
 # You have to edit this file to reflect your system configuation
 #
-# $Id: setup.cfg,v 1.30 2012/02/21 17:17:16 stroeder Exp $
+# $Id: setup.cfg,v 1.31 2015/06/21 11:37:11 stroeder Exp $
 
 # Section for compiling the C extension module
 # for wrapping OpenLDAP 2 libs
 [_ldap]
 
 # Define extra include and library dirs if needed
-library_dirs = /opt/openldap-RE24/lib /usr/lib
-include_dirs = /opt/openldap-RE24/include /usr/include/sasl /usr/include
+library_dirs = /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64
+include_dirs = /usr/include /usr/include/sasl /usr/local/include /usr/include/local/sasl
 
 # These defines needs OpenLDAP built with
 # ./configure --with-cyrus-sasl --with-tls

From 533736d296646412d28b472e8bb130925d52468e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 21 Jun 2015 11:38:32 +0000
Subject: [PATCH 163/868] Added LDIFRecordList.handle_modify()

---
 Lib/ldif.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index cbe741e..447b1c7 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.81 2015/06/20 14:09:45 stroeder Exp $
+$Id: ldif.py,v 1.82 2015/06/21 11:38:32 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -508,6 +508,7 @@ def __init__(
     """
     LDIFParser.__init__(self,input_file,ignored_attr_types,max_entries,process_url_schemes)
     self.all_records = []
+    self.all_modify_changes = []
 
   def handle(self,dn,entry):
     """
@@ -515,6 +516,14 @@ def handle(self,dn,entry):
     """
     self.all_records.append((dn,entry))
 
+  def handle_modify(self,dn,modops,controls=None):
+    """
+    Process a single LDIF record representing a single modify operation.
+    This method should be implemented by applications using LDIFParser.
+    """
+    controls = [] or None
+    self.all_modify_changes.append((dn,modops,controls))
+
 
 class LDIFCopy(LDIFParser):
   """

From d4b2cfa22b7316305c15d6f50acd7754ecb59e00 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 21 Jun 2015 17:50:43 +0000
Subject: [PATCH 164/868] Correct typo in include_dirs

---
 setup.cfg | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 1ea653a..aa23527 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,7 +1,7 @@
 # Example for setup.cfg
 # You have to edit this file to reflect your system configuation
 #
-# $Id: setup.cfg,v 1.31 2015/06/21 11:37:11 stroeder Exp $
+# $Id: setup.cfg,v 1.32 2015/06/21 17:50:43 stroeder Exp $
 
 # Section for compiling the C extension module
 # for wrapping OpenLDAP 2 libs
@@ -9,7 +9,7 @@
 
 # Define extra include and library dirs if needed
 library_dirs = /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64
-include_dirs = /usr/include /usr/include/sasl /usr/local/include /usr/include/local/sasl
+include_dirs = /usr/include /usr/include/sasl /usr/local/include /usr/local/include/sasl
 
 # These defines needs OpenLDAP built with
 # ./configure --with-cyrus-sasl --with-tls

From e5f5fb76e621002f990dcdd077b0039c3190e91c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 21 Jun 2015 19:08:16 +0000
Subject: [PATCH 165/868] Stripped trailing spaces

---
 CHANGES | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index d1eddd5..f258e7e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -30,8 +30,8 @@ Changes since 2.4.18:
 Lib/
 * Fixed missing ReconnectLDAPObject._reconnect_lock when pickling
   (see SF#64, thanks to Dan O'Reilly)
-* Added ldap.controls.pagedresults which is pure Python implementation of 
-  Simple Paged Results Control (see RFC 2696) and delivers the correct 
+* Added ldap.controls.pagedresults which is pure Python implementation of
+  Simple Paged Results Control (see RFC 2696) and delivers the correct
   result size
 
 ----------------------------------------------------------------
@@ -82,11 +82,11 @@ Lib/
   string of digits
 * Support for X-SUBST in schema element class LDAPSyntax
 * Support for X-ORDERED and X-ORIGIN in schema element class AttributeType
-* ldapurl: New scope 'subordinates' defined in 
+* ldapurl: New scope 'subordinates' defined in
   draft-sermersheim-ldap-subordinate-scope
 
 Modules/
-* New constant ldap.SCOPE_SUBORDINATE derived from ldap.h for 
+* New constant ldap.SCOPE_SUBORDINATE derived from ldap.h for
   draft-sermersheim-ldap-subordinate-scope
 * Fixed constant ldap.sasl.CB_GETREALM (thanks to Martin Pfeifer)
 
@@ -1168,4 +1168,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.344 2015/06/20 14:09:45 stroeder Exp $
+$Id: CHANGES,v 1.345 2015/06/21 19:08:16 stroeder Exp $

From 086e68976bf420b9e93a63c5c1986543b219844f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 22 Jun 2015 11:51:07 +0000
Subject: [PATCH 166/868] New mix-in class
 ldap.controls.openldap.SearchNoOpMixIn adds convience method noop_search_st()
 to LDAPObject class

---
 CHANGES                       |  4 +++-
 Lib/ldap/controls/openldap.py | 35 ++++++++++++++++++++++++++++++++++-
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index f258e7e..7d2886c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -21,6 +21,8 @@ Lib/
     and parse_change_records()
   - Stricter order checking of dn:, changetype:, etc.
   - Removed non-existent 'AttrTypeandValueLDIF' from ldif.__all__
+* New mix-in class ldap.controls.openldap.SearchNoOpMixIn
+  adds convience method noop_search_st() to LDAPObject class
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1168,4 +1170,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.345 2015/06/21 19:08:16 stroeder Exp $
+$Id: CHANGES,v 1.346 2015/06/22 11:51:07 stroeder Exp $
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index a8ed001..62b6a5d 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: openldap.py,v 1.1 2013/07/05 16:57:25 stroeder Exp $
+$Id: openldap.py,v 1.2 2015/06/22 11:51:07 stroeder Exp $
 """
 
 import ldap.controls
@@ -42,3 +42,36 @@ def decodeControlValue(self,encodedControlValue):
 
 ldap.controls.KNOWN_RESPONSE_CONTROLS[SearchNoOpControl.controlType] = SearchNoOpControl
 
+
+class SearchNoOpMixIn:
+  """
+  Mix-in class to be used with class LDAPObject and friends.
+  
+  It adds a convenience method noop_search_st() to LDAPObject
+  for easily using the no-op search control.
+  """
+  
+  def noop_search_st(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass=*)',timeout=-1):
+    try:
+      msg_id = self.search_ext(
+        base,
+        scope,
+        filterstr=filterstr,
+        attrlist=['1.1'],
+        timeout=timeout,
+        serverctrls=[SearchNoOpControl(criticality=True)],
+      )
+      _,_,_,search_response_ctrls = self.result3(msg_id,all=1,timeout=timeout)
+    except LDAPLimitErrors,e:
+      self.abandon(msg_id)
+      raise e
+    else:
+      noop_srch_ctrl = [
+        c
+        for c in search_response_ctrls
+        if c.controlType==SearchNoOpControl.controlType
+      ]
+      if noop_srch_ctrl:
+        return noop_srch_ctrl[0].numSearchResults,noop_srch_ctrl[0].numSearchContinuations
+      else:
+        return (None,None)

From a4169eb36ed3240e54a52b9900ed14a46c70c802 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 22 Jun 2015 16:47:08 +0000
Subject: [PATCH 167/868] Added modules ldap.controls.vlv and ldap.controls.sss
 for Virtual List View (see draft-ietf-ldapext-ldapv3-vlv) and Server-side
 Sorting (see RFC 2891)

---
 CHANGES                  |   5 +-
 Lib/ldap/controls/sss.py | 131 +++++++++++++++++++++++++++++++++++++
 Lib/ldap/controls/vlv.py | 136 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 271 insertions(+), 1 deletion(-)
 create mode 100644 Lib/ldap/controls/sss.py
 create mode 100644 Lib/ldap/controls/vlv.py

diff --git a/CHANGES b/CHANGES
index 7d2886c..fe4f23f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -23,6 +23,9 @@ Lib/
   - Removed non-existent 'AttrTypeandValueLDIF' from ldif.__all__
 * New mix-in class ldap.controls.openldap.SearchNoOpMixIn
   adds convience method noop_search_st() to LDAPObject class
+* Added new experimental modules which implement the control classes
+  for Virtual List View (see draft-ietf-ldapext-ldapv3-vlv) and
+  Server-side Sorting (see RFC 2891) (thanks to Benjamin Dauvergne)
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1170,4 +1173,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.346 2015/06/22 11:51:07 stroeder Exp $
+$Id: CHANGES,v 1.347 2015/06/22 16:47:08 stroeder Exp $
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
new file mode 100644
index 0000000..406fb0b
--- /dev/null
+++ b/Lib/ldap/controls/sss.py
@@ -0,0 +1,131 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.sss - classes for Server Side Sorting
+(see RFC 2891)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: sss.py,v 1.1 2015/06/22 16:47:08 stroeder Exp $
+"""
+
+__all__ = [
+    'SSSRequestControl',
+    'SSSResponseControl',
+    'SSSVLVPagedLDAPObject'
+]
+
+
+import ldap
+from ldap.ldapobject import LDAPObject
+from ldap.controls import (RequestControl, ResponseControl,
+        KNOWN_RESPONSE_CONTROLS, DecodeControlTuples)
+
+from pyasn1.type import univ, namedtype, tag, namedval, constraint
+from pyasn1.codec.ber import encoder, decoder
+
+
+#    SortKeyList ::= SEQUENCE OF SEQUENCE {
+#                     attributeType   AttributeDescription,
+#                     orderingRule    [0] MatchingRuleId OPTIONAL,
+#                     reverseOrder    [1] BOOLEAN DEFAULT FALSE }
+
+
+class SortKeyType(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+            namedtype.NamedType('attributeType', univ.OctetString()),
+            namedtype.OptionalNamedType('orderingRule',
+                  univ.OctetString().subtype(
+                    implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)
+                  )
+                ),
+            namedtype.DefaultedNamedType('reverseOrder', univ.Boolean(False).subtype(
+                implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))))
+
+
+class SortKeyListType(univ.SequenceOf):
+    componentType = SortKeyType()
+
+
+class SSSRequestControl(RequestControl):
+    '''Order result server side
+
+        >>> s = SSSRequestControl('-cn')
+    '''
+    controlType = '1.2.840.113556.1.4.473'
+
+    def __init__(
+        self,
+        criticality=False,
+        ordering_rules=None,
+    ):
+        RequestControl.__init__(self,self.controlType,criticality)
+        self.ordering_rules = ordering_rules
+        if isinstance(ordering_rules, basestring):
+            ordering_rules = [ordering_rules]
+        for rule in ordering_rules:
+            rule = rule.split(':')
+            assert len(rule) < 3, 'syntax for ordering rule: [-]<attribute-type>[:ordering-rule]'
+
+    def asn1(self):
+        p = SortKeyListType()
+        for i, rule in enumerate(self.ordering_rules):
+            q = SortKeyType()
+            reverse_order = rule.startswith('-')
+            if reverse_order:
+                rule = rule[1:]
+            if ':' in rule:
+                attribute_type, ordering_rule = rule.split(':')
+            else:
+                attribute_type, ordering_rule = rule, None
+            q.setComponentByName('attributeType', attribute_type)
+            if ordering_rule:
+                q.setComponentByName('orderingRule', ordering_rule)
+            if reverse_order:
+                q.setComponentByName('reverseOrder', 1)
+            p.setComponentByPosition(i, q)
+        return p
+
+    def encodeControlValue(self):
+        return encoder.encode(self.asn1())
+
+
+class SortResultType(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+            namedtype.NamedType('sortResult', univ.Enumerated().subtype(
+                namedValues=namedval.NamedValues(
+                        ('success', 0),
+                        ('operationsError', 1),
+                        ('timeLimitExceeded', 3),
+                        ('strongAuthRequired', 8),
+                        ('adminLimitExceeded', 11),
+                        ('noSuchAttribute', 16),
+                        ('inappropriateMatching', 18),
+                        ('insufficientAccessRights', 50),
+                        ('busy', 51),
+                        ('unwillingToPerform', 53),
+                        ('other', 80)),
+                subtypeSpec=univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(
+                        0, 1, 3, 8, 11, 16, 18, 50, 51, 53, 80))),
+            namedtype.OptionalNamedType('attributeType',
+                  univ.OctetString().subtype(
+                    implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)
+                  )
+                ))
+
+
+class SSSResponseControl(ResponseControl):
+    controlType = '1.2.840.113556.1.4.474'
+
+    def __init__(self,criticality=False):
+        ResponseControl.__init__(self,self.controlType,criticality)
+
+    def decodeControlValue(self, encoded):
+        p, rest = decoder.decode(encoded, asn1Spec=SortResultType())
+        assert not rest, 'all data could not be decoded'
+        self.result = int(p.getComponentByName('sortResult'))
+        self.result_code = p.getComponentByName('sortResult').prettyOut(self.result)
+        self.attribute_type_error = p.getComponentByName('attributeType')
+
+
+KNOWN_RESPONSE_CONTROLS[SSSRequestControl.controlType] = SSSRequestControl
+KNOWN_RESPONSE_CONTROLS[SSSResponseControl.controlType] = SSSResponseControl
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
new file mode 100644
index 0000000..b439cdd
--- /dev/null
+++ b/Lib/ldap/controls/vlv.py
@@ -0,0 +1,136 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.vlv - classes for Simple Paged control
+(see draft-ietf-ldapext-ldapv3-vlv)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: vlv.py,v 1.1 2015/06/22 16:47:08 stroeder Exp $
+"""
+
+__all__ = [
+  'VLVRequestControl',
+  'VLVResponseControl',
+]
+
+import ldap
+from ldap.ldapobject import LDAPObject
+from ldap.controls import (RequestControl, ResponseControl,
+        KNOWN_RESPONSE_CONTROLS, DecodeControlTuples)
+
+from pyasn1.type import univ, namedtype, tag, namedval, constraint
+from pyasn1.codec.ber import encoder, decoder
+
+
+class ByOffsetType(univ.Sequence):
+    tagSet = univ.Sequence.tagSet.tagImplicitly(
+            tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))
+    componentType = namedtype.NamedTypes(
+            namedtype.NamedType('offset', univ.Integer()),
+            namedtype.NamedType('contentCount', univ.Integer()))
+
+
+class TargetType(univ.Choice):
+    componentType = namedtype.NamedTypes(
+            namedtype.NamedType('byOffset', ByOffsetType()),
+            namedtype.NamedType('greaterThanOrEqual', univ.OctetString().subtype(
+                implicitTag=tag.Tag(tag.tagClassContext,
+                    tag.tagFormatSimple, 1))))
+
+
+class VirtualListViewRequestType(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+            namedtype.NamedType('beforeCount', univ.Integer()),
+            namedtype.NamedType('afterCount', univ.Integer()),
+            namedtype.NamedType('target', TargetType()),
+            namedtype.OptionalNamedType('contextID', univ.OctetString()))
+
+class VLVRequestControl(RequestControl):
+    controlType = '2.16.840.1.113730.3.4.9'
+
+    def __init__(
+        self,
+        criticality=False,
+        before_count=0,
+        after_count=0,
+        offset=None,
+        content_count=None,
+        greater_than_or_equal=None,
+        context_id=None,
+    ):
+        RequestControl.__init__(self,self.controlType,criticality)
+        assert (offset is not None and content_count is not None) or greater_than_or_equal, 'offset and ' \
+            'content_count must be set together or greater_than_or_equal must be ' \
+            'used'
+        self.before_count = before_count
+        self.after_count = after_count
+        self.offset = offset
+        self.content_count = content_count
+        self.greater_than_or_equal = greater_than_or_equal
+        self.context_id = context_id
+
+    def encodeControlValue(self):
+        p = VirtualListViewRequestType()
+        p.setComponentByName('beforeCount', self.before_count)
+        p.setComponentByName('afterCount', self.after_count)
+        if self.offset is not None and self.content_count is not None:
+            by_offset = ByOffsetType()
+            by_offset.setComponentByName('offset', self.offset)
+            by_offset.setComponentByName('contentCount', self.content_count)
+            target = TargetType()
+            target.setComponentByName('byOffset', by_offset)
+        elif self.greater_than_or_equal:
+            target = TargetType()
+            target.setComponentByName('greaterThanOrEqual',
+                    self.greater_than_or_equal)
+        else:
+            raise NotImplementedError
+        p.setComponentByName('target', target)
+        return encoder.encode(p)
+
+KNOWN_RESPONSE_CONTROLS[VLVRequestControl.controlType] = VLVRequestControl
+
+
+class VirtualListViewResultType(univ.Enumerated):
+    namedValues = namedval.NamedValues(
+               ('success', 0),
+               ('operationsError', 1),
+               ('protocolError', 3),
+               ('unwillingToPerform', 53),
+               ('insufficientAccessRights', 50),
+               ('adminLimitExceeded', 11),
+               ('innapropriateMatching', 18),
+               ('sortControlMissing', 60),
+               ('offsetRangeError', 61),
+               ('other', 80),
+    )
+
+
+class VirtualListViewResponseType(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+            namedtype.NamedType('targetPosition', univ.Integer()),
+            namedtype.NamedType('contentCount', univ.Integer()),
+            namedtype.NamedType('virtualListViewResult',
+                VirtualListViewResultType()),
+            namedtype.OptionalNamedType('contextID', univ.OctetString()))
+
+
+class VLVResponseControl(ResponseControl):
+    controlType = '2.16.840.1.113730.3.4.10'
+
+    def __init__(self,criticality=False):
+        ResponseControl.__init__(self,self.controlType,criticality)
+
+    def decodeControlValue(self,encoded):
+        p, rest = decoder.decode(encoded, asn1Spec=VirtualListViewResponseType())
+        assert not rest, 'all data could not be decoded'
+        self.target_position = int(p.getComponentByName('targetPosition'))
+        self.content_count = int(p.getComponentByName('contentCount'))
+        self.result = int(p.getComponentByName('virtualListViewResult'))
+        self.result_code = p.getComponentByName('virtualListViewResult') \
+                .prettyOut(self.result)
+        self.context_id = p.getComponentByName('contextID')
+        if self.context_id:
+            self.context_id = str(self.context_id)
+
+KNOWN_RESPONSE_CONTROLS[VLVResponseControl.controlType] = VLVResponseControl

From caf2cc6e4a87f9b1253aed0da41807f3ef6d2fa8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 22 Jun 2015 17:55:01 +0000
Subject: [PATCH 168/868] Corrected comment

---
 Lib/ldap/controls/vlv.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index b439cdd..8a2c7f9 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -1,11 +1,11 @@
 # -*- coding: utf-8 -*-
 """
-ldap.controls.vlv - classes for Simple Paged control
+ldap.controls.vlv - classes for Virtual List View
 (see draft-ietf-ldapext-ldapv3-vlv)
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: vlv.py,v 1.1 2015/06/22 16:47:08 stroeder Exp $
+$Id: vlv.py,v 1.2 2015/06/22 17:55:01 stroeder Exp $
 """
 
 __all__ = [

From 52dfc3e2e49d2248eaacb040801904262e8b95cd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 22 Jun 2015 17:56:50 +0000
Subject: [PATCH 169/868] Stripped trailing white-spaces

---
 Lib/ldap/controls/openldap.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 62b6a5d..55f3d0c 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: openldap.py,v 1.2 2015/06/22 11:51:07 stroeder Exp $
+$Id: openldap.py,v 1.3 2015/06/22 17:56:50 stroeder Exp $
 """
 
 import ldap.controls
@@ -46,11 +46,11 @@ def decodeControlValue(self,encodedControlValue):
 class SearchNoOpMixIn:
   """
   Mix-in class to be used with class LDAPObject and friends.
-  
+
   It adds a convenience method noop_search_st() to LDAPObject
   for easily using the no-op search control.
   """
-  
+
   def noop_search_st(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass=*)',timeout=-1):
     try:
       msg_id = self.search_ext(

From d1c42920b8a48dd2b225a735743dfb66b0c0dc1b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 23 Jun 2015 09:44:04 +0000
Subject: [PATCH 170/868] Added exceptions ldap.VLV_ERROR,
 ldap.X_PROXY_AUTHZ_FAILURE and ldap.AUTH_METHOD_NOT_SUPPORTED

---
 CHANGES          | 6 +++++-
 Modules/errors.c | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index fe4f23f..9ff9e9a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,10 @@ Changes since 2.4.19:
 * New wrapping of OpenLDAP's function ldap_sasl_bind_s() allows
   to intercept the SASL handshake (thanks to René Kijewski)
 
+Modules/
+* Added exceptions ldap.VLV_ERROR, ldap.X_PROXY_AUTHZ_FAILURE and 
+  ldap.AUTH_METHOD_NOT_SUPPORTED
+
 Lib/
 * Abandoned old syntax when raising ValueError in modules ldif and
   ldapurl, more information in some exceptions.
@@ -1173,4 +1177,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.347 2015/06/22 16:47:08 stroeder Exp $
+$Id: CHANGES,v 1.348 2015/06/23 09:44:04 stroeder Exp $
diff --git a/Modules/errors.c b/Modules/errors.c
index 35e3dec..64793db 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,7 +2,7 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.23 2012/01/11 10:04:48 stroeder Exp $ */
+ * $Id: errors.c,v 1.24 2015/06/23 09:44:04 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -141,8 +141,10 @@ LDAPinit_errors( PyObject*d ) {
   }
 
   seterrobj(ADMINLIMIT_EXCEEDED);
+  seterrobj(VLV_ERROR);
   seterrobj(AFFECTS_MULTIPLE_DSAS);
   seterrobj(ALIAS_DEREF_PROBLEM);
+  seterrobj(X_PROXY_AUTHZ_FAILURE);
   seterrobj(ALIAS_PROBLEM);
   seterrobj(ALREADY_EXISTS);
   seterrobj(AUTH_UNKNOWN);
@@ -150,6 +152,7 @@ LDAPinit_errors( PyObject*d ) {
   seterrobj(CLIENT_LOOP);
   seterrobj(COMPARE_FALSE);
   seterrobj(COMPARE_TRUE);
+  seterrobj(AUTH_METHOD_NOT_SUPPORTED);
   seterrobj(CONFIDENTIALITY_REQUIRED);
   seterrobj(CONNECT_ERROR);
   seterrobj(CONSTRAINT_VIOLATION);

From 44439cc639fca6211181449a1323b7a236dd998a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 23 Jun 2015 09:45:09 +0000
Subject: [PATCH 171/868] Sorted seterrobj() lines

---
 Modules/errors.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Modules/errors.c b/Modules/errors.c
index 64793db..ece438d 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,7 +2,7 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.24 2015/06/23 09:44:04 stroeder Exp $ */
+ * $Id: errors.c,v 1.25 2015/06/23 09:45:09 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -141,18 +141,16 @@ LDAPinit_errors( PyObject*d ) {
   }
 
   seterrobj(ADMINLIMIT_EXCEEDED);
-  seterrobj(VLV_ERROR);
   seterrobj(AFFECTS_MULTIPLE_DSAS);
   seterrobj(ALIAS_DEREF_PROBLEM);
-  seterrobj(X_PROXY_AUTHZ_FAILURE);
   seterrobj(ALIAS_PROBLEM);
   seterrobj(ALREADY_EXISTS);
+  seterrobj(AUTH_METHOD_NOT_SUPPORTED);
   seterrobj(AUTH_UNKNOWN);
   seterrobj(BUSY);
   seterrobj(CLIENT_LOOP);
   seterrobj(COMPARE_FALSE);
   seterrobj(COMPARE_TRUE);
-  seterrobj(AUTH_METHOD_NOT_SUPPORTED);
   seterrobj(CONFIDENTIALITY_REQUIRED);
   seterrobj(CONNECT_ERROR);
   seterrobj(CONSTRAINT_VIOLATION);
@@ -171,15 +169,15 @@ LDAPinit_errors( PyObject*d ) {
   seterrobj(LOOP_DETECT);
   seterrobj(MORE_RESULTS_TO_RETURN);
   seterrobj(NAMING_VIOLATION);
-  seterrobj(NO_OBJECT_CLASS_MODS);
-  seterrobj(NOT_ALLOWED_ON_NONLEAF);
-  seterrobj(NOT_ALLOWED_ON_RDN);
-  seterrobj(NOT_SUPPORTED);
   seterrobj(NO_MEMORY);
   seterrobj(NO_OBJECT_CLASS_MODS);
+  seterrobj(NO_OBJECT_CLASS_MODS);
   seterrobj(NO_RESULTS_RETURNED);
   seterrobj(NO_SUCH_ATTRIBUTE);
   seterrobj(NO_SUCH_OBJECT);
+  seterrobj(NOT_ALLOWED_ON_NONLEAF);
+  seterrobj(NOT_ALLOWED_ON_RDN);
+  seterrobj(NOT_SUPPORTED);
   seterrobj(OBJECT_CLASS_VIOLATION);
   seterrobj(OPERATIONS_ERROR);
   seterrobj(OTHER);
@@ -203,6 +201,8 @@ LDAPinit_errors( PyObject*d ) {
   seterrobj(UNDEFINED_TYPE);
   seterrobj(UNWILLING_TO_PERFORM);
   seterrobj(USER_CANCELLED);
+  seterrobj(VLV_ERROR);
+  seterrobj(X_PROXY_AUTHZ_FAILURE);
 
 #ifdef LDAP_API_FEATURE_CANCEL
   seterrobj(CANCELLED);

From 14506e91c1808fecd6178973705ce51311391672 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 7 Jul 2015 12:46:31 +0000
Subject: [PATCH 172/868] cosmetic line wrapping

---
 Lib/ldap/controls/vlv.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index 8a2c7f9..afe0613 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: vlv.py,v 1.2 2015/06/22 17:55:01 stroeder Exp $
+$Id: vlv.py,v 1.3 2015/07/07 12:46:31 stroeder Exp $
 """
 
 __all__ = [
@@ -45,6 +45,7 @@ class VirtualListViewRequestType(univ.Sequence):
             namedtype.NamedType('target', TargetType()),
             namedtype.OptionalNamedType('contextID', univ.OctetString()))
 
+
 class VLVRequestControl(RequestControl):
     controlType = '2.16.840.1.113730.3.4.9'
 
@@ -59,9 +60,11 @@ def __init__(
         context_id=None,
     ):
         RequestControl.__init__(self,self.controlType,criticality)
-        assert (offset is not None and content_count is not None) or greater_than_or_equal, 'offset and ' \
-            'content_count must be set together or greater_than_or_equal must be ' \
-            'used'
+        assert (offset is not None and content_count is not None) or \
+               greater_than_or_equal, \
+            ValueError(
+                'offset and content_count must be set together or greater_than_or_equal must be used'
+            )
         self.before_count = before_count
         self.after_count = after_count
         self.offset = offset

From 7833bb707250b4e84f8983afbc88192da4996ef3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 7 Jul 2015 12:50:15 +0000
Subject: [PATCH 173/868] Stronger wording regarding experimental status of
 VLV/SSS support

---
 CHANGES | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9ff9e9a..a7dd38b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -27,9 +27,10 @@ Lib/
   - Removed non-existent 'AttrTypeandValueLDIF' from ldif.__all__
 * New mix-in class ldap.controls.openldap.SearchNoOpMixIn
   adds convience method noop_search_st() to LDAPObject class
-* Added new experimental modules which implement the control classes
+* Added new modules which implement the control classes
   for Virtual List View (see draft-ietf-ldapext-ldapv3-vlv) and
   Server-side Sorting (see RFC 2891) (thanks to Benjamin Dauvergne)
+  Note: This is still experimental! Even the API can change later.
 
 ----------------------------------------------------------------
 Released 2.4.19 2015-01-10
@@ -1177,4 +1178,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.348 2015/06/23 09:44:04 stroeder Exp $
+$Id: CHANGES,v 1.349 2015/07/07 12:50:15 stroeder Exp $

From 69335a5af193290d1522f4dde19b6e71fb383949 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 7 Jul 2015 13:21:42 +0000
Subject: [PATCH 174/868] Prepare release 2.4.20

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index a7dd38b..17ec6c7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.20 2015-05-xx
+Released 2.4.20 2015-07-07
 
 Changes since 2.4.19:
 
@@ -1178,4 +1178,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.349 2015/07/07 12:50:15 stroeder Exp $
+$Id: CHANGES,v 1.350 2015/07/07 13:21:42 stroeder Exp $

From b4410cec3db48cd429f8fae78cf3b3f34f7fc827 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 8 Aug 2015 13:36:30 +0000
Subject: [PATCH 175/868] Started 2.4.21

---
 CHANGES              | 9 ++++++++-
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 17ec6c7..76830ab 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+----------------------------------------------------------------
+Released 2.4.21 2015-07-xx
+
+Changes since 2.4.20:
+
+Lib/
+
 ----------------------------------------------------------------
 Released 2.4.20 2015-07-07
 
@@ -1178,4 +1185,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.350 2015/07/07 13:21:42 stroeder Exp $
+$Id: CHANGES,v 1.351 2015/08/08 13:36:30 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 1cc3b2f..65e3b9f 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.37 2015/06/05 21:04:58 stroeder Exp $
+$Id: dsml.py,v 1.38 2015/08/08 13:36:30 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.20'
+__version__ = '2.4.21'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 466ec0d..c7d59e2 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.97 2015/06/05 21:04:58 stroeder Exp $
+$Id: __init__.py,v 1.98 2015/08/08 13:36:30 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.20'
+__version__ = '2.4.21'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index a43c59b..c6a7ef0 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.72 2015/06/06 09:21:37 stroeder Exp $
+\$Id: ldapurl.py,v 1.73 2015/08/08 13:36:30 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.20'
+__version__ = '2.4.21'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 447b1c7..d099f42 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.82 2015/06/21 11:38:32 stroeder Exp $
+$Id: ldif.py,v 1.83 2015/08/08 13:36:30 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.20'
+__version__ = '2.4.21'
 
 __all__ = [
   # constants

From 983bf24d350f511069825844ec5584b50ce07a3e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 8 Aug 2015 13:37:41 +0000
Subject: [PATCH 176/868] LDAPObject.read_s() now returns None instead of
 raising ldap.NO_SUCH_OBJECT in case the search operation returned emtpy
 result.

---
 CHANGES                | 4 +++-
 Lib/ldap/ldapobject.py | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 76830ab..9d03e6c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,8 @@ Released 2.4.21 2015-07-xx
 Changes since 2.4.20:
 
 Lib/
+* LDAPObject.read_s() now returns None instead of raising 
+  ldap.NO_SUCH_OBJECT in case the search operation returned emtpy result.
 
 ----------------------------------------------------------------
 Released 2.4.20 2015-07-07
@@ -1185,4 +1187,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.351 2015/08/08 13:36:30 stroeder Exp $
+$Id: CHANGES,v 1.352 2015/08/08 13:37:41 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index f29d316..c807973 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.146 2015/06/11 15:13:43 stroeder Exp $
+\$Id: ldapobject.py,v 1.147 2015/08/08 13:37:41 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -695,7 +695,7 @@ def read_s(self,dn,filterstr=None,attrlist=None,serverctrls=None,clientctrls=Non
     if r:
       return r[0][1]
     else:
-      raise ldap.NO_SUCH_OBJECT('Empty search result reading entry %s' % (repr(dn)))
+      return None
 
   def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     """

From b1ee70bf7e8e59d7b30dd5439d0b19d3d67436b8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 8 Aug 2015 14:13:30 +0000
Subject: [PATCH 177/868] Handle s_temp==None

---
 Lib/ldap/schema/subentry.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 60fca93..042e128 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: subentry.py,v 1.35 2015/06/06 09:21:38 stroeder Exp $
+\$Id: subentry.py,v 1.36 2015/08/08 14:13:30 stroeder Exp $
 """
 
 import ldap.cidict,ldap.schema
@@ -483,6 +483,7 @@ def urlfetch(uri,trace_level=0):
     subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
   # Work-around for mixed-cased attribute names
   subschemasubentry_entry = ldap.cidict.cidict()
+  s_temp = s_temp or {}
   for at,av in s_temp.items():
     if at in SCHEMA_CLASS_MAPPING:
       try:

From 4fb8c92e47cdc7aeb80945744c38f5bea2e4c23b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 18 Sep 2015 14:51:44 +0000
Subject: [PATCH 178/868] Unit tests for module ldif

---
 CHANGES         |   5 +-
 Tests/t_ldif.py | 132 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 Tests/t_ldif.py

diff --git a/CHANGES b/CHANGES
index 9d03e6c..8869884 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,9 @@ Lib/
 * LDAPObject.read_s() now returns None instead of raising 
   ldap.NO_SUCH_OBJECT in case the search operation returned emtpy result.
 
+Tests/
+* Unit tests for module ldif (thanks to Petr Viktorin)
+
 ----------------------------------------------------------------
 Released 2.4.20 2015-07-07
 
@@ -1187,4 +1190,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.352 2015/08/08 13:37:41 stroeder Exp $
+$Id: CHANGES,v 1.353 2015/09/18 14:51:44 stroeder Exp $
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
new file mode 100644
index 0000000..8620b05
--- /dev/null
+++ b/Tests/t_ldif.py
@@ -0,0 +1,132 @@
+# -*- coding: utf-8 -*-
+
+import unittest
+import textwrap
+
+import ldif
+
+
+try:
+    from StringIO import StringIO
+except ImportError:
+    from io import StringIO
+
+
+class TestParse(unittest.TestCase):
+    maxDiff = None
+
+    def check_ldif_to_records(self, ldif_string, expected):
+        #import pdb; pdb.set_trace()
+        got = ldif.ParseLDIF(StringIO(ldif_string))
+        self.assertEqual(got, expected)
+
+    def check_records_to_ldif(self, records, expected):
+        f = StringIO()
+        ldif_writer = ldif.LDIFWriter(f)
+        for dn, attrs in records:
+            ldif_writer.unparse(dn, attrs)
+        got = f.getvalue()
+        self.assertEqual(got, expected)
+
+    def check_roundtrip(self, ldif_source, records, ldif_expected=None):
+        ldif_source = textwrap.dedent(ldif_source).lstrip() + '\n'
+        if ldif_expected is None:
+            ldif_expected = ldif_source
+        else:
+            ldif_expected = textwrap.dedent(ldif_expected).lstrip() + '\n'
+
+        self.check_ldif_to_records(ldif_source, records)
+        self.check_records_to_ldif(records, ldif_expected)
+        self.check_ldif_to_records(ldif_expected, records)
+
+    def test_simple(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                attrib: value
+                attrib: value2
+            """, [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2']}),
+            ])
+
+    def test_multiple(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                a: v
+                attrib: value
+                attrib: value2
+
+                dn: cn=a,cn=b,cn=c
+                attrib: value2
+                attrib: value3
+                b: v
+            """, [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2'], 'a': [b'v']}),
+                ('cn=a,cn=b,cn=c', {'attrib': [b'value2', b'value3'], 'b': [b'v']}),
+            ])
+
+    def test_folded(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                attrib: very
+                 long
+                  value
+                attrib2: %s
+            """ % ('asdf.' * 20), [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'verylong value'],
+                                    'attrib2': [b'asdf.' * 20]}),
+            ], """
+                dn: cn=x,cn=y,cn=z
+                attrib: verylong value
+                attrib2: asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.as
+                 df.asdf.asdf.asdf.asdf.asdf.asdf.
+            """)
+
+    def test_empty(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                attrib: 
+                attrib: foo
+            """, [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'', b'foo']}),
+            ])
+
+    def test_binary(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                attrib:: CQAKOiVA
+            """, [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'\t\0\n:%@']}),
+            ])
+
+    def test_unicode(self):
+        self.check_roundtrip("""
+                dn: cn=Michael Stroeder,dc=stroeder,dc=com
+                lastname: Ströder
+            """, [
+                ('cn=Michael Stroeder,dc=stroeder,dc=com',
+                 {'lastname': [b'Str\303\266der']}),
+            ], """
+                dn: cn=Michael Stroeder,dc=stroeder,dc=com
+                lastname:: U3Ryw7ZkZXI=
+            """)
+
+    def test_sorted(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                b: value_b
+                c: value_c
+                a: value_a
+            """, [
+                ('cn=x,cn=y,cn=z', {'a': [b'value_a'],
+                                    'b': [b'value_b'],
+                                    'c': [b'value_c']}),
+            ], """
+                dn: cn=x,cn=y,cn=z
+                a: value_a
+                b: value_b
+                c: value_c
+            """)
+
+
+if __name__ == '__main__':
+    unittest.main()

From dc620855f6c3e678847572033956b6276c09a15d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 18 Sep 2015 17:24:39 +0000
Subject: [PATCH 179/868] Added encoding header

---
 Lib/ldap/controls/openldap.py     | 3 ++-
 Lib/ldap/controls/sessiontrack.py | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 55f3d0c..53425e0 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -1,9 +1,10 @@
+# -*- coding: utf-8 -*-
 """
 ldap.controls.openldap - classes for OpenLDAP-specific controls
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: openldap.py,v 1.3 2015/06/22 17:56:50 stroeder Exp $
+$Id: openldap.py,v 1.4 2015/09/18 17:24:39 stroeder Exp $
 """
 
 import ldap.controls
diff --git a/Lib/ldap/controls/sessiontrack.py b/Lib/ldap/controls/sessiontrack.py
index 285c637..e3b7042 100644
--- a/Lib/ldap/controls/sessiontrack.py
+++ b/Lib/ldap/controls/sessiontrack.py
@@ -1,10 +1,11 @@
+# -*- coding: utf-8 -*-
 """
 ldap.controls.sessiontrack - class for session tracking control
 (see draft-wahl-ldap-session)
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: sessiontrack.py,v 1.4 2013/07/04 16:20:06 stroeder Exp $
+$Id: sessiontrack.py,v 1.5 2015/09/18 17:25:07 stroeder Exp $
 """
 
 from ldap.controls import RequestControl

From f79033ba4aef955315842119f3f1fbc9b5fb2fbb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 18 Sep 2015 17:24:55 +0000
Subject: [PATCH 180/868] Added encoding header; removed shee-bang

---
 Lib/ldap/controls/readentry.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/readentry.py b/Lib/ldap/controls/readentry.py
index 19ba9d5..5ff8dca 100644
--- a/Lib/ldap/controls/readentry.py
+++ b/Lib/ldap/controls/readentry.py
@@ -1,11 +1,11 @@
-#!/usr/bin/env python
+# -*- coding: utf-8 -*-
 """
 ldap.controls.readentry - classes for the Read Entry controls
 (see RFC 4527)
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: readentry.py,v 1.4 2011/07/28 08:57:12 stroeder Exp $
+$Id: readentry.py,v 1.5 2015/09/18 17:24:55 stroeder Exp $
 """
 
 import ldap

From 620990614ec3d4ed7e31681f0e111e9a9fc11aa9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 18 Sep 2015 20:20:32 +0000
Subject: [PATCH 181/868] ldap.resiter.ResultProcessor.allresults() now takes
 new key-word argument add_ctrls which is internally passed to
 LDAPObject.result4() and lets the method also return response control along
 with the search results.

---
 CHANGES             | 6 +++++-
 Lib/ldap/resiter.py | 8 ++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8869884..3e88321 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,10 @@ Changes since 2.4.20:
 Lib/
 * LDAPObject.read_s() now returns None instead of raising 
   ldap.NO_SUCH_OBJECT in case the search operation returned emtpy result.
+* ldap.resiter.ResultProcessor.allresults() now takes new key-word
+  argument add_ctrls which is internally passed to LDAPObject.result4()
+  and lets the method also return response control along with the search 
+  results.
 
 Tests/
 * Unit tests for module ldif (thanks to Petr Viktorin)
@@ -1190,4 +1194,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.353 2015/09/18 14:51:44 stroeder Exp $
+$Id: CHANGES,v 1.354 2015/09/18 20:20:32 stroeder Exp $
diff --git a/Lib/ldap/resiter.py b/Lib/ldap/resiter.py
index e34fad6..fdbbc3e 100644
--- a/Lib/ldap/resiter.py
+++ b/Lib/ldap/resiter.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: resiter.py,v 1.6 2011/07/28 08:23:32 stroeder Exp $
+\$Id: resiter.py,v 1.7 2015/09/18 20:20:32 stroeder Exp $
 
 Python compability note:
 Requires Python 2.3+
@@ -15,15 +15,15 @@ class ResultProcessor:
   Mix-in class used with ldap.ldapopbject.LDAPObject or derived classes.
   """
 
-  def allresults(self,msgid,timeout=-1):
+  def allresults(self,msgid,timeout=-1,add_ctrls=0):
     """
     Generator function which returns an iterator for processing all LDAP operation
     results of the given msgid retrieved with LDAPObject.result3() -> 4-tuple
     """
-    result_type,result_list,result_msgid,result_serverctrls = self.result3(msgid,0,timeout)
+    result_type,result_list,result_msgid,result_serverctrls,_,_ = self.result4(msgid,0,timeout,add_ctrls=add_ctrls)
     while result_type and result_list:
       # Loop over list of search results
       for result_item in result_list:
         yield (result_type,result_list,result_msgid,result_serverctrls)
-      result_type,result_list,result_msgid,result_serverctrls = self.result3(msgid,0,timeout)
+      result_type,result_list,result_msgid,result_serverctrls,_,_ = self.result4(msgid,0,timeout,add_ctrls=add_ctrls)
     return # allresults()

From 96525a0b614663ae6272c4d2d8135df0df65825c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 19 Sep 2015 13:38:30 +0000
Subject: [PATCH 182/868] Added ldap.controls.deref implementing support for
 dereference control

---
 CHANGES                     |   3 +-
 Demo/pyasn1/derefcontrol.py |  47 ++++++++++++++
 Lib/ldap/controls/deref.py  | 125 ++++++++++++++++++++++++++++++++++++
 setup.py                    |   3 +-
 4 files changed, 176 insertions(+), 2 deletions(-)
 create mode 100644 Demo/pyasn1/derefcontrol.py
 create mode 100644 Lib/ldap/controls/deref.py

diff --git a/CHANGES b/CHANGES
index 3e88321..2e10005 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,7 @@ Lib/
   argument add_ctrls which is internally passed to LDAPObject.result4()
   and lets the method also return response control along with the search 
   results.
+* Added ldap.controls.deref implementing support for dereference control
 
 Tests/
 * Unit tests for module ldif (thanks to Petr Viktorin)
@@ -1194,4 +1195,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.354 2015/09/18 20:20:32 stroeder Exp $
+$Id: CHANGES,v 1.355 2015/09/19 13:38:30 stroeder Exp $
diff --git a/Demo/pyasn1/derefcontrol.py b/Demo/pyasn1/derefcontrol.py
new file mode 100644
index 0000000..885b66e
--- /dev/null
+++ b/Demo/pyasn1/derefcontrol.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python
+"""
+This sample script demonstrates the use of the dereference control
+(see https://tools.ietf.org/html/draft-masarati-ldap-deref)
+
+Requires module pyasn1 (see http://pyasn1.sourceforge.net/)
+"""
+
+import pprint,ldap,ldap.modlist,ldap.resiter
+
+from ldap.controls.deref import DereferenceControl
+
+uri = "ldap://localhost:2071/"
+
+class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
+  pass
+
+
+l = MyLDAPObject(uri,trace_level=2)
+l.simple_bind_s('uid=diradm,dc=example,dc=com','testsecret')
+
+dc = DereferenceControl(
+  True,
+  {
+    'member':[
+      'uid',
+      'description',
+#      'cn',
+#      'mail',
+    ],
+  }
+)
+print dc._derefSpecs().prettyPrint()
+dc.encodeControlValue()
+
+msg_id = l.search_ext(
+  'dc=example,dc=com',
+  ldap.SCOPE_SUBTREE,
+  '(objectClass=groupOfNames)',
+  attrlist=['cn','objectClass','member','description'],
+  serverctrls = [dc]
+)
+
+for res_type,res_data,res_msgid,res_controls in l.allresults(msg_id,add_ctrls=1):
+  for dn,entry,deref_control in res_data:
+    # process dn and entry
+    print dn,entry['objectClass']
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
new file mode 100644
index 0000000..c8cef79
--- /dev/null
+++ b/Lib/ldap/controls/deref.py
@@ -0,0 +1,125 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.controls.deref - classes for 
+(see https://tools.ietf.org/html/draft-masarati-ldap-deref)
+
+See http://www.python-ldap.org/ for project details.
+
+$Id: deref.py,v 1.1 2015/09/19 13:38:30 stroeder Exp $
+"""
+
+__all__ = [
+  'DEREF_CONTROL_OID',
+  'DereferenceControl',
+]
+
+import ldap.controls
+from ldap.controls import LDAPControl,KNOWN_RESPONSE_CONTROLS
+
+import pyasn1_modules.rfc2251
+from pyasn1.type import namedtype,univ,tag
+from pyasn1.codec.ber import encoder,decoder
+from pyasn1_modules.rfc2251 import LDAPDN,AttributeDescription,AttributeDescriptionList,AttributeValue
+
+
+DEREF_CONTROL_OID = '1.3.6.1.4.1.4203.666.5.16'
+
+
+# Request types
+#---------------------------------------------------------------------------
+
+# For compability with ASN.1 declaration in I-D
+AttributeList = AttributeDescriptionList
+
+class DerefSpec(univ.Sequence):
+  componentType = namedtype.NamedTypes(
+    namedtype.NamedType(
+      'derefAttr',
+      AttributeDescription()
+    ),
+    namedtype.NamedType(
+      'attributes',
+      AttributeList()
+    ),
+  )
+
+class DerefSpecs(univ.SequenceOf):
+  componentType = DerefSpec()
+
+# Response types
+#---------------------------------------------------------------------------
+
+
+class AttributeValues(univ.SetOf):
+    componentType = AttributeValue()
+
+
+class PartialAttribute(univ.Sequence):
+  componentType = namedtype.NamedTypes(
+    namedtype.NamedType('type', AttributeDescription()),
+    namedtype.NamedType('vals', AttributeValues()),
+  )
+
+
+class PartialAttributeList(univ.SequenceOf):
+  componentType = PartialAttribute()
+  tagSet = univ.Sequence.tagSet.tagImplicitly(
+    tag.Tag(tag.tagClassContext,tag.tagFormatConstructed,0)
+  )
+
+
+class DerefRes(univ.Sequence):
+  componentType = namedtype.NamedTypes(
+    namedtype.NamedType('derefAttr', AttributeDescription()),
+    namedtype.NamedType('derefVal', LDAPDN()),
+    namedtype.OptionalNamedType('attrVals', PartialAttributeList()),
+  )
+
+
+class DerefResultControlValue(univ.SequenceOf):
+    componentType = DerefRes()
+
+
+class DereferenceControl(LDAPControl):
+  controlType = DEREF_CONTROL_OID
+
+  def __init__(self,criticality=False,derefSpecs=None):
+    LDAPControl.__init__(self,self.controlType,criticality)
+    self.derefSpecs = derefSpecs or {}
+
+  def _derefSpecs(self):
+    deref_specs = DerefSpecs()
+    i = 0
+    for deref_attr,deref_attribute_names in self.derefSpecs.items():
+      deref_spec = DerefSpec()
+      deref_attributes = AttributeList()
+      for j in range(len(deref_attribute_names)):
+        deref_attributes.setComponentByPosition(j,deref_attribute_names[j])
+      deref_spec.setComponentByName('derefAttr',AttributeDescription(deref_attr))
+      deref_spec.setComponentByName('attributes',deref_attributes)
+      deref_specs.setComponentByPosition(i,deref_spec)
+      i += 1
+    return deref_specs
+
+  def encodeControlValue(self):
+    return encoder.encode(self._derefSpecs())
+
+  def decodeControlValue(self,encodedControlValue):
+    decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=DerefResultControlValue())
+    print decodedValue.prettyPrint()
+    self.derefRes = {}
+    for deref_res in decodedValue:
+      deref_attr,deref_val,deref_vals = deref_res
+      partial_attrs_dict = dict([
+        (str(t),map(str,v))
+        for t,v in deref_vals or []
+      ])
+      try:
+        self.derefRes[str(deref_attr)].append((str(deref_val),partial_attrs_dict))
+      except KeyError:
+        self.derefRes[str(deref_attr)] = [(str(deref_val),partial_attrs_dict)]
+    import pprint
+    pprint.pprint(self.derefRes)
+
+
+KNOWN_RESPONSE_CONTROLS[DereferenceControl.controlType] = DereferenceControl
diff --git a/setup.py b/setup.py
index b2fe367..868d2f0 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.72 2014/03/12 20:29:23 stroeder Exp $
+$Id: setup.py,v 1.73 2015/09/19 13:38:30 stroeder Exp $
 """
 
 has_setuptools = False
@@ -150,6 +150,7 @@ class OpenLDAP2:
     'ldap',
     'ldap.async',
     'ldap.controls',
+    'ldap.controls.deref',
     'ldap.controls.libldap',
     'ldap.controls.openldap',
     'ldap.controls.ppolicy',

From 4d2fdec00cbab889dc9c2f79fcf0da114c167caa Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 19 Sep 2015 13:41:01 +0000
Subject: [PATCH 183/868] Removed debug print statements

---
 Lib/ldap/controls/deref.py | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index c8cef79..02c68b7 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: deref.py,v 1.1 2015/09/19 13:38:30 stroeder Exp $
+$Id: deref.py,v 1.2 2015/09/19 13:41:01 stroeder Exp $
 """
 
 __all__ = [
@@ -106,7 +106,6 @@ def encodeControlValue(self):
 
   def decodeControlValue(self,encodedControlValue):
     decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=DerefResultControlValue())
-    print decodedValue.prettyPrint()
     self.derefRes = {}
     for deref_res in decodedValue:
       deref_attr,deref_val,deref_vals = deref_res
@@ -118,8 +117,6 @@ def decodeControlValue(self,encodedControlValue):
         self.derefRes[str(deref_attr)].append((str(deref_val),partial_attrs_dict))
       except KeyError:
         self.derefRes[str(deref_attr)] = [(str(deref_val),partial_attrs_dict)]
-    import pprint
-    pprint.pprint(self.derefRes)
 
 
 KNOWN_RESPONSE_CONTROLS[DereferenceControl.controlType] = DereferenceControl

From 3a84c23bec0d4db25865dac4463dc4a27d628ddc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 19 Sep 2015 13:45:47 +0000
Subject: [PATCH 184/868] Less but better output

---
 Demo/pyasn1/derefcontrol.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Demo/pyasn1/derefcontrol.py b/Demo/pyasn1/derefcontrol.py
index 885b66e..03b3bde 100644
--- a/Demo/pyasn1/derefcontrol.py
+++ b/Demo/pyasn1/derefcontrol.py
@@ -16,7 +16,7 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
   pass
 
 
-l = MyLDAPObject(uri,trace_level=2)
+l = MyLDAPObject(uri,trace_level=0)
 l.simple_bind_s('uid=diradm,dc=example,dc=com','testsecret')
 
 dc = DereferenceControl(
@@ -30,8 +30,9 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
     ],
   }
 )
+
+print 'pyasn1 output of request control:'
 print dc._derefSpecs().prettyPrint()
-dc.encodeControlValue()
 
 msg_id = l.search_ext(
   'dc=example,dc=com',
@@ -45,3 +46,5 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
   for dn,entry,deref_control in res_data:
     # process dn and entry
     print dn,entry['objectClass']
+    if deref_control:
+      pprint.pprint(deref_control[0].derefRes)

From 60a67e990501dcf007364097e16d07d827537945 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 19 Sep 2015 16:00:39 +0000
Subject: [PATCH 185/868] Use public FreeIPA demo server running 389-ds

---
 Demo/pyasn1/derefcontrol.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Demo/pyasn1/derefcontrol.py b/Demo/pyasn1/derefcontrol.py
index 03b3bde..4ac5155 100644
--- a/Demo/pyasn1/derefcontrol.py
+++ b/Demo/pyasn1/derefcontrol.py
@@ -10,14 +10,14 @@
 
 from ldap.controls.deref import DereferenceControl
 
-uri = "ldap://localhost:2071/"
+uri = "ldap://ipa.demo1.freeipa.org"
 
 class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
   pass
 
 
 l = MyLDAPObject(uri,trace_level=0)
-l.simple_bind_s('uid=diradm,dc=example,dc=com','testsecret')
+l.simple_bind_s('uid=admin,cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org','Secret123')
 
 dc = DereferenceControl(
   True,
@@ -25,8 +25,8 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
     'member':[
       'uid',
       'description',
-#      'cn',
-#      'mail',
+      'cn',
+      'mail',
     ],
   }
 )
@@ -35,7 +35,7 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
 print dc._derefSpecs().prettyPrint()
 
 msg_id = l.search_ext(
-  'dc=example,dc=com',
+  'dc=demo1,dc=freeipa,dc=org',
   ldap.SCOPE_SUBTREE,
   '(objectClass=groupOfNames)',
   attrlist=['cn','objectClass','member','description'],

From d977e94b088fd0bd53623a80fda5e506d68d0d96 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 25 Sep 2015 16:21:47 +0000
Subject: [PATCH 186/868] Prepare release 2.4.21

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2e10005..df17338 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.21 2015-07-xx
+Released 2.4.21 2015-09-25
 
 Changes since 2.4.20:
 
@@ -1195,4 +1195,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.355 2015/09/19 13:38:30 stroeder Exp $
+$Id: CHANGES,v 1.356 2015/09/25 16:21:47 stroeder Exp $

From b994312f31550a3f57106d76336befed0bb901d7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 30 Sep 2015 17:15:53 +0000
Subject: [PATCH 187/868] Started 2.4.22

---
 CHANGES              | 9 ++++++++-
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index df17338..586e687 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+----------------------------------------------------------------
+Released 2.4.22 2015-10-xx
+
+Changes since 2.4.21:
+
+Lib/
+
 ----------------------------------------------------------------
 Released 2.4.21 2015-09-25
 
@@ -1195,4 +1202,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.356 2015/09/25 16:21:47 stroeder Exp $
+$Id: CHANGES,v 1.357 2015/09/30 17:15:53 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 65e3b9f..6db30c8 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.38 2015/08/08 13:36:30 stroeder Exp $
+$Id: dsml.py,v 1.39 2015/09/30 17:15:53 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.21'
+__version__ = '2.4.22'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index c7d59e2..cecec33 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.98 2015/08/08 13:36:30 stroeder Exp $
+$Id: __init__.py,v 1.99 2015/09/30 17:15:53 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.21'
+__version__ = '2.4.22'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index c6a7ef0..e5bf13d 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.73 2015/08/08 13:36:30 stroeder Exp $
+\$Id: ldapurl.py,v 1.74 2015/09/30 17:15:53 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.21'
+__version__ = '2.4.22'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index d099f42..36f302d 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.83 2015/08/08 13:36:30 stroeder Exp $
+$Id: ldif.py,v 1.84 2015/09/30 17:15:53 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.21'
+__version__ = '2.4.22'
 
 __all__ = [
   # constants

From c74ad898458332c5e2325e5167d635434be490be Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 30 Sep 2015 17:17:28 +0000
Subject: [PATCH 188/868] LDIFParser now also accepts value-spec without a
 space after the colon

---
 CHANGES     | 4 +++-
 Lib/ldif.py | 8 ++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 586e687..a5540e5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,8 @@ Released 2.4.22 2015-10-xx
 Changes since 2.4.21:
 
 Lib/
+* LDIFParser now also accepts value-spec without a space
+  after the colon.
 
 ----------------------------------------------------------------
 Released 2.4.21 2015-09-25
@@ -1202,4 +1204,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.357 2015/09/30 17:15:53 stroeder Exp $
+$Id: CHANGES,v 1.358 2015/09/30 17:17:28 stroeder Exp $
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 36f302d..47df877 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.84 2015/09/30 17:15:53 stroeder Exp $
+$Id: ldif.py,v 1.85 2015/09/30 17:17:28 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -324,7 +324,7 @@ def _next_key_and_value(self):
     # if needed attribute value is BASE64 decoded
     value_spec = unfolded_line[colon_pos:colon_pos+2]
     if value_spec==': ':
-      attr_value = unfolded_line[colon_pos+2:]
+      attr_value = unfolded_line[colon_pos+2:].lstrip()
     elif value_spec=='::':
       # attribute value needs base64-decoding
       attr_value = base64.decodestring(unfolded_line[colon_pos+2:])
@@ -336,8 +336,8 @@ def _next_key_and_value(self):
         u = urlparse.urlparse(url)
         if self._process_url_schemes.has_key(u[0]):
           attr_value = urllib.urlopen(url).read()
-    elif value_spec==':\r\n' or value_spec=='\n':
-      attr_value = ''
+    else:
+      attr_value = unfolded_line[colon_pos+1:]
     return attr_type,attr_value
 
   def parse_entry_records(self):

From 4d09415f224f495bdce6215c81564f0be8fb23ae Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 30 Sep 2015 17:19:00 +0000
Subject: [PATCH 189/868] Always compare parsed lists and not LDIF strings

---
 Tests/t_ldif.py | 55 +++++++++++++++++++++----------------------------
 1 file changed, 23 insertions(+), 32 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 8620b05..d841dae 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -15,29 +15,24 @@
 class TestParse(unittest.TestCase):
     maxDiff = None
 
-    def check_ldif_to_records(self, ldif_string, expected):
-        #import pdb; pdb.set_trace()
-        got = ldif.ParseLDIF(StringIO(ldif_string))
-        self.assertEqual(got, expected)
+    def _parse_entry_records(self, ldif_string):
+        return ldif.ParseLDIF(StringIO(ldif_string))
 
-    def check_records_to_ldif(self, records, expected):
+    def _unparse_entry_records(self, records):
         f = StringIO()
         ldif_writer = ldif.LDIFWriter(f)
         for dn, attrs in records:
             ldif_writer.unparse(dn, attrs)
-        got = f.getvalue()
-        self.assertEqual(got, expected)
+        return f.getvalue()
 
-    def check_roundtrip(self, ldif_source, records, ldif_expected=None):
+    def check_roundtrip(self, ldif_source, entry_records):
         ldif_source = textwrap.dedent(ldif_source).lstrip() + '\n'
-        if ldif_expected is None:
-            ldif_expected = ldif_source
-        else:
-            ldif_expected = textwrap.dedent(ldif_expected).lstrip() + '\n'
-
-        self.check_ldif_to_records(ldif_source, records)
-        self.check_records_to_ldif(records, ldif_expected)
-        self.check_ldif_to_records(ldif_expected, records)
+        parsed_entry_records = self._parse_entry_records(ldif_source)
+        parsed_entry_records2 = self._parse_entry_records(
+            self._unparse_entry_records(entry_records)
+        )
+        self.assertEqual(parsed_entry_records, entry_records)
+        self.assertEqual(parsed_entry_records2, entry_records)
 
     def test_simple(self):
         self.check_roundtrip("""
@@ -48,6 +43,15 @@ def test_simple(self):
                 ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2']}),
             ])
 
+    def test_simple2(self):
+        self.check_roundtrip("""
+                dn:cn=x,cn=y,cn=z
+                attrib:value
+                attrib:value2
+            """, [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2']}),
+            ])
+
     def test_multiple(self):
         self.check_roundtrip("""
                 dn: cn=x,cn=y,cn=z
@@ -74,12 +78,7 @@ def test_folded(self):
             """ % ('asdf.' * 20), [
                 ('cn=x,cn=y,cn=z', {'attrib': [b'verylong value'],
                                     'attrib2': [b'asdf.' * 20]}),
-            ], """
-                dn: cn=x,cn=y,cn=z
-                attrib: verylong value
-                attrib2: asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.asdf.as
-                 df.asdf.asdf.asdf.asdf.asdf.asdf.
-            """)
+            ])
 
     def test_empty(self):
         self.check_roundtrip("""
@@ -105,10 +104,7 @@ def test_unicode(self):
             """, [
                 ('cn=Michael Stroeder,dc=stroeder,dc=com',
                  {'lastname': [b'Str\303\266der']}),
-            ], """
-                dn: cn=Michael Stroeder,dc=stroeder,dc=com
-                lastname:: U3Ryw7ZkZXI=
-            """)
+            ])
 
     def test_sorted(self):
         self.check_roundtrip("""
@@ -120,12 +116,7 @@ def test_sorted(self):
                 ('cn=x,cn=y,cn=z', {'a': [b'value_a'],
                                     'b': [b'value_b'],
                                     'c': [b'value_c']}),
-            ], """
-                dn: cn=x,cn=y,cn=z
-                a: value_a
-                b: value_b
-                c: value_c
-            """)
+            ])
 
 
 if __name__ == '__main__':

From a4ed5141bba0fc87b0d422cdeec837328d359e81 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 30 Sep 2015 17:41:46 +0000
Subject: [PATCH 190/868] Added test case for :: without trailing space

---
 Tests/t_ldif.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index d841dae..efd69ec 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -97,6 +97,14 @@ def test_binary(self):
                 ('cn=x,cn=y,cn=z', {'attrib': [b'\t\0\n:%@']}),
             ])
 
+    def test_binary2(self):
+        self.check_roundtrip("""
+                dn: cn=x,cn=y,cn=z
+                attrib::CQAKOiVA
+            """, [
+                ('cn=x,cn=y,cn=z', {'attrib': [b'\t\0\n:%@']}),
+            ])
+
     def test_unicode(self):
         self.check_roundtrip("""
                 dn: cn=Michael Stroeder,dc=stroeder,dc=com

From 71e9d46ae495ed7e7132007b94e67690a8e65759 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 12:37:39 +0000
Subject: [PATCH 191/868] Updated release and copyright

---
 Doc/conf.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 32babb6..51fb9d5 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.21 2015/06/05 21:05:37 stroeder Exp $
+# $Id: conf.py,v 1.22 2015/10/24 12:37:39 stroeder Exp $
 
 import sys
 
@@ -36,7 +36,7 @@
 
 # General substitutions.
 project = 'python-ldap'
-copyright = '2008-2014, python-ldap project team'
+copyright = '2008-2015, python-ldap project team'
 
 # The default replacements for |version| and |release|, also used in various
 # other places throughout the built documents.
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.20.0'
+release = '2.4.21.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From abef0bb5f3f4cbade4a0f64102c85018110a15f9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 12:49:41 +0000
Subject: [PATCH 192/868] Added stub for ldap.sasl

---
 Doc/index.rst     |  3 ++-
 Doc/ldap-sasl.rst | 69 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 1 deletion(-)
 create mode 100644 Doc/ldap-sasl.rst

diff --git a/Doc/index.rst b/Doc/index.rst
index ad86059..2338eb2 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -2,7 +2,7 @@
 python-ldap Documentation
 ##########################
 
-.. % $Id: index.rst,v 1.8 2011/10/26 19:42:45 stroeder Exp $
+.. % $Id: index.rst,v 1.9 2015/10/24 12:49:41 stroeder Exp $
 
 .. topic:: Abstract
 
@@ -30,6 +30,7 @@ Contents
    ldap-resiter.rst
    ldap-schema.rst
    ldap-syncrepl.rst
+   ldap-sasl.rst
    ldif.rst
    ldapurl.rst
    dsml.rst
diff --git a/Doc/ldap-sasl.rst b/Doc/ldap-sasl.rst
new file mode 100644
index 0000000..dd5fce3
--- /dev/null
+++ b/Doc/ldap-sasl.rst
@@ -0,0 +1,69 @@
+.. % $Id: ldap-sasl.rst,v 1.1 2015/10/24 12:49:41 stroeder Exp $
+
+
+********************************************
+:py:mod:`ldap.sasl` Handling LDAPv3 schema
+********************************************
+
+.. py:module:: ldap.sasl
+
+This module implements various authentication methods for SASL bind.
+
+.. seealso::
+
+   :rfc:`4422` - Simple Authentication and Security Layer (SASL)
+
+
+:py:mod:`ldap.sasl` SASL bind requests
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. py:module:: ldap.sasl
+
+
+.. py:data:: CB_USER
+
+.. py:data:: CB_AUTHNAME
+
+.. py:data:: CB_LANGUAGE
+
+.. py:data:: CB_PASS
+
+.. py:data:: CB_ECHOPROMPT
+
+.. py:data:: CB_NOECHOPROMPT
+
+.. py:data:: CB_GETREALM
+
+
+Functions
+=========
+
+.. autofunction:: ldap.sasl.subentry.urlfetch
+
+Classes
+=======
+
+.. autoclass:: ldap.sasl.sasl
+   :members:
+
+.. autoclass:: ldap.sasl.cram_md5
+   :members:
+
+.. autoclass:: ldap.sasl.digest_md5
+   :members:
+
+.. autoclass:: ldap.sasl.gssapi
+   :members:
+
+.. autoclass:: ldap.sasl.external
+   :members:
+
+
+.. _ldap.sasl-example:
+
+Examples for ldap.sasl
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+::
+
+   import ldap.sasl

From c50d6942470340c46fb08684a948b07f4ac919f6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 13:07:33 +0000
Subject: [PATCH 193/868] Added example and link to RFC 4513

---
 Doc/ldap-sasl.rst | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap-sasl.rst b/Doc/ldap-sasl.rst
index dd5fce3..2cd5fc6 100644
--- a/Doc/ldap-sasl.rst
+++ b/Doc/ldap-sasl.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-sasl.rst,v 1.1 2015/10/24 12:49:41 stroeder Exp $
+.. % $Id: ldap-sasl.rst,v 1.2 2015/10/24 13:07:33 stroeder Exp $
 
 
 ********************************************
@@ -12,6 +12,7 @@ This module implements various authentication methods for SASL bind.
 .. seealso::
 
    :rfc:`4422` - Simple Authentication and Security Layer (SASL)
+   :rfc:`4513` - Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms
 
 
 :py:mod:`ldap.sasl` SASL bind requests
@@ -64,6 +65,21 @@ Classes
 Examples for ldap.sasl
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
+This example connects to a OpenLDAP server via LDAP over IPC and
+sends a SASL external bind request.
+
 ::
 
-   import ldap.sasl
+   import ldap, ldap.sasl, urllib
+
+   ldapi_path = '/tmp/openldap-socket'
+   ldap_conn = ldap.initialize(
+       'ldapi://%s' % (
+           urllib.quote_plus(ldapi_path)
+       )
+   )
+   # Send SASL bind request for mechanism EXTERNAL
+   ldap_conn.sasl_non_interactive_bind_s('EXTERNAL')
+   # Find out the SASL Authorization Identity
+   print ldap_conn.whoami_s()
+

From 5abe88935f51c6404ec694b27ad5ffbbdb6d09dd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 13:41:02 +0000
Subject: [PATCH 194/868] Removed functions section and link to
 draft-chu-ldap-ldapi

---
 Doc/ldap-sasl.rst | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/Doc/ldap-sasl.rst b/Doc/ldap-sasl.rst
index 2cd5fc6..c91b49a 100644
--- a/Doc/ldap-sasl.rst
+++ b/Doc/ldap-sasl.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-sasl.rst,v 1.2 2015/10/24 13:07:33 stroeder Exp $
+.. % $Id: ldap-sasl.rst,v 1.3 2015/10/24 13:41:02 stroeder Exp $
 
 
 ********************************************
@@ -15,11 +15,8 @@ This module implements various authentication methods for SASL bind.
    :rfc:`4513` - Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms
 
 
-:py:mod:`ldap.sasl` SASL bind requests
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-.. py:module:: ldap.sasl
-
+Constants
+=========
 
 .. py:data:: CB_USER
 
@@ -36,11 +33,6 @@ This module implements various authentication methods for SASL bind.
 .. py:data:: CB_GETREALM
 
 
-Functions
-=========
-
-.. autofunction:: ldap.sasl.subentry.urlfetch
-
 Classes
 =======
 
@@ -65,8 +57,9 @@ Classes
 Examples for ldap.sasl
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
-This example connects to a OpenLDAP server via LDAP over IPC and
-sends a SASL external bind request.
+This example connects to an OpenLDAP server via LDAP over IPC
+(see `draft-chu-ldap-ldapi <https://tools.ietf.org/html/draft-chu-ldap-ldapi>`_)
+and sends a SASL external bind request.
 
 ::
 

From 51ed53505d6f6e92ce0fd422d6024ba2ea34683e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 15:27:03 +0000
Subject: [PATCH 195/868] Started missing docs for sub-module ldap.sasl.

---
 CHANGES | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index a5540e5..e763ef1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,9 @@ Lib/
 * LDIFParser now also accepts value-spec without a space
   after the colon.
 
+Doc/
+* Started missing docs for sub-module ldap.sasl.
+
 ----------------------------------------------------------------
 Released 2.4.21 2015-09-25
 
@@ -1204,4 +1207,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.358 2015/09/30 17:17:28 stroeder Exp $
+$Id: CHANGES,v 1.359 2015/10/24 15:27:03 stroeder Exp $

From 2cc6d1102bf91420640477d50f65b8526453752e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 15:42:41 +0000
Subject: [PATCH 196/868] Added key-word argument authz_id to LDAPObject
 methods sasl_non_interactive_bind_s(), sasl_external_bind_s() and
 sasl_gssapi_bind_s().

---
 CHANGES                |  5 ++++-
 Lib/ldap/ldapobject.py | 20 +++++++++++++-------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index e763ef1..f8cffaf 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,9 @@ Changes since 2.4.21:
 Lib/
 * LDIFParser now also accepts value-spec without a space
   after the colon.
+* Added key-word argument authz_id to LDAPObject methods
+  sasl_non_interactive_bind_s(), sasl_external_bind_s() and 
+  sasl_gssapi_bind_s()
 
 Doc/
 * Started missing docs for sub-module ldap.sasl.
@@ -1207,4 +1210,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.359 2015/10/24 15:27:03 stroeder Exp $
+$Id: CHANGES,v 1.360 2015/10/24 15:42:41 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index c807973..39f0f75 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.147 2015/08/08 13:37:41 stroeder Exp $
+\$Id: ldapobject.py,v 1.148 2015/10/24 15:42:41 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -243,23 +243,29 @@ def sasl_interactive_bind_s(self,who,auth,serverctrls=None,clientctrls=None,sasl
     """
     return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
 
-  def sasl_non_interactive_bind_s(self,sasl_mech,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+  def sasl_non_interactive_bind_s(self,sasl_mech,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET,authz_id=''):
     """
     Send a SASL bind request using a non-interactive SASL method (e.g. GSSAPI, EXTERNAL)
     """
-    self.sasl_interactive_bind_s('',ldap.sasl.sasl({},sasl_mech))
+    self.sasl_interactive_bind_s(
+      '',
+      ldap.sasl.sasl(
+        {ldap.sasl.CB_USER:authz_id},
+        sasl_mech
+      )
+    )
 
-  def sasl_external_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+  def sasl_external_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET,authz_id=''):
     """
     Send SASL bind request using SASL mech EXTERNAL
     """
-    self.sasl_non_interactive_bind_s('EXTERNAL',serverctrls,clientctrls,sasl_flags)
+    self.sasl_non_interactive_bind_s('EXTERNAL',serverctrls,clientctrls,sasl_flags,authz_id)
 
-  def sasl_gssapi_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET):
+  def sasl_gssapi_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET,authz_id=''):
     """
     Send SASL bind request using SASL mech GSSAPI
     """
-    self.sasl_non_interactive_bind_s('GSSAPI',serverctrls,clientctrls,sasl_flags)
+    self.sasl_non_interactive_bind_s('GSSAPI',serverctrls,clientctrls,sasl_flags,authz_id)
 
   def sasl_bind_s(self,dn,mechanism,cred,serverctrls=None,clientctrls=None):
     """

From 12cf5911e0ce6d42567587ae4176694ae6813453 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 15:46:12 +0000
Subject: [PATCH 197/868] ReconnectLDAPObject.sasl_bind_s() now correctly uses
 generic wrapper arguments *args,**kwargs

---
 CHANGES                | 5 ++++-
 Lib/ldap/ldapobject.py | 6 +++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index f8cffaf..575252a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,9 @@ Lib/
 * Added key-word argument authz_id to LDAPObject methods
   sasl_non_interactive_bind_s(), sasl_external_bind_s() and 
   sasl_gssapi_bind_s()
+* Hmmpf! Added missing self to LDAPObject.fileno().
+* ReconnectLDAPObject.sasl_bind_s() now correctly uses
+  generic wrapper arguments *args,**kwargs
 
 Doc/
 * Started missing docs for sub-module ldap.sasl.
@@ -1210,4 +1213,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.360 2015/10/24 15:42:41 stroeder Exp $
+$Id: CHANGES,v 1.361 2015/10/24 15:46:12 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 39f0f75..8205bd4 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.148 2015/10/24 15:42:41 stroeder Exp $
+\$Id: ldapobject.py,v 1.149 2015/10/24 15:46:12 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -136,7 +136,7 @@ def __getattr__(self,name):
         self.__class__.__name__,repr(name)
       )
 
-  def fileno():
+  def fileno(self):
     """
     Returns file description of LDAP connection.
 
@@ -933,7 +933,7 @@ def sasl_interactive_bind_s(self,*args,**kwargs):
     self._store_last_bind(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
     return res
 
-  def sasl_bind_s(self,dn,mechanism,cred,serverctrls=None,clientctrls=None):
+  def sasl_bind_s(self,*args,**kwargs):
     res = self._apply_method_s(SimpleLDAPObject.sasl_bind_s,*args,**kwargs)
     self._store_last_bind(SimpleLDAPObject.sasl_bind_s,*args,**kwargs)
     return res

From 0fa88d045e2406ac505db39fd2f655f52e1be404 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 15:50:00 +0000
Subject: [PATCH 198/868] LDIFParser.parse_change_records() now correctly calls
 handle_change_modify()

---
 CHANGES     | 6 ++++--
 Lib/ldif.py | 4 ++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 575252a..6f2301f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.22 2015-10-xx
+Released 2.4.22 2015-10-25
 
 Changes since 2.4.21:
 
@@ -12,6 +12,8 @@ Lib/
 * Hmmpf! Added missing self to LDAPObject.fileno().
 * ReconnectLDAPObject.sasl_bind_s() now correctly uses
   generic wrapper arguments *args,**kwargs
+* LDIFParser.parse_change_records() now correctly calls
+  LDIFParser.handle_change_modify()
 
 Doc/
 * Started missing docs for sub-module ldap.sasl.
@@ -1213,4 +1215,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.361 2015/10/24 15:46:12 stroeder Exp $
+$Id: CHANGES,v 1.362 2015/10/24 15:50:00 stroeder Exp $
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 47df877..7466020 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.85 2015/09/30 17:17:28 stroeder Exp $
+$Id: ldif.py,v 1.86 2015/10/24 15:50:00 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -467,7 +467,7 @@ def parse_change_records(self):
 
         if modops:
           # append entry to result list
-          self.handle_modify(dn,modops,controls)
+          self.handle_change_modify(dn,modops,controls)
 
       else:
 

From c9f34d54556d82a49805be1e4e24e2f8e881cdfc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 15:52:23 +0000
Subject: [PATCH 199/868] Undefined variable name 'SSSVLVPagedLDAPObject' in
 __all__ (undefined-all-variable)

---
 Lib/ldap/controls/sss.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 406fb0b..95f751e 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -5,13 +5,12 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: sss.py,v 1.1 2015/06/22 16:47:08 stroeder Exp $
+$Id: sss.py,v 1.2 2015/10/24 15:52:23 stroeder Exp $
 """
 
 __all__ = [
     'SSSRequestControl',
     'SSSResponseControl',
-    'SSSVLVPagedLDAPObject'
 ]
 
 

From c6b18c750bfd03b46f7a00be098dc327b1704117 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 15:55:07 +0000
Subject: [PATCH 200/868] Corrected ldap.controls.pwdpolicy.__all__

---
 CHANGES                        | 3 ++-
 Lib/ldap/controls/pwdpolicy.py | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6f2301f..cf8757a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -14,6 +14,7 @@ Lib/
   generic wrapper arguments *args,**kwargs
 * LDIFParser.parse_change_records() now correctly calls
   LDIFParser.handle_change_modify()
+* Corrected ldap.controls.pwdpolicy.__all__
 
 Doc/
 * Started missing docs for sub-module ldap.sasl.
@@ -1215,4 +1216,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.362 2015/10/24 15:50:00 stroeder Exp $
+$Id: CHANGES,v 1.363 2015/10/24 15:55:07 stroeder Exp $
diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index 0cb4260..dc013d4 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -5,11 +5,12 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: pwdpolicy.py,v 1.4 2014/03/12 21:34:07 stroeder Exp $
+$Id: pwdpolicy.py,v 1.5 2015/10/24 15:55:07 stroeder Exp $
 """
 
 __all__ = [
-  'ExpirationWarningControl'
+  'PasswordExpiringControl',
+  'PasswordExpiredControl',
 ]
 
 # Imports from python-ldap 2.4+

From b8844cb5264febf18371a63947b1becbaa1ea67d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 16:12:31 +0000
Subject: [PATCH 201/868] Prefer method name handle_modify()

---
 Lib/ldif.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 7466020..5145190 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.86 2015/10/24 15:50:00 stroeder Exp $
+$Id: ldif.py,v 1.87 2015/10/24 16:12:31 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -391,7 +391,7 @@ def parse(self):
     """
     return self.parse_entry_records() # parse()
 
-  def handle_change_modify(self,dn,modops,controls=None):
+  def handle_modify(self,dn,modops,controls=None):
     """
     Process a single LDIF record representing a single modify operation.
     This method should be implemented by applications using LDIFParser.
@@ -467,7 +467,7 @@ def parse_change_records(self):
 
         if modops:
           # append entry to result list
-          self.handle_change_modify(dn,modops,controls)
+          self.handle_modify(dn,modops,controls)
 
       else:
 

From 5d85c44b836313b4b6969e47e5dbf903e09cfa79 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 16:21:14 +0000
Subject: [PATCH 202/868] Explicitly list limit exception types

---
 Demo/pyasn1/noopsearch.py     | 8 +++++---
 Lib/ldap/controls/openldap.py | 9 +++++++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/Demo/pyasn1/noopsearch.py b/Demo/pyasn1/noopsearch.py
index a22f394..e2846ce 100644
--- a/Demo/pyasn1/noopsearch.py
+++ b/Demo/pyasn1/noopsearch.py
@@ -14,8 +14,6 @@
 
 from ldap.controls.openldap import SearchNoOpControl
 
-LDAPLimitErrors = (ldap.TIMEOUT,ldap.TIMELIMIT_EXCEEDED,ldap.SIZELIMIT_EXCEEDED,ldap.ADMINLIMIT_EXCEEDED)
-
 SEARCH_TIMEOUT=30.0
 
 try:
@@ -56,7 +54,11 @@
     serverctrls=[SearchNoOpControl(criticality=True)],
   )
   _,_,_,search_response_ctrls = ldap_conn.result3(msg_id,all=1,timeout=SEARCH_TIMEOUT)
-except LDAPLimitErrors,e:
+except (
+  ldap.TIMEOUT,
+  ldap.TIMELIMIT_EXCEEDED,
+  ldap.SIZELIMIT_EXCEEDED,
+  ldap.ADMINLIMIT_EXCEEDED),e:
   ldap_conn.abandon(msg_id)
   sys.exit(1)
 
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 53425e0..8480e7c 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: openldap.py,v 1.4 2015/09/18 17:24:39 stroeder Exp $
+$Id: openldap.py,v 1.5 2015/10/24 16:21:14 stroeder Exp $
 """
 
 import ldap.controls
@@ -63,7 +63,12 @@ def noop_search_st(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass=*)
         serverctrls=[SearchNoOpControl(criticality=True)],
       )
       _,_,_,search_response_ctrls = self.result3(msg_id,all=1,timeout=timeout)
-    except LDAPLimitErrors,e:
+    except (
+      ldap.TIMEOUT,
+      ldap.TIMELIMIT_EXCEEDED,
+      ldap.SIZELIMIT_EXCEEDED,
+      ldap.ADMINLIMIT_EXCEEDED
+    ),e:
       self.abandon(msg_id)
       raise e
     else:

From 4df497cca5ab155f631eaeaddcf65db2912eaa75 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 24 Oct 2015 16:21:56 +0000
Subject: [PATCH 203/868] Added SearchNoOpMixIn to __all__

---
 Lib/ldap/controls/openldap.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 8480e7c..99c2baa 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: openldap.py,v 1.5 2015/10/24 16:21:14 stroeder Exp $
+$Id: openldap.py,v 1.6 2015/10/24 16:21:56 stroeder Exp $
 """
 
 import ldap.controls
@@ -15,7 +15,8 @@
 
 
 __all__ = [
-  'SearchNoOpControl'
+  'SearchNoOpControl',
+  'SearchNoOpMixIn',
 ]
 
 

From 277a6f2add838667b76f24110ee9adc8256906b6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 19 Nov 2015 05:16:46 +0000
Subject: [PATCH 204/868] Fixed typos

---
 Doc/ldap.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index ef870bd..ccb661a 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.28 2015/06/05 20:49:04 stroeder Exp $
+.. % $Id: ldap.rst,v 1.29 2015/11/19 05:16:46 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -107,7 +107,7 @@ Options
 
 .. seealso::
 
-   :manpage:`ldap.conf{5}` and :manpage:`ldap_get_options{3}`
+   :manpage:`ldap.conf(5)` and :manpage:`ldap_get_option(3)`
 
 
 For use with functions :py:func:set_option() and :py:func:get_option()

From 7d16ba245c295ca7c2947620e77a9b1d7f82d66f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 9 Dec 2015 17:12:02 +0000
Subject: [PATCH 205/868] correct use of :c:func

---
 Doc/ldap.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index ccb661a..4d6068e 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.29 2015/11/19 05:16:46 stroeder Exp $
+.. % $Id: ldap.rst,v 1.30 2015/12/09 17:12:02 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -961,7 +961,7 @@ and wait for and return with the server's result, or with
    values are lists of strings.
 
    The DN in *dn* is automatically extracted using the underlying libldap
-   function :cfunc:`ldap_get_dn()`, which may raise an exception if the
+   function :c:func:`ldap_get_dn()`, which may raise an exception if the
    DN is malformed.
 
    If *attrsonly* is non-zero, the values of *attrs* will be meaningless

From 7c569e3687d965d1ea0fb2719019195a876b071c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 9 Dec 2015 17:33:14 +0000
Subject: [PATCH 206/868] release 2.4.22: Use Sphinx' pyramid theme and set
 html_static_path

---
 Doc/conf.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 51fb9d5..e9e4833 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.22 2015/10/24 12:37:39 stroeder Exp $
+# $Id: conf.py,v 1.23 2015/12/09 17:33:14 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.21.0'
+release = '2.4.22.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
@@ -76,12 +76,12 @@
 # The style sheet to use for HTML and HTML Help pages. A file of that name
 # must exist either in Sphinx' static/ path, or in one of the custom paths
 # given in html_static_path.
-html_style = 'default.css'
+html_style = 'pyramid.css'
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['.static']
+html_static_path = ['/usr/lib/python2.7/site-packages/sphinx/themes/pyramid/static']
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.

From 634079e79bc128c07752de36393f584eedc828ca Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 9 Dec 2015 17:56:38 +0000
Subject: [PATCH 207/868] Replaced OpenLDAP version number 2.3 with 2.4

---
 Doc/installing.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 475adcf..ace20b4 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,4 +1,4 @@
-.. % $Id: installing.rst,v 1.15 2011/07/24 19:00:53 stroeder Exp $
+.. % $Id: installing.rst,v 1.16 2015/12/09 17:56:38 stroeder Exp $
 
 ***********************
 Building and installing
@@ -95,14 +95,14 @@ Example
 
 The following example is for a full-featured build (including SSL and SASL support)
 of python-ldap with OpenLDAP installed in a different prefix directory
-(here /opt/openldap-2.3) and SASL header files found in /usr/include/sasl.
+(here /opt/openldap-2.4) and SASL header files found in /usr/include/sasl.
 Debugging symbols are preserved with compile option -g.
 
 ::
 
   [_ldap]
-  library_dirs = /opt/openldap-2.3/lib
-  include_dirs = /opt/openldap-2.3/include /usr/include/sasl
+  library_dirs = /opt/openldap-2.4/lib
+  include_dirs = /opt/openldap-2.4/include /usr/include/sasl
 
   extra_compile_args = -g
   extra_objects =

From 507dcd6b7dbb93b7a9b150514a6fc1bd22ad32bb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 9 Dec 2015 17:57:18 +0000
Subject: [PATCH 208/868] Removed OpenLDAP version number, better links for
 I-Ds

---
 Doc/ldap-controls.rst |  8 ++++----
 Doc/ldap.rst          | 23 +++++++++++++++--------
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/Doc/ldap-controls.rst b/Doc/ldap-controls.rst
index 00266e6..f006bae 100644
--- a/Doc/ldap-controls.rst
+++ b/Doc/ldap-controls.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-controls.rst,v 1.11 2012/08/09 07:19:30 stroeder Exp $
+.. % $Id: ldap-controls.rst,v 1.12 2015/12/09 17:57:18 stroeder Exp $
 
 
 *********************************************************************
@@ -91,7 +91,7 @@ RFC or Internet-Draft is very helpful to understand the API.
 
    .. seealso::
 
-      http://tools.ietf.org/draft/draft-zeilenga-ldap-relax/
+      `draft-zeilenga-ldap-relax <https://tools.ietf.org/html/draft-zeilenga-ldap-relax>`_
 
 .. autoclass:: ldap.controls.simple.ProxyAuthzControl
    :members:
@@ -165,7 +165,7 @@ search.
 
 .. seealso::
 
-   http://tools.ietf.org/html/draft-ietf-ldapext-psearch
+   `draft-ietf-ldapext-psearch <https://tools.ietf.org/html/draft-ietf-ldapext-psearch>`_
 
 
 .. autoclass:: ldap.controls.psearch.PersistentSearchControl
@@ -183,7 +183,7 @@ search.
 
 .. seealso::
 
-   http://tools.ietf.org/html/draft-wahl-ldap-session
+   `draft-wahl-ldap-session <https://tools.ietf.org/html/draft-wahl-ldap-session>`_
 
 
 .. autoclass:: ldap.controls.sessiontrack.SessionTrackingControl
diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 4d6068e..70f15d3 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.30 2015/12/09 17:12:02 stroeder Exp $
+.. % $Id: ldap.rst,v 1.31 2015/12/09 17:57:18 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -10,13 +10,20 @@
 .. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
 
 
-This module provides access to the LDAP  (Lightweight Directory Access Protocol)
-C API implemented  in OpenLDAP 2.3 or newer.  It is similar to the C API, with
-the notable differences  that lists are manipulated via Python  list operations
-and errors appear as exceptions.    For far more detailed information on the C
-interface,   please see the (expired) draft-ietf-ldapext-ldap-c-api-04.    This
-documentation is current for the Python LDAP module, version  |release|.  Source
-and binaries are available from http://www.python-ldap.org/.
+This module provides access to the LDAP (Lightweight Directory Access Protocol)
+C API implemented in OpenLDAP.  It is similar to the C API, with
+the notable differences that lists are manipulated via Python list operations
+and errors appear as exceptions.
+
+   .. seealso::
+
+      For more detailed information on the C interface, please see the (expired)
+      `draft-ietf-ldapext-ldap-c-api <https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api>`_
+
+
+This documentation is current for the Python LDAP module, version  
+|release|.  Source and binaries are available from 
+http://www.python-ldap.org/.
 
 
 Functions

From be777af099c2f40aaa8fda5fe59c80b552837097 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 16 Jan 2016 19:00:08 +0000
Subject: [PATCH 209/868] Missing items for 2.4.22

---
 CHANGES | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index cf8757a..667ca07 100644
--- a/CHANGES
+++ b/CHANGES
@@ -12,9 +12,9 @@ Lib/
 * Hmmpf! Added missing self to LDAPObject.fileno().
 * ReconnectLDAPObject.sasl_bind_s() now correctly uses
   generic wrapper arguments *args,**kwargs
-* LDIFParser.parse_change_records() now correctly calls
-  LDIFParser.handle_change_modify()
-* Corrected ldap.controls.pwdpolicy.__all__
+* Correct method name LDIFParser.handle_modify()
+* Corrected __all__ in modules ldap.controls.pwdpolicy and 
+  ldap.controls.openldap
 
 Doc/
 * Started missing docs for sub-module ldap.sasl.
@@ -1216,4 +1216,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.363 2015/10/24 15:55:07 stroeder Exp $
+$Id: CHANGES,v 1.364 2016/01/16 19:00:08 stroeder Exp $

From a2cf4c134b519930dd3f07854dce48f9eb321eaa Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 16 Jan 2016 19:00:47 +0000
Subject: [PATCH 210/868] Started 2.4.23

---
 CHANGES              | 10 +++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 667ca07..c52b403 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.23 2016-01-xx
+
+Changes since 2.4.22:
+
+Modules/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.22 2015-10-25
 
@@ -1216,4 +1224,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.364 2016/01/16 19:00:08 stroeder Exp $
+$Id: CHANGES,v 1.365 2016/01/16 19:00:47 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 6db30c8..007ca48 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.39 2015/09/30 17:15:53 stroeder Exp $
+$Id: dsml.py,v 1.40 2016/01/16 19:00:47 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.22'
+__version__ = '2.4.23'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index cecec33..b453dfd 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.99 2015/09/30 17:15:53 stroeder Exp $
+$Id: __init__.py,v 1.100 2016/01/16 19:00:47 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.22'
+__version__ = '2.4.23'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index e5bf13d..36a26f8 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.74 2015/09/30 17:15:53 stroeder Exp $
+\$Id: ldapurl.py,v 1.75 2016/01/16 19:00:47 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.22'
+__version__ = '2.4.23'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 5145190..1739394 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.87 2015/10/24 16:12:31 stroeder Exp $
+$Id: ldif.py,v 1.88 2016/01/16 19:00:47 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.22'
+__version__ = '2.4.23'
 
 __all__ = [
   # constants

From 1cf5326eb1211075684a0d900cfe2fd27c76f755 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 16 Jan 2016 19:08:34 +0000
Subject: [PATCH 211/868] Ref count issue in attrs_from_List() was fixed
 (thanks to Elmir Jagudin)

---
 CHANGES              |  5 ++--
 Modules/LDAPObject.c | 64 +++++++++++++++++++++++---------------------
 2 files changed, 37 insertions(+), 32 deletions(-)

diff --git a/CHANGES b/CHANGES
index c52b403..1137836 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.23 2016-01-xx
 Changes since 2.4.22:
 
 Modules/
-* 
+* Ref count issue in attrs_from_List() was fixed
+  (thanks to Elmir Jagudin)
 
 ----------------------------------------------------------------
 Released 2.4.22 2015-10-25
@@ -1224,4 +1225,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.365 2016/01/16 19:00:47 stroeder Exp $
+$Id: CHANGES,v 1.366 2016/01/16 19:08:34 stroeder Exp $
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index eddd7e1..b8c4795 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.91 2015/05/02 16:19:23 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.92 2016/01/16 19:08:34 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -18,7 +18,7 @@
 #include <sasl.h>
 #endif
 
-static void free_attrs(char***);
+static void free_attrs(char***, PyObject*);
 
 /* constructor */
 
@@ -252,16 +252,17 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
 /*
  * convert a python list of strings into an attr list (char*[]).
  * returns 1 if successful, 0 if not (with exception set)
- * XXX the strings should live longer than the resulting attrs pointer.
  */
 
 int
-attrs_from_List( PyObject *attrlist, char***attrsp ) {
+attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
 
     char **attrs = NULL;
     Py_ssize_t i, len;
     PyObject *item;
 
+    *seq = NULL;
+
     if (attrlist == Py_None) {
         /* None means a NULL attrlist */
     } else if (PyString_Check(attrlist)) {
@@ -269,32 +270,32 @@ attrs_from_List( PyObject *attrlist, char***attrsp ) {
         PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
                   "expected *list* of strings, not a string", attrlist ));
         goto error;
-    } else if (PySequence_Check(attrlist)) {
-        len = PySequence_Length(attrlist);
-        attrs = PyMem_NEW(char *, len + 1);
-        if (attrs == NULL)
+    }
+
+    *seq = PySequence_Fast(attrlist, "expected list of strings or None");
+
+    if (*seq == NULL)
+        goto error;
+    len = PySequence_Length(attrlist);
+
+    attrs = PyMem_NEW(char *, len + 1);
+    if (attrs == NULL)
             goto nomem;
 
-        for (i = 0; i < len; i++) {
-            attrs[i] = NULL;
-            item = PySequence_GetItem(attrlist, i);
-            if (item == NULL)
-                goto error;
-            if (!PyString_Check(item)) {
-                PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-                                "expected string in list", item));
-                Py_DECREF(item);
-                goto error;
-            }
-            attrs[i] = PyString_AsString(item);
-            Py_DECREF(item);
+
+    for (i = 0; i < len; i++) {
+        attrs[i] = NULL;
+        item = PySequence_Fast_GET_ITEM(*seq, i);
+        if (item == NULL)
+            goto error;
+        if (!PyString_Check(item)) {
+            PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+                            "expected string in list", item));
+            goto error;
         }
-        attrs[len] = NULL;
-    } else {
-        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
-                         "expected list of strings or None", attrlist ));
-        goto error;
+        attrs[i] = PyString_AsString(item);
     }
+    attrs[len] = NULL;
 
     *attrsp = attrs;
     return 1;
@@ -302,20 +303,22 @@ attrs_from_List( PyObject *attrlist, char***attrsp ) {
 nomem:
     PyErr_NoMemory();
 error:
-    free_attrs(&attrs);
+    free_attrs(&attrs, *seq);
     return 0;
 }
 
 /* free memory allocated from above routine */
 
 static void
-free_attrs( char*** attrsp ) {
+free_attrs( char*** attrsp, PyObject* seq ) {
     char **attrs = *attrsp;
 
     if (attrs != NULL) {
         PyMem_DEL(attrs);
         *attrsp = NULL;
     }
+
+    Py_XDECREF(seq);
 }
 
 /*------------------------------------------------------------
@@ -1107,6 +1110,7 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
 
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
+    PyObject *attrs_seq = NULL;
     LDAPControl** server_ldcs = NULL;
     LDAPControl** client_ldcs = NULL;
 
@@ -1124,7 +1128,7 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
                            &serverctrls, &clientctrls, &timeout, &sizelimit )) return NULL;
     if (not_valid(self)) return NULL;
 
-    if (!attrs_from_List( attrlist, &attrs )) 
+    if (!attrs_from_List( attrlist, &attrs, &attrs_seq ))
          return NULL;
 
     if (timeout >= 0) {
@@ -1149,7 +1153,7 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
                              server_ldcs, client_ldcs, tvp, sizelimit, &msgid );
     LDAP_END_ALLOW_THREADS( self );
 
-    free_attrs( &attrs );
+    free_attrs( &attrs,  attrs_seq);
     LDAPControl_List_DEL( server_ldcs );
     LDAPControl_List_DEL( client_ldcs );
 

From 861529790c2ca69cf282c29f84e0e43ce501073e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jan 2016 20:29:41 +0000
Subject: [PATCH 212/868] Started 2.4.24

---
 CHANGES              | 9 +++++++--
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1137836..8bc3f96 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,10 @@
 ----------------------------------------------------------------
-Released 2.4.23 2016-01-xx
+Released 2.4.24 2016-01-18
+
+Changes since 2.4.23:
+
+----------------------------------------------------------------
+Released 2.4.23 2016-01-17
 
 Changes since 2.4.22:
 
@@ -1225,4 +1230,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.366 2016/01/16 19:08:34 stroeder Exp $
+$Id: CHANGES,v 1.367 2016/01/17 20:30:43 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 007ca48..e056016 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.40 2016/01/16 19:00:47 stroeder Exp $
+$Id: dsml.py,v 1.41 2016/01/17 20:29:41 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.23'
+__version__ = '2.4.24'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index b453dfd..5b0ddaf 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.100 2016/01/16 19:00:47 stroeder Exp $
+$Id: __init__.py,v 1.101 2016/01/17 20:29:41 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.23'
+__version__ = '2.4.24'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 36a26f8..2485867 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.75 2016/01/16 19:00:47 stroeder Exp $
+\$Id: ldapurl.py,v 1.76 2016/01/17 20:29:41 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.23'
+__version__ = '2.4.24'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 1739394..183394a 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.88 2016/01/16 19:00:47 stroeder Exp $
+$Id: ldif.py,v 1.89 2016/01/17 20:29:41 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.23'
+__version__ = '2.4.24'
 
 __all__ = [
   # constants

From 1d4bdc5b88581567f7d0961fd7906861a8637fed Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jan 2016 20:31:54 +0000
Subject: [PATCH 213/868] Work-around for attrlist=None regression introduced
 in 2.4.23 by ref count patch

---
 CHANGES                | 6 +++++-
 Lib/ldap/ldapobject.py | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8bc3f96..198578a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,10 @@ Released 2.4.24 2016-01-18
 
 Changes since 2.4.23:
 
+Lib/
+* Work-around for attrlist=None regression introduced in 2.4.23
+  by ref count patch
+
 ----------------------------------------------------------------
 Released 2.4.23 2016-01-17
 
@@ -1230,4 +1234,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.367 2016/01/17 20:30:43 stroeder Exp $
+$Id: CHANGES,v 1.368 2016/01/17 20:31:54 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 8205bd4..e8e0b5d 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.149 2015/10/24 15:46:12 stroeder Exp $
+\$Id: ldapobject.py,v 1.150 2016/01/17 20:31:54 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -580,7 +580,7 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
     return self._ldap_call(
       self._l.search_ext,
       base,scope,filterstr,
-      attrlist,attrsonly,
+      attrlist or [],attrsonly,
       RequestControlTuples(serverctrls),
       RequestControlTuples(clientctrls),
       timeout,sizelimit,

From 6bc49775e8e7adfcc72f003a47353f89dd941a20 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 18 Jan 2016 10:38:26 +0000
Subject: [PATCH 214/868] Real fix for attrlist=None regression introduced in
 2.4.23 by ref count patch

---
 CHANGES                | 4 ++--
 Lib/ldap/ldapobject.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 198578a..b712599 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,7 @@ Released 2.4.24 2016-01-18
 Changes since 2.4.23:
 
 Lib/
-* Work-around for attrlist=None regression introduced in 2.4.23
+* Fix for attrlist=None regression introduced in 2.4.23
   by ref count patch
 
 ----------------------------------------------------------------
@@ -1234,4 +1234,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.368 2016/01/17 20:31:54 stroeder Exp $
+$Id: CHANGES,v 1.369 2016/01/18 10:38:26 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index e8e0b5d..76b5c70 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.150 2016/01/17 20:31:54 stroeder Exp $
+\$Id: ldapobject.py,v 1.151 2016/01/18 10:38:26 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -580,7 +580,7 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
     return self._ldap_call(
       self._l.search_ext,
       base,scope,filterstr,
-      attrlist or [],attrsonly,
+      attrlist,attrsonly,
       RequestControlTuples(serverctrls),
       RequestControlTuples(clientctrls),
       timeout,sizelimit,

From ad35a27f6192e67449b8bbd3f0d2cc67beddca73 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 18 Jan 2016 12:33:07 +0000
Subject: [PATCH 215/868] Real fix for attrlist=None regression introduced in
 2.4.23 by ref count patch

---
 Modules/LDAPObject.c | 47 ++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index b8c4795..725ab37 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.92 2016/01/16 19:08:34 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.93 2016/01/18 12:33:07 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -270,32 +270,31 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
         PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
                   "expected *list* of strings, not a string", attrlist ));
         goto error;
-    }
-
-    *seq = PySequence_Fast(attrlist, "expected list of strings or None");
-
-    if (*seq == NULL)
-        goto error;
-    len = PySequence_Length(attrlist);
-
-    attrs = PyMem_NEW(char *, len + 1);
-    if (attrs == NULL)
-            goto nomem;
-
-
-    for (i = 0; i < len; i++) {
-        attrs[i] = NULL;
-        item = PySequence_Fast_GET_ITEM(*seq, i);
-        if (item == NULL)
-            goto error;
-        if (!PyString_Check(item)) {
-            PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-                            "expected string in list", item));
+    } else {
+        *seq = PySequence_Fast(attrlist, "expected list of strings or None");
+        if (*seq == NULL)
             goto error;
+
+        len = PySequence_Length(attrlist);
+
+        attrs = PyMem_NEW(char *, len + 1);
+        if (attrs == NULL)
+                goto nomem;
+
+        for (i = 0; i < len; i++) {
+            attrs[i] = NULL;
+            item = PySequence_Fast_GET_ITEM(*seq, i);
+            if (item == NULL)
+                goto error;
+            if (!PyString_Check(item)) {
+                PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
+                                "expected string in list", item));
+                goto error;
+            }
+            attrs[i] = PyString_AsString(item);
         }
-        attrs[i] = PyString_AsString(item);
+        attrs[len] = NULL;
     }
-    attrs[len] = NULL;
 
     *attrsp = attrs;
     return 1;

From e1c8ad032094cff9f357c792119af3a63843d3c5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 18 Jan 2016 15:16:29 +0000
Subject: [PATCH 216/868] Prepare release 2.4.25

---
 CHANGES              | 5 +++--
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index b712599..53df95a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,7 +1,8 @@
 ----------------------------------------------------------------
-Released 2.4.24 2016-01-18
+Released 2.4.25 2016-01-18
 
 Changes since 2.4.23:
+(2.4.24 is missing because of foolish pypi version madness)
 
 Lib/
 * Fix for attrlist=None regression introduced in 2.4.23
@@ -1234,4 +1235,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.369 2016/01/18 10:38:26 stroeder Exp $
+$Id: CHANGES,v 1.370 2016/01/18 15:16:29 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index e056016..5961931 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.41 2016/01/17 20:29:41 stroeder Exp $
+$Id: dsml.py,v 1.42 2016/01/18 15:16:29 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.24'
+__version__ = '2.4.25'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 5b0ddaf..2b5f438 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.101 2016/01/17 20:29:41 stroeder Exp $
+$Id: __init__.py,v 1.102 2016/01/18 15:17:30 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.24'
+__version__ = '2.4.25'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 2485867..b41173f 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.76 2016/01/17 20:29:41 stroeder Exp $
+\$Id: ldapurl.py,v 1.77 2016/01/18 15:16:29 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.24'
+__version__ = '2.4.25'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 183394a..6ef97cd 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.89 2016/01/17 20:29:41 stroeder Exp $
+$Id: ldif.py,v 1.90 2016/01/18 15:16:29 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.24'
+__version__ = '2.4.25'
 
 __all__ = [
   # constants

From 56d80b661321f6d3da2e2d59517c36c08fde362a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 26 Jan 2016 10:43:24 +0000
Subject: [PATCH 217/868] Started 2.4.26

---
 CHANGES              | 11 ++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 53df95a..fedd42f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+----------------------------------------------------------------
+Released 2.4.26 2016-xx-xx
+
+Changes since 2.4.25:
+
+Modules/
+* 
+  (thanks to )
+
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
 
@@ -1235,4 +1244,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.370 2016/01/18 15:16:29 stroeder Exp $
+$Id: CHANGES,v 1.371 2016/01/26 10:43:24 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 5961931..845d784 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.42 2016/01/18 15:16:29 stroeder Exp $
+$Id: dsml.py,v 1.43 2016/01/26 10:43:24 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.25'
+__version__ = '2.4.26'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 2b5f438..ef106be 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.102 2016/01/18 15:17:30 stroeder Exp $
+$Id: __init__.py,v 1.103 2016/01/26 10:43:24 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.25'
+__version__ = '2.4.26'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index b41173f..49792e4 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.77 2016/01/18 15:16:29 stroeder Exp $
+\$Id: ldapurl.py,v 1.78 2016/01/26 10:43:24 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.25'
+__version__ = '2.4.26'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 6ef97cd..2d9f4c3 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.90 2016/01/18 15:16:29 stroeder Exp $
+$Id: ldif.py,v 1.91 2016/01/26 10:43:24 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.25'
+__version__ = '2.4.26'
 
 __all__ = [
   # constants

From 0d45e6d758dce092ca1f965802696899799ca464 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 26 Jan 2016 11:01:08 +0000
Subject: [PATCH 218/868] Fixed #69 Segmentation fault on whoami_s after unbind

---
 CHANGES              | 6 +++---
 Modules/LDAPObject.c | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index fedd42f..163116d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,8 +4,8 @@ Released 2.4.26 2016-xx-xx
 Changes since 2.4.25:
 
 Modules/
-* 
-  (thanks to )
+* Fixed #69 Segmentation fault on whoami_s after unbind 
+  (thanks to Christian Heimes and Petr Viktorin)
 
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
@@ -1244,4 +1244,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.371 2016/01/26 10:43:24 stroeder Exp $
+$Id: CHANGES,v 1.372 2016/01/26 11:01:08 stroeder Exp $
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 725ab37..10f166a 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.93 2016/01/18 12:33:07 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.94 2016/01/26 11:01:08 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -1180,6 +1180,7 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
     int ldaperror;
 
     if (!PyArg_ParseTuple( args, "|OO", &serverctrls, &clientctrls)) return NULL;
+    if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))

From 3784f889d90cb5308b8e9b08f6493db61ae2e5bb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 26 Jan 2016 11:12:54 +0000
Subject: [PATCH 219/868] LDAPObject.unbind_ext() now removed class attribute
 LDAPObject._l to completely invalidate C wrapper object

---
 CHANGES                | 6 +++++-
 Lib/ldap/ldapobject.py | 6 ++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 163116d..062dcbd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,10 @@ Released 2.4.26 2016-xx-xx
 
 Changes since 2.4.25:
 
+Lib/
+* LDAPObject.unbind_ext() now removed class attribute
+  LDAPObject._l to completely invalidate C wrapper object
+
 Modules/
 * Fixed #69 Segmentation fault on whoami_s after unbind 
   (thanks to Christian Heimes and Petr Viktorin)
@@ -1244,4 +1248,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.372 2016/01/26 11:01:08 stroeder Exp $
+$Id: CHANGES,v 1.373 2016/01/26 11:12:54 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 76b5c70..0fe2fbb 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.151 2016/01/18 10:38:26 stroeder Exp $
+\$Id: ldapobject.py,v 1.152 2016/01/26 11:12:54 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -623,7 +623,9 @@ def unbind_ext(self,serverctrls=None,clientctrls=None):
         The unbind and unbind_s methods are identical, and are
         synchronous in nature
     """
-    return self._ldap_call(self._l.unbind_ext,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+    res = self._ldap_call(self._l.unbind_ext,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
+    del self._l
+    return res
 
   def unbind_ext_s(self,serverctrls=None,clientctrls=None):
     msgid = self.unbind_ext(serverctrls,clientctrls)

From d5015742de6681bb932101ca960cb5b191869cae Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 28 Jan 2016 09:43:08 +0000
Subject: [PATCH 220/868] Handle removing LDAPObject._l solely in
 SimpleLDAPObject.unbind_ext()

---
 Lib/ldap/ldapobject.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 0fe2fbb..d6fe4c4 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.152 2016/01/26 11:12:54 stroeder Exp $
+\$Id: ldapobject.py,v 1.153 2016/01/28 09:43:08 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -624,7 +624,10 @@ def unbind_ext(self,serverctrls=None,clientctrls=None):
         synchronous in nature
     """
     res = self._ldap_call(self._l.unbind_ext,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
-    del self._l
+    try:
+      del self._l
+    except AttributeError:
+      pass
     return res
 
   def unbind_ext_s(self,serverctrls=None,clientctrls=None):
@@ -902,7 +905,6 @@ def _apply_method_s(self,func,*args,**kwargs):
       return func(self,*args,**kwargs)
     except ldap.SERVER_DOWN:
       SimpleLDAPObject.unbind_s(self)
-      del self._l
       # Try to reconnect
       self.reconnect(self._uri,retry_max=self._retry_max,retry_delay=self._retry_delay)
       # Re-try last operation

From 46268ed3deaf7c8aee671268846786585ab37c37 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 28 Jan 2016 09:43:57 +0000
Subject: [PATCH 221/868] typo

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 062dcbd..f51f126 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,7 @@ Released 2.4.26 2016-xx-xx
 Changes since 2.4.25:
 
 Lib/
-* LDAPObject.unbind_ext() now removed class attribute
+* LDAPObject.unbind_ext() now removes class attribute
   LDAPObject._l to completely invalidate C wrapper object
 
 Modules/
@@ -1248,4 +1248,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.373 2016/01/26 11:12:54 stroeder Exp $
+$Id: CHANGES,v 1.374 2016/01/28 09:43:57 stroeder Exp $

From 6febaf2c340480b24acb3963fa396c3a5b3c2c4e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Feb 2016 08:38:49 +0000
Subject: [PATCH 222/868] 1. Make test independent of module ldap 2. removed
 unused function sort() 3. added test-cases for subordinate scope 4. use r""
 in case of % signs in string 5. cosmetic changes

---
 Tests/t_ldapurl.py | 60 ++++++++++++++++++++++++----------------------
 1 file changed, 32 insertions(+), 28 deletions(-)

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 5ccd442..46f9a8a 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -1,21 +1,18 @@
-import ldap, unittest
+import unittest
 import urllib
 
+import ldapurl
 from ldapurl import LDAPUrl
 
+
 class MyLDAPUrl(LDAPUrl):
-  attr2extype = {
-    'who':'bindname',
-    'cred':'X-BINDPW',
-    'start_tls':'startTLS',
-    'trace_level':'trace',
-  }
-
-def sort(l):
-    "Returns a sorted copy of a list"
-    l2 = [e for e in l]
-    l2.sort()
-    return l2
+    attr2extype = {
+        'who':'bindname',
+        'cred':'X-BINDPW',
+        'start_tls':'startTLS',
+        'trace_level':'trace',
+    }
+
 
 class TestLDAPUrl(unittest.TestCase):
 
@@ -23,7 +20,8 @@ def assertNone(self, expr, msg=None):
         self.failIf(expr is not None, msg or ("%r" % expr))
 
     def test_combo(self):
-        u = MyLDAPUrl("ldap://127.0.0.1:1234/dc=example,dc=com"
+        u = MyLDAPUrl(
+            "ldap://127.0.0.1:1234/dc=example,dc=com"
             + "?attr1,attr2,attr3"
             + "?sub"
             + "?" + urllib.quote("(objectClass=*)")
@@ -35,7 +33,7 @@ def test_combo(self):
         self.assertEquals(u.hostport, "127.0.0.1:1234")
         self.assertEquals(u.dn, "dc=example,dc=com")
         self.assertEquals(u.attrs, ["attr1","attr2","attr3"])
-        self.assertEquals(u.scope, ldap.SCOPE_SUBTREE)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
         self.assertEquals(u.filterstr, "(objectClass=*)")
         self.assertEquals(len(u.extensions), 3)
         self.assertEquals(u.who, "cn=d,c=au")
@@ -143,17 +141,21 @@ def test_parse_scope_default(self):
 
     def test_parse_scope(self):
         u = LDAPUrl("ldap:///??sub")
-        self.assertEquals(u.scope, ldap.SCOPE_SUBTREE)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
         u = LDAPUrl("ldap:///??sub?")
-        self.assertEquals(u.scope, ldap.SCOPE_SUBTREE)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
         u = LDAPUrl("ldap:///??base")
-        self.assertEquals(u.scope, ldap.SCOPE_BASE)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_BASE)
         u = LDAPUrl("ldap:///??base?")
-        self.assertEquals(u.scope, ldap.SCOPE_BASE)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_BASE)
         u = LDAPUrl("ldap:///??one")
-        self.assertEquals(u.scope, ldap.SCOPE_ONELEVEL)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_ONELEVEL)
         u = LDAPUrl("ldap:///??one?")
-        self.assertEquals(u.scope, ldap.SCOPE_ONELEVEL)
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_ONELEVEL)
+        u = LDAPUrl("ldap:///??subordinates")
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBORDINATES)
+        u = LDAPUrl("ldap:///??subordinates?")
+        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBORDINATES)
 
     def test_parse_filter(self):
         u = LDAPUrl("ldap:///???(cn=Bob)")
@@ -219,24 +221,26 @@ def test_bad_urls(self):
                 #XXX-- the following should raise exceptions!
                 "ldap://:389/",         # [host [COLON port]]
                 "ldap://a:/",           # [host [COLON port]]
-                "ldap://%%%/",          # invalid URL encoding
+                r"ldap://%%%/",          # invalid URL encoding
                 "ldap:///?,",           # attrdesc *(COMMA attrdesc)
                 "ldap:///?a,",          # attrdesc *(COMMA attrdesc)
                 "ldap:///?,a",          # attrdesc *(COMMA attrdesc)
                 "ldap:///?a,,b",        # attrdesc *(COMMA attrdesc)
-                "ldap://%00/",          # RFC4516 2.1
-                "ldap:///%00",          # RFC4516 2.1
-                "ldap:///?%00",         # RFC4516 2.1
-                "ldap:///??%00",        # RFC4516 2.1
+                r"ldap://%00/",         # RFC4516 2.1
+                r"ldap:///%00",         # RFC4516 2.1
+                r"ldap:///?%00",        # RFC4516 2.1
+                r"ldap:///??%00",       # RFC4516 2.1
                 "ldap:///????0=0",      # extype must start with Alpha
                 "ldap:///????a_b=0",    # extype contains only [-a-zA-Z0-9]
                 "ldap:///????!!a=0",    # only one exclamation allowed
         ):
-            try: 
+            assertRaises(ValueError, LDAPUrl, [bad])
+            try:
                 LDAPUrl(bad)
-                self.fail("should have raised ValueError: %r" % bad)
             except ValueError:
                 pass
+            else:
+                self.fail("should have raised ValueError: %r" % bad)
 
 if __name__ == '__main__':
     unittest.main()

From 00e0773293b5cb90c9c265dade93148f052f6e02 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Feb 2016 08:39:26 +0000
Subject: [PATCH 223/868] removed wrong line

---
 Tests/t_ldapurl.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 46f9a8a..aef53aa 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -234,7 +234,6 @@ def test_bad_urls(self):
                 "ldap:///????a_b=0",    # extype contains only [-a-zA-Z0-9]
                 "ldap:///????!!a=0",    # only one exclamation allowed
         ):
-            assertRaises(ValueError, LDAPUrl, [bad])
             try:
                 LDAPUrl(bad)
             except ValueError:

From 747adca77a5ca4e0239f41c1701f054579a28b08 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Feb 2016 09:07:33 +0000
Subject: [PATCH 224/868] SF#66 and fixed constant names

---
 Tests/t_cext.py | 78 ++++++++++++++++++++++++-------------------------
 1 file changed, 39 insertions(+), 39 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 7a44c92..fd17ee9 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -39,7 +39,7 @@ def _init(self, reuse_existing=True, bind=True):
             # Perform a simple bind
             l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
             m = l.simple_bind(server.get_root_dn(), server.get_root_password())
-            result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ONE, self.timeout)
+            result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
             self.assertTrue(result, _ldap.RES_BIND)
         return l
 
@@ -56,7 +56,7 @@ def test_constants(self):
         self.assertEquals(_ldap.VERSION2, 2)
         self.assertEquals(_ldap.VERSION3, 3)
 
-        # constants for result3()
+        # constants for result4()
         self.assertEquals(_ldap.RES_BIND, 0x61)
         self.assertEquals(_ldap.RES_SEARCH_ENTRY, 0x64)
         self.assertEquals(_ldap.RES_SEARCH_RESULT, 0x65)
@@ -84,7 +84,7 @@ def test_constants(self):
         self.assertNotNone(_ldap.MOD_INCREMENT)
         self.assertNotNone(_ldap.MOD_BVALUES)
 
-        # for result3()
+        # for result4()
         self.assertNotNone(_ldap.MSG_ONE)
         self.assertNotNone(_ldap.MSG_ALL)
         self.assertNotNone(_ldap.MSG_RECEIVED)
@@ -144,8 +144,8 @@ def test_constants(self):
         self.assertNotNone(_ldap.AVA_NONPRINTABLE)
 
         # these two constants are pointless? XXX
-        self.assertEquals(_ldap.LDAP_OPT_ON, 1) 
-        self.assertEquals(_ldap.LDAP_OPT_OFF, 0)
+        self.assertEquals(_ldap.OPT_ON, 1) 
+        self.assertEquals(_ldap.OPT_OFF, 0)
 
         # these constants useless after ldap_url_parse() was dropped XXX
         self.assertNotNone(_ldap.URL_ERR_BADSCOPE)
@@ -157,7 +157,7 @@ def test_simple_bind(self):
     def test_simple_anonymous_bind(self):
         l = self._init(bind=False)
         m = l.simple_bind("", "")
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
@@ -165,7 +165,7 @@ def test_simple_anonymous_bind(self):
 
         # see if we can get the rootdse while we're here
         m = l.search_ext("", _ldap.SCOPE_BASE, '(objectClass=*)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg[0][0], "") # rootDSE has no dn
         self.assertEquals(msgid, m)
@@ -185,7 +185,7 @@ def test_search_ext_individual(self):
 
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, 
                 '(objectClass=dcObject)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ONE, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
 
         # Expect to get just one object
         self.assertEquals(result, _ldap.RES_SEARCH_ENTRY)
@@ -198,7 +198,7 @@ def test_search_ext_individual(self):
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ONE, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
@@ -214,7 +214,7 @@ def test_abandon(self):
 
         got_timeout = False
         try:
-            r = l.result3(m, _ldap.MSG_ALL, 0.3)  # (timeout /could/ be longer)
+            r = l.result4(m, _ldap.MSG_ALL, 0.3)  # (timeout /could/ be longer)
         except _ldap.TIMEOUT, e:
             got_timeout = True
         self.assertTrue(got_timeout)
@@ -223,7 +223,7 @@ def test_search_ext_all(self):
         l = self._init()
 
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # Expect to get some objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
@@ -240,7 +240,7 @@ def test_add(self):
                ('description', 'testing'),
             ])
 
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
@@ -248,7 +248,7 @@ def test_add(self):
 
         # search for it back
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # Expect to get the objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
@@ -272,14 +272,14 @@ def test_compare(self):
                ('cn', 'CompareTest'),
                ('userPassword', 'the_password'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # try a false compare
         m = l.compare_ext(dn, "userPassword", "bad_string")
         compared_false = False
         try:
-            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(repr(r))
         except _ldap.COMPARE_FALSE:
             compared_false = True
@@ -289,7 +289,7 @@ def test_compare(self):
         m = l.compare_ext(dn, "userPassword", "the_password")
         compared_true = False
         try:
-            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(repr(r))
         except _ldap.COMPARE_TRUE:
             compared_true = True
@@ -298,7 +298,7 @@ def test_compare(self):
         m = l.compare_ext(dn, "badAttribute", "ignoreme")
         raised_error = False
         try:
-            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(repr(r))
         except _ldap.error:
             raised_error = True
@@ -311,7 +311,7 @@ def test_delete_no_such_object(self):
         not_found = False
         m = l.delete_ext("cn=DoesNotExist,"+self.base)
         try:
-            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(r)
         except _ldap.NO_SUCH_OBJECT:
             not_found = True
@@ -325,11 +325,11 @@ def test_delete(self):
                ('objectClass','organizationalRole'), 
                ('cn', 'Deleteme'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         m = l.delete_ext(dn)
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_DELETE)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
@@ -344,7 +344,7 @@ def test_modify_no_such_object(self):
                 (_ldap.MOD_ADD, 'description', ['blah']),
             ])
         try:
-            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(r)
         except _ldap.NO_SUCH_OBJECT:
             not_found = True
@@ -360,7 +360,7 @@ def DISABLED_test_modify_no_such_object_empty_attrs(self):
                 (_ldap.MOD_ADD, 'description', []),
             ])
         self.assertTrue(isinstance(m, int))
-        r = l.result3(m, _ldap.MSG_ALL, self.timeout) # what should happen??
+        r = l.result4(m, _ldap.MSG_ALL, self.timeout) # what should happen??
         self.fail(r)
 
     def test_modify(self):
@@ -373,13 +373,13 @@ def test_modify(self):
                ('sn', 'Modify'),
                ('description', 'a description'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         m = l.modify_ext(dn, [
                 (_ldap.MOD_ADD, 'description', ['b desc', 'c desc']),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_MODIFY)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
@@ -387,7 +387,7 @@ def test_modify(self):
 
         # search for it back
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # Expect to get the objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
@@ -407,12 +407,12 @@ def test_rename(self):
                ('objectClass','organizationalRole'), 
                ('cn', 'RenameMe'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # do the rename with same parent
         m = l.rename(dn, "cn=IAmRenamed")
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_MODRDN)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
@@ -420,7 +420,7 @@ def test_rename(self):
 
         # make sure the old one is gone
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(len(pmsg), 0) # expect no results
         self.assertEquals(msgid, m)
@@ -429,7 +429,7 @@ def test_rename(self):
         # check that the new one looks right
         dn2 = "cn=IAmRenamed,"+self.base
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
@@ -443,7 +443,7 @@ def test_rename(self):
                ('objectClass','organizationalUnit'), 
                ('ou', 'RenameContainer'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # WORKAROUND bug in slapd. (Without an existing child, 
@@ -454,7 +454,7 @@ def test_rename(self):
                ('objectClass','organizationalRole'), 
                ('cn', 'Bogus'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # now rename from dn2 to the conater
@@ -462,7 +462,7 @@ def test_rename(self):
 
         # Now try renaming dn2 across container (simultaneous name change)
         m = l.rename(dn2, "cn=IAmRenamedAgain", containerDn)
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_MODRDN)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
@@ -470,18 +470,18 @@ def test_rename(self):
 
         # make sure dn2 is gone
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(len(pmsg), 0) # expect no results
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # make sure dn3 is there
         m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
@@ -507,7 +507,7 @@ def test_whoami_anonymous(self):
 
         # Anonymous bind
         m = l.simple_bind("", "")
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
 
         r = l.whoami_s()
@@ -524,20 +524,20 @@ def test_passwd(self):
                ('cn', 'PasswordTest'),
                ('userPassword', 'initial'),
             ])
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # try changing password with a wrong old-pw
         m = l.passwd(dn, "bogus", "ignored")
         try:
-            r = l.result3(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail("expected UNWILLING_TO_PERFORM")
         except _ldap.UNWILLING_TO_PERFORM:
             pass
 
         # try changing password with a correct old-pw
         m = l.passwd(dn, "initial", "changed")
-        result,pmsg,msgid,ctrls = l.result3(m, _ldap.MSG_ALL, self.timeout)
+        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
         self.assertEquals(result, _ldap.RES_EXTENDED)

From d61959cfa64f0f1f38a8e1ecb5b800485c49d217 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Feb 2016 09:08:39 +0000
Subject: [PATCH 225/868] Stripped trailing spaces, honor TMP env var, changed
 PATH_SCHEMA_CORE

---
 Tests/slapd.py | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/Tests/slapd.py b/Tests/slapd.py
index 48747fa..0c5d925 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -1,6 +1,6 @@
 
 """
-Utilities for starting up a test slapd server 
+Utilities for starting up a test slapd server
 and talking to it with ldapsearch/ldapadd.
 """
 
@@ -21,10 +21,10 @@ def mkdirs(path):
 
 def delete_directory_content(path):
     for dirpath,dirnames,filenames in os.walk(path, topdown=False):
-        for n in filenames: 
+        for n in filenames:
             _log.info("remove %s", os.path.join(dirpath, n))
             os.remove(os.path.join(dirpath, n))
-        for n in dirnames: 
+        for n in dirnames:
             _log.info("rmdir %s", os.path.join(dirpath, n))
             os.rmdir(os.path.join(dirpath, n))
 
@@ -53,10 +53,10 @@ class Slapd:
     _log = logging.getLogger("Slapd")
 
     # Use /var/tmp to placate apparmour on Ubuntu:
-    PATH_TMPDIR = "/var/tmp/python-ldap-test"  
+    PATH_TMPDIR = "/var/tmp/python-ldap-test"
     PATH_SBINDIR = "/usr/sbin"
     PATH_BINDIR = "/usr/bin"
-    PATH_SCHEMA_CORE = "/etc/ldap/schema/core.schema"
+    PATH_SCHEMA_CORE = "/etc/openldap/schema/core.schema"
     PATH_LDAPADD = os.path.join(PATH_BINDIR, "ldapadd")
     PATH_LDAPSEARCH = os.path.join(PATH_BINDIR, "ldapsearch")
     PATH_SLAPD = os.path.join(PATH_SBINDIR, "slapd")
@@ -89,7 +89,7 @@ def __init__(self):
         self._root_password = "password"
         self._slapd_debug_level = 0
 
-    # Setters 
+    # Setters
     def set_port(self, port):
         self._port = port
     def set_dn_suffix(self, dn):
@@ -120,7 +120,7 @@ def get_root_dn(self):
     def get_root_password(self):
         return self._root_password
     def get_tmpdir(self):
-        return self._tmpdir
+        return os.environ.get('TMP',self._tmpdir)
 
     def __del__(self):
         self.stop()
@@ -159,7 +159,7 @@ def _write_config(self):
 
     def start(self):
         """
-        Starts the slapd server process running, and waits for it to come up. 
+        Starts the slapd server process running, and waits for it to come up.
         """
         if self._proc is None:
             ok = False
@@ -184,9 +184,9 @@ def _start_slapd(self):
         # Spawns/forks the slapd process
         config_path = self._write_config()
         self._log.info("starting slapd")
-        self._proc = subprocess.Popen([self.PATH_SLAPD, 
-                "-f", config_path, 
-                "-h", self.get_url(), 
+        self._proc = subprocess.Popen([self.PATH_SLAPD,
+                "-f", config_path,
+                "-h", self.get_url(),
                 "-d", str(self._slapd_debug_level),
                 ])
         self._proc_config = config_path
@@ -239,9 +239,9 @@ def _stopped(self):
         if self._proc is not None:
             self._log.info("slapd terminated")
             self._proc = None
-            try: 
+            try:
                 os.remove(self._proc_config)
-            except os.error: 
+            except os.error:
                 self._log.debug("could not remove %s", self._proc_config)
 
     def _test_configuration(self):
@@ -252,8 +252,8 @@ def _test_configuration(self):
             if self._log.isEnabledFor(logging.DEBUG):
                 verboseflag = "-v"
             p = subprocess.Popen([
-                self.PATH_SLAPTEST, 
-                verboseflag, 
+                self.PATH_SLAPTEST,
+                verboseflag,
                 "-f", config_path
             ])
             if p.wait() != 0:
@@ -265,7 +265,7 @@ def _test_configuration(self):
     def ldapadd(self, ldif, extra_args=[]):
         """Runs ldapadd on this slapd instance, passing it the ldif content"""
         self._log.debug("adding %s", repr(ldif))
-        p = subprocess.Popen([self.PATH_LDAPADD, 
+        p = subprocess.Popen([self.PATH_LDAPADD,
                 "-x",
                 "-D", self.get_root_dn(),
                 "-w", self.get_root_password(),
@@ -279,7 +279,7 @@ def ldapsearch(self, base=None, filter='(objectClass=*)', attrs=[],
         scope='sub', extra_args=[]):
         if base is None: base = self.get_dn_suffix()
         self._log.debug("ldapsearch filter=%s", repr(filter))
-        p = subprocess.Popen([self.PATH_LDAPSEARCH, 
+        p = subprocess.Popen([self.PATH_LDAPSEARCH,
                 "-x",
                 "-D", self.get_root_dn(),
                 "-w", self.get_root_password(),

From a8c791d0514d6927e2b69e898f0ad0bb1b0daf79 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Feb 2016 09:17:20 +0000
Subject: [PATCH 226/868] comments about Tests/ in 2.4.26

---
 CHANGES | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index f51f126..df9fcc9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,13 @@ Modules/
 * Fixed #69 Segmentation fault on whoami_s after unbind 
   (thanks to Christian Heimes and Petr Viktorin)
 
+Tests/
+* Fixed result3() being used instead of correct result4()
+  (see #66, thanks to David D. Riddle)
+* Tests/slapd.py honors env var $TMP instead of just using
+  hard-coded /var/tmp
+* Tests/slapd.py now expects schema to be in /etc/openldap/
+
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
 
@@ -1248,4 +1255,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.374 2016/01/28 09:43:57 stroeder Exp $
+$Id: CHANGES,v 1.375 2016/02/05 09:17:20 stroeder Exp $

From 9b789fc317839cd23378c6cd7ca6c703db48db8f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 5 Feb 2016 09:17:47 +0000
Subject: [PATCH 227/868] comments about Tests/ in 2.4.26

---
 CHANGES | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index df9fcc9..2002d03 100644
--- a/CHANGES
+++ b/CHANGES
@@ -17,6 +17,7 @@ Tests/
 * Tests/slapd.py honors env var $TMP instead of just using
   hard-coded /var/tmp
 * Tests/slapd.py now expects schema to be in /etc/openldap/
+* Tests/t_ldapurl.py now independent of module ldap
 
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
@@ -1255,4 +1256,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.375 2016/02/05 09:17:20 stroeder Exp $
+$Id: CHANGES,v 1.376 2016/02/05 09:17:47 stroeder Exp $

From d74cac9fe53a19404269a9ae73db9a425f57bff3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 6 Feb 2016 11:07:17 +0000
Subject: [PATCH 228/868] Added TestParse.test_comments()

---
 Tests/t_ldif.py | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index efd69ec..316221e 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -126,6 +126,29 @@ def test_sorted(self):
                                     'c': [b'value_c']}),
             ])
 
+    def test_comments(self):
+        self.check_roundtrip("""
+                # comment #1
+                dn: cn=x1,cn=y1,cn=z1
+                b1: value_b1
+                c1: value_c1
+                a1: value_a1
+
+                # comment #2
+                dn: cn=x2,cn=y2,cn=z2
+                b2: value_b2
+                c2: value_c2
+                a2: value_a2
+
+            """, [
+                ('cn=x1,cn=y1,cn=z1', {'a1': [b'value_a1'],
+                                       'b1': [b'value_b1'],
+                                       'c1': [b'value_c1']}),
+                ('cn=x2,cn=y2,cn=z2', {'a2': [b'value_a2'],
+                                       'b2': [b'value_b2'],
+                                       'c2': [b'value_c2']}),
+            ])
+
 
 if __name__ == '__main__':
     unittest.main()

From e3be4cf755148614791529781bb4243e330459e8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 6 Feb 2016 11:08:21 +0000
Subject: [PATCH 229/868] TestParse.test_comments() with multi-line comment

---
 Tests/t_ldif.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 316221e..bfa31af 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -134,7 +134,8 @@ def test_comments(self):
                 c1: value_c1
                 a1: value_a1
 
-                # comment #2
+                # comment #2.1
+                # comment #2.2
                 dn: cn=x2,cn=y2,cn=z2
                 b2: value_b2
                 c2: value_c2

From 8332c5e1f176abfc1eaa342192ab092ff1eae72b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 6 Feb 2016 11:11:54 +0000
Subject: [PATCH 230/868] TestParse.test_comments() with line-folding

---
 Tests/t_ldif.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index bfa31af..1ea1c30 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -128,7 +128,8 @@ def test_sorted(self):
 
     def test_comments(self):
         self.check_roundtrip("""
-                # comment #1
+                # comment #1 
+                 with line-folding
                 dn: cn=x1,cn=y1,cn=z1
                 b1: value_b1
                 c1: value_c1

From 56bc060861f1c724d2e32108fd6909bb0b1473c4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 9 Feb 2016 11:58:30 +0000
Subject: [PATCH 231/868] Note about stderr when setting OPT_DEBUG_LEVEL

---
 Doc/ldap.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 70f15d3..2eb971e 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.31 2015/12/09 17:57:18 stroeder Exp $
+.. % $Id: ldap.rst,v 1.32 2016/02/09 11:58:30 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -129,7 +129,8 @@ following option identifiers are defined as constants:
 
 .. py:data:: OPT_DEBUG_LEVEL
 
-   Sets the debug level within the underlying LDAP C lib.
+   Sets the debug level within the underlying OpenLDAP C lib (libldap).
+   libldap sends the log messages to stderr.
 
 .. py:data:: OPT_DEFBASE
 

From 1f08ca640de86b0496a99cb75e05316a01a0a931 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 9 Feb 2016 17:12:28 +0000
Subject: [PATCH 232/868] Added TestParse.test_maxentries()

---
 Tests/t_ldif.py | 35 ++++++++++++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 1ea1c30..36b1e1e 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -15,8 +15,8 @@
 class TestParse(unittest.TestCase):
     maxDiff = None
 
-    def _parse_entry_records(self, ldif_string):
-        return ldif.ParseLDIF(StringIO(ldif_string))
+    def _parse_entry_records(self, ldif_string, maxentries):
+        return ldif.ParseLDIF(StringIO(ldif_string), maxentries=maxentries)
 
     def _unparse_entry_records(self, records):
         f = StringIO()
@@ -25,11 +25,11 @@ def _unparse_entry_records(self, records):
             ldif_writer.unparse(dn, attrs)
         return f.getvalue()
 
-    def check_roundtrip(self, ldif_source, entry_records):
+    def check_roundtrip(self, ldif_source, entry_records, maxentries=0):
         ldif_source = textwrap.dedent(ldif_source).lstrip() + '\n'
-        parsed_entry_records = self._parse_entry_records(ldif_source)
+        parsed_entry_records = self._parse_entry_records(ldif_source, maxentries)
         parsed_entry_records2 = self._parse_entry_records(
-            self._unparse_entry_records(entry_records)
+            self._unparse_entry_records(entry_records), maxentries
         )
         self.assertEqual(parsed_entry_records, entry_records)
         self.assertEqual(parsed_entry_records2, entry_records)
@@ -151,6 +151,31 @@ def test_comments(self):
                                        'c2': [b'value_c2']}),
             ])
 
+    def test_maxentries(self):
+        self.check_roundtrip("""
+                dn: cn=x1,cn=y1,cn=z1
+                b1: value_b1
+                a1: value_a1
+
+                dn: cn=x2,cn=y2,cn=z2
+                b2: value_b2
+                a2: value_a2
+
+                dn: cn=x3,cn=y3,cn=z3
+                b3: value_b3
+                a3: value_a3
+
+                dn: cn=x4,cn=y4,cn=z4
+                b2: value_b4
+                a2: value_a4
+
+            """, [
+                ('cn=x1,cn=y1,cn=z1', {'a1': [b'value_a1'],
+                                       'b1': [b'value_b1']}),
+                ('cn=x2,cn=y2,cn=z2', {'a2': [b'value_a2'],
+                                       'b2': [b'value_b2']}),
+            ], maxentries=2)
+
 
 if __name__ == '__main__':
     unittest.main()

From c3daabf18de8c4faad166859104bce37452c62bb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 9 Feb 2016 19:42:24 +0000
Subject: [PATCH 233/868] Removed TestParse.maxDiff; Renamed TestParse to
 TestEntryRecords

---
 Tests/t_ldif.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 36b1e1e..92d7f8c 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -12,8 +12,7 @@
     from io import StringIO
 
 
-class TestParse(unittest.TestCase):
-    maxDiff = None
+class TestEntryRecords(unittest.TestCase):
 
     def _parse_entry_records(self, ldif_string, maxentries):
         return ldif.ParseLDIF(StringIO(ldif_string), maxentries=maxentries)

From 1c15c41ce926bfed7fc02ac8bb086752a6fff3ac Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 9 Feb 2016 19:43:35 +0000
Subject: [PATCH 234/868] Added TestEntryRecords.test_multiple_empty_lines()
 but disabled the actual check for now

---
 Tests/t_ldif.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 92d7f8c..5c1072b 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -175,6 +175,25 @@ def test_maxentries(self):
                                        'b2': [b'value_b2']}),
             ], maxentries=2)
 
+    def test_multiple_empty_lines(self):
+        """
+        see http://sourceforge.net/p/python-ldap/feature-requests/18/
+        """
+        return
+        self.check_roundtrip("""
+                # silly example
+                dn: uid=one,dc=tld
+                uid: one
+
+
+                # another silly example
+                dn: uid=two,dc=tld
+                uid: two
+            """, [
+                ('uid=one,dc=tld', {'uid': [b'one']}),
+                ('uid=two,dc=tld', {'uid': [b'two']}),
+            ])
+
 
 if __name__ == '__main__':
     unittest.main()

From 18e3968bfcca63b4895d79b9ed2a37bf386f6afe Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 9 Feb 2016 19:44:00 +0000
Subject: [PATCH 235/868] Added TestEntryRecords.test_multiple_empty_lines()
 but disabled the actual check for now

---
 Tests/t_ldif.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 5c1072b..1b15179 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -179,7 +179,7 @@ def test_multiple_empty_lines(self):
         """
         see http://sourceforge.net/p/python-ldap/feature-requests/18/
         """
-        return
+        return # disabled
         self.check_roundtrip("""
                 # silly example
                 dn: uid=one,dc=tld

From 309059668dc283144edbc9340437b4f8194f6ca3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 10 Feb 2016 12:05:50 +0000
Subject: [PATCH 236/868] Use class LDIFRecordList directly instead of
 deprecated function ParseLDIF(), support ignored_attr_types

---
 Tests/t_ldif.py | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 1b15179..2b050a0 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -14,8 +14,15 @@
 
 class TestEntryRecords(unittest.TestCase):
 
-    def _parse_entry_records(self, ldif_string, maxentries):
-        return ldif.ParseLDIF(StringIO(ldif_string), maxentries=maxentries)
+    def _parse_entry_records(self, ldif_string, ignored_attr_types=None, max_entries=0):
+        f = StringIO(ldif_string)
+        ldif_parser = ldif.LDIFRecordList(
+            f,
+            ignored_attr_types=ignored_attr_types,
+            max_entries=max_entries,
+        )
+        ldif_parser.parse_entry_records()
+        return ldif_parser.all_records
 
     def _unparse_entry_records(self, records):
         f = StringIO()
@@ -24,17 +31,25 @@ def _unparse_entry_records(self, records):
             ldif_writer.unparse(dn, attrs)
         return f.getvalue()
 
-    def check_roundtrip(self, ldif_source, entry_records, maxentries=0):
+    def check_roundtrip(self, ldif_source, entry_records, ignored_attr_types=None, max_entries=0):
         ldif_source = textwrap.dedent(ldif_source).lstrip() + '\n'
-        parsed_entry_records = self._parse_entry_records(ldif_source, maxentries)
+        parsed_entry_records = self._parse_entry_records(
+            ldif_source,
+            ignored_attr_types=None,
+            max_entries=max_entries,
+        )
         parsed_entry_records2 = self._parse_entry_records(
-            self._unparse_entry_records(entry_records), maxentries
+            self._unparse_entry_records(entry_records),
+            ignored_attr_types=None,
+            max_entries=max_entries,
         )
         self.assertEqual(parsed_entry_records, entry_records)
         self.assertEqual(parsed_entry_records2, entry_records)
 
     def test_simple(self):
         self.check_roundtrip("""
+                version: 1
+
                 dn: cn=x,cn=y,cn=z
                 attrib: value
                 attrib: value2
@@ -150,7 +165,7 @@ def test_comments(self):
                                        'c2': [b'value_c2']}),
             ])
 
-    def test_maxentries(self):
+    def test_max_entries(self):
         self.check_roundtrip("""
                 dn: cn=x1,cn=y1,cn=z1
                 b1: value_b1
@@ -173,7 +188,7 @@ def test_maxentries(self):
                                        'b1': [b'value_b1']}),
                 ('cn=x2,cn=y2,cn=z2', {'a2': [b'value_a2'],
                                        'b2': [b'value_b2']}),
-            ], maxentries=2)
+            ], max_entries=2)
 
     def test_multiple_empty_lines(self):
         """

From ac734a17c7509cd27bd85afa49dcb6ea3459a835 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 10 Feb 2016 13:57:20 +0000
Subject: [PATCH 237/868] source code formatting more suitable for easy
 copy&paste

---
 Tests/t_ldif.py | 419 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 281 insertions(+), 138 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 2b050a0..68d006f 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -14,7 +14,12 @@
 
 class TestEntryRecords(unittest.TestCase):
 
-    def _parse_entry_records(self, ldif_string, ignored_attr_types=None, max_entries=0):
+    def _parse_entry_records(
+          self,
+          ldif_string,
+          ignored_attr_types=None,
+          max_entries=0,
+    ):
         f = StringIO(ldif_string)
         ldif_parser = ldif.LDIFRecordList(
             f,
@@ -31,183 +36,321 @@ def _unparse_entry_records(self, records):
             ldif_writer.unparse(dn, attrs)
         return f.getvalue()
 
-    def check_roundtrip(self, ldif_source, entry_records, ignored_attr_types=None, max_entries=0):
+    def check_roundtrip(
+            self,
+            ldif_source,
+            entry_records,
+            ignored_attr_types=None,
+            max_entries=0
+    ):
         ldif_source = textwrap.dedent(ldif_source).lstrip() + '\n'
         parsed_entry_records = self._parse_entry_records(
             ldif_source,
-            ignored_attr_types=None,
+            ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
         parsed_entry_records2 = self._parse_entry_records(
             self._unparse_entry_records(entry_records),
-            ignored_attr_types=None,
+            ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
         self.assertEqual(parsed_entry_records, entry_records)
         self.assertEqual(parsed_entry_records2, entry_records)
 
     def test_simple(self):
-        self.check_roundtrip("""
-                version: 1
-
-                dn: cn=x,cn=y,cn=z
-                attrib: value
-                attrib: value2
-            """, [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2']}),
-            ])
+        self.check_roundtrip(
+            """
+            version: 1
+
+            dn: cn=x,cn=y,cn=z
+            attrib: value
+            attrib: value2
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'attrib': [b'value', b'value2'],
+                    },
+                ),
+            ]
+        )
 
     def test_simple2(self):
-        self.check_roundtrip("""
-                dn:cn=x,cn=y,cn=z
-                attrib:value
-                attrib:value2
-            """, [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn:cn=x,cn=y,cn=z
+            attrib:value
+            attrib:value2
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'attrib': [b'value', b'value2'],
+                    },
+                ),
+            ]
+        )
 
     def test_multiple(self):
-        self.check_roundtrip("""
-                dn: cn=x,cn=y,cn=z
-                a: v
-                attrib: value
-                attrib: value2
-
-                dn: cn=a,cn=b,cn=c
-                attrib: value2
-                attrib: value3
-                b: v
-            """, [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'value', b'value2'], 'a': [b'v']}),
-                ('cn=a,cn=b,cn=c', {'attrib': [b'value2', b'value3'], 'b': [b'v']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            a: v
+            attrib: value
+            attrib: value2
+
+            dn: cn=a,cn=b,cn=c
+            attrib: value2
+            attrib: value3
+            b: v
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'attrib': [b'value', b'value2'],
+                        'a': [b'v'],
+                    },
+                ),
+                (
+                    'cn=a,cn=b,cn=c',
+                    {
+                        'attrib': [b'value2', b'value3'],
+                        'b': [b'v'],
+                    },
+                ),
+            ]
+        )
 
     def test_folded(self):
-        self.check_roundtrip("""
-                dn: cn=x,cn=y,cn=z
-                attrib: very
-                 long
-                  value
-                attrib2: %s
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            attrib: very
+             long
+              value
+            attrib2: %s
             """ % ('asdf.' * 20), [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'verylong value'],
-                                    'attrib2': [b'asdf.' * 20]}),
-            ])
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'attrib': [b'verylong value'],
+                        'attrib2': [b'asdf.' * 20],
+                    }
+                ),
+            ]
+        )
 
     def test_empty(self):
-        self.check_roundtrip("""
-                dn: cn=x,cn=y,cn=z
-                attrib: 
-                attrib: foo
-            """, [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'', b'foo']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            attrib1:
+            attrib1: foo
+            attrib2: 
+            attrib2: foo
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'attrib1': [b'', b'foo'],
+                        'attrib2': [b'', b'foo'],
+                    },
+                ),
+            ]
+        )
 
     def test_binary(self):
-        self.check_roundtrip("""
-                dn: cn=x,cn=y,cn=z
-                attrib:: CQAKOiVA
-            """, [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'\t\0\n:%@']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            attrib:: CQAKOiVA
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                      'attrib': [b'\t\0\n:%@'],
+                    },
+                ),
+            ]
+        )
 
     def test_binary2(self):
-        self.check_roundtrip("""
-                dn: cn=x,cn=y,cn=z
-                attrib::CQAKOiVA
-            """, [
-                ('cn=x,cn=y,cn=z', {'attrib': [b'\t\0\n:%@']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            attrib::CQAKOiVA
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {'attrib': [b'\t\0\n:%@']},
+                ),
+            ]
+        )
 
     def test_unicode(self):
-        self.check_roundtrip("""
-                dn: cn=Michael Stroeder,dc=stroeder,dc=com
-                lastname: Ströder
-            """, [
-                ('cn=Michael Stroeder,dc=stroeder,dc=com',
-                 {'lastname': [b'Str\303\266der']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn: cn=Michael Stroeder,dc=stroeder,dc=com
+            lastname: Ströder
+            """,
+            [
+                (
+                    'cn=Michael Stroeder,dc=stroeder,dc=com',
+                    {'lastname': [b'Str\303\266der']},
+                ),
+            ]
+        )
 
     def test_sorted(self):
-        self.check_roundtrip("""
-                dn: cn=x,cn=y,cn=z
-                b: value_b
-                c: value_c
-                a: value_a
-            """, [
-                ('cn=x,cn=y,cn=z', {'a': [b'value_a'],
-                                    'b': [b'value_b'],
-                                    'c': [b'value_c']}),
-            ])
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            b: value_b
+            c: value_c
+            a: value_a
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'a': [b'value_a'],
+                        'b': [b'value_b'],
+                        'c': [b'value_c'],
+                    }
+                ),
+            ]
+        )
+
+    def test_ignored_attr_types(self):
+        self.check_roundtrip(
+            """
+            dn: cn=x,cn=y,cn=z
+            a: value_a
+            b: value_b
+            c: value_c
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {
+                        'a': [b'value_a'],
+                        'c': [b'value_c'],
+                    }
+                ),
+            ],
+            ignored_attr_types=['b'],
+        )
 
     def test_comments(self):
-        self.check_roundtrip("""
-                # comment #1 
-                 with line-folding
-                dn: cn=x1,cn=y1,cn=z1
-                b1: value_b1
-                c1: value_c1
-                a1: value_a1
-
-                # comment #2.1
-                # comment #2.2
-                dn: cn=x2,cn=y2,cn=z2
-                b2: value_b2
-                c2: value_c2
-                a2: value_a2
-
-            """, [
-                ('cn=x1,cn=y1,cn=z1', {'a1': [b'value_a1'],
-                                       'b1': [b'value_b1'],
-                                       'c1': [b'value_c1']}),
-                ('cn=x2,cn=y2,cn=z2', {'a2': [b'value_a2'],
-                                       'b2': [b'value_b2'],
-                                       'c2': [b'value_c2']}),
-            ])
+        self.check_roundtrip(
+            """
+            # comment #1
+             with line-folding
+            dn: cn=x1,cn=y1,cn=z1
+            b1: value_b1
+            c1: value_c1
+            a1: value_a1
+
+            # comment #2.1
+            # comment #2.2
+            dn: cn=x2,cn=y2,cn=z2
+            b2: value_b2
+            c2: value_c2
+            a2: value_a2
+
+            """,
+            [
+                (
+                    'cn=x1,cn=y1,cn=z1',
+                    {
+                        'a1': [b'value_a1'],
+                        'b1': [b'value_b1'],
+                        'c1': [b'value_c1'],
+                    }
+                ),
+                (
+                    'cn=x2,cn=y2,cn=z2',
+                    {
+                        'a2': [b'value_a2'],
+                        'b2': [b'value_b2'],
+                        'c2': [b'value_c2'],
+                    }
+                ),
+            ]
+        )
 
     def test_max_entries(self):
-        self.check_roundtrip("""
-                dn: cn=x1,cn=y1,cn=z1
-                b1: value_b1
-                a1: value_a1
-
-                dn: cn=x2,cn=y2,cn=z2
-                b2: value_b2
-                a2: value_a2
-
-                dn: cn=x3,cn=y3,cn=z3
-                b3: value_b3
-                a3: value_a3
-
-                dn: cn=x4,cn=y4,cn=z4
-                b2: value_b4
-                a2: value_a4
-
-            """, [
-                ('cn=x1,cn=y1,cn=z1', {'a1': [b'value_a1'],
-                                       'b1': [b'value_b1']}),
-                ('cn=x2,cn=y2,cn=z2', {'a2': [b'value_a2'],
-                                       'b2': [b'value_b2']}),
-            ], max_entries=2)
+        self.check_roundtrip(
+            """
+            dn: cn=x1,cn=y1,cn=z1
+            b1: value_b1
+            a1: value_a1
+
+            dn: cn=x2,cn=y2,cn=z2
+            b2: value_b2
+            a2: value_a2
+
+            dn: cn=x3,cn=y3,cn=z3
+            b3: value_b3
+            a3: value_a3
+
+            dn: cn=x4,cn=y4,cn=z4
+            b2: value_b4
+            a2: value_a4
+
+            """,
+            [
+                (
+                    'cn=x1,cn=y1,cn=z1',
+                    {
+                        'a1': [b'value_a1'],
+                        'b1': [b'value_b1'],
+                    }
+                ),
+                (
+                    'cn=x2,cn=y2,cn=z2',
+                    {
+                        'a2': [b'value_a2'],
+                        'b2': [b'value_b2'],
+                    }
+                ),
+            ],
+            max_entries=2
+        )
 
     def test_multiple_empty_lines(self):
         """
         see http://sourceforge.net/p/python-ldap/feature-requests/18/
         """
         return # disabled
-        self.check_roundtrip("""
-                # silly example
-                dn: uid=one,dc=tld
-                uid: one
-
-
-                # another silly example
-                dn: uid=two,dc=tld
-                uid: two
-            """, [
-                ('uid=one,dc=tld', {'uid': [b'one']}),
-                ('uid=two,dc=tld', {'uid': [b'two']}),
-            ])
+        self.check_roundtrip(
+            """
+            # normal
+            dn: uid=one,dc=tld
+            uid: one
+
+
+            # after extra empty line
+            dn: uid=two,dc=tld
+            uid: two
+            """,
+            [
+                (
+                    'uid=one,dc=tld',
+                    {'uid': [b'one']}
+                ),
+                (
+                    'uid=two,dc=tld',
+                    {'uid': [b'two']}
+                ),
+            ],
+        )
 
 
 if __name__ == '__main__':

From ec45d3edefffa8b6ea17c78282d257aa8d096fb7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 10 Feb 2016 22:11:04 +0000
Subject: [PATCH 238/868] More clean-ups, also make pylint more happy

---
 Tests/t_ldif.py | 87 +++++++++++++++++++++++++++++--------------------
 1 file changed, 52 insertions(+), 35 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 68d006f..62e12e1 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -1,51 +1,69 @@
 # -*- coding: utf-8 -*-
+"""
+Automatic tests for python-ldap's module ldif
 
-import unittest
-import textwrap
+See http://www.python-ldap.org/ for details.
 
-import ldif
+$Id: t_ldif.py,v 1.13 2016/02/10 22:11:04 stroeder Exp $
+"""
 
+# from Python's standard lib
+import unittest
+import textwrap
 
 try:
     from StringIO import StringIO
 except ImportError:
     from io import StringIO
 
+# from python-ldap
+import ldif
+
 
 class TestEntryRecords(unittest.TestCase):
 
     def _parse_entry_records(
-          self,
-          ldif_string,
-          ignored_attr_types=None,
-          max_entries=0,
+            self,
+            ldif_string,
+            ignored_attr_types=None,
+            max_entries=0,
     ):
-        f = StringIO(ldif_string)
+        """
+        Parse LDIF data in `ldif_string' into list of entry records
+        """
+        ldif_file = StringIO(ldif_string)
         ldif_parser = ldif.LDIFRecordList(
-            f,
+            ldif_file,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
         ldif_parser.parse_entry_records()
         return ldif_parser.all_records
 
-    def _unparse_entry_records(self, records):
-        f = StringIO()
-        ldif_writer = ldif.LDIFWriter(f)
-        for dn, attrs in records:
-            ldif_writer.unparse(dn, attrs)
-        return f.getvalue()
+    def _unparse_entry_records(self, entry_records):
+        """
+        Returns LDIF string with entry records from list `entry_records'
+        """
+        ldif_file = StringIO()
+        ldif_writer = ldif.LDIFWriter(ldif_file)
+        for dn, entry in entry_records:
+            ldif_writer.unparse(dn, entry)
+        return ldif_file.getvalue()
 
-    def check_roundtrip(
+    def check_entry_records(
             self,
-            ldif_source,
+            ldif_string,
             entry_records,
             ignored_attr_types=None,
             max_entries=0
     ):
-        ldif_source = textwrap.dedent(ldif_source).lstrip() + '\n'
+        """
+        Checks whether entry records in `ldif_string' gets correctly parsed
+        and matches list of unparsed `entry_records'.
+        """
+        ldif_string = textwrap.dedent(ldif_string).lstrip() + '\n'
         parsed_entry_records = self._parse_entry_records(
-            ldif_source,
+            ldif_string,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
@@ -58,7 +76,7 @@ def check_roundtrip(
         self.assertEqual(parsed_entry_records2, entry_records)
 
     def test_simple(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             version: 1
 
@@ -77,7 +95,7 @@ def test_simple(self):
         )
 
     def test_simple2(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn:cn=x,cn=y,cn=z
             attrib:value
@@ -94,7 +112,7 @@ def test_simple2(self):
         )
 
     def test_multiple(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             a: v
@@ -125,7 +143,7 @@ def test_multiple(self):
         )
 
     def test_folded(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib: very
@@ -144,12 +162,12 @@ def test_folded(self):
         )
 
     def test_empty(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib1:
             attrib1: foo
-            attrib2: 
+            attrib2:
             attrib2: foo
             """,
             [
@@ -164,7 +182,7 @@ def test_empty(self):
         )
 
     def test_binary(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib:: CQAKOiVA
@@ -173,14 +191,14 @@ def test_binary(self):
                 (
                     'cn=x,cn=y,cn=z',
                     {
-                      'attrib': [b'\t\0\n:%@'],
+                        'attrib': [b'\t\0\n:%@'],
                     },
                 ),
             ]
         )
 
     def test_binary2(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib::CQAKOiVA
@@ -194,7 +212,7 @@ def test_binary2(self):
         )
 
     def test_unicode(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=Michael Stroeder,dc=stroeder,dc=com
             lastname: Ströder
@@ -208,7 +226,7 @@ def test_unicode(self):
         )
 
     def test_sorted(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             b: value_b
@@ -228,7 +246,7 @@ def test_sorted(self):
         )
 
     def test_ignored_attr_types(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
             a: value_a
@@ -248,7 +266,7 @@ def test_ignored_attr_types(self):
         )
 
     def test_comments(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             # comment #1
              with line-folding
@@ -286,7 +304,7 @@ def test_comments(self):
         )
 
     def test_max_entries(self):
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             dn: cn=x1,cn=y1,cn=z1
             b1: value_b1
@@ -328,8 +346,7 @@ def test_multiple_empty_lines(self):
         """
         see http://sourceforge.net/p/python-ldap/feature-requests/18/
         """
-        return # disabled
-        self.check_roundtrip(
+        self.check_entry_records(
             """
             # normal
             dn: uid=one,dc=tld

From 978cbf71ea7a5ff4544a0b1ed213f7cd4a75d541 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 11 Feb 2016 01:08:29 +0000
Subject: [PATCH 239/868] Tests/t_ldif.py with more test-cases

---
 CHANGES | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 2002d03..dab0142 100644
--- a/CHANGES
+++ b/CHANGES
@@ -18,6 +18,7 @@ Tests/
   hard-coded /var/tmp
 * Tests/slapd.py now expects schema to be in /etc/openldap/
 * Tests/t_ldapurl.py now independent of module ldap
+* Tests/t_ldif.py reworked and with more test-cases
 
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
@@ -1256,4 +1257,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.376 2016/02/05 09:17:47 stroeder Exp $
+$Id: CHANGES,v 1.377 2016/02/11 01:08:29 stroeder Exp $

From 1dd979ffae22ea3b3c20827108b1ed966f80311e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 11 Feb 2016 01:08:43 +0000
Subject: [PATCH 240/868] Tests/t_ldif.py with more test-cases

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index dab0142..bd05fe5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -18,7 +18,7 @@ Tests/
   hard-coded /var/tmp
 * Tests/slapd.py now expects schema to be in /etc/openldap/
 * Tests/t_ldapurl.py now independent of module ldap
-* Tests/t_ldif.py reworked and with more test-cases
+* Tests/t_ldif.py with more test-cases
 
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
@@ -1257,4 +1257,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.377 2016/02/11 01:08:29 stroeder Exp $
+$Id: CHANGES,v 1.378 2016/02/11 01:08:43 stroeder Exp $

From 8fd0a22b2265a9136aac032fd7c6ca1d3dd8a4fe Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 16 Feb 2016 18:01:35 +0000
Subject: [PATCH 241/868] Consequently use HTTPS links

---
 setup.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/setup.py b/setup.py
index 868d2f0..4d435f1 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.73 2015/09/19 13:38:30 stroeder Exp $
+$Id: setup.py,v 1.74 2016/02/16 18:01:35 stroeder Exp $
 """
 
 has_setuptools = False
@@ -91,8 +91,8 @@ class OpenLDAP2:
   """,
   author = 'python-ldap project',
   author_email = 'python-ldap@python.org',
-  url = 'http://www.python-ldap.org/',
-  download_url = 'http://pypi.python.org/pypi/python-ldap/',
+  url = 'https://www.python-ldap.org/',
+  download_url = 'https://pypi.python.org/pypi/python-ldap/',
   classifiers = [
     'Development Status :: 5 - Production/Stable',
     'Intended Audience :: Developers',

From 1dff225e46ccb39d4929556123a811d7b0ba192f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 29 Feb 2016 17:05:43 +0000
Subject: [PATCH 242/868] release = '2.4.26.0'

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index e9e4833..72fc8bb 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.23 2015/12/09 17:33:14 stroeder Exp $
+# $Id: conf.py,v 1.24 2016/02/29 17:05:43 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.22.0'
+release = '2.4.26.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From 2d57f9db3711fa9f53e868bea94839b27da4e71f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 29 Feb 2016 18:55:59 +0000
Subject: [PATCH 243/868] style

---
 Tests/t_ldif.py | 82 +++++++++++++++++++++++++++----------------------
 1 file changed, 46 insertions(+), 36 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 62e12e1..f7ff843 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.13 2016/02/10 22:11:04 stroeder Exp $
+$Id: t_ldif.py,v 1.14 2016/02/29 18:55:59 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -20,35 +20,44 @@
 import ldif
 
 
-class TestEntryRecords(unittest.TestCase):
+def parse_records(
+        ldif_string,
+        record_type='entry',
+        ignored_attr_types=None,
+        max_entries=0,
+):
+    """
+    Parse LDIF data in `ldif_string' into list of records
+    """
+    ldif_file = StringIO(ldif_string)
+    ldif_parser = ldif.LDIFRecordList(
+        ldif_file,
+        ignored_attr_types=ignored_attr_types,
+        max_entries=max_entries,
+    )
+    parser_method = getattr(
+        ldif_parser,
+        'parse_%s_records' % record_type
+    )
+    parser_method()
+    return ldif_parser.all_records
+
+
+def unparse_records(records):
+    """
+    Returns LDIF string with entry records from list `entry_records'
+    """
+    ldif_file = StringIO()
+    ldif_writer = ldif.LDIFWriter(ldif_file)
+    for dn, entry in records:
+        ldif_writer.unparse(dn, entry)
+    return ldif_file.getvalue()
 
-    def _parse_entry_records(
-            self,
-            ldif_string,
-            ignored_attr_types=None,
-            max_entries=0,
-    ):
-        """
-        Parse LDIF data in `ldif_string' into list of entry records
-        """
-        ldif_file = StringIO(ldif_string)
-        ldif_parser = ldif.LDIFRecordList(
-            ldif_file,
-            ignored_attr_types=ignored_attr_types,
-            max_entries=max_entries,
-        )
-        ldif_parser.parse_entry_records()
-        return ldif_parser.all_records
 
-    def _unparse_entry_records(self, entry_records):
-        """
-        Returns LDIF string with entry records from list `entry_records'
-        """
-        ldif_file = StringIO()
-        ldif_writer = ldif.LDIFWriter(ldif_file)
-        for dn, entry in entry_records:
-            ldif_writer.unparse(dn, entry)
-        return ldif_file.getvalue()
+class TestEntryRecords(unittest.TestCase):
+    """
+    Various LDIF test cases
+    """
 
     def check_entry_records(
             self,
@@ -62,13 +71,13 @@ def check_entry_records(
         and matches list of unparsed `entry_records'.
         """
         ldif_string = textwrap.dedent(ldif_string).lstrip() + '\n'
-        parsed_entry_records = self._parse_entry_records(
+        parsed_entry_records = parse_records(
             ldif_string,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
-        parsed_entry_records2 = self._parse_entry_records(
-            self._unparse_entry_records(entry_records),
+        parsed_entry_records2 = parse_records(
+            unparse_records(entry_records),
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
@@ -146,16 +155,17 @@ def test_folded(self):
         self.check_entry_records(
             """
             dn: cn=x,cn=y,cn=z
-            attrib: very
+            attrib: very\x20
              long
-              value
+              line-folded\x20
+             value
             attrib2: %s
-            """ % ('asdf.' * 20), [
+            """ % (b'asdf.'*20), [
                 (
                     'cn=x,cn=y,cn=z',
                     {
-                        'attrib': [b'verylong value'],
-                        'attrib2': [b'asdf.' * 20],
+                        'attrib': [b'very long line-folded value'],
+                        'attrib2': [b'asdf.'*20],
                     }
                 ),
             ]

From d48b8225906be665317a615a3ad90ed21f2fe75d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 29 Feb 2016 18:56:43 +0000
Subject: [PATCH 244/868] be explicit

---
 Tests/t_ldif.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index f7ff843..42bcae0 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.14 2016/02/29 18:55:59 stroeder Exp $
+$Id: t_ldif.py,v 1.15 2016/02/29 18:56:43 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -73,11 +73,13 @@ def check_entry_records(
         ldif_string = textwrap.dedent(ldif_string).lstrip() + '\n'
         parsed_entry_records = parse_records(
             ldif_string,
+            record_type='entry',
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
         parsed_entry_records2 = parse_records(
             unparse_records(entry_records),
+            record_type='entry',
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )

From e8a55d278c9b3c01c7a1d8e0f100996876803bb2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 29 Feb 2016 22:44:42 +0000
Subject: [PATCH 245/868] More preparation to also check change records

---
 Tests/t_ldif.py | 59 ++++++++++++++++++++++++++++---------------------
 1 file changed, 34 insertions(+), 25 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 42bcae0..a76f098 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.15 2016/02/29 18:56:43 stroeder Exp $
+$Id: t_ldif.py,v 1.16 2016/02/29 22:44:42 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -45,7 +45,7 @@ def parse_records(
 
 def unparse_records(records):
     """
-    Returns LDIF string with entry records from list `entry_records'
+    Returns LDIF string with entry records from list `records'
     """
     ldif_file = StringIO()
     ldif_writer = ldif.LDIFWriter(ldif_file)
@@ -59,35 +59,44 @@ class TestEntryRecords(unittest.TestCase):
     Various LDIF test cases
     """
 
-    def check_entry_records(
+    def check_records(
             self,
             ldif_string,
-            entry_records,
+            records,
+            record_type='entry',
             ignored_attr_types=None,
             max_entries=0
     ):
         """
         Checks whether entry records in `ldif_string' gets correctly parsed
-        and matches list of unparsed `entry_records'.
+        and matches list of unparsed `records'.
         """
         ldif_string = textwrap.dedent(ldif_string).lstrip() + '\n'
-        parsed_entry_records = parse_records(
+        parsed_records = parse_records(
             ldif_string,
-            record_type='entry',
+            record_type=record_type,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
-        parsed_entry_records2 = parse_records(
-            unparse_records(entry_records),
-            record_type='entry',
+        parsed_records2 = parse_records(
+            unparse_records(records),
+            record_type=record_type,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
-        self.assertEqual(parsed_entry_records, entry_records)
-        self.assertEqual(parsed_entry_records2, entry_records)
+        self.assertEqual(parsed_records, records)
+        self.assertEqual(parsed_records2, records)
+
+    def test_empty(self):
+        self.check_records(
+            """
+            version: 1
+            """,
+            []
+        )
 
     def test_simple(self):
-        self.check_entry_records(
+        self.check_records(
             """
             version: 1
 
@@ -106,7 +115,7 @@ def test_simple(self):
         )
 
     def test_simple2(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn:cn=x,cn=y,cn=z
             attrib:value
@@ -123,7 +132,7 @@ def test_simple2(self):
         )
 
     def test_multiple(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             a: v
@@ -154,7 +163,7 @@ def test_multiple(self):
         )
 
     def test_folded(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib: very\x20
@@ -174,7 +183,7 @@ def test_folded(self):
         )
 
     def test_empty(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib1:
@@ -194,7 +203,7 @@ def test_empty(self):
         )
 
     def test_binary(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib:: CQAKOiVA
@@ -210,7 +219,7 @@ def test_binary(self):
         )
 
     def test_binary2(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             attrib::CQAKOiVA
@@ -224,7 +233,7 @@ def test_binary2(self):
         )
 
     def test_unicode(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=Michael Stroeder,dc=stroeder,dc=com
             lastname: Ströder
@@ -238,7 +247,7 @@ def test_unicode(self):
         )
 
     def test_sorted(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             b: value_b
@@ -258,7 +267,7 @@ def test_sorted(self):
         )
 
     def test_ignored_attr_types(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x,cn=y,cn=z
             a: value_a
@@ -278,7 +287,7 @@ def test_ignored_attr_types(self):
         )
 
     def test_comments(self):
-        self.check_entry_records(
+        self.check_records(
             """
             # comment #1
              with line-folding
@@ -316,7 +325,7 @@ def test_comments(self):
         )
 
     def test_max_entries(self):
-        self.check_entry_records(
+        self.check_records(
             """
             dn: cn=x1,cn=y1,cn=z1
             b1: value_b1
@@ -358,7 +367,7 @@ def test_multiple_empty_lines(self):
         """
         see http://sourceforge.net/p/python-ldap/feature-requests/18/
         """
-        self.check_entry_records(
+        self.check_records(
             """
             # normal
             dn: uid=one,dc=tld

From 30e4b3142af0180a52ad996650bad833375ee6f3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 29 Feb 2016 22:51:36 +0000
Subject: [PATCH 246/868] some refactoring, tested with t_ldif.py

---
 Lib/ldif.py | 163 +++++++++++++++++++++++++++++-----------------------
 1 file changed, 90 insertions(+), 73 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 2d9f4c3..20fd61a 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.91 2016/01/26 10:43:24 stroeder Exp $
+$Id: ldif.py,v 1.92 2016/02/29 22:51:36 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -97,7 +97,7 @@ def __init__(self,output_file,base64_attrs=None,cols=76,line_sep='\n'):
     self._output_file = output_file
     self._base64_attrs = list_dict([a.lower() for a in (base64_attrs or [])])
     self._cols = cols
-    self._line_sep = line_sep
+    self._last_line_sep = line_sep
     self.records_written = 0
 
   def _unfold_lines(self,line):
@@ -108,16 +108,16 @@ def _unfold_lines(self,line):
     line_len = len(line)
     if line_len<=self._cols:
       self._output_file.write(line)
-      self._output_file.write(self._line_sep)
+      self._output_file.write(self._last_line_sep)
     else:
       # Fold line
       pos = self._cols
       self._output_file.write(line[0:min(line_len,self._cols)])
-      self._output_file.write(self._line_sep)
+      self._output_file.write(self._last_line_sep)
       while pos<line_len:
         self._output_file.write(' ')
         self._output_file.write(line[pos:min(line_len,pos+self._cols-1)])
-        self._output_file.write(self._line_sep)
+        self._output_file.write(self._last_line_sep)
         pos = pos+self._cols-1
     return # _unfold_lines()
 
@@ -181,7 +181,7 @@ def _unparseChangeRecord(self,modlist):
         for mod_val in mod_vals:
           self._unparseAttrTypeandValue(mod_type,mod_val)
       if mod_len==3:
-        self._output_file.write('-'+self._line_sep)
+        self._output_file.write('-'+self._last_line_sep)
 
   def unparse(self,dn,record):
     """
@@ -201,7 +201,7 @@ def unparse(self,dn,record):
     else:
       raise ValueError('Argument record must be dictionary or list instead of %s' % (repr(record)))
     # Write empty line separating the records
-    self._output_file.write(self._line_sep)
+    self._output_file.write(self._last_line_sep)
     # Count records written
     self.records_written = self.records_written+1
     return # unparse()
@@ -270,11 +270,16 @@ def __init__(
     self._max_entries = max_entries
     self._process_url_schemes = list_dict([s.lower() for s in (process_url_schemes or [])])
     self._ignored_attr_types = list_dict([a.lower() for a in (ignored_attr_types or [])])
-    self._line_sep = line_sep
+    self._last_line_sep = line_sep
+    self.version = None
+    # Initialize counters
     self.line_counter = 0
     self.byte_counter = 0
     self.records_read = 0
-    self._line = self._readline()
+    # Store some symbols for better performance
+    self._base64_decodestring = base64.decodestring
+    # Read very first line
+    self._last_line = self._readline()
 
   def handle(self,dn,entry):
     """
@@ -287,7 +292,12 @@ def _readline(self):
     s = self._input_file.readline()
     self.line_counter = self.line_counter + 1
     self.byte_counter = self.byte_counter + len(s)
-    if s[-2:]=='\r\n':
+    if not s:
+      raise EOFError('EOF reached after %d lines (%d bytes)' % (
+        self.line_counter,
+        self.byte_counter,
+      ))
+    elif s[-2:]=='\r\n':
       return s[:-2]
     elif s[-1:]=='\n':
       return s[:-1]
@@ -298,11 +308,12 @@ def _unfold_lines(self):
     """
     Unfold several folded lines with trailing space into one line
     """
-    unfolded_lines = [ self._line ]
-    self._line = self._readline()
-    while self._line and self._line[0]==' ':
-      unfolded_lines.append(self._line[1:])
-      self._line = self._readline()
+    unfolded_lines = [ self._last_line ]
+    next_line = self._readline()
+    while next_line and next_line[0]==' ':
+      unfolded_lines.append(next_line[1:])
+      next_line = self._readline()
+    self._last_line = next_line
     return ''.join(unfolded_lines)
 
   def _next_key_and_value(self):
@@ -319,7 +330,10 @@ def _next_key_and_value(self):
       return None,None
     if unfolded_line=='-':
       return '-',None
-    colon_pos = unfolded_line.index(':')
+    try:
+      colon_pos = unfolded_line.index(':')
+    except ValueError,e:
+      raise ValueError('no value-spec in %s' % (repr(unfolded_line)))
     attr_type = unfolded_line[0:colon_pos]
     # if needed attribute value is BASE64 decoded
     value_spec = unfolded_line[colon_pos:colon_pos+2]
@@ -327,7 +341,7 @@ def _next_key_and_value(self):
       attr_value = unfolded_line[colon_pos+2:].lstrip()
     elif value_spec=='::':
       # attribute value needs base64-decoding
-      attr_value = base64.decodestring(unfolded_line[colon_pos+2:])
+      attr_value = self._base64_decodestring(unfolded_line[colon_pos+2:])
     elif value_spec==':<':
       # fetch attribute value from URL
       url = unfolded_line[colon_pos+2:].strip()
@@ -340,18 +354,36 @@ def _next_key_and_value(self):
       attr_value = unfolded_line[colon_pos+1:]
     return attr_type,attr_value
 
+  def _consume_empty_lines(self):
+    """
+    Consume empty lines until first non-empty line.
+    Must only be used between full records!
+
+    Returns non-empty key-value-tuple.
+    """
+    # Local symbol for better performance
+    next_key_and_value = self._next_key_and_value
+    # Consume empty lines
+    try:
+      k,v = next_key_and_value()
+      while k==v==None:
+        k,v = next_key_and_value()
+    except EOFError:
+      k,v = None,None
+    return k,v
+
   def parse_entry_records(self):
     """
     Continously read and parse LDIF entry records
     """
-    k,v = self._next_key_and_value()
+    # Local symbol for better performance
+    next_key_and_value = self._next_key_and_value
+    # Consume empty lines
+    k,v = self._consume_empty_lines()
+    # Consume 'version' line
     if k=='version':
-      self.version = v
-      k,v = self._next_key_and_value()
-      if k==v==None:
-        k,v = self._next_key_and_value()
-    else:
-      self.version = None
+      self.version = int(v)
+      k,v = self._consume_empty_lines()
 
     # Loop for processing whole records
     while k!=None and \
@@ -364,25 +396,27 @@ def parse_entry_records(self):
       dn = v
       entry = {}
       # Consume second line of record
-      k,v = self._next_key_and_value()
+      k,v = next_key_and_value()
 
-      # Loop for reading the attributes
-      while k!=None and \
-         not k.lower() in self._ignored_attr_types:
-        # Add the attribute to the entry if not ignored attribute
-        try:
-          entry[k].append(v)
-        except KeyError:
-          entry[k]=[v]
-        # Read the next line within the record
-        k,v = self._next_key_and_value()
-      # Consume empty separator line
-      k,v = self._next_key_and_value()
-      if entry:
-        # append entry to result list
-        self.handle(dn,entry)
+      try:
+        # Loop for reading the attributes
+        while k!=None:
+          # Add the attribute to the entry if not ignored attribute
+          if not k.lower() in self._ignored_attr_types:
+            try:
+              entry[k].append(v)
+            except KeyError:
+              entry[k]=[v]
+          # Read the next line within the record
+          k,v = next_key_and_value()
+      except EOFError:
+        pass
+
+      # handle record
+      self.handle(dn,entry)
       self.records_read = self.records_read + 1
-
+      # Consume empty separator line(s)
+      k,v = self._consume_empty_lines()
     return # parse_entry_records()
 
   def parse(self):
@@ -400,13 +434,14 @@ def handle_modify(self,dn,modops,controls=None):
     pass
 
   def parse_change_records(self):
+    next_key_and_value = self._next_key_and_value
     self.changetype_counter = {}
-    k,v = self._next_key_and_value()
+    k,v = next_key_and_value()
     if k=='version':
       self.version = v
-      k,v = self._next_key_and_value()
+      k,v = next_key_and_value()
       if k==v==None:
-        k,v = self._next_key_and_value()
+        k,v = next_key_and_value()
     else:
       self.version = None
 
@@ -422,7 +457,7 @@ def parse_change_records(self):
       dn = v
       # Read "control:" lines
       controls = []
-      k,v = self._next_key_and_value()
+      k,v = next_key_and_value()
       while k=='control':
         try:
           control_type,criticality,control_value = v.split(' ',2)
@@ -430,7 +465,7 @@ def parse_change_records(self):
           control_value = None
           control_type,criticality = v.split(' ',1)
         controls.append((control_type,criticality,control_value))
-        k,v = self._next_key_and_value()
+        k,v = next_key_and_value()
       # Determine changetype first, assuming changetype: as default
       changetype = 'modify'
       # Consume second line of record
@@ -438,7 +473,7 @@ def parse_change_records(self):
         if not v in valid_changetype_dict:
           raise ValueError('Invalid changetype: %s' % repr(v))
         changetype = v
-        k,v = self._next_key_and_value()
+        k,v = next_key_and_value()
 
       if changetype=='modify':
 
@@ -455,15 +490,15 @@ def parse_change_records(self):
           # we now have the attribute name to be modified
           modattr = v
           modvalues = []
-          k,v = self._next_key_and_value()
+          k,v = next_key_and_value()
           while k==modattr:
             modvalues.append(v)
-            k,v = self._next_key_and_value()
+            k,v = next_key_and_value()
           modops.append((modop,modattr,modvalues or None))
-          k,v = self._next_key_and_value()
+          k,v = next_key_and_value()
           if k=='-':
             # Consume next line
-            k,v = self._next_key_and_value()
+            k,v = next_key_and_value()
 
         if modops:
           # append entry to result list
@@ -473,10 +508,12 @@ def parse_change_records(self):
 
         # Consume the unhandled change record
         while k!=None:
-          k,v = self._next_key_and_value()
+          k,v = next_key_and_value()
 
       # Consume empty separation line
-      k,v = self._next_key_and_value()
+      k,v = next_key_and_value()
+      while k is None and v is None:
+        k,v = next_key_and_value()
 
       # Increment record counters
       try:
@@ -560,23 +597,3 @@ def ParseLDIF(f,ignore_attrs=None,maxentries=0):
   )
   ldif_parser.parse()
   return ldif_parser.all_records
-
-
-if __name__ == '__main__':
-  import sys,os,time,pprint
-  parser_class_name = sys.argv[1]
-  parser_class = vars()[parser_class_name]
-  parser_method_name = sys.argv[2]
-  for input_file_name in sys.argv[3:]:
-    input_file_size = os.stat(input_file_name).st_size
-    input_file = open(input_file_name,'rb')
-    ldif_parser = parser_class(input_file)
-    parser_method = getattr(ldif_parser,parser_method_name)
-    start_time = time.time()
-    parser_method()
-    end_time = time.time()
-    input_file.close()
-    print '***Time needed:',end_time-start_time,'seconds'
-    print '***Records read:',ldif_parser.records_read
-    print '***Lines read:',ldif_parser.line_counter
-    print '***Bytes read:',ldif_parser.byte_counter,'of',input_file_size

From 12138d39f500283cb69feb159cd3fcb64600fdd6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 3 Mar 2016 17:06:10 +0000
Subject: [PATCH 247/868] Added interop note for ldap.modlist.modifyModlist()

---
 Doc/ldap-modlist.rst | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Doc/ldap-modlist.rst b/Doc/ldap-modlist.rst
index 5fd6351..0eb41c5 100644
--- a/Doc/ldap-modlist.rst
+++ b/Doc/ldap-modlist.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-modlist.rst,v 1.4 2011/07/22 17:39:44 stroeder Exp $
+.. % $Id: ldap-modlist.rst,v 1.5 2016/03/03 17:06:10 stroeder Exp $
 
 
 :py:mod:`ldap.modlist` Generate modify lists
@@ -51,3 +51,12 @@ The :mod:`ldap.modlist` module defines the following functions:
    the comparison will be conducted case-insensitive. It is useful in
    situations where a LDAP server normalizes values and one wants to avoid
    unnecessary changes (e.g. case of attribute type names in DNs).
+
+   .. note::
+      Replacing attribute values is always done with a 
+      :py:const:`ldap.MOD_DELETE`/:py:const:`ldap.MOD_ADD` pair instead of 
+      :py:const:`ldap.MOD_REPLACE` to work-around potential issues with 
+      attributes for which no EQUALITY matching rule are defined in the 
+      server's subschema.  This works correctly in most situations but 
+      rarely fails with some LDAP servers implementing (schema) checks on 
+      transient state entry during processing the modify operation.

From b8fb5514c6b0ba162ba90378f389fdb7465bbfb4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 11 Mar 2016 12:46:09 +0000
Subject: [PATCH 248/868] SimpleLDAPObject.unbind_ext() already removes class
 attribute _l => no need to do it in ReconnectLDAPObject.reconnect()

---
 Lib/ldap/ldapobject.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index d6fe4c4..9e9c217 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.153 2016/01/28 09:43:08 stroeder Exp $
+\$Id: ldapobject.py,v 1.154 2016/03/11 12:46:09 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -886,7 +886,6 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
             self._trace_file.write('=> delay %s...\n' % (retry_delay))
           time.sleep(retry_delay)
           SimpleLDAPObject.unbind_s(self)
-          del self._l
         else:
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('*** %s reconnect to %s successful => repeat last operation\n' % (

From 325db8e34fb2352a3506cc792bea7f56cfb52fa7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 7 Apr 2016 20:17:16 +0000
Subject: [PATCH 249/868] added ldap.controls.sss to py_modules

---
 setup.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index 4d435f1..2cc776b 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.74 2016/02/16 18:01:35 stroeder Exp $
+$Id: setup.py,v 1.75 2016/04/07 20:17:16 stroeder Exp $
 """
 
 has_setuptools = False
@@ -159,6 +159,7 @@ class OpenLDAP2:
     'ldap.controls.readentry',
     'ldap.controls.sessiontrack',
     'ldap.controls.simple',
+    'ldap.controls.sss',
     'ldap.cidict',
     'ldap.dn',
     'ldap.extop',

From a729264c866b23ee7378c8e674cd5d3aeb3ab7cf Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 7 Apr 2016 20:22:17 +0000
Subject: [PATCH 250/868] added ldap.controls.sss to py_modules

---
 CHANGES | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index bd05fe5..137f684 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,9 @@ Released 2.4.26 2016-xx-xx
 
 Changes since 2.4.25:
 
+Installation:
+* added ldap.controls.sss to py_modules in setup.py
+
 Lib/
 * LDAPObject.unbind_ext() now removes class attribute
   LDAPObject._l to completely invalidate C wrapper object
@@ -1257,4 +1260,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.378 2016/02/11 01:08:43 stroeder Exp $
+$Id: CHANGES,v 1.379 2016/04/07 20:22:17 stroeder Exp $

From 6ef1fb227f6dab717c7be96e1a0cecbd1d395946 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dirk@dmllr.de>
Date: Wed, 18 May 2016 10:27:07 +0200
Subject: [PATCH 251/868] Readd LICENCE

the original python-ldap project this fork is based on used this
LICENSE, which is inherited by this project.

This file was left out of the pyldap CVS mirror, because it was not
touched since 2000.
All other files from CVS are already present in the repository.
---
 LICENCE | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 LICENCE

diff --git a/LICENCE b/LICENCE
new file mode 100644
index 0000000..a98c010
--- /dev/null
+++ b/LICENCE
@@ -0,0 +1,10 @@
+The pyldap package is distributed under Python-style license.
+
+Standard disclaimer:
+   This software is made available by the author(s) to the public for free
+   and "as is".  All users of this free software are solely and entirely
+   responsible for their own choice and use of this software for their
+   own purposes.  By using this software, each user agrees that the
+   author(s) shall not be liable for damages of any kind in relation to
+   its use or performance. The author(s) do not warrant that this software
+   is fit for any purpose.

From 02d3119f8a471b8e40e1c4f97beaef9c586acc90 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 13:59:20 +0000
Subject: [PATCH 252/868] call commenceShutdown(None, None) and some formatting
 cosmetics

---
 Demo/pyasn1/syncrepl.py | 42 ++++++++++++++++++++++++++---------------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index c1185e6..1177d18 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -15,27 +15,28 @@
 python-ldap 2.4.10+
 """
 
+# Import modules from Python standard lib
+import shelve,signal,time,sys,logging
+
 # Import the python-ldap modules
-import ldap,ldapurl
+import ldap
+import ldapurl
 # Import specific classes from python-ldap
 from ldap.ldapobject import ReconnectLDAPObject
 from ldap.syncrepl import SyncreplConsumer
 
-# Import modules from Python standard lib
-import shelve,signal,time,sys,logging
-
 
 # Global state
 watcher_running = True
 ldap_connection = False
 
 
-class SyncReplConsumer(ReconnectLDAPObject,SyncreplConsumer):
+class SyncReplConsumer(ReconnectLDAPObject, SyncreplConsumer):
     """
     Syncrepl Consumer interface
     """
 
-    def __init__(self,db_path,*args,**kwargs):
+    def __init__(self, db_path, *args, **kwargs):
         # Initialise the LDAP Connection first
         ldap.ldapobject.ReconnectLDAPObject.__init__(self, *args, **kwargs)
         # Now prepare the data store
@@ -55,19 +56,22 @@ def syncrepl_set_cookie(self,cookie):
         self.__data['cookie'] = cookie
 
     def syncrepl_entry(self,dn,attributes,uuid):
-        # First we determine the type of change we have here (and store away the previous data for later if needed)
+        # First we determine the type of change we have here
+        # (and store away the previous data for later if needed)
         previous_attributes = dict()
         if uuid in self.__data:
             change_type = 'modify'
             previous_attributes = self.__data[uuid]
         else:
             change_type = 'add'
-        # Now we store our knowledge of the existence of this entry (including the DN as an attribute for convenience)
+        # Now we store our knowledge of the existence of this entry
+        # (including the DN as an attribute for convenience)
         attributes['dn'] = dn
         self.__data[uuid] = attributes
         # Debugging
         print 'Detected', change_type, 'of entry:', dn
-        # If we have a cookie then this is not our first time being run, so it must be a change
+        # If we have a cookie then this is not our first time being run,
+        # so it must be a change
         if 'ldap_cookie' in self.__data:
                 self.perform_application_sync(dn, attributes, previous_attributes)
 
@@ -80,11 +84,18 @@ def syncrepl_delete(self,uuids):
             del self.__data[uuid]
 
     def syncrepl_present(self,uuids,refreshDeletes=False):
-        # If we have not been given any UUID values, then we have recieved all the present controls...
+        # If we have not been given any UUID values,
+        # then we have recieved all the present controls...
         if uuids is None:
-            # We only do things if refreshDeletes is false as the syncrepl extension will call syncrepl_delete instead when it detects a delete notice
+            # We only do things if refreshDeletes is false as the syncrepl 
+            # extension will call syncrepl_delete instead when it detects a 
+            # delete notice
             if refreshDeletes is False:
-                deletedEntries = [uuid for uuid in self.__data.keys() if uuid not in self.__presentUUIDs and uuid != 'ldap_cookie']
+                deletedEntries = [
+                    uuid
+                    for uuid in self.__data.keys()
+                    if uuid not in self.__presentUUIDs and uuid != 'ldap_cookie'
+                ]
                 self.syncrepl_delete( deletedEntries )
             # Phase is now completed, reset the list
             self.__presentUUIDs = {}
@@ -113,6 +124,7 @@ def commenceShutdown(signum, stack):
     # Tear down the server connection
     if( ldap_connection ):
             ldap_connection.close_db()
+            ldap_connection.unbind_s()
             del ldap_connection
 
     # Shutdown
@@ -144,11 +156,11 @@ def commenceShutdown(signum, stack):
 while watcher_running:
     print 'Connecting to LDAP server now...'
     # Prepare the LDAP server connection (triggers the connection as well)
-    ldap_connection = SyncReplConsumer(database_path,ldap_url.initializeUrl())
+    ldap_connection = SyncReplConsumer(database_path, ldap_url.initializeUrl())
 
     # Now we login to the LDAP server
     try:
-        ldap_connection.simple_bind_s(ldap_url.who,ldap_url.cred)
+        ldap_connection.simple_bind_s(ldap_url.who, ldap_url.cred)
     except ldap.INVALID_CREDENTIALS, e:
         print 'Login to LDAP server failed: ', str(e)
         sys.exit(1)
@@ -172,7 +184,7 @@ def commenceShutdown(signum, stack):
             pass
     except KeyboardInterrupt:
         # User asked to exit
-        commenceShutdown()
+        commenceShutdown(None, None)
         pass
     except Exception, e:
         # Handle any exception

From 0def217fba5098990c4e9d778c9ad072318ec743 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 14:49:22 +0000
Subject: [PATCH 253/868] SimpleLDAPObject.unbind_ext_s(): simplified and flush
 trace file

---
 Lib/ldap/ldapobject.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 9e9c217..94b7a90 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.154 2016/03/11 12:46:09 stroeder Exp $
+\$Id: ldapobject.py,v 1.155 2016/07/17 14:49:22 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -633,8 +633,11 @@ def unbind_ext(self,serverctrls=None,clientctrls=None):
   def unbind_ext_s(self,serverctrls=None,clientctrls=None):
     msgid = self.unbind_ext(serverctrls,clientctrls)
     if msgid!=None:
-      resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
-      return resp_type, resp_data, resp_msgid, resp_ctrls
+      result = self.result3(msgid,all=1,timeout=self.timeout)
+    else:
+      result = None
+    self._trace_file.flush()
+    return result
 
   def unbind(self):
     return self.unbind_ext(None,None)

From ad88a804bf071e3a31ea2eeb02b9fc6139a43ef4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 15:12:58 +0000
Subject: [PATCH 254/868] added functions ldap.strf_secs() and ldap.strp_secs()

---
 CHANGES               |  3 ++-
 Lib/ldap/__init__.py  |  4 ++--
 Lib/ldap/functions.py | 19 +++++++++++++++++--
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 137f684..888eb55 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,7 @@ Installation:
 Lib/
 * LDAPObject.unbind_ext() now removes class attribute
   LDAPObject._l to completely invalidate C wrapper object
+* added functions ldap.strf_secs() and ldap.strp_secs()
 
 Modules/
 * Fixed #69 Segmentation fault on whoami_s after unbind 
@@ -1260,4 +1261,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.379 2016/04/07 20:22:17 stroeder Exp $
+$Id: CHANGES,v 1.380 2016/07/17 15:12:58 stroeder Exp $
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index ef106be..0cb29f1 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.103 2016/01/26 10:43:24 stroeder Exp $
+$Id: __init__.py,v 1.104 2016/07/17 15:12:58 stroeder Exp $
 """
 
 # This is also the overall release version number
@@ -82,7 +82,7 @@ def release(self):
 # Create module-wide lock for serializing all calls into underlying LDAP lib
 _ldap_module_lock = LDAPLock(desc='Module wide')
 
-from functions import open,initialize,init,get_option,set_option,escape_str
+from functions import open,initialize,init,get_option,set_option,escape_str,strf_secs,strp_secs
 
 from ldapobject import NO_UNIQUE_ENTRY
 
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 8ba0130..3e04744 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.31 2015/06/06 09:21:37 stroeder Exp $
+\$Id: functions.py,v 1.32 2016/07/17 15:12:58 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -27,7 +27,8 @@
   'escape_str',
 ]
 
-import sys,pprint,_ldap,ldap
+import sys,pprint,time,_ldap,ldap
+from calendar import timegm
 
 from ldap import LDAPError
 
@@ -140,3 +141,17 @@ def escape_str(escape_func,s,*args):
   """
   escape_args = map(escape_func,args)
   return s % tuple(escape_args)
+
+
+def strf_secs(secs):
+    """
+    Convert seconds since epoch to a string compliant to LDAP syntax GeneralizedTime
+    """
+    return time.strftime('%Y%m%d%H%M%SZ', time.gmtime(secs))
+
+
+def strp_secs(dt_str):
+    """
+    Convert LDAP syntax GeneralizedTime to seconds since epoch
+    """
+    return timegm(time.strptime(dt_str, '%Y%m%d%H%M%SZ'))

From 854c5d8cfb7372e97f88608adf73328faa511ae3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 16:06:19 +0000
Subject: [PATCH 255/868] call self._consume_empty_lines()

---
 Lib/ldif.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 20fd61a..205d81e 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.92 2016/02/29 22:51:36 stroeder Exp $
+$Id: ldif.py,v 1.93 2016/07/17 16:06:19 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -510,10 +510,8 @@ def parse_change_records(self):
         while k!=None:
           k,v = next_key_and_value()
 
-      # Consume empty separation line
-      k,v = next_key_and_value()
-      while k is None and v is None:
-        k,v = next_key_and_value()
+      # Consume empty separator line(s)
+      k,v = self._consume_empty_lines()
 
       # Increment record counters
       try:

From 9ab29199821679cef3e545762170456c2c4b78c7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 16:11:25 +0000
Subject: [PATCH 256/868] parse_change_records(): version is Integer

---
 Lib/ldif.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 205d81e..ac0a9bf 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.93 2016/07/17 16:06:19 stroeder Exp $
+$Id: ldif.py,v 1.94 2016/07/17 16:11:25 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -438,7 +438,7 @@ def parse_change_records(self):
     self.changetype_counter = {}
     k,v = next_key_and_value()
     if k=='version':
-      self.version = v
+      self.version = int(v)
       k,v = next_key_and_value()
       if k==v==None:
         k,v = next_key_and_value()

From 06017131e8a78384685a79b1debd4a499ecceef1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 16:25:46 +0000
Subject: [PATCH 257/868] class TestChangeRecords

---
 Tests/t_ldif.py | 54 +++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 52 insertions(+), 2 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index a76f098..9a3e103 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.16 2016/02/29 22:44:42 stroeder Exp $
+$Id: t_ldif.py,v 1.17 2016/07/17 16:25:46 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -54,7 +54,7 @@ def unparse_records(records):
     return ldif_file.getvalue()
 
 
-class TestEntryRecords(unittest.TestCase):
+class TestLDIFParser(unittest.TestCase):
     """
     Various LDIF test cases
     """
@@ -87,6 +87,12 @@ def check_records(
         self.assertEqual(parsed_records, records)
         self.assertEqual(parsed_records2, records)
 
+
+class TestEntryRecords(TestLDIFParser):
+    """
+    Various LDIF test cases
+    """
+
     def test_empty(self):
         self.check_records(
             """
@@ -391,5 +397,49 @@ def test_multiple_empty_lines(self):
         )
 
 
+class TestChangeRecords(TestLDIFParser):
+    """
+    Various LDIF test cases
+    """
+
+    def test_empty(self):
+        self.check_records(
+            """
+            version: 1
+            """,
+            [],
+            record_type='change',
+        )
+
+    def test_simple(self):
+        self.check_records(
+            """
+            version: 1
+
+            dn: cn=x,cn=y,cn=z
+            changetype: modify
+            replace: attrib
+            attrib: value
+            attrib: value2
+            -
+            add: attrib2
+            attrib2: value
+            attrib2: value2
+            -
+            delete: attrib3
+            attrib3: value
+            -
+            delete: attrib4
+            -
+            """,
+            [
+                (ldif.MOD_OP_INTEGER['replace'], 'attrib', [b'value', b'value2']),
+                (ldif.MOD_OP_INTEGER['add'], 'attrib2', [b'value', b'value2']),
+                (ldif.MOD_OP_INTEGER['delete'], 'attrib3', [b'value']),
+                (ldif.MOD_OP_INTEGER['delete'], 'attrib4', None),
+            ],
+            record_type='change',
+        )
+
 if __name__ == '__main__':
     unittest.main()

From d70170ceda317056483274f0723513996955d663 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 17:43:04 +0000
Subject: [PATCH 258/868] fixed LDIFParser.parse_change_records()

---
 Lib/ldif.py | 78 ++++++++++++++++++++++++++++++-----------------------
 1 file changed, 44 insertions(+), 34 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index ac0a9bf..69ebcbf 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.94 2016/07/17 16:11:25 stroeder Exp $
+$Id: ldif.py,v 1.95 2016/07/17 17:43:04 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -276,10 +276,14 @@ def __init__(
     self.line_counter = 0
     self.byte_counter = 0
     self.records_read = 0
+    self.changetype_counter = {}.fromkeys(CHANGE_TYPES,0)
     # Store some symbols for better performance
     self._base64_decodestring = base64.decodestring
     # Read very first line
-    self._last_line = self._readline()
+    try:
+      self._last_line = self._readline()
+    except EOFError:
+      self._last_line = ''
 
   def handle(self,dn,entry):
     """
@@ -378,12 +382,16 @@ def parse_entry_records(self):
     """
     # Local symbol for better performance
     next_key_and_value = self._next_key_and_value
-    # Consume empty lines
-    k,v = self._consume_empty_lines()
-    # Consume 'version' line
-    if k=='version':
-      self.version = int(v)
+
+    try:
+      # Consume empty lines
       k,v = self._consume_empty_lines()
+      # Consume 'version' line
+      if k=='version':
+        self.version = int(v)
+        k,v = self._consume_empty_lines()
+    except EOFError:
+      return
 
     # Loop for processing whole records
     while k!=None and \
@@ -398,19 +406,19 @@ def parse_entry_records(self):
       # Consume second line of record
       k,v = next_key_and_value()
 
-      try:
-        # Loop for reading the attributes
-        while k!=None:
-          # Add the attribute to the entry if not ignored attribute
-          if not k.lower() in self._ignored_attr_types:
-            try:
-              entry[k].append(v)
-            except KeyError:
-              entry[k]=[v]
-          # Read the next line within the record
+      # Loop for reading the attributes
+      while k!=None:
+        # Add the attribute to the entry if not ignored attribute
+        if not k.lower() in self._ignored_attr_types:
+          try:
+            entry[k].append(v)
+          except KeyError:
+            entry[k]=[v]
+        # Read the next line within the record
+        try:
           k,v = next_key_and_value()
-      except EOFError:
-        pass
+        except EOFError:
+          k,v = None,None
 
       # handle record
       self.handle(dn,entry)
@@ -434,31 +442,29 @@ def handle_modify(self,dn,modops,controls=None):
     pass
 
   def parse_change_records(self):
+    # Local symbol for better performance
     next_key_and_value = self._next_key_and_value
-    self.changetype_counter = {}
-    k,v = next_key_and_value()
+    # Consume empty lines
+    k,v = self._consume_empty_lines()
+    # Consume 'version' line
     if k=='version':
       self.version = int(v)
-      k,v = next_key_and_value()
-      if k==v==None:
-        k,v = next_key_and_value()
-    else:
-      self.version = None
+      k,v = self._consume_empty_lines()
 
     # Loop for processing whole records
     while k!=None and \
           (not self._max_entries or self.records_read<self._max_entries):
-
       # Consume first line which must start with "dn: "
       if k!='dn':
         raise ValueError('Line %d: First line of record does not start with "dn:": %s' % (self.line_counter,repr(k)))
       if not is_dn(v):
-        raise ValueError('Line %d: Not a valid string-representation for dn: %s' % (self.line_counter,repr(v)))
+        raise ValueError('Line %d: Not a valid string-representation for dn: %s.' % (self.line_counter,repr(v)))
       dn = v
+      # Consume second line of record
+      k,v = next_key_and_value()
       # Read "control:" lines
       controls = []
-      k,v = next_key_and_value()
-      while k=='control':
+      while k!=None and k=='control':
         try:
           control_type,criticality,control_value = v.split(' ',2)
         except ValueError:
@@ -466,9 +472,10 @@ def parse_change_records(self):
           control_type,criticality = v.split(' ',1)
         controls.append((control_type,criticality,control_value))
         k,v = next_key_and_value()
-      # Determine changetype first, assuming changetype: as default
-      changetype = 'modify'
-      # Consume second line of record
+
+      # Determine changetype first
+      changetype = None
+      # Consume changetype line of record
       if k=='changetype':
         if not v in valid_changetype_dict:
           raise ValueError('Invalid changetype: %s' % repr(v))
@@ -495,7 +502,10 @@ def parse_change_records(self):
             modvalues.append(v)
             k,v = next_key_and_value()
           modops.append((modop,modattr,modvalues or None))
-          k,v = next_key_and_value()
+          try:
+            k,v = next_key_and_value()
+          except EOFError:
+            k,v = None,None
           if k=='-':
             # Consume next line
             k,v = next_key_and_value()

From 0c7977cb9bd311374825d7253f14ece38dd6bd15 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 17:43:39 +0000
Subject: [PATCH 259/868] TestChangeRecords.test_simple() almost works

---
 Tests/t_ldif.py | 105 ++++++++++++++++++++++++++----------------------
 1 file changed, 57 insertions(+), 48 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 9a3e103..3c80a02 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.17 2016/07/17 16:25:46 stroeder Exp $
+$Id: t_ldif.py,v 1.18 2016/07/17 17:43:39 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -20,50 +20,54 @@
 import ldif
 
 
-def parse_records(
-        ldif_string,
-        record_type='entry',
-        ignored_attr_types=None,
-        max_entries=0,
-):
-    """
-    Parse LDIF data in `ldif_string' into list of records
-    """
-    ldif_file = StringIO(ldif_string)
-    ldif_parser = ldif.LDIFRecordList(
-        ldif_file,
-        ignored_attr_types=ignored_attr_types,
-        max_entries=max_entries,
-    )
-    parser_method = getattr(
-        ldif_parser,
-        'parse_%s_records' % record_type
-    )
-    parser_method()
-    return ldif_parser.all_records
-
-
-def unparse_records(records):
-    """
-    Returns LDIF string with entry records from list `records'
-    """
-    ldif_file = StringIO()
-    ldif_writer = ldif.LDIFWriter(ldif_file)
-    for dn, entry in records:
-        ldif_writer.unparse(dn, entry)
-    return ldif_file.getvalue()
-
-
 class TestLDIFParser(unittest.TestCase):
     """
     Various LDIF test cases
     """
 
+    def _parse_records(
+            self,
+            ldif_string,
+            ignored_attr_types=None,
+            max_entries=0,
+        ):
+        """
+        Parse LDIF data in `ldif_string' into list of records
+        """
+        ldif_file = StringIO(ldif_string)
+        ldif_parser = ldif.LDIFRecordList(
+            ldif_file,
+            ignored_attr_types=ignored_attr_types,
+            max_entries=max_entries,
+        )
+        parser_method = getattr(
+            ldif_parser,
+            'parse_%s_records' % self.record_type
+        )
+        parser_method()
+        if self.record_type == 'entry':
+            return ldif_parser.all_records
+        elif self.record_type == 'change':
+            return ldif_parser.all_modify_changes
+
+    def _unparse_records(self, records):
+        """
+        Returns LDIF string with entry records from list `records'
+        """
+        ldif_file = StringIO()
+        ldif_writer = ldif.LDIFWriter(ldif_file)
+        if self.record_type == 'entry':
+            for dn, entry in records:
+                ldif_writer.unparse(dn, entry)
+        elif self.record_type == 'change':
+            for dn, modops, controls in records:
+                ldif_writer.unparse(dn, modops)
+        return ldif_file.getvalue()
+
     def check_records(
             self,
             ldif_string,
             records,
-            record_type='entry',
             ignored_attr_types=None,
             max_entries=0
     ):
@@ -72,15 +76,13 @@ def check_records(
         and matches list of unparsed `records'.
         """
         ldif_string = textwrap.dedent(ldif_string).lstrip() + '\n'
-        parsed_records = parse_records(
+        parsed_records = self._parse_records(
             ldif_string,
-            record_type=record_type,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
-        parsed_records2 = parse_records(
-            unparse_records(records),
-            record_type=record_type,
+        parsed_records2 = self._parse_records(
+            self._unparse_records(records),
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
@@ -92,11 +94,13 @@ class TestEntryRecords(TestLDIFParser):
     """
     Various LDIF test cases
     """
+    record_type='entry'
 
     def test_empty(self):
         self.check_records(
             """
             version: 1
+
             """,
             []
         )
@@ -188,7 +192,7 @@ def test_folded(self):
             ]
         )
 
-    def test_empty(self):
+    def test_empty_attr_values(self):
         self.check_records(
             """
             dn: cn=x,cn=y,cn=z
@@ -401,6 +405,7 @@ class TestChangeRecords(TestLDIFParser):
     """
     Various LDIF test cases
     """
+    record_type='change'
 
     def test_empty(self):
         self.check_records(
@@ -408,7 +413,6 @@ def test_empty(self):
             version: 1
             """,
             [],
-            record_type='change',
         )
 
     def test_simple(self):
@@ -433,12 +437,17 @@ def test_simple(self):
             -
             """,
             [
-                (ldif.MOD_OP_INTEGER['replace'], 'attrib', [b'value', b'value2']),
-                (ldif.MOD_OP_INTEGER['add'], 'attrib2', [b'value', b'value2']),
-                (ldif.MOD_OP_INTEGER['delete'], 'attrib3', [b'value']),
-                (ldif.MOD_OP_INTEGER['delete'], 'attrib4', None),
+                (
+                    'cn=x,cn=y,cn=z',
+                    [
+                        (ldif.MOD_OP_INTEGER['replace'], 'attrib', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['add'], 'attrib2', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['delete'], 'attrib3', [b'value']),
+                        (ldif.MOD_OP_INTEGER['delete'], 'attrib4', None),
+                    ],
+                    [],
+                ),
             ],
-            record_type='change',
         )
 
 if __name__ == '__main__':

From fa991f9790137264343a41ca7cab84d3273d2952 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 19:30:44 +0000
Subject: [PATCH 260/868] tolerate missing dash

---
 Lib/ldif.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 69ebcbf..238f097 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.95 2016/07/17 17:43:04 stroeder Exp $
+$Id: ldif.py,v 1.96 2016/07/17 19:30:44 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -497,7 +497,10 @@ def parse_change_records(self):
           # we now have the attribute name to be modified
           modattr = v
           modvalues = []
-          k,v = next_key_and_value()
+          try:
+            k,v = next_key_and_value()
+          except EOFError:
+            k,v = None,None
           while k==modattr:
             modvalues.append(v)
             k,v = next_key_and_value()

From c97fe7f4871fe605f443909b428ffd54ed26ec30 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 19:37:37 +0000
Subject: [PATCH 261/868] fixed TestChangeRecords.test_simple() and added
 TestChangeRecords.test_simple_missing_dash()

---
 Tests/t_ldif.py | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 3c80a02..89ad045 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.18 2016/07/17 17:43:39 stroeder Exp $
+$Id: t_ldif.py,v 1.19 2016/07/17 19:37:37 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -81,8 +81,9 @@ def check_records(
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
+        generated_ldif = self._unparse_records(records)
         parsed_records2 = self._parse_records(
-            self._unparse_records(records),
+            generated_ldif,
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
@@ -435,6 +436,7 @@ def test_simple(self):
             -
             delete: attrib4
             -
+
             """,
             [
                 (
@@ -445,10 +447,38 @@ def test_simple(self):
                         (ldif.MOD_OP_INTEGER['delete'], 'attrib3', [b'value']),
                         (ldif.MOD_OP_INTEGER['delete'], 'attrib4', None),
                     ],
-                    [],
+                    None,
                 ),
             ],
         )
 
+    def test_missing_trailing_separator(self):
+        self.check_records(
+            """
+            version: 1
+
+            dn: cn=x,cn=y,cn=z
+            changetype: modify
+            replace: attrib
+            attrib: value
+            attrib: value2
+            -
+            add: attrib2
+            attrib2: value
+            attrib2: value2
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    [
+                        (ldif.MOD_OP_INTEGER['replace'], 'attrib', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['add'], 'attrib2', [b'value', b'value2']),
+                    ],
+                    None,
+                ),
+            ],
+        )
+
+
 if __name__ == '__main__':
     unittest.main()

From cb07289ab142aa7b96be80aba22acf775bfd8d02 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 19:38:32 +0000
Subject: [PATCH 262/868] LDIFParser.parse_change_records(): more liberal
 parsing

---
 Lib/ldif.py | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 238f097..bae4b76 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.96 2016/07/17 19:30:44 stroeder Exp $
+$Id: ldif.py,v 1.97 2016/07/17 19:38:32 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -487,31 +487,31 @@ def parse_change_records(self):
         # From here we assume a change record is read with changetype: modify
         modops = []
 
-        # Loop for reading the list of modifications
-        while k!=None:
-          # Extract attribute mod-operation (add, delete, replace)
-          try:
-            modop = MOD_OP_INTEGER[k]
-          except KeyError:
-            raise ValueError('Line %d: Invalid mod-op string: %s' % (self.line_counter,repr(k)))
-          # we now have the attribute name to be modified
-          modattr = v
-          modvalues = []
-          try:
-            k,v = next_key_and_value()
-          except EOFError:
-            k,v = None,None
-          while k==modattr:
-            modvalues.append(v)
-            k,v = next_key_and_value()
-          modops.append((modop,modattr,modvalues or None))
-          try:
+        try:
+          # Loop for reading the list of modifications
+          while k!=None:
+            # Extract attribute mod-operation (add, delete, replace)
+            try:
+              modop = MOD_OP_INTEGER[k]
+            except KeyError:
+              raise ValueError('Line %d: Invalid mod-op string: %s' % (self.line_counter,repr(k)))
+            # we now have the attribute name to be modified
+            modattr = v
+            modvalues = []
             k,v = next_key_and_value()
-          except EOFError:
-            k,v = None,None
-          if k=='-':
-            # Consume next line
+            while k==modattr:
+              modvalues.append(v)
+              try:
+                k,v = next_key_and_value()
+              except EOFError:
+                k,v = None,None
+            modops.append((modop,modattr,modvalues or None))
             k,v = next_key_and_value()
+            if k=='-':
+              # Consume next line
+              k,v = next_key_and_value()
+        except EOFError:
+          k,v = None,None
 
         if modops:
           # append entry to result list

From 04fee781b6fddb95093e805efa2d2685b3e09510 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 19:42:32 +0000
Subject: [PATCH 263/868] LDAPObject.unbind_ext() now flushes trace file

---
 CHANGES | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 888eb55..773a719 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,7 +9,11 @@ Installation:
 Lib/
 * LDAPObject.unbind_ext() now removes class attribute
   LDAPObject._l to completely invalidate C wrapper object
+* LDAPObject.unbind_ext() now flushes trace file
 * added functions ldap.strf_secs() and ldap.strp_secs()
+* Refactored ldif.LDIFParser
+  * ldif.LDIFParser.version ís now Integer
+  * ignore multiple empty lines between records
 
 Modules/
 * Fixed #69 Segmentation fault on whoami_s after unbind 
@@ -1261,4 +1265,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.380 2016/07/17 15:12:58 stroeder Exp $
+$Id: CHANGES,v 1.381 2016/07/17 19:42:32 stroeder Exp $

From 4de6216d731d65b9a971dd634a43115052700c15 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 19:44:19 +0000
Subject: [PATCH 264/868] cosmetic change: use constants in SEARCH_SCOPE_STR
 dict

---
 Lib/ldapurl.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 49792e4..b9e78a8 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.78 2016/01/26 10:43:24 stroeder Exp $
+\$Id: ldapurl.py,v 1.79 2016/07/17 19:44:19 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -32,7 +32,13 @@
 LDAP_SCOPE_SUBTREE = 2
 LDAP_SCOPE_SUBORDINATES = 3
 
-SEARCH_SCOPE_STR = {None:'',0:'base',1:'one',2:'sub',3:'subordinates'}
+SEARCH_SCOPE_STR = {
+  None:'',
+  LDAP_SCOPE_BASE:'base',
+  LDAP_SCOPE_ONELEVEL:'one',
+  LDAP_SCOPE_SUBTREE:'sub',
+  LDAP_SCOPE_SUBORDINATES:'subordinates',
+}
 
 SEARCH_SCOPE = {
   '':None,

From 6b82a8212af3baff032a4abe0741c50d37ea819c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 17 Jul 2016 19:46:49 +0000
Subject: [PATCH 265/868] mention test-cases for LDIF change records

---
 CHANGES | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 773a719..0febf32 100644
--- a/CHANGES
+++ b/CHANGES
@@ -26,7 +26,8 @@ Tests/
   hard-coded /var/tmp
 * Tests/slapd.py now expects schema to be in /etc/openldap/
 * Tests/t_ldapurl.py now independent of module ldap
-* Tests/t_ldif.py with more test-cases
+* Tests/t_ldif.py now has more test-cases also
+  for change records
 
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
@@ -1265,4 +1266,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.381 2016/07/17 19:42:32 stroeder Exp $
+$Id: CHANGES,v 1.382 2016/07/17 19:46:49 stroeder Exp $

From 9f889bb99237d1af7c6a6361b51a692f83d845e1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 14:57:46 +0000
Subject: [PATCH 266/868] started to implement
 TestChangeRecords.test_bad_change_records()

---
 Tests/t_ldif.py | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 89ad045..7fdc680 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.19 2016/07/17 19:37:37 stroeder Exp $
+$Id: t_ldif.py,v 1.20 2016/07/24 14:57:46 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -479,6 +479,23 @@ def test_missing_trailing_separator(self):
             ],
         )
 
+    def test_bad_change_records(self):
+        for bad_ldif_string in (
+            """
+            changetype: modify
+            replace: attrib
+            attrib: value
+            attrib: value2
+            """,
+        ):
+            ldif_string = textwrap.dedent(bad_ldif_string).lstrip() + '\n'
+            try:
+                res = self._parse_records(ldif_string)
+            except ValueError, value_error:
+                pass
+            else:
+                self.fail("should have raised ValueError: %r" % ldif_str)
+
 
 if __name__ == '__main__':
     unittest.main()

From ab1ba33d066e83228ac4071065e994b76c2b6b67 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:14:56 +0000
Subject: [PATCH 267/868] added function ldap.filter.time_span_filter()

---
 CHANGES            |  3 ++-
 Lib/ldap/filter.py | 38 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 0febf32..74f02de 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,7 @@ Lib/
   LDAPObject._l to completely invalidate C wrapper object
 * LDAPObject.unbind_ext() now flushes trace file
 * added functions ldap.strf_secs() and ldap.strp_secs()
+* added function ldap.filter.time_span_filter()
 * Refactored ldif.LDIFParser
   * ldif.LDIFParser.version ís now Integer
   * ignore multiple empty lines between records
@@ -1266,4 +1267,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.382 2016/07/17 19:46:49 stroeder Exp $
+$Id: CHANGES,v 1.383 2016/07/24 15:14:56 stroeder Exp $
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index 46f957e..727c1f8 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: filter.py,v 1.10 2015/06/06 09:21:37 stroeder Exp $
+\$Id: filter.py,v 1.11 2016/07/24 15:14:56 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -11,6 +11,10 @@
 
 from ldap import __version__
 
+from ldap.functions import strf_secs
+
+import time
+
 
 def escape_filter_chars(assertion_value,escape_mode=0):
   """
@@ -53,3 +57,35 @@ def filter_format(filter_template,assertion_values):
         count of %s in filter_template.
   """
   return filter_template % (tuple(map(escape_filter_chars,assertion_values)))
+
+
+def time_span_filter(
+        filterstr='',
+        from_timestamp=0,
+        until_timestamp=None,
+        delta_attr='modifyTimestamp',
+    ):
+    """
+    If last_run_timestr is non-zero filterstr will be extended
+    """
+    if until_timestamp is None:
+        until_timestamp = time.time()
+        if from_timestamp < 0:
+            from_timestamp = until_timestamp + from_timestamp
+    if from_timestamp > until_timestamp:
+        raise ValueError('from_timestamp %r must not be greater than until_timestamp %r' % (
+            from_timestamp, until_timestamp
+        ))
+    return (
+        '(&'
+        '{filterstr}'
+        '({delta_attr}>={from_timestr})'
+        '(!({delta_attr}>={until_timestr}))'
+        ')'
+    ).format(
+        filterstr=filterstr,
+        delta_attr=delta_attr,
+        from_timestr=strf_secs(from_timestamp),
+        until_timestr=strf_secs(until_timestamp),
+    )
+    # end of time_span_filter()

From 7fec6bb16fa74f1e4e394196777729e482c5cce9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:37:25 +0000
Subject: [PATCH 268/868] tests for ldap.strf_secs(), ldap.strp_secs() and
 ldap.escape_str()

---
 Tests/t_ldap_functions.py | 75 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 Tests/t_ldap_functions.py

diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
new file mode 100644
index 0000000..6947352
--- /dev/null
+++ b/Tests/t_ldap_functions.py
@@ -0,0 +1,75 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for module ldap.functions
+"""
+
+# from Python's standard lib
+import unittest
+
+# from python-ldap
+import ldap
+from ldap.dn import escape_dn_chars
+from ldap.filter import escape_filter_chars
+
+
+class TestFunction(unittest.TestCase):
+    """
+    test ldap.functions
+    """
+
+    def test_ldap_strf_secs(self):
+        """
+        test function ldap_strf_secs()
+        """
+        self.assertEquals(ldap.strf_secs(0), '19700101000000Z')
+        self.assertEquals(ldap.strf_secs(1466947067), '20160626131747Z')
+
+    def test_ldap_strp_secs(self):
+        """
+        test function ldap_strp_secs()
+        """
+        self.assertEquals(ldap.strp_secs('19700101000000Z'), 0)
+        self.assertEquals(ldap.strp_secs('20160626131747Z'), 1466947067)
+
+    def test_escape_str(self):
+        """
+        test function escape_string_tmpl()
+        """
+        self.assertEquals(
+            ldap.escape_str(
+                escape_filter_chars,
+                '(&(objectClass=aeUser)(uid=%s))',
+                'foo'
+            ),
+            '(&(objectClass=aeUser)(uid=foo))'
+        )
+        self.assertEquals(
+            ldap.escape_str(
+                escape_filter_chars,
+                '(&(objectClass=aeUser)(uid=%s))',
+                'foo)bar'
+            ),
+            '(&(objectClass=aeUser)(uid=foo\\29bar))'
+        )
+        self.assertEquals(
+            ldap.escape_str(
+                escape_dn_chars,
+                'uid=%s',
+                'foo=bar'
+            ),
+            'uid=foo\\=bar'
+        )
+        self.assertEquals(
+            ldap.escape_str(
+                escape_dn_chars,
+                'uid=%s,cn=%s,cn=%s,dc=example,dc=com',
+                'foo=bar',
+                'foo+',
+                '+bar',
+            ),
+            'uid=foo\\=bar,cn=foo\\+,cn=\\+bar,dc=example,dc=com'
+        )
+
+
+if __name__ == '__main__':
+    unittest.main()

From 3fb192f92740a7cf60a28d823291760688a9ed69 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:40:17 +0000
Subject: [PATCH 269/868] tests for ldap.dn.is_dn()

---
 Tests/t_ldap_dn.py | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 Tests/t_ldap_dn.py

diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
new file mode 100644
index 0000000..553e2e5
--- /dev/null
+++ b/Tests/t_ldap_dn.py
@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for module ldap.functions
+"""
+
+# from Python's standard lib
+import unittest
+
+# from python-ldap
+import ldap.dn
+
+
+class TestDN(unittest.TestCase):
+    """
+    test ldap.functions
+    """
+
+    def test_is_dn(self):
+        """
+        test function is_dn()
+        """
+        self.assertEquals(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
+        self.assertEquals(ldap.dn.is_dn('uid=xkcd,cn=foobar,ou=ae-dir'), True)
+
+
+if __name__ == '__main__':
+    unittest.main()

From a2e29cfb419fc82ee443f129d2cb57a903b676e3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:42:17 +0000
Subject: [PATCH 270/868] fixed ldap.dn.is_dn()

---
 Lib/ldap/dn.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index e3dbca6..0abd6a5 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.13 2015/06/06 09:21:37 stroeder Exp $
+\$Id: dn.py,v 1.14 2016/07/24 15:42:17 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -116,8 +116,8 @@ def is_dn(s):
   distinguished host_name (DN), otherwise False is returned.
   """
   try:
-    dn2str(s)
-  except Exception:
+    str2dn(s)
+  except Exception, err:
     return False
   else:
     return True

From f74f85807b2f3286bab78f272487c4959fda4633 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:43:03 +0000
Subject: [PATCH 271/868] fixed ldap.dn.is_dn.__doc__

---
 Lib/ldap/dn.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 0abd6a5..45950e5 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.14 2016/07/24 15:42:17 stroeder Exp $
+\$Id: dn.py,v 1.15 2016/07/24 15:43:03 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -112,7 +112,7 @@ def explode_rdn(rdn,notypes=0,flags=0):
 
 def is_dn(s):
   """
-  Returns True is `s' can be parsed by ldap.dn.dn2str() like as a
+  Returns True is `s' can be parsed by ldap.dn.str2dn() like as a
   distinguished host_name (DN), otherwise False is returned.
   """
   try:

From 42fbf211d4764eaf8404ba84402db22f3e3f729e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:47:46 +0000
Subject: [PATCH 272/868] HTTPS URL to www.python-ldap.org

---
 Doc/dsml.rst          | 4 ++--
 Doc/ldap-controls.rst | 4 ++--
 Doc/ldap-dn.rst       | 4 ++--
 Doc/ldap-filter.rst   | 4 ++--
 Doc/ldap-resiter.rst  | 4 ++--
 Doc/ldap.rst          | 4 ++--
 Doc/ldapurl.rst       | 4 ++--
 Doc/ldif.rst          | 4 ++--
 8 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/Doc/dsml.rst b/Doc/dsml.rst
index 3e9bcbf..a3225c8 100644
--- a/Doc/dsml.rst
+++ b/Doc/dsml.rst
@@ -1,4 +1,4 @@
-.. % $Id: dsml.rst,v 1.5 2011/07/28 09:05:10 stroeder Exp $
+.. % $Id: dsml.rst,v 1.6 2016/07/24 15:47:46 stroeder Exp $
 
 ***************************************
 :mod:`dsml` DSMLv1 parser and generator
@@ -6,7 +6,7 @@
 
 .. :py:module:: dsml
    :synopsis: Parses and generates DSMLv1 files
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 This module parses and generates LDAP data in the format DSMLv1. It is
diff --git a/Doc/ldap-controls.rst b/Doc/ldap-controls.rst
index f006bae..fb9cbce 100644
--- a/Doc/ldap-controls.rst
+++ b/Doc/ldap-controls.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-controls.rst,v 1.12 2015/12/09 17:57:18 stroeder Exp $
+.. % $Id: ldap-controls.rst,v 1.13 2016/07/24 15:47:46 stroeder Exp $
 
 
 *********************************************************************
@@ -7,7 +7,7 @@
 
 .. py:module:: ldap.controls
    :synopsis: High-level access to LDAPv3 extended controls.
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 Variables
diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index 81b6ba7..80c5b81 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-dn.rst,v 1.6 2011/07/22 07:43:45 stroeder Exp $
+.. % $Id: ldap-dn.rst,v 1.7 2016/07/24 15:47:46 stroeder Exp $
 
 
 :py:mod:`ldap.dn` LDAP Distinguished Name handling
@@ -6,7 +6,7 @@
 
 .. py:module:: ldap.dn
    :synopsis: LDAP Distinguished Name handling.
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 .. % Author of the module code;
diff --git a/Doc/ldap-filter.rst b/Doc/ldap-filter.rst
index 8295792..bb484a8 100644
--- a/Doc/ldap-filter.rst
+++ b/Doc/ldap-filter.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-filter.rst,v 1.4 2011/07/21 20:33:26 stroeder Exp $
+.. % $Id: ldap-filter.rst,v 1.5 2016/07/24 15:47:46 stroeder Exp $
 
 
 :py:mod:`ldap.filter` LDAP filter handling
@@ -6,7 +6,7 @@
 
 .. py:module:: ldap.filter
    :synopsis: LDAP filter handling.
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 .. % Author of the module code;
diff --git a/Doc/ldap-resiter.rst b/Doc/ldap-resiter.rst
index 443ded5..4c854fa 100644
--- a/Doc/ldap-resiter.rst
+++ b/Doc/ldap-resiter.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-resiter.rst,v 1.5 2011/08/27 15:43:06 stroeder Exp $
+.. % $Id: ldap-resiter.rst,v 1.6 2016/07/24 15:47:46 stroeder Exp $
 
 
 :py:mod:`ldap.resiter` Generator for stream-processing of large search results
@@ -6,7 +6,7 @@
 
 .. py:module:: ldap.resiter
    :synopsis: Generator for stream-processing of large search results.
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 .. _ldap.resiter-classes:
diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 2eb971e..8016b23 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.32 2016/02/09 11:58:30 stroeder Exp $
+.. % $Id: ldap.rst,v 1.33 2016/07/24 15:47:46 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -7,7 +7,7 @@
 .. py:module:: ldap
     :platform: Posix, Windows
     :synopsis: Access to an underlying LDAP C library.
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 This module provides access to the LDAP (Lightweight Directory Access Protocol)
diff --git a/Doc/ldapurl.rst b/Doc/ldapurl.rst
index b5bea92..d1f8ede 100644
--- a/Doc/ldapurl.rst
+++ b/Doc/ldapurl.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldapurl.rst,v 1.9 2011/07/22 13:27:01 stroeder Exp $
+.. % $Id: ldapurl.rst,v 1.10 2016/07/24 15:47:46 stroeder Exp $
 
 ###################################
 :py:mod:`ldapurl` LDAP URL handling
@@ -6,7 +6,7 @@
 
 .. py:module:: ldapurl
    :synopsis: Parses and generates LDAP URLs
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 This module parses and generates LDAP URLs.    It is implemented in pure Python
diff --git a/Doc/ldif.rst b/Doc/ldif.rst
index 19edf58..0bf28e1 100644
--- a/Doc/ldif.rst
+++ b/Doc/ldif.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldif.rst,v 1.8 2011/09/14 18:29:18 stroeder Exp $
+.. % $Id: ldif.rst,v 1.9 2016/07/24 15:47:46 stroeder Exp $
 
 #####################################
 :mod:`ldif` LDIF parser and generator
@@ -6,7 +6,7 @@
 
 .. py:module:: ldif
    :synopsis: Parses and generates LDIF files
-.. moduleauthor:: python-ldap project (see http://www.python-ldap.org/)
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
 This module parses and generates LDAP data in the format LDIF.    It is

From 25c5b66937346ff733b03549092fb7fa3eaa9467 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:52:26 +0000
Subject: [PATCH 273/868] added ldap.dn.is_dn()

---
 Doc/ldap-dn.rst | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index 80c5b81..c6456e8 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-dn.rst,v 1.7 2016/07/24 15:47:46 stroeder Exp $
+.. % $Id: ldap-dn.rst,v 1.8 2016/07/24 15:52:26 stroeder Exp $
 
 
 :py:mod:`ldap.dn` LDAP Distinguished Name handling
@@ -79,6 +79,12 @@ The :mod:`ldap.dn` module defines the following functions:
 
    .. % -> list
 
+.. function:: is_dn(dn[, flags=0])
+
+   This function checks whether *dn* is a valid LDAP distinguished name by 
+   passing it to function :func:`str2dn`.
+
+   .. % -> boolean
 
 .. _ldap-dn-example:
 

From e9fca605a7933810741236aeec655f0e902bf2a5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:53:56 +0000
Subject: [PATCH 274/868] Fixed ldap.dn.is_dn()

---
 CHANGES | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 74f02de..2c1ff6b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -15,6 +15,7 @@ Lib/
 * Refactored ldif.LDIFParser
   * ldif.LDIFParser.version ís now Integer
   * ignore multiple empty lines between records
+* Fixed ldap.dn.is_dn()
 
 Modules/
 * Fixed #69 Segmentation fault on whoami_s after unbind 
@@ -1267,4 +1268,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.383 2016/07/24 15:14:56 stroeder Exp $
+$Id: CHANGES,v 1.384 2016/07/24 15:53:56 stroeder Exp $

From b7b599907902d0a71fac643c7ab604d5a4c8dc1e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:58:26 +0000
Subject: [PATCH 275/868] is_dn() now also accepts flags and passes it to
 str2dn()

---
 Lib/ldap/dn.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 45950e5..569b296 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.15 2016/07/24 15:43:03 stroeder Exp $
+\$Id: dn.py,v 1.16 2016/07/24 15:58:26 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
@@ -110,14 +110,14 @@ def explode_rdn(rdn,notypes=0,flags=0):
     return ['='.join((atype,escape_dn_chars(avalue or ''))) for atype,avalue,dummy in rdn_decomp]
 
 
-def is_dn(s):
+def is_dn(s,flags=0):
   """
   Returns True is `s' can be parsed by ldap.dn.str2dn() like as a
   distinguished host_name (DN), otherwise False is returned.
   """
   try:
-    str2dn(s)
-  except Exception, err:
+    str2dn(s,flags)
+  except Exception:
     return False
   else:
     return True

From 33f0ab370c0723ee88abd69576de38699a8a0ea1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 15:59:45 +0000
Subject: [PATCH 276/868] fixed __doc__

---
 Tests/t_ldap_dn.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 553e2e5..2183d3a 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 """
-Automatic tests for module ldap.functions
+Automatic tests for module ldap.dn
 """
 
 # from Python's standard lib

From 926ee07eb372ff9250cbd66d4e9c5153323a521b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:03:46 +0000
Subject: [PATCH 277/868] tests for ldap.filter

---
 Tests/t_ldap_filter.py | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 Tests/t_ldap_filter.py

diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
new file mode 100644
index 0000000..9ba3f5a
--- /dev/null
+++ b/Tests/t_ldap_filter.py
@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for module ldap.filter
+"""
+
+# from Python's standard lib
+import unittest
+
+# from python-ldap
+from ldap.filter import escape_filter_chars
+
+
+class TestDN(unittest.TestCase):
+    """
+    test ldap.functions
+    """
+
+    def test_escape_filter_chars(self):
+        """
+        test function is_dn()
+        """
+        self.assertEquals(escape_filter_chars(r'foobar'), 'foobar')
+        self.assertEquals(escape_filter_chars(r'foo\bar'), r'foo\5cbar')
+
+
+if __name__ == '__main__':
+    unittest.main()

From 82e1985ac92cc66a1761defc711b3a3bee93efbe Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:05:28 +0000
Subject: [PATCH 278/868] added some more test scripts for ldap.dn, ldap.filter
 and ldap.functions

---
 CHANGES | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2c1ff6b..9084485 100644
--- a/CHANGES
+++ b/CHANGES
@@ -18,7 +18,7 @@ Lib/
 * Fixed ldap.dn.is_dn()
 
 Modules/
-* Fixed #69 Segmentation fault on whoami_s after unbind 
+* Fixed #69 Segmentation fault on whoami_s after unbind
   (thanks to Christian Heimes and Petr Viktorin)
 
 Tests/
@@ -30,6 +30,8 @@ Tests/
 * Tests/t_ldapurl.py now independent of module ldap
 * Tests/t_ldif.py now has more test-cases also
   for change records
+* added some more test scripts for sub-modules ldap.dn, ldap.filter and
+  ldap.functions (not complete yet)
 
 ----------------------------------------------------------------
 Released 2.4.25 2016-01-18
@@ -59,13 +61,13 @@ Lib/
 * LDIFParser now also accepts value-spec without a space
   after the colon.
 * Added key-word argument authz_id to LDAPObject methods
-  sasl_non_interactive_bind_s(), sasl_external_bind_s() and 
+  sasl_non_interactive_bind_s(), sasl_external_bind_s() and
   sasl_gssapi_bind_s()
 * Hmmpf! Added missing self to LDAPObject.fileno().
 * ReconnectLDAPObject.sasl_bind_s() now correctly uses
   generic wrapper arguments *args,**kwargs
 * Correct method name LDIFParser.handle_modify()
-* Corrected __all__ in modules ldap.controls.pwdpolicy and 
+* Corrected __all__ in modules ldap.controls.pwdpolicy and
   ldap.controls.openldap
 
 Doc/
@@ -77,11 +79,11 @@ Released 2.4.21 2015-09-25
 Changes since 2.4.20:
 
 Lib/
-* LDAPObject.read_s() now returns None instead of raising 
+* LDAPObject.read_s() now returns None instead of raising
   ldap.NO_SUCH_OBJECT in case the search operation returned emtpy result.
 * ldap.resiter.ResultProcessor.allresults() now takes new key-word
   argument add_ctrls which is internally passed to LDAPObject.result4()
-  and lets the method also return response control along with the search 
+  and lets the method also return response control along with the search
   results.
 * Added ldap.controls.deref implementing support for dereference control
 
@@ -97,7 +99,7 @@ Changes since 2.4.19:
   to intercept the SASL handshake (thanks to René Kijewski)
 
 Modules/
-* Added exceptions ldap.VLV_ERROR, ldap.X_PROXY_AUTHZ_FAILURE and 
+* Added exceptions ldap.VLV_ERROR, ldap.X_PROXY_AUTHZ_FAILURE and
   ldap.AUTH_METHOD_NOT_SUPPORTED
 
 Lib/
@@ -1268,4 +1270,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.384 2016/07/24 15:53:56 stroeder Exp $
+$Id: CHANGES,v 1.385 2016/07/24 16:05:28 stroeder Exp $

From d4ae0269fbc7cbf026ab3b59d661fb3b2b733660 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:10:51 +0000
Subject: [PATCH 279/868] test escape_filter_chars() with all possible
 escape_mode values

---
 Tests/t_ldap_filter.py | 45 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 41 insertions(+), 4 deletions(-)

diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index 9ba3f5a..2fe1f2f 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -15,12 +15,49 @@ class TestDN(unittest.TestCase):
     test ldap.functions
     """
 
-    def test_escape_filter_chars(self):
+    def test_escape_filter_chars_mode0(self):
         """
-        test function is_dn()
+        test function escape_filter_chars() with escape_mode=0
         """
-        self.assertEquals(escape_filter_chars(r'foobar'), 'foobar')
-        self.assertEquals(escape_filter_chars(r'foo\bar'), r'foo\5cbar')
+        self.assertEquals(
+            escape_filter_chars(r'foobar'),
+            'foobar'
+        )
+        self.assertEquals(
+            escape_filter_chars(r'foo\bar'),
+            r'foo\5cbar'
+        )
+        self.assertEquals(
+            escape_filter_chars(
+                r'foo\bar',
+                escape_mode=0
+            ),
+            r'foo\5cbar'
+        )
+
+    def test_escape_filter_chars_mode1(self):
+        """
+        test function escape_filter_chars() with escape_mode=1
+        """
+        self.assertEquals(
+            escape_filter_chars(
+                '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f',
+                escape_mode=1
+            ),
+            r'\c3\a4\c3\b6\c3\bc\c3\84\c3\96\c3\9c\c3\9f'
+        )
+
+    def test_escape_filter_chars_mode2(self):
+        """
+        test function escape_filter_chars() with escape_mode=2
+        """
+        self.assertEquals(
+            escape_filter_chars(
+                'foobar',
+                escape_mode=2
+            ),
+            r'\66\6f\6f\62\61\72'
+        )
 
 
 if __name__ == '__main__':

From 7d1a375c8fb56194b19d6060fcb17629a3ba315e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:12:55 +0000
Subject: [PATCH 280/868] HTTPS URL to www.python-ldap.org

---
 Doc/ldap.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 8016b23..7f7380e 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.33 2016/07/24 15:47:46 stroeder Exp $
+.. % $Id: ldap.rst,v 1.34 2016/07/24 16:12:55 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -23,7 +23,7 @@ and errors appear as exceptions.
 
 This documentation is current for the Python LDAP module, version  
 |release|.  Source and binaries are available from 
-http://www.python-ldap.org/.
+https://www.python-ldap.org/.
 
 
 Functions

From 01693164af9a601660af610bff1d02037756375a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:22:32 +0000
Subject: [PATCH 281/868] added methods read_rootdse_s() and
 get_naming_contexts()

---
 CHANGES                |  4 +++-
 Lib/ldap/ldapobject.py | 22 +++++++++++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9084485..4ebc8ce 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,8 @@ Lib/
 * LDAPObject.unbind_ext() now removes class attribute
   LDAPObject._l to completely invalidate C wrapper object
 * LDAPObject.unbind_ext() now flushes trace file
+* ldap.ldapobject.SimpleLDAPObject:
+  added convenience methods read_rootdse_s() and get_naming_contexts() 
 * added functions ldap.strf_secs() and ldap.strp_secs()
 * added function ldap.filter.time_span_filter()
 * Refactored ldif.LDIFParser
@@ -1270,4 +1272,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.385 2016/07/24 16:05:28 stroeder Exp $
+$Id: CHANGES,v 1.386 2016/07/24 16:24:44 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 94b7a90..13ea9e5 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.155 2016/07/17 14:49:22 stroeder Exp $
+\$Id: ldapobject.py,v 1.156 2016/07/24 16:22:32 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -745,6 +745,26 @@ def find_unique_entry(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass
       raise NO_UNIQUE_ENTRY('No or non-unique search result for %s' % (repr(filterstr)))
     return r[0]
 
+  def read_rootdse_s(self, filterstr='(objectClass=*)', attrlist=None):
+    """
+    convenience wrapper around read_s() for reading rootDSE
+    """
+    ldap_rootdse = self.read_s(
+      '',
+      filterstr=filterstr,
+      attrlist=attrlist or ['*', '+'],
+    )
+    return ldap_rootdse  # read_rootdse_s()
+
+  def get_naming_contexts(self):
+    """
+    returns all attribute values of namingContexts in rootDSE
+    if namingContexts is not present (not readable) then empty list is returned
+    """
+    return self.read_rootdse_s(
+      attrlist=['namingContexts']
+    ).get('namingContexts', [])
+
 
 class NonblockingLDAPObject(SimpleLDAPObject):
 

From 704cd3c21220df13d0a96b8454002cb7e89df49c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:27:50 +0000
Subject: [PATCH 282/868] wording

---
 CHANGES | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4ebc8ce..82135e8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,7 +11,7 @@ Lib/
   LDAPObject._l to completely invalidate C wrapper object
 * LDAPObject.unbind_ext() now flushes trace file
 * ldap.ldapobject.SimpleLDAPObject:
-  added convenience methods read_rootdse_s() and get_naming_contexts() 
+  added convenience methods read_rootdse_s() and get_naming_contexts()
 * added functions ldap.strf_secs() and ldap.strp_secs()
 * added function ldap.filter.time_span_filter()
 * Refactored ldif.LDIFParser
@@ -30,8 +30,7 @@ Tests/
   hard-coded /var/tmp
 * Tests/slapd.py now expects schema to be in /etc/openldap/
 * Tests/t_ldapurl.py now independent of module ldap
-* Tests/t_ldif.py now has more test-cases also
-  for change records
+* Tests/t_ldif.py now has more test-cases including change records
 * added some more test scripts for sub-modules ldap.dn, ldap.filter and
   ldap.functions (not complete yet)
 
@@ -1272,4 +1271,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.386 2016/07/24 16:24:44 stroeder Exp $
+$Id: CHANGES,v 1.387 2016/07/24 16:27:50 stroeder Exp $

From e50de299ad48ca811eaea5365b8adfa76e160c32 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 24 Jul 2016 16:35:22 +0000
Subject: [PATCH 283/868] set release date

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 82135e8..4f6b182 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.26 2016-xx-xx
+Released 2.4.26 2016-07-24
 
 Changes since 2.4.25:
 
@@ -1271,4 +1271,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.387 2016/07/24 16:27:50 stroeder Exp $
+$Id: CHANGES,v 1.388 2016/07/24 16:35:22 stroeder Exp $

From 69e7aa9db55220f4ed85ee8f328abf939c82ee77 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 25 Jul 2016 08:11:49 +0000
Subject: [PATCH 284/868] started 2.4.27

---
 CHANGES | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 4f6b182..b54e904 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.27 2016-07-xx
+
+Changes since 2.4.26:
+
+Lib/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.26 2016-07-24
 
@@ -1271,4 +1279,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.388 2016/07/24 16:35:22 stroeder Exp $
+$Id: CHANGES,v 1.389 2016/07/25 08:11:49 stroeder Exp $

From 850add0c4805465ec65e73c85af05347cf494a97 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 25 Jul 2016 08:15:14 +0000
Subject: [PATCH 285/868] added 'strf_secs' and 'strp_secs' to
 ldap.functions.__all__

---
 CHANGES               | 4 ++--
 Lib/ldap/functions.py | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index b54e904..32a0114 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,7 @@ Released 2.4.27 2016-07-xx
 Changes since 2.4.26:
 
 Lib/
-* 
+* added 'strf_secs' and 'strp_secs' to ldap.functions.__all__
 
 ----------------------------------------------------------------
 Released 2.4.26 2016-07-24
@@ -1279,4 +1279,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.389 2016/07/25 08:11:49 stroeder Exp $
+$Id: CHANGES,v 1.390 2016/07/25 08:15:14 stroeder Exp $
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 3e04744..b0af7ee 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.32 2016/07/17 15:12:58 stroeder Exp $
+\$Id: functions.py,v 1.33 2016/07/25 08:15:14 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -25,6 +25,7 @@
   'explode_dn','explode_rdn',
   'get_option','set_option',
   'escape_str',
+  'strf_secs','strp_secs',
 ]
 
 import sys,pprint,time,_ldap,ldap

From 810f3aa76f927d5c56a0f38417c5775d0cf4e1ea Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 27 Jul 2016 09:31:30 +0000
Subject: [PATCH 286/868] 1. Added
 TestEntryRecords.test_missing_trailing_line_separator() 2. avoid adding
 trailing new-line in TestLDIFParser.check_records() which masks some
 corner-cases 3. TestChangeRecords: renamed method
 test_missing_trailing_separator() to test_missing_trailing_dash_separator()

---
 Tests/t_ldif.py | 57 ++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 52 insertions(+), 5 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 7fdc680..900af7b 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.20 2016/07/24 14:57:46 stroeder Exp $
+$Id: t_ldif.py,v 1.21 2016/07/27 09:31:30 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -75,7 +75,7 @@ def check_records(
         Checks whether entry records in `ldif_string' gets correctly parsed
         and matches list of unparsed `records'.
         """
-        ldif_string = textwrap.dedent(ldif_string).lstrip() + '\n'
+        ldif_string = textwrap.dedent(ldif_string).lstrip()
         parsed_records = self._parse_records(
             ldif_string,
             ignored_attr_types=ignored_attr_types,
@@ -87,8 +87,8 @@ def check_records(
             ignored_attr_types=ignored_attr_types,
             max_entries=max_entries,
         )
-        self.assertEqual(parsed_records, records)
-        self.assertEqual(parsed_records2, records)
+        self.assertEqual(records, parsed_records)
+        self.assertEqual(records, parsed_records2)
 
 
 class TestEntryRecords(TestLDIFParser):
@@ -114,6 +114,7 @@ def test_simple(self):
             dn: cn=x,cn=y,cn=z
             attrib: value
             attrib: value2
+
             """,
             [
                 (
@@ -131,6 +132,7 @@ def test_simple2(self):
             dn:cn=x,cn=y,cn=z
             attrib:value
             attrib:value2
+
             """,
             [
                 (
@@ -154,6 +156,7 @@ def test_multiple(self):
             attrib: value2
             attrib: value3
             b: v
+
             """,
             [
                 (
@@ -182,6 +185,7 @@ def test_folded(self):
               line-folded\x20
              value
             attrib2: %s
+
             """ % (b'asdf.'*20), [
                 (
                     'cn=x,cn=y,cn=z',
@@ -201,6 +205,7 @@ def test_empty_attr_values(self):
             attrib1: foo
             attrib2:
             attrib2: foo
+
             """,
             [
                 (
@@ -218,6 +223,7 @@ def test_binary(self):
             """
             dn: cn=x,cn=y,cn=z
             attrib:: CQAKOiVA
+
             """,
             [
                 (
@@ -234,6 +240,7 @@ def test_binary2(self):
             """
             dn: cn=x,cn=y,cn=z
             attrib::CQAKOiVA
+
             """,
             [
                 (
@@ -248,6 +255,7 @@ def test_unicode(self):
             """
             dn: cn=Michael Stroeder,dc=stroeder,dc=com
             lastname: Ströder
+
             """,
             [
                 (
@@ -264,6 +272,7 @@ def test_sorted(self):
             b: value_b
             c: value_c
             a: value_a
+
             """,
             [
                 (
@@ -284,6 +293,7 @@ def test_ignored_attr_types(self):
             a: value_a
             b: value_b
             c: value_c
+
             """,
             [
                 (
@@ -374,6 +384,39 @@ def test_max_entries(self):
             max_entries=2
         )
 
+    def test_missing_trailing_line_separator(self):
+        self.check_records(
+            """
+            dn: cn=x1,cn=y1,cn=z1
+            first: value_a1
+            middle: value_b1
+            last: value_c1
+
+            dn: cn=x2,cn=y2,cn=z2
+            first: value_a2
+            middle: value_b2
+            last: value_c2
+            """,
+            [
+                (
+                    'cn=x1,cn=y1,cn=z1',
+                    {
+                        'first': [b'value_a1'],
+                        'middle': [b'value_b1'],
+                        'last': [b'value_c1'],
+                    }
+                ),
+                (
+                    'cn=x2,cn=y2,cn=z2',
+                    {
+                        'first': [b'value_a2'],
+                        'middle': [b'value_b2'],
+                        'last': [b'value_c2'],
+                    }
+                ),
+            ],
+        )
+
     def test_multiple_empty_lines(self):
         """
         see http://sourceforge.net/p/python-ldap/feature-requests/18/
@@ -385,9 +428,11 @@ def test_multiple_empty_lines(self):
             uid: one
 
 
+
             # after extra empty line
             dn: uid=two,dc=tld
             uid: two
+
             """,
             [
                 (
@@ -452,7 +497,7 @@ def test_simple(self):
             ],
         )
 
-    def test_missing_trailing_separator(self):
+    def test_missing_trailing_dash_separator(self):
         self.check_records(
             """
             version: 1
@@ -466,6 +511,7 @@ def test_missing_trailing_separator(self):
             add: attrib2
             attrib2: value
             attrib2: value2
+
             """,
             [
                 (
@@ -486,6 +532,7 @@ def test_bad_change_records(self):
             replace: attrib
             attrib: value
             attrib: value2
+
             """,
         ):
             ldif_string = textwrap.dedent(bad_ldif_string).lstrip() + '\n'

From 8145792b39a48439603e2e78b8e439dc7c17ddda Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 30 Jul 2016 16:18:47 +0000
Subject: [PATCH 287/868] bump __version__ to 2.4.27

---
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/dsml.py b/Lib/dsml.py
index 845d784..1796620 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.43 2016/01/26 10:43:24 stroeder Exp $
+$Id: dsml.py,v 1.44 2016/07/30 16:18:47 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.26'
+__version__ = '2.4.27'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 0cb29f1..5e40bad 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.104 2016/07/17 15:12:58 stroeder Exp $
+$Id: __init__.py,v 1.105 2016/07/30 16:18:47 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.26'
+__version__ = '2.4.27'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index b9e78a8..0eea425 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.79 2016/07/17 19:44:19 stroeder Exp $
+\$Id: ldapurl.py,v 1.80 2016/07/30 16:18:47 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.26'
+__version__ = '2.4.27'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index bae4b76..8afea75 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.97 2016/07/17 19:38:32 stroeder Exp $
+$Id: ldif.py,v 1.98 2016/07/30 16:18:47 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.26'
+__version__ = '2.4.27'
 
 __all__ = [
   # constants

From 7b521f85c0a2bdd39fd808ca32192c8a4fa0d8af Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 30 Jul 2016 17:15:22 +0000
Subject: [PATCH 288/868] added method test_weird_empty_lines() in classes
 TestEntryRecords and TestChangeRecords

---
 Tests/t_ldif.py | 108 ++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 105 insertions(+), 3 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 900af7b..e8a8399 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.21 2016/07/27 09:31:30 stroeder Exp $
+$Id: t_ldif.py,v 1.22 2016/07/30 17:15:22 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -395,8 +395,46 @@ def test_missing_trailing_line_separator(self):
             dn: cn=x2,cn=y2,cn=z2
             first: value_a2
             middle: value_b2
-            last: value_c2
-            """,
+            last: value_c2""",
+            [
+                (
+                    'cn=x1,cn=y1,cn=z1',
+                    {
+                        'first': [b'value_a1'],
+                        'middle': [b'value_b1'],
+                        'last': [b'value_c1'],
+                    }
+                ),
+                (
+                    'cn=x2,cn=y2,cn=z2',
+                    {
+                        'first': [b'value_a2'],
+                        'middle': [b'value_b2'],
+                        'last': [b'value_c2'],
+                    }
+                ),
+            ],
+        )
+
+    def test_weird_empty_lines(self):
+        self.check_records(
+            """
+
+            # comment before version
+               
+            version: 1
+
+
+            dn: cn=x1,cn=y1,cn=z1
+            first: value_a1
+            middle: value_b1
+            last: value_c1
+
+
+            dn: cn=x2,cn=y2,cn=z2
+            first: value_a2
+            middle: value_b2
+            last: value_c2""",
             [
                 (
                     'cn=x1,cn=y1,cn=z1',
@@ -497,6 +535,70 @@ def test_simple(self):
             ],
         )
 
+    def test_weird_empty_lines(self):
+        self.check_records(
+            """
+
+            # comment before version
+               
+            version: 1
+
+
+            dn: cn=x,cn=y,cn=z
+            changetype: modify
+            replace: attrib
+            attrib: value
+            attrib: value2
+            -
+            add: attrib2
+            attrib2: value
+            attrib2: value2
+            -
+            delete: attrib3
+            attrib3: value
+            -
+            delete: attrib4
+            -
+
+
+            dn: cn=foo,cn=bar
+            changetype: modify
+            replace: attrib
+            attrib: value
+            attrib: value2
+            -
+            add: attrib2
+            attrib2: value
+            attrib2: value2
+            -
+            delete: attrib3
+            attrib3: value
+            -
+            delete: attrib4""",
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    [
+                        (ldif.MOD_OP_INTEGER['replace'], 'attrib', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['add'], 'attrib2', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['delete'], 'attrib3', [b'value']),
+                        (ldif.MOD_OP_INTEGER['delete'], 'attrib4', None),
+                    ],
+                    None,
+                ),
+                (
+                    'cn=foo,cn=bar',
+                    [
+                        (ldif.MOD_OP_INTEGER['replace'], 'attrib', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['add'], 'attrib2', [b'value', b'value2']),
+                        (ldif.MOD_OP_INTEGER['delete'], 'attrib3', [b'value']),
+                        (ldif.MOD_OP_INTEGER['delete'], 'attrib4', None),
+                    ],
+                    None,
+                ),
+            ],
+        )
+
     def test_missing_trailing_dash_separator(self):
         self.check_records(
             """

From 57be6e8fb82e8c7cf02dc3df3315c529bb077ede Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 30 Jul 2016 19:01:59 +0000
Subject: [PATCH 289/868] fixed regression introduced with 2.4.26:
 ldif.LDIFParser did not accept LDIF entry records without trailing empty
 separator line

---
 CHANGES     |  5 ++++-
 Lib/ldif.py | 12 +++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/CHANGES b/CHANGES
index 32a0114..fe8f627 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,9 @@ Changes since 2.4.26:
 
 Lib/
 * added 'strf_secs' and 'strp_secs' to ldap.functions.__all__
+* fixed regression introduced with 2.4.26:
+  ldif.LDIFParser did not accept LDIF entry records
+  without trailing empty separator line
 
 ----------------------------------------------------------------
 Released 2.4.26 2016-07-24
@@ -1279,4 +1282,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.390 2016/07/25 08:15:14 stroeder Exp $
+$Id: CHANGES,v 1.391 2016/07/30 19:01:59 stroeder Exp $
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 8afea75..172d0c3 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.98 2016/07/30 16:18:47 stroeder Exp $
+$Id: ldif.py,v 1.99 2016/07/30 19:01:59 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -297,10 +297,7 @@ def _readline(self):
     self.line_counter = self.line_counter + 1
     self.byte_counter = self.byte_counter + len(s)
     if not s:
-      raise EOFError('EOF reached after %d lines (%d bytes)' % (
-        self.line_counter,
-        self.byte_counter,
-      ))
+      return None
     elif s[-2:]=='\r\n':
       return s[:-2]
     elif s[-1:]=='\n':
@@ -312,6 +309,11 @@ def _unfold_lines(self):
     """
     Unfold several folded lines with trailing space into one line
     """
+    if self._last_line is None:
+      raise EOFError('EOF reached after %d lines (%d bytes)' % (
+        self.line_counter,
+        self.byte_counter,
+      ))
     unfolded_lines = [ self._last_line ]
     next_line = self._readline()
     while next_line and next_line[0]==' ':

From c1c3f805dd41e8d0f6fa2f70d14765db1b3ca431 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 30 Jul 2016 19:38:05 +0000
Subject: [PATCH 290/868] fixed regression introduced with 2.4.26:
 ldif.LDIFParser did not fully parse LDIF records without trailing empty
 separator line

---
 CHANGES     | 6 +++---
 Lib/ldif.py | 7 +++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index fe8f627..224bbac 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,8 +6,8 @@ Changes since 2.4.26:
 Lib/
 * added 'strf_secs' and 'strp_secs' to ldap.functions.__all__
 * fixed regression introduced with 2.4.26:
-  ldif.LDIFParser did not accept LDIF entry records
-  without trailing empty separator line
+  ldif.LDIFParser did not fully parse LDIF records without trailing empty
+  separator line
 
 ----------------------------------------------------------------
 Released 2.4.26 2016-07-24
@@ -1282,4 +1282,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.391 2016/07/30 19:01:59 stroeder Exp $
+$Id: CHANGES,v 1.392 2016/07/30 19:38:05 stroeder Exp $
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 172d0c3..2b3158c 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.99 2016/07/30 19:01:59 stroeder Exp $
+$Id: ldif.py,v 1.100 2016/07/30 19:38:05 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
@@ -500,7 +500,10 @@ def parse_change_records(self):
             # we now have the attribute name to be modified
             modattr = v
             modvalues = []
-            k,v = next_key_and_value()
+            try:
+              k,v = next_key_and_value()
+            except EOFError:
+              k,v = None,None
             while k==modattr:
               modvalues.append(v)
               try:

From 11bb0a4a19948c5cf77489cdd7c1527fe0f30030 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 1 Aug 2016 10:13:01 +0000
Subject: [PATCH 291/868] bump __version__ to 2.4.27

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 72fc8bb..7fa6e6a 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.24 2016/02/29 17:05:43 stroeder Exp $
+# $Id: conf.py,v 1.25 2016/08/01 10:13:01 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.26.0'
+release = '2.4.27.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From 05d51d3c9bd682718dbb642168fad1ca400476a1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 1 Aug 2016 10:15:39 +0000
Subject: [PATCH 292/868] prepare release 2.4.27

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 224bbac..c9aab1c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.27 2016-07-xx
+Released 2.4.27 2016-08-01
 
 Changes since 2.4.26:
 
@@ -1282,4 +1282,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.392 2016/07/30 19:38:05 stroeder Exp $
+$Id: CHANGES,v 1.393 2016/08/01 10:15:39 stroeder Exp $

From eefffebd19e2e64119f715f0b00c394900a9ad0d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 13 Aug 2016 09:44:08 +0000
Subject: [PATCH 293/868] added classifier 'Programming Language :: Python ::
 2'

---
 setup.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index 2cc776b..d738632 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.75 2016/04/07 20:17:16 stroeder Exp $
+$Id: setup.py,v 1.76 2016/08/13 09:44:08 stroeder Exp $
 """
 
 has_setuptools = False
@@ -103,6 +103,7 @@ class OpenLDAP2:
     'Operating System :: POSIX',
     'Programming Language :: C',
     'Programming Language :: Python',
+    'Programming Language :: Python :: 2',
     'Topic :: Database',
     'Topic :: Internet',
     'Topic :: Software Development :: Libraries :: Python Modules',

From 79b99224a4796ad9d5f966bb123027a15c66e49d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 26 Sep 2016 22:05:44 +0000
Subject: [PATCH 294/868] added example script which finds highest
 uidNumber/gidNumber values

---
 Demo/pyasn1/sss_highest_number.py | 32 +++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 Demo/pyasn1/sss_highest_number.py

diff --git a/Demo/pyasn1/sss_highest_number.py b/Demo/pyasn1/sss_highest_number.py
new file mode 100644
index 0000000..9b1003a
--- /dev/null
+++ b/Demo/pyasn1/sss_highest_number.py
@@ -0,0 +1,32 @@
+#!/usr/bin/env python
+"""
+This sample script demonstrates the use of the server-side-sorting control
+(see RFC 2891)
+
+Requires module pyasn1 (see http://pyasn1.sourceforge.net/)
+"""
+
+import pprint,ldap
+
+from ldap.controls.sss import SSSRequestControl
+
+uri = "ldap://ipa.demo1.freeipa.org"
+
+l = ldap.initialize(uri,trace_level=0)
+l.simple_bind_s('uid=admin,cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org','Secret123')
+
+for id_attr in ('uidNumber','gidNumber'):
+  sss_control = SSSRequestControl(ordering_rules=['-%s' % (id_attr)])
+  ldap_result = l.search_ext_s(
+    'dc=demo1,dc=freeipa,dc=org',
+    ldap.SCOPE_SUBTREE,
+    '(%s=*)' % (id_attr),
+    attrlist=[id_attr],
+    serverctrls = [sss_control],
+  )
+  print 'Highest value of %s' % (id_attr)
+  if ldap_result:
+    dn,entry = ldap_result[0]
+    print '->',entry[id_attr]
+  else:
+    print 'not found'

From b5a5acf5d5a1fa01515e2314a56daf6b0e063481 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 26 Sep 2016 22:06:54 +0000
Subject: [PATCH 295/868] Fixed example in SSSRequestControl.__doc__

---
 Lib/ldap/controls/sss.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 95f751e..71bef3d 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: sss.py,v 1.2 2015/10/24 15:52:23 stroeder Exp $
+$Id: sss.py,v 1.3 2016/09/26 22:06:54 stroeder Exp $
 """
 
 __all__ = [
@@ -48,7 +48,7 @@ class SortKeyListType(univ.SequenceOf):
 class SSSRequestControl(RequestControl):
     '''Order result server side
 
-        >>> s = SSSRequestControl('-cn')
+        >>> s = SSSRequestControl(ordering_rules=['-cn'])
     '''
     controlType = '1.2.840.113556.1.4.473'
 

From dbc6eec3145a53c85f2a28d8088ce65652709a55 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 26 Sep 2016 22:32:14 +0000
Subject: [PATCH 296/868] async search to deal with ldap.SIZELIMIT_EXCEEDED,
 added comments

---
 Demo/pyasn1/sss_highest_number.py | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/Demo/pyasn1/sss_highest_number.py b/Demo/pyasn1/sss_highest_number.py
index 9b1003a..fb19fdd 100644
--- a/Demo/pyasn1/sss_highest_number.py
+++ b/Demo/pyasn1/sss_highest_number.py
@@ -8,22 +8,38 @@
 
 import pprint,ldap
 
+from ldap.ldapobject import LDAPObject
 from ldap.controls.sss import SSSRequestControl
+from ldap.resiter import ResultProcessor
+
+class MyLDAPObject(LDAPObject,ResultProcessor):
+  pass
 
 uri = "ldap://ipa.demo1.freeipa.org"
 
-l = ldap.initialize(uri,trace_level=0)
+l = MyLDAPObject(uri,trace_level=0)
 l.simple_bind_s('uid=admin,cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org','Secret123')
 
 for id_attr in ('uidNumber','gidNumber'):
+  # reverse sorting request control
   sss_control = SSSRequestControl(ordering_rules=['-%s' % (id_attr)])
-  ldap_result = l.search_ext_s(
+  # send search request
+  msg_id = l.search_ext(
     'dc=demo1,dc=freeipa,dc=org',
     ldap.SCOPE_SUBTREE,
     '(%s=*)' % (id_attr),
     attrlist=[id_attr],
+    sizelimit=1,
     serverctrls = [sss_control],
   )
+  # collect result
+  ldap_result = []
+  try:
+    for res_type,res_data,res_msgid,res_controls in l.allresults(msg_id,add_ctrls=0):
+      ldap_result.extend(res_data)
+  except ldap.SIZELIMIT_EXCEEDED:
+    pass
+  # print result
   print 'Highest value of %s' % (id_attr)
   if ldap_result:
     dn,entry = ldap_result[0]

From 49755d0a0d7625170243552ab9c043db57d1b5d6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 11 Nov 2016 14:41:07 +0000
Subject: [PATCH 297/868] started 2.4.28

---
 CHANGES              | 10 +++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index c9aab1c..d205de9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.28 2016-11-xx
+
+Changes since 2.4.27:
+
+Lib/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.27 2016-08-01
 
@@ -1282,4 +1290,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.393 2016/08/01 10:15:39 stroeder Exp $
+$Id: CHANGES,v 1.394 2016/11/11 14:41:07 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 1796620..6527f86 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.44 2016/07/30 16:18:47 stroeder Exp $
+$Id: dsml.py,v 1.45 2016/11/11 14:41:07 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.27'
+__version__ = '2.4.28'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 5e40bad..2ff9193 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.105 2016/07/30 16:18:47 stroeder Exp $
+$Id: __init__.py,v 1.106 2016/11/11 14:41:07 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.27'
+__version__ = '2.4.28'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 0eea425..179ed48 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.80 2016/07/30 16:18:47 stroeder Exp $
+\$Id: ldapurl.py,v 1.81 2016/11/11 14:41:07 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.27'
+__version__ = '2.4.28'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 2b3158c..a96b5a0 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.100 2016/07/30 19:38:05 stroeder Exp $
+$Id: ldif.py,v 1.101 2016/11/11 14:41:07 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.27'
+__version__ = '2.4.28'
 
 __all__ = [
   # constants

From d8ada28247b6924f8a4a961c46f59951cf937715 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 11 Nov 2016 14:42:18 +0000
Subject: [PATCH 298/868] added dummy method logging_file_class.flush() because
 LDAPObject.unbind_ext_s() invokes it

---
 CHANGES            | 5 +++--
 Lib/ldap/logger.py | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index d205de9..a758fad 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.28 2016-11-xx
 Changes since 2.4.27:
 
 Lib/
-* 
+* added dummy method logging_file_class.flush() because
+  LDAPObject.unbind_ext_s() invokes it
 
 ----------------------------------------------------------------
 Released 2.4.27 2016-08-01
@@ -1290,4 +1291,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.394 2016/11/11 14:41:07 stroeder Exp $
+$Id: CHANGES,v 1.395 2016/11/11 14:42:18 stroeder Exp $
diff --git a/Lib/ldap/logger.py b/Lib/ldap/logger.py
index 16c4d63..d955c2e 100644
--- a/Lib/ldap/logger.py
+++ b/Lib/ldap/logger.py
@@ -13,4 +13,7 @@ def __init__(self,logging_level):
   def write(self,msg):
     logging.log(self._logging_level,msg[:-1])
 
+  def flush(self):
+    return
+
 logging_file_obj = logging_file_class(logging.DEBUG)

From 5c7740a41650d887cc206cedb6a1b9411ab7a28e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 17 Nov 2016 12:08:30 +0000
Subject: [PATCH 299/868] LDAPObject.unbind_ext_s() now ignores AttributeError
 in case _trace_file has no flush() method

---
 CHANGES                | 4 +++-
 Lib/ldap/ldapobject.py | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index a758fad..7300d01 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,8 @@ Released 2.4.28 2016-11-xx
 Changes since 2.4.27:
 
 Lib/
+* LDAPObject.unbind_ext_s() now ignores AttributeError
+  in case _trace_file has no flush() method
 * added dummy method logging_file_class.flush() because
   LDAPObject.unbind_ext_s() invokes it
 
@@ -1291,4 +1293,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.395 2016/11/11 14:42:18 stroeder Exp $
+$Id: CHANGES,v 1.396 2016/11/17 12:08:30 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 13ea9e5..9b87787 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.156 2016/07/24 16:22:32 stroeder Exp $
+\$Id: ldapobject.py,v 1.157 2016/11/17 12:08:30 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -636,7 +636,10 @@ def unbind_ext_s(self,serverctrls=None,clientctrls=None):
       result = self.result3(msgid,all=1,timeout=self.timeout)
     else:
       result = None
-    self._trace_file.flush()
+    try:
+      self._trace_file.flush()
+    except AttributeError:
+      pass
     return result
 
   def unbind(self):

From 84ca4ebbbf183b41bb346c70f0d31669618b60c9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 17 Nov 2016 12:08:59 +0000
Subject: [PATCH 300/868] prepare release 2.4.28

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7300d01..51dc96d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.28 2016-11-xx
+Released 2.4.28 2016-11-17
 
 Changes since 2.4.27:
 
@@ -1293,4 +1293,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.396 2016/11/17 12:08:30 stroeder Exp $
+$Id: CHANGES,v 1.397 2016/11/17 12:08:59 stroeder Exp $

From 946fe3f414a837521ff80f57d16d48f70ba7e015 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 18 Nov 2016 07:01:45 +0000
Subject: [PATCH 301/868] LDAPObject.unbind_ext_s() invokes
 LDAPObject._trace_file.flush() only if LDAPObject._trace_level is non-zero
 and Python is running in debug mode

---
 CHANGES                |  9 ++++++---
 Lib/ldap/ldapobject.py | 11 ++++++-----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index 51dc96d..2be9953 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,9 +4,12 @@ Released 2.4.28 2016-11-17
 Changes since 2.4.27:
 
 Lib/
+* LDAPObject.unbind_ext_s() invokes LDAPObject._trace_file.flush()
+  only if LDAPObject._trace_level is non-zero and Python is running
+  in debug mode
 * LDAPObject.unbind_ext_s() now ignores AttributeError
-  in case _trace_file has no flush() method
-* added dummy method logging_file_class.flush() because
+  in case LDAPObject._trace_file has no flush() method
+* added dummy method ldap.logger.logging_file_class.flush() because
   LDAPObject.unbind_ext_s() invokes it
 
 ----------------------------------------------------------------
@@ -1293,4 +1296,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.397 2016/11/17 12:08:59 stroeder Exp $
+$Id: CHANGES,v 1.398 2016/11/18 07:01:45 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 9b87787..188405c 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.157 2016/11/17 12:08:30 stroeder Exp $
+\$Id: ldapobject.py,v 1.158 2016/11/18 07:01:45 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -636,10 +636,11 @@ def unbind_ext_s(self,serverctrls=None,clientctrls=None):
       result = self.result3(msgid,all=1,timeout=self.timeout)
     else:
       result = None
-    try:
-      self._trace_file.flush()
-    except AttributeError:
-      pass
+    if __debug__ and self._trace_level>=1:
+      try:
+        self._trace_file.flush()
+      except AttributeError:
+        pass
     return result
 
   def unbind(self):

From 29e740fbe93a5fd5c3ca76faa394ae4681eb9e65 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 11 Dec 2016 17:11:27 +0000
Subject: [PATCH 302/868] TestLDAPUrl.test_bad_urls(): One bad URL per line,
 put every failed URL into a list to be displayed with self.fail()

---
 Tests/t_ldapurl.py | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index aef53aa..d1b09c8 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -215,9 +215,20 @@ def test_parse_extensions_novalue(self):
         self.assertNone(u.who)
 
     def test_bad_urls(self):
-        for bad in ("", "ldap:", "ldap:/", ":///", "://", "///", "//", "/",
+        failed_urls = []
+        for bad in (
+                "",
+                "ldap:",
+                "ldap:/",
+                ":///",
+                "://",
+                "///",
+                "//",
+                "/",
                 "ldap:///?????",       # extension can't start with '?'
-                "LDAP://", "invalid://", "ldap:///??invalid",
+                "LDAP://",
+                "invalid://",
+                "ldap:///??invalid",
                 #XXX-- the following should raise exceptions!
                 "ldap://:389/",         # [host [COLON port]]
                 "ldap://a:/",           # [host [COLON port]]
@@ -239,7 +250,9 @@ def test_bad_urls(self):
             except ValueError:
                 pass
             else:
-                self.fail("should have raised ValueError: %r" % bad)
+                failed_urls.append(bad)
+        if failed_urls:
+          self.fail("These LDAP URLs should have raised ValueError: %r" % failed_urls)
 
 if __name__ == '__main__':
     unittest.main()

From 9306a8eda79e09ef2c48406a6b49c898d93d6ce0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 11 Dec 2016 17:14:29 +0000
Subject: [PATCH 303/868] added decorator @unittest.expectedFailure to
 TestLDAPUrl.test_bad_urls() for now

---
 Tests/t_ldapurl.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index d1b09c8..96af4f9 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -214,6 +214,7 @@ def test_parse_extensions_novalue(self):
         self.assertEquals(len(u.extensions), 1)
         self.assertNone(u.who)
 
+    @unittest.expectedFailure
     def test_bad_urls(self):
         failed_urls = []
         for bad in (

From fc26f82f10923bd030b3c6f427924af10ce15765 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 6 Jan 2017 15:06:24 +0000
Subject: [PATCH 304/868] we have 2017 now

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 7fa6e6a..0970e0b 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.25 2016/08/01 10:13:01 stroeder Exp $
+# $Id: conf.py,v 1.26 2017/01/06 15:06:24 stroeder Exp $
 
 import sys
 
@@ -36,7 +36,7 @@
 
 # General substitutions.
 project = 'python-ldap'
-copyright = '2008-2015, python-ldap project team'
+copyright = '2008-2017, python-ldap project team'
 
 # The default replacements for |version| and |release|, also used in various
 # other places throughout the built documents.

From bd7cdd0cd92d2cd03f308e50bd7a35a69a180330 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 6 Jan 2017 15:07:57 +0000
Subject: [PATCH 305/868] Started 2.4.29

---
 CHANGES              | 13 ++++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2be9953..5f3c725 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+----------------------------------------------------------------
+Released 2.4.29 2017-xx-xx
+
+Changes since 2.4.28:
+
+Lib/
+* 
+
+Modules/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.28 2016-11-17
 
@@ -1296,4 +1307,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.398 2016/11/18 07:01:45 stroeder Exp $
+$Id: CHANGES,v 1.399 2017/01/06 15:07:57 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 6527f86..3273bff 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.45 2016/11/11 14:41:07 stroeder Exp $
+$Id: dsml.py,v 1.46 2017/01/06 15:07:57 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.28'
+__version__ = '2.4.29'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 2ff9193..03ec9fb 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.106 2016/11/11 14:41:07 stroeder Exp $
+$Id: __init__.py,v 1.107 2017/01/06 15:07:57 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.28'
+__version__ = '2.4.29'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 179ed48..df70510 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.81 2016/11/11 14:41:07 stroeder Exp $
+\$Id: ldapurl.py,v 1.82 2017/01/06 15:07:57 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.28'
+__version__ = '2.4.29'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index a96b5a0..8ef39bd 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.101 2016/11/11 14:41:07 stroeder Exp $
+$Id: ldif.py,v 1.102 2017/01/06 15:07:57 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.28'
+__version__ = '2.4.29'
 
 __all__ = [
   # constants

From 2db5c4c5f828b1e15e050931123a9fc3f222f290 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 6 Jan 2017 15:11:14 +0000
Subject: [PATCH 306/868] Fixed checking for empty server error message

---
 CHANGES          | 5 +++--
 Modules/errors.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5f3c725..3b0bbe0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,7 +7,8 @@ Lib/
 * 
 
 Modules/
-* 
+* Fixed checking for empty server error message
+  (thanks to Bradley Baetz)
 
 ----------------------------------------------------------------
 Released 2.4.28 2016-11-17
@@ -1307,4 +1308,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.399 2017/01/06 15:07:57 stroeder Exp $
+$Id: CHANGES,v 1.400 2017/01/06 15:11:14 stroeder Exp $
diff --git a/Modules/errors.c b/Modules/errors.c
index ece438d..e3abeb5 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,7 +2,7 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.25 2015/06/23 09:45:09 stroeder Exp $ */
+ * $Id: errors.c,v 1.26 2017/01/06 15:11:14 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -98,7 +98,7 @@ LDAPerror( LDAP *l, char *msg )
         Py_XDECREF(str);
     } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0
       && error != NULL) {
-        if (error != '\0') {
+        if (*error != '\0') {
       str = PyString_FromString(error);
       if (str)
           PyDict_SetItemString( info, "info", str );

From e832b5776ab4075cbdd6e2d8df6e53b306c50403 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 25 Jan 2017 19:41:31 +0000
Subject: [PATCH 307/868] Fixed releasing GIL when calling ldap_start_tls_s()

---
 CHANGES              |  4 +++-
 Modules/LDAPObject.c | 12 +++++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/CHANGES b/CHANGES
index 3b0bbe0..d5b66df 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,8 @@ Lib/
 Modules/
 * Fixed checking for empty server error message
   (thanks to Bradley Baetz)
+* Fixed releasing GIL when calling ldap_start_tls_s()
+  (thanks to Lars Munch)
 
 ----------------------------------------------------------------
 Released 2.4.28 2016-11-17
@@ -1308,4 +1310,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.400 2017/01/06 15:11:14 stroeder Exp $
+$Id: CHANGES,v 1.401 2017/01/25 19:41:31 stroeder Exp $
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 10f166a..a0ab8c6 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.94 2016/01/26 11:01:08 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.95 2017/01/25 19:41:31 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -1213,14 +1213,16 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
 static PyObject*
 l_ldap_start_tls_s( LDAPObject* self, PyObject* args )
 {
-    int result;
+    int ldaperror;
 
     if (!PyArg_ParseTuple( args, "" )) return NULL;
     if (not_valid(self)) return NULL;
 
-    result = ldap_start_tls_s( self->ldap, NULL, NULL );
-    if ( result != LDAP_SUCCESS ){
-        ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &result);
+    LDAP_BEGIN_ALLOW_THREADS( self );
+    ldaperror = ldap_start_tls_s( self->ldap, NULL, NULL );
+    LDAP_END_ALLOW_THREADS( self );
+    if ( ldaperror != LDAP_SUCCESS ){
+        ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &ldaperror);
         return LDAPerror( self->ldap, "ldap_start_tls_s" );
     }
 

From 67e31578d3ce61eef9119df2149d6c8aa52ec679 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 25 Jan 2017 19:43:39 +0000
Subject: [PATCH 308/868] prepare release 2.4.29

---
 CHANGES | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index d5b66df..29baf03 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,11 +1,8 @@
 ----------------------------------------------------------------
-Released 2.4.29 2017-xx-xx
+Released 2.4.29 2017-01-25
 
 Changes since 2.4.28:
 
-Lib/
-* 
-
 Modules/
 * Fixed checking for empty server error message
   (thanks to Bradley Baetz)
@@ -1310,4 +1307,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.401 2017/01/25 19:41:31 stroeder Exp $
+$Id: CHANGES,v 1.402 2017/01/25 19:43:39 stroeder Exp $

From ba46652bf79d3b29f113e9bd8fc8268cc77f2f62 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 8 Feb 2017 09:44:18 +0000
Subject: [PATCH 309/868] release 2.4.30 with compability fix for pyasn1 0.2.x

---
 CHANGES                    | 11 ++++++++++-
 Lib/dsml.py                |  4 ++--
 Lib/ldap/__init__.py       |  4 ++--
 Lib/ldap/controls/deref.py |  9 ++++-----
 Lib/ldapurl.py             |  4 ++--
 Lib/ldif.py                |  4 ++--
 6 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/CHANGES b/CHANGES
index 29baf03..5bdf7d1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+----------------------------------------------------------------
+Released 2.4.30 2017-02-08
+
+Changes since 2.4.29:
+
+Lib/
+* compability fix in ldap.controls.deref to be compatible to
+  recent pyasn1 0.2.x (thanks to Ilya Etingof)
+
 ----------------------------------------------------------------
 Released 2.4.29 2017-01-25
 
@@ -1307,4 +1316,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.402 2017/01/25 19:43:39 stroeder Exp $
+$Id: CHANGES,v 1.403 2017/02/08 09:44:18 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 3273bff..c9ac2ca 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.46 2017/01/06 15:07:57 stroeder Exp $
+$Id: dsml.py,v 1.47 2017/02/08 09:44:18 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.29'
+__version__ = '2.4.30'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 03ec9fb..a0f76da 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.107 2017/01/06 15:07:57 stroeder Exp $
+$Id: __init__.py,v 1.108 2017/02/08 09:44:18 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.29'
+__version__ = '2.4.30'
 
 import sys
 
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index 02c68b7..504647e 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -5,7 +5,7 @@
 
 See http://www.python-ldap.org/ for project details.
 
-$Id: deref.py,v 1.2 2015/09/19 13:41:01 stroeder Exp $
+$Id: deref.py,v 1.3 2017/02/08 09:44:18 stroeder Exp $
 """
 
 __all__ = [
@@ -108,15 +108,14 @@ def decodeControlValue(self,encodedControlValue):
     decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=DerefResultControlValue())
     self.derefRes = {}
     for deref_res in decodedValue:
-      deref_attr,deref_val,deref_vals = deref_res
+      deref_attr,deref_val,deref_vals = deref_res[0],deref_res[1],deref_res[2]
       partial_attrs_dict = dict([
-        (str(t),map(str,v))
-        for t,v in deref_vals or []
+        (str(tv[0]),map(str,tv[1]))
+        for tv in deref_vals or []
       ])
       try:
         self.derefRes[str(deref_attr)].append((str(deref_val),partial_attrs_dict))
       except KeyError:
         self.derefRes[str(deref_attr)] = [(str(deref_val),partial_attrs_dict)]
 
-
 KNOWN_RESPONSE_CONTROLS[DereferenceControl.controlType] = DereferenceControl
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index df70510..d5ed4cf 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.82 2017/01/06 15:07:57 stroeder Exp $
+\$Id: ldapurl.py,v 1.83 2017/02/08 09:44:18 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.29'
+__version__ = '2.4.30'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 8ef39bd..621ad79 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.102 2017/01/06 15:07:57 stroeder Exp $
+$Id: ldif.py,v 1.103 2017/02/08 09:44:18 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.29'
+__version__ = '2.4.30'
 
 __all__ = [
   # constants

From 8e184352c8086fd6609a36747d2c9ba4b5e1a749 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 11:07:35 +0000
Subject: [PATCH 310/868] Lib/ldap/schema/test_tokenizer.py is now
 Tests/t_ldap_schema_tokenizer.py based on module unittest

---
 Tests/Lib/ldap/schema/test_tokenizer.py | 30 ---------------------
 Tests/t_ldap_schema_tokenizer.py        | 36 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 30 deletions(-)
 delete mode 100644 Tests/Lib/ldap/schema/test_tokenizer.py
 create mode 100644 Tests/t_ldap_schema_tokenizer.py

diff --git a/Tests/Lib/ldap/schema/test_tokenizer.py b/Tests/Lib/ldap/schema/test_tokenizer.py
deleted file mode 100644
index 8f66f8a..0000000
--- a/Tests/Lib/ldap/schema/test_tokenizer.py
+++ /dev/null
@@ -1,30 +0,0 @@
-import ldap.schema
-from ldap.schema.tokenizer import split_tokens,extract_tokens
-
-testcases_split_tokens = (
-  (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
-  ("BLUBBER DI BLUBB",["BLUBBER","DI","BLUBB"]),
-  ("BLUBBER  DI   BLUBB  ",["BLUBBER","DI","BLUBB"]),
-  ("BLUBBER  DI  'BLUBB'   ",["BLUBBER","DI","BLUBB"]),
-  ("BLUBBER ( DI ) 'BLUBB'   ",["BLUBBER","(","DI",")","BLUBB"]),
-  ("BLUBBER(DI)",["BLUBBER","(","DI",")"]),
-  ("BLUBBER ( DI)",["BLUBBER","(","DI",")"]),
-  ("BLUBBER ''",["BLUBBER",""]),
-  ("( BLUBBER (DI 'BLUBB'))",["(","BLUBBER","(","DI","BLUBB",")",")"]),
-  ("BLUBB (DA$BLAH)",['BLUBB',"(","DA","BLAH",")"]),
-  ("BLUBB ( DA $  BLAH )",['BLUBB',"(","DA","BLAH",")"]),
-  ("BLUBB (DA$ BLAH)",['BLUBB',"(","DA","BLAH",")"]),
-  ("BLUBB (DA $BLAH)",['BLUBB',"(","DA","BLAH",")"]),
-  ("BLUBB 'DA$BLAH'",['BLUBB',"DA$BLAH"]),
-  ("BLUBB DI 'BLU B B ER' DA 'BLAH' ",['BLUBB','DI','BLU B B ER','DA','BLAH']),
-  ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER",['BLUBB','DI','BLU B B ER','DA','BLAH','LABER']),
-  ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]), # for Oracle
-  ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ",['BLUBB','DI','BLU B B ER','MUST','BLAH']) # for Oracle
-)
-
-for t,r in testcases_split_tokens:
-  l = ldap.schema.tokenizer.split_tokens(t,{'MUST':None})
-  if l!=r:
-    print 'String:',repr(t)
-    print '=>',l
-    print 'differs from',r
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
new file mode 100644
index 0000000..c77b20d
--- /dev/null
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -0,0 +1,36 @@
+import unittest
+
+import ldap.schema
+from ldap.schema.tokenizer import split_tokens,extract_tokens
+
+class TestTokenize(unittest.TestCase):
+    testcases_split_tokens = (
+        (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
+        ("BLUBBER DI BLUBB",["BLUBBER","DI","BLUBB"]),
+        ("BLUBBER  DI   BLUBB  ",["BLUBBER","DI","BLUBB"]),
+        ("BLUBBER  DI  'BLUBB'   ",["BLUBBER","DI","BLUBB"]),
+        ("BLUBBER ( DI ) 'BLUBB'   ",["BLUBBER","(","DI",")","BLUBB"]),
+        ("BLUBBER(DI)",["BLUBBER","(","DI",")"]),
+        ("BLUBBER ( DI)",["BLUBBER","(","DI",")"]),
+        ("BLUBBER ''",["BLUBBER",""]),
+        ("( BLUBBER (DI 'BLUBB'))",["(","BLUBBER","(","DI","BLUBB",")",")"]),
+        ("BLUBB (DA$BLAH)",['BLUBB',"(","DA","BLAH",")"]),
+        ("BLUBB ( DA $  BLAH )",['BLUBB',"(","DA","BLAH",")"]),
+        ("BLUBB (DA$ BLAH)",['BLUBB',"(","DA","BLAH",")"]),
+        ("BLUBB (DA $BLAH)",['BLUBB',"(","DA","BLAH",")"]),
+        ("BLUBB 'DA$BLAH'",['BLUBB',"DA$BLAH"]),
+        ("BLUBB DI 'BLU B B ER' DA 'BLAH' ",['BLUBB','DI','BLU B B ER','DA','BLAH']),
+        ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER",['BLUBB','DI','BLU B B ER','DA','BLAH','LABER']),
+
+        #("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]), # for Oracle
+        #("BLUBB DI 'BLU B B ER'MUST 'BLAH' ",['BLUBB','DI','BLU B B ER','MUST','BLAH']) # for Oracle
+    )
+
+    def test_split_tokens(self):
+        for t, r in self.testcases_split_tokens:
+            l = ldap.schema.tokenizer.split_tokens(t, {'MUST':None})
+            self.assertEqual(l, r)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 60ae0ef3e3e0da146fdd4cd6a786afc99251f95d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 11:12:03 +0000
Subject: [PATCH 311/868] Tests/Lib/ldap/test_modlist.py is now
 Tests/t_ldap_modlist.py based on module unittest

---
 Tests/Lib/ldap/test_modlist.py | 137 ------------------------------
 Tests/t_ldap_modlist.py        | 151 +++++++++++++++++++++++++++++++++
 2 files changed, 151 insertions(+), 137 deletions(-)
 delete mode 100644 Tests/Lib/ldap/test_modlist.py
 create mode 100644 Tests/t_ldap_modlist.py

diff --git a/Tests/Lib/ldap/test_modlist.py b/Tests/Lib/ldap/test_modlist.py
deleted file mode 100644
index fef0f65..0000000
--- a/Tests/Lib/ldap/test_modlist.py
+++ /dev/null
@@ -1,137 +0,0 @@
-"""
-Tests for module ldap.modlist
-"""
-
-import ldap
-
-from ldap.modlist import addModlist,modifyModlist
-  
-print '\nTesting function addModlist():'
-addModlist_tests = [
-  (
-    {
-      'objectClass':['person','pilotPerson'],
-      'cn':['Michael Str\303\266der','Michael Stroeder'],
-      'sn':['Str\303\266der'],
-      'dummy1':[],
-      'dummy2':['2'],
-      'dummy3':[''],
-    },
-    [
-      ('objectClass',['person','pilotPerson']),
-      ('cn',['Michael Str\303\266der','Michael Stroeder']),
-      ('sn',['Str\303\266der']),
-      ('dummy2',['2']),
-      ('dummy3',['']),
-    ]
-  ),
-]
-for entry,test_modlist in addModlist_tests:
-  test_modlist.sort()
-  result_modlist = addModlist(entry)
-  result_modlist.sort()
-  if test_modlist!=result_modlist:
-    print 'addModlist(%s) returns\n%s\ninstead of\n%s.' % (
-      repr(entry),repr(result_modlist),repr(test_modlist)
-    )
-
-print '\nTesting function modifyModlist():'
-modifyModlist_tests = [
-
-  (
-    {
-      'objectClass':['person','pilotPerson'],
-      'cn':['Michael Str\303\266der','Michael Stroeder'],
-      'sn':['Str\303\266der'],
-      'enum':['a','b','c'],
-      'c':['DE'],
-    },
-    {
-      'objectClass':['person','inetOrgPerson'],
-      'cn':['Michael Str\303\266der','Michael Stroeder'],
-      'sn':[],
-      'enum':['a','b','d'],
-      'mail':['michael@stroeder.com'],
-    },
-    [],
-    [
-      (ldap.MOD_DELETE,'objectClass',None),
-      (ldap.MOD_ADD,'objectClass',['person','inetOrgPerson']),
-      (ldap.MOD_DELETE,'c',None),
-      (ldap.MOD_DELETE,'sn',None),
-      (ldap.MOD_ADD,'mail',['michael@stroeder.com']),
-      (ldap.MOD_DELETE,'enum',None),
-      (ldap.MOD_ADD,'enum',['a','b','d']),
-    ]
-  ),
-
-  (
-    {
-      'c':['DE'],
-    },
-    {
-      'c':['FR'],
-    },
-    [],
-    [
-      (ldap.MOD_DELETE,'c',None),
-      (ldap.MOD_ADD,'c',['FR']),
-    ]
-  ),
-
-  # Now a weird test-case for catching all possibilities
-  # of removing an attribute with MOD_DELETE,attr_type,None
-  (
-    {
-      'objectClass':['person'],
-      'cn':[None],
-      'sn':[''],
-      'c':['DE'],
-    },
-    {
-      'objectClass':[],
-      'cn':[],
-      'sn':[None],
-    },
-    [],
-    [
-      (ldap.MOD_DELETE,'c',None),
-      (ldap.MOD_DELETE,'objectClass',None),
-      (ldap.MOD_DELETE,'sn',None),
-    ]
-  ),
-
-  (
-    {
-      'objectClass':['person'],
-      'cn':['Michael Str\303\266der','Michael Stroeder'],
-      'sn':['Str\303\266der'],
-      'enum':['a','b','C'],
-    },
-    {
-      'objectClass':['Person'],
-      'cn':['Michael Str\303\266der','Michael Stroeder'],
-      'sn':[],
-      'enum':['a','b','c'],
-    },
-    ['objectClass'],
-    [
-      (ldap.MOD_DELETE,'sn',None),
-      (ldap.MOD_DELETE,'enum',None),
-      (ldap.MOD_ADD,'enum',['a','b','c']),
-    ]
-  ),
-
-]
-for old_entry,new_entry,case_ignore_attr_types,test_modlist in modifyModlist_tests:
-  test_modlist.sort()
-  result_modlist = modifyModlist(old_entry,new_entry,case_ignore_attr_types=case_ignore_attr_types)
-  result_modlist.sort()
-
-  if test_modlist!=result_modlist:
-    print 'modifyModlist(%s,%s) returns\n%s\ninstead of\n%s.' % (
-      repr(old_entry),
-      repr(new_entry),
-      repr(result_modlist),
-      repr(test_modlist)
-    )
diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
new file mode 100644
index 0000000..3d24a70
--- /dev/null
+++ b/Tests/t_ldap_modlist.py
@@ -0,0 +1,151 @@
+"""
+Tests for module ldap.modlist
+"""
+import unittest
+
+import ldap
+
+from ldap.modlist import addModlist,modifyModlist
+
+class TestModlist(unittest.TestCase):
+
+    addModlist_tests = [
+        (
+            {
+                'objectClass':['person','pilotPerson'],
+                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'sn':['Str\303\266der'],
+                'dummy1':[],
+                'dummy2':['2'],
+                'dummy3':[''],
+            },
+            [
+                ('objectClass',['person','pilotPerson']),
+                ('cn',['Michael Str\303\266der','Michael Stroeder']),
+                ('sn',['Str\303\266der']),
+                ('dummy2',['2']),
+                ('dummy3',['']),
+            ]
+        ),
+    ]
+
+    def test_addModlist(self):
+        for entry,test_modlist in self.addModlist_tests:
+            test_modlist.sort()
+            result_modlist = addModlist(entry)
+            result_modlist.sort()
+            self.assertEqual(
+                test_modlist, result_modlist,
+                'addModlist(%s) returns\n%s\ninstead of\n%s.' % (
+                    repr(entry),repr(result_modlist),repr(test_modlist)
+                )
+            )
+
+    modifyModlist_tests = [
+        (
+            {
+                'objectClass':['person','pilotPerson'],
+                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'sn':['Str\303\266der'],
+                'enum':['a','b','c'],
+                'c':['DE'],
+            },
+            {
+                'objectClass':['person','inetOrgPerson'],
+                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'sn':[],
+                'enum':['a','b','d'],
+                'mail':['michael@stroeder.com'],
+            },
+            [],
+            [
+                (ldap.MOD_DELETE,'objectClass',None),
+                (ldap.MOD_ADD,'objectClass',['person','inetOrgPerson']),
+                (ldap.MOD_DELETE,'c',None),
+                (ldap.MOD_DELETE,'sn',None),
+                (ldap.MOD_ADD,'mail',['michael@stroeder.com']),
+                (ldap.MOD_DELETE,'enum',None),
+                (ldap.MOD_ADD,'enum',['a','b','d']),
+            ]
+        ),
+
+        (
+            {
+                'c':['DE'],
+            },
+            {
+                'c':['FR'],
+            },
+            [],
+            [
+                (ldap.MOD_DELETE,'c',None),
+                (ldap.MOD_ADD,'c',['FR']),
+            ]
+        ),
+
+        # Now a weird test-case for catching all possibilities
+        # of removing an attribute with MOD_DELETE,attr_type,None
+        (
+            {
+                'objectClass':['person'],
+                'cn':[None],
+                'sn':[''],
+                'c':['DE'],
+            },
+            {
+                'objectClass':[],
+                'cn':[],
+                'sn':[None],
+            },
+            [],
+            [
+                (ldap.MOD_DELETE,'c',None),
+                (ldap.MOD_DELETE,'objectClass',None),
+                (ldap.MOD_DELETE,'sn',None),
+            ]
+        ),
+
+        (
+            {
+                'objectClass':['person'],
+                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'sn':['Str\303\266der'],
+                'enum':['a','b','C'],
+            },
+            {
+                'objectClass':['Person'],
+                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'sn':[],
+                'enum':['a','b','c'],
+            },
+            ['objectClass'],
+            [
+                (ldap.MOD_DELETE,'sn',None),
+                (ldap.MOD_DELETE,'enum',None),
+                (ldap.MOD_ADD,'enum',['a','b','c']),
+            ]
+        ),
+
+    ]
+
+    def test_modifyModlist(self):
+        for old_entry, new_entry, case_ignore_attr_types, test_modlist in self.modifyModlist_tests:
+            test_modlist.sort()
+            result_modlist = modifyModlist(
+                old_entry, new_entry,
+                case_ignore_attr_types=case_ignore_attr_types)
+            result_modlist.sort()
+
+            self.assertEqual(
+                test_modlist, result_modlist,
+                'modifyModlist(%s,%s) returns\n%s\ninstead of\n%s.' % (
+                    repr(old_entry),
+                    repr(new_entry),
+                    repr(result_modlist),
+                    repr(test_modlist),
+                )
+            )
+
+
+if __name__ == '__main__':
+    unittest.main()

From be189542e103012a139ce8bccf030f73079cc973 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 13:25:18 +0000
Subject: [PATCH 312/868] added test class TestIsLDAPUrl for
 ldapurl.isLDAPUrl()

---
 Tests/t_ldapurl.py | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 96af4f9..f854bf5 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -14,6 +14,41 @@ class MyLDAPUrl(LDAPUrl):
     }
 
 
+class TestIsLDAPUrl(unittest.TestCase):
+
+    is_ldap_url_tests = {
+        # Examples from RFC2255
+        'ldap:///o=University%20of%20Michigan,c=US':1,
+        'ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,c=US':1,
+        'ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,':1,
+        'ldap://host.com:6666/o=University%20of%20Michigan,':1,
+        'ldap://ldap.itd.umich.edu/c=GB?objectClass?one':1,
+        'ldap://ldap.question.com/o=Question%3f,c=US?mail':1,
+        'ldap://ldap.netscape.com/o=Babsco,c=US??(int=%5c00%5c00%5c00%5c04)':1,
+        'ldap:///??sub??bindname=cn=Manager%2co=Foo':1,
+        'ldap:///??sub??!bindname=cn=Manager%2co=Foo':1,
+        # More examples from various sources
+        'ldap://ldap.nameflow.net:1389/c%3dDE':1,
+        'ldap://root.openldap.org/dc=openldap,dc=org':1,
+        'ldap://root.openldap.org/dc=openldap,dc=org':1,
+        'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61':1,
+        'ldp://root.openldap.org/dc=openldap,dc=org':0,
+        'ldap://localhost:1389/ou%3DUnstructured%20testing%20tree%2Cdc%3Dstroeder%2Cdc%3Dcom??one':1,
+        'ldaps://ldap.example.com/c%3dDE':1,
+        'ldapi:///dc=stroeder,dc=de????x-saslmech=EXTERNAL':1,
+    }
+
+    def test_isLDAPUrl(self):
+        for ldap_url, expected in self.is_ldap_url_tests.items():
+            result = ldapurl.isLDAPUrl(ldap_url)
+            self.assertEqual(
+                result, expected,
+                'isLDAPUrl("%s") returns %d instead of %d.' % (
+                    ldap_url, result, expected,
+                )
+            )
+
+
 class TestLDAPUrl(unittest.TestCase):
 
     def assertNone(self, expr, msg=None):

From 121fc11f0b56ea9d55203e146a1be162462499ed Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 13:28:06 +0000
Subject: [PATCH 313/868] added new test class TestParseLDAPUrl

---
 Tests/t_ldapurl.py | 119 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 119 insertions(+)

diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index f854bf5..9d78f6f 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -49,6 +49,125 @@ def test_isLDAPUrl(self):
             )
 
 
+class TestParseLDAPUrl(unittest.TestCase):
+
+    parse_ldap_url_tests = [
+    (
+        'ldap://root.openldap.org/dc=openldap,dc=org',
+        LDAPUrl(
+            hostport='root.openldap.org',
+            dn='dc=openldap,dc=org'
+        )
+    ),
+    (
+        'ldap://root.openldap.org/dc%3dboolean%2cdc%3dnet???%28objectClass%3d%2a%29',
+        LDAPUrl(
+            hostport='root.openldap.org',
+            dn='dc=boolean,dc=net',
+            filterstr='(objectClass=*)'
+        )
+    ),
+    (
+        'ldap://root.openldap.org/dc=openldap,dc=org??sub?',
+        LDAPUrl(
+            hostport='root.openldap.org',
+            dn='dc=openldap,dc=org',
+            scope=ldapurl.LDAP_SCOPE_SUBTREE
+        )
+    ),
+    (
+        'ldap://root.openldap.org/dc=openldap,dc=org??one?',
+        LDAPUrl(
+            hostport='root.openldap.org',
+            dn='dc=openldap,dc=org',
+            scope=ldapurl.LDAP_SCOPE_ONELEVEL
+        )
+    ),
+    (
+        'ldap://root.openldap.org/dc=openldap,dc=org??base?',
+        LDAPUrl(
+            hostport='root.openldap.org',
+            dn='dc=openldap,dc=org',
+            scope=ldapurl.LDAP_SCOPE_BASE
+        )
+    ),
+    (
+        'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61',
+        LDAPUrl(
+            hostport='x500.mh.se',
+            dn='o=Mitthogskolan,c=se',
+            extensions=ldapurl.LDAPUrlExtensions({
+                '1.2.752.58.10.2':ldapurl.LDAPUrlExtension(
+                critical=0,extype='1.2.752.58.10.2',exvalue='T.61'
+                )
+            })
+        )
+    ),
+    (
+        'ldap://localhost:12345/dc=stroeder,dc=com????!bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,!X-BINDPW=secretpassword',
+        LDAPUrl(
+            hostport='localhost:12345',
+            dn='dc=stroeder,dc=com',
+            extensions=ldapurl.LDAPUrlExtensions({
+                'bindname':ldapurl.LDAPUrlExtension(
+                critical=1,extype='bindname',exvalue='cn=Michael,dc=stroeder,dc=com'
+                ),
+                'X-BINDPW':ldapurl.LDAPUrlExtension(
+                critical=1,extype='X-BINDPW',exvalue='secretpassword'
+                ),
+            }),
+        )
+    ),
+    (
+        'ldap://localhost:54321/dc=stroeder,dc=com????bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,X-BINDPW=secretpassword',
+        LDAPUrl(
+            hostport='localhost:54321',
+            dn='dc=stroeder,dc=com',
+            who='cn=Michael,dc=stroeder,dc=com',
+            cred='secretpassword'
+        )
+    ),
+    (
+        'ldaps://localhost:12345/dc=stroeder,dc=com',
+        LDAPUrl(
+            urlscheme='ldaps',
+            hostport='localhost:12345',
+            dn='dc=stroeder,dc=com',
+        ),
+    ),
+    (
+        'ldapi://%2ftmp%2fopenldap2-1389/dc=stroeder,dc=com',
+        LDAPUrl(
+            urlscheme='ldapi',
+            hostport='/tmp/openldap2-1389',
+            dn='dc=stroeder,dc=com',
+        ),
+    ),
+    ]
+
+    def test_ldapurl(self):
+        for ldap_url_str,test_ldap_url_obj in self.parse_ldap_url_tests:
+            ldap_url_obj = LDAPUrl(ldapUrl=ldap_url_str)
+            self.assertEqual(
+                ldap_url_obj, test_ldap_url_obj,
+                'Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
+                    repr(ldap_url_str),
+                    repr(ldap_url_obj),
+                    repr(test_ldap_url_obj),
+                )
+            )
+            unparsed_ldap_url_str = test_ldap_url_obj.unparse()
+            unparsed_ldap_url_obj = LDAPUrl(ldapUrl=unparsed_ldap_url_str)
+            self.assertEqual(
+                unparsed_ldap_url_obj, test_ldap_url_obj,
+                'Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
+                    repr(unparsed_ldap_url_str),
+                    repr(unparsed_ldap_url_obj),
+                    repr(test_ldap_url_obj),
+                )
+            )
+
+
 class TestLDAPUrl(unittest.TestCase):
 
     def assertNone(self, expr, msg=None):

From 39f980356387bd3b114b731bf0620db2dcfbbaa7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 13:36:20 +0000
Subject: [PATCH 314/868] started 2.4.3.1

---
 CHANGES | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 5bdf7d1..682452d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+----------------------------------------------------------------
+Released 2.4.31 2017-02-xx
+
+Changes since 2.4.30:
+
 ----------------------------------------------------------------
 Released 2.4.30 2017-02-08
 
@@ -1316,4 +1321,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.403 2017/02/08 09:44:18 stroeder Exp $
+$Id: CHANGES,v 1.404 2017/02/14 13:36:20 stroeder Exp $

From 47eb5461a924f3c629e7d6186c702abf19d1d6e0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 13:36:33 +0000
Subject: [PATCH 315/868] started 2.4.31

---
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/dsml.py b/Lib/dsml.py
index c9ac2ca..a92d6f6 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.47 2017/02/08 09:44:18 stroeder Exp $
+$Id: dsml.py,v 1.48 2017/02/14 13:36:33 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.30'
+__version__ = '2.4.31'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index a0f76da..b57c5d4 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.108 2017/02/08 09:44:18 stroeder Exp $
+$Id: __init__.py,v 1.109 2017/02/14 13:36:34 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.30'
+__version__ = '2.4.31'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index d5ed4cf..43c1f25 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.83 2017/02/08 09:44:18 stroeder Exp $
+\$Id: ldapurl.py,v 1.84 2017/02/14 13:36:34 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.30'
+__version__ = '2.4.31'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 621ad79..deede81 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.103 2017/02/08 09:44:18 stroeder Exp $
+$Id: ldif.py,v 1.104 2017/02/14 13:36:34 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.30'
+__version__ = '2.4.31'
 
 __all__ = [
   # constants

From 0d9faae31a3aaa37ff46501b9e2b4e07498b912f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 13:37:51 +0000
Subject: [PATCH 316/868] new/updates scripts Tests/t_*.py

---
 CHANGES | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 682452d..e4a3857 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,12 @@ Released 2.4.31 2017-02-xx
 
 Changes since 2.4.30:
 
+Tests/
+(thanks to Petr Viktorin)
+* new test scripts t_ldap_schema_tokenizer.py and t_ldap_modlist.py
+  on former raw scripts
+* new test-cases in t_ldapurl.py based on former raw scripts
+
 ----------------------------------------------------------------
 Released 2.4.30 2017-02-08
 
@@ -1321,4 +1327,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.404 2017/02/14 13:36:20 stroeder Exp $
+$Id: CHANGES,v 1.405 2017/02/14 13:37:51 stroeder Exp $

From bec33ba407fbfd5c2d943f7abc71bc80496fe8c4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 18:02:20 +0000
Subject: [PATCH 317/868] new test-cases in t_ldap_dn.py

---
 CHANGES            |  3 ++-
 Tests/t_ldap_dn.py | 11 ++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index e4a3857..e4a15e3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ Tests/
 * new test scripts t_ldap_schema_tokenizer.py and t_ldap_modlist.py
   on former raw scripts
 * new test-cases in t_ldapurl.py based on former raw scripts
+* new test-cases in t_ldap_dn.py
 
 ----------------------------------------------------------------
 Released 2.4.30 2017-02-08
@@ -1327,4 +1328,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.405 2017/02/14 13:37:51 stroeder Exp $
+$Id: CHANGES,v 1.406 2017/02/14 18:02:20 stroeder Exp $
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 2183d3a..ee47e07 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -20,8 +20,17 @@ def test_is_dn(self):
         test function is_dn()
         """
         self.assertEquals(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
+        self.assertEquals(ldap.dn.is_dn('-cn=foobar,ou=ae-dir'), False)
+        self.assertEquals(ldap.dn.is_dn(';cn=foobar,ou=ae-dir'), False)
+        self.assertEquals(ldap.dn.is_dn(',cn=foobar,ou=ae-dir'), False)
+        self.assertEquals(ldap.dn.is_dn('cn=foobar,ou=ae-dir,'), False)
         self.assertEquals(ldap.dn.is_dn('uid=xkcd,cn=foobar,ou=ae-dir'), True)
-
+        self.assertEquals(
+            ldap.dn.is_dn(
+                'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c.o=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f'
+            ),
+            True
+        )
 
 if __name__ == '__main__':
     unittest.main()

From 2c09762faaf596b4a041dc7b4cf7a939e2829393 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 18:04:07 +0000
Subject: [PATCH 318/868] Tests must match glob pattern t_*.py

---
 Tests/runtests.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Tests/runtests.sh b/Tests/runtests.sh
index f857025..7230c6e 100755
--- a/Tests/runtests.sh
+++ b/Tests/runtests.sh
@@ -11,7 +11,8 @@ set -e
 plat_specifier=`$PYTHON -c 'import sys,distutils.util; \
         print(distutils.util.get_platform()+"-"+sys.version[0:3])'`
 failed=
-for test in t_*.py;  do
+for test in t_*.py
+do
     echo "$test:"
     PYTHONPATH="../build/lib.$plat_specifier" $PYTHON "$test" "$@" || 
         failed="$failed $test"

From 1e7a1ea3c1d6f1dd48c3e9381d5ee2c6f48a2b42 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 19:00:47 +0000
Subject: [PATCH 319/868] tests were merged into Tests/t_ldapurl.py

---
 Tests/Lib/test_ldapurl.py | 154 --------------------------------------
 1 file changed, 154 deletions(-)
 delete mode 100644 Tests/Lib/test_ldapurl.py

diff --git a/Tests/Lib/test_ldapurl.py b/Tests/Lib/test_ldapurl.py
deleted file mode 100644
index 0016683..0000000
--- a/Tests/Lib/test_ldapurl.py
+++ /dev/null
@@ -1,154 +0,0 @@
-"""
-Performes various tests for module ldapurl
-"""
-
-import ldapurl
-from ldapurl import *
-
-print '\nTesting function isLDAPUrl():'
-is_ldap_url_tests = {
-  # Examples from RFC2255
-  'ldap:///o=University%20of%20Michigan,c=US':1,
-  'ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,c=US':1,
-  'ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,':1,
-  'ldap://host.com:6666/o=University%20of%20Michigan,':1,
-  'ldap://ldap.itd.umich.edu/c=GB?objectClass?one':1,
-  'ldap://ldap.question.com/o=Question%3f,c=US?mail':1,
-  'ldap://ldap.netscape.com/o=Babsco,c=US??(int=%5c00%5c00%5c00%5c04)':1,
-  'ldap:///??sub??bindname=cn=Manager%2co=Foo':1,
-  'ldap:///??sub??!bindname=cn=Manager%2co=Foo':1,
-  # More examples from various sources
-  'ldap://ldap.nameflow.net:1389/c%3dDE':1,
-  'ldap://root.openldap.org/dc=openldap,dc=org':1,
-  'ldap://root.openldap.org/dc=openldap,dc=org':1,
-  'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61':1,
-  'ldp://root.openldap.org/dc=openldap,dc=org':0,
-  'ldap://localhost:1389/ou%3DUnstructured%20testing%20tree%2Cdc%3Dstroeder%2Cdc%3Dcom??one':1,
-}
-for ldap_url in is_ldap_url_tests.keys():
-  result_is_ldap_url = isLDAPUrl(ldap_url)
-  if result_is_ldap_url !=is_ldap_url_tests[ldap_url]:
-    print 'isLDAPUrl("%s") returns %d instead of %d.' % (
-      repr(ldap_url),result_is_ldap_url,is_ldap_url_tests[ldap_url]
-    )
-
-print '\nTesting class LDAPUrl:'
-parse_ldap_url_tests = [
-  (
-    'ldap://root.openldap.org/dc=openldap,dc=org',
-    LDAPUrl(
-      hostport='root.openldap.org',
-      dn='dc=openldap,dc=org'
-    )
-  ),
-  (
-    'ldap://root.openldap.org/dc%3dboolean%2cdc%3dnet???%28objectClass%3d%2a%29',
-    LDAPUrl(
-      hostport='root.openldap.org',
-      dn='dc=boolean,dc=net',
-      filterstr='(objectClass=*)'
-    )
-  ),
-  (
-    'ldap://root.openldap.org/dc=openldap,dc=org??sub?',
-    LDAPUrl(
-      hostport='root.openldap.org',
-      dn='dc=openldap,dc=org',
-      scope=ldapurl.LDAP_SCOPE_SUBTREE
-    )
-  ),
-  (
-    'ldap://root.openldap.org/dc=openldap,dc=org??one?',
-    LDAPUrl(
-      hostport='root.openldap.org',
-      dn='dc=openldap,dc=org',
-      scope=ldapurl.LDAP_SCOPE_ONELEVEL
-    )
-  ),
-  (
-    'ldap://root.openldap.org/dc=openldap,dc=org??base?',
-    LDAPUrl(
-      hostport='root.openldap.org',
-      dn='dc=openldap,dc=org',
-      scope=ldapurl.LDAP_SCOPE_BASE
-    )
-  ),
-  (
-    'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61',
-    LDAPUrl(
-      hostport='x500.mh.se',
-      dn='o=Mitthogskolan,c=se',
-      extensions=LDAPUrlExtensions({
-        '1.2.752.58.10.2':ldapurl.LDAPUrlExtension(
-          critical=0,extype='1.2.752.58.10.2',exvalue='T.61'
-        )
-      })
-    )
-  ),
-  (
-    'ldap://localhost:12345/dc=stroeder,dc=com????!bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,!X-BINDPW=secretpassword',
-    LDAPUrl(
-      hostport='localhost:12345',
-      dn='dc=stroeder,dc=com',
-      extensions=LDAPUrlExtensions({
-        'bindname':LDAPUrlExtension(
-          critical=1,extype='bindname',exvalue='cn=Michael,dc=stroeder,dc=com'
-        ),
-        'X-BINDPW':LDAPUrlExtension(
-          critical=1,extype='X-BINDPW',exvalue='secretpassword'
-        ),
-      }),
-    )
-  ),
-  (
-    'ldap://localhost:54321/dc=stroeder,dc=com????bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,X-BINDPW=secretpassword',
-    LDAPUrl(
-      hostport='localhost:54321',
-      dn='dc=stroeder,dc=com',
-      who='cn=Michael,dc=stroeder,dc=com',
-      cred='secretpassword'
-    )
-  ),
-  (
-    'ldaps://localhost:12345/dc=stroeder,dc=com',
-    LDAPUrl(
-      urlscheme='ldaps',
-      hostport='localhost:12345',
-      dn='dc=stroeder,dc=com',
-    ),
-  ),
-  (
-    'ldapi://%2ftmp%2fopenldap2-1389/dc=stroeder,dc=com',
-    LDAPUrl(
-      urlscheme='ldapi',
-      hostport='/tmp/openldap2-1389',
-      dn='dc=stroeder,dc=com',
-    ),
-  ),
-]
-
-for ldap_url_str,test_ldap_url_obj in parse_ldap_url_tests:
-#  print '\nTesting LDAP URL:',repr(ldap_url)
-  ldap_url_obj = LDAPUrl(ldapUrl=ldap_url_str)
-  print '#'*72
-  print test_ldap_url_obj.unparse()
-  if ldap_url_obj.__ne__(test_ldap_url_obj):
-    print '-'*72
-    print 'Parsing error! Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
-      repr(ldap_url_str),
-      repr(ldap_url_obj),
-      repr(test_ldap_url_obj)
-    )
-  else:
-    print 'Parsing ok'
-    unparsed_ldap_url_str = test_ldap_url_obj.unparse()
-    unparsed_ldap_url_obj = LDAPUrl(ldapUrl=unparsed_ldap_url_str)
-    if unparsed_ldap_url_obj.__ne__(test_ldap_url_obj):
-      print '-'*72
-      print 'Unparsing error! Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
-        repr(unparsed_ldap_url_str),
-        repr(unparsed_ldap_url_obj),
-        repr(test_ldap_url_obj)
-      )
-    else:
-      print 'Unparsing ok'

From 1e6082c51187aa6ec6012f4e73c96efb96eacca1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 19:02:50 +0000
Subject: [PATCH 320/868] Tests/search.py moved to Demo/ldapurl_search.py
 because it

---
 Tests/search.py => Demo/ldapurl_search.py | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename Tests/search.py => Demo/ldapurl_search.py (100%)

diff --git a/Tests/search.py b/Demo/ldapurl_search.py
similarity index 100%
rename from Tests/search.py
rename to Demo/ldapurl_search.py

From 5c1b95859fde4b78d2d2287cdfcb897bde8367e8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 19:07:15 +0000
Subject: [PATCH 321/868] consistent white-spaces

---
 setup.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/setup.py b/setup.py
index d738632..0088b8f 100644
--- a/setup.py
+++ b/setup.py
@@ -3,15 +3,15 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.76 2016/08/13 09:44:08 stroeder Exp $
+$Id: setup.py,v 1.77 2017/02/14 19:07:15 stroeder Exp $
 """
 
 has_setuptools = False
 try:
-        from setuptools import setup, Extension
-        has_setuptools = True
+  from setuptools import setup, Extension
+  has_setuptools = True
 except ImportError:
-        from distutils.core import setup, Extension
+  from distutils.core import setup, Extension
 
 from ConfigParser import ConfigParser
 import sys,os,string,time

From 4334b470921e1d246784032483948f316ef30d09 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 19:30:03 +0000
Subject: [PATCH 322/868] prepare release 2.4.31

---
 CHANGES | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index e4a15e3..34de108 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,14 +1,15 @@
 ----------------------------------------------------------------
-Released 2.4.31 2017-02-xx
+Released 2.4.31 2017-02-14
 
 Changes since 2.4.30:
 
 Tests/
-(thanks to Petr Viktorin)
 * new test scripts t_ldap_schema_tokenizer.py and t_ldap_modlist.py
-  on former raw scripts
+  on former raw scripts (thanks to Petr Viktorin)
 * new test-cases in t_ldapurl.py based on former raw scripts
+  (thanks to Petr Viktorin)
 * new test-cases in t_ldap_dn.py
+* moved a script to Demo/
 
 ----------------------------------------------------------------
 Released 2.4.30 2017-02-08
@@ -1328,4 +1329,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.406 2017/02/14 18:02:20 stroeder Exp $
+$Id: CHANGES,v 1.407 2017/02/14 19:30:03 stroeder Exp $

From 121b9749037d7a6c92eaea46247c3aa183453bf7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 21:36:01 +0000
Subject: [PATCH 323/868] prepare release 2.4.32

---
 CHANGES              | 5 ++++-
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 34de108..60ed0c1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+----------------------------------------------------------------
+Released 2.4.32 2017-02-14
+
 ----------------------------------------------------------------
 Released 2.4.31 2017-02-14
 
@@ -1329,4 +1332,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.407 2017/02/14 19:30:03 stroeder Exp $
+$Id: CHANGES,v 1.408 2017/02/14 21:36:01 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index a92d6f6..0129313 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.48 2017/02/14 13:36:33 stroeder Exp $
+$Id: dsml.py,v 1.49 2017/02/14 21:36:01 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.31'
+__version__ = '2.4.32'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index b57c5d4..09dfa0c 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.109 2017/02/14 13:36:34 stroeder Exp $
+$Id: __init__.py,v 1.110 2017/02/14 21:36:01 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.31'
+__version__ = '2.4.32'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 43c1f25..53171e8 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.84 2017/02/14 13:36:34 stroeder Exp $
+\$Id: ldapurl.py,v 1.85 2017/02/14 21:36:01 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.31'
+__version__ = '2.4.32'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index deede81..84b3783 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.104 2017/02/14 13:36:34 stroeder Exp $
+$Id: ldif.py,v 1.105 2017/02/14 21:36:01 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.31'
+__version__ = '2.4.32'
 
 __all__ = [
   # constants

From 960636d2c42ecb0ba725f2f4e834f13bd1ab6283 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 14 Feb 2017 21:38:13 +0000
Subject: [PATCH 324/868] running tests made easier now

---
 CHANGES           |  6 +++++-
 MANIFEST.in       |  1 +
 Tests/__init__.py | 15 +++++++++++++++
 Tests/runtests.sh | 27 ---------------------------
 Tests/t_cext.py   |  4 +++-
 setup.py          |  3 ++-
 tox.ini           | 13 +++++++++++++
 7 files changed, 39 insertions(+), 30 deletions(-)
 create mode 100644 Tests/__init__.py
 delete mode 100755 Tests/runtests.sh
 create mode 100644 tox.ini

diff --git a/CHANGES b/CHANGES
index 60ed0c1..1c5ef5c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
 ----------------------------------------------------------------
 Released 2.4.32 2017-02-14
 
+Running tests made easier:
+- python setup.py test
+- added tox.ini
+
 ----------------------------------------------------------------
 Released 2.4.31 2017-02-14
 
@@ -1332,4 +1336,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.408 2017/02/14 21:36:01 stroeder Exp $
+$Id: CHANGES,v 1.409 2017/02/14 21:38:13 stroeder Exp $
diff --git a/MANIFEST.in b/MANIFEST.in
index 7ea2fdd..459af43 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -3,4 +3,5 @@ include Modules/*.c Modules/*.h Modules/LICENSE
 recursive-include Build *.cfg*
 recursive-include Lib *.py
 recursive-include Demo *.py
+include tox.ini
 recursive-include Tests *.py
diff --git a/Tests/__init__.py b/Tests/__init__.py
new file mode 100644
index 0000000..739dd08
--- /dev/null
+++ b/Tests/__init__.py
@@ -0,0 +1,15 @@
+"""
+python-ldap tests module package
+"""
+
+import t_cext 
+import t_ldap_dn 
+import t_ldap_filter 
+import t_ldap_functions 
+import t_ldap_modlist 
+import t_ldap_schema_tokenizer 
+import t_ldapurl 
+import t_ldif 
+import t_search 
+
+import slapd
\ No newline at end of file
diff --git a/Tests/runtests.sh b/Tests/runtests.sh
deleted file mode 100755
index 7230c6e..0000000
--- a/Tests/runtests.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/sh
-#
-# This script runs all the t_*.py tests in the current directory,
-# preparing PYTHONPATH to use the most recent local build
-#
-# Run with -v option for verbose
-#
-
-set -e
-: ${PYTHON:="python"}
-plat_specifier=`$PYTHON -c 'import sys,distutils.util; \
-        print(distutils.util.get_platform()+"-"+sys.version[0:3])'`
-failed=
-for test in t_*.py
-do
-    echo "$test:"
-    PYTHONPATH="../build/lib.$plat_specifier" $PYTHON "$test" "$@" || 
-        failed="$failed $test"
-done
-
-if test -n "$failed"; then
-   echo "Tests that failed:$failed" >&2
-   exit 1
-else
-   echo "All tests passed. Yay."
-   exit 0
-fi
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index fd17ee9..159d6fb 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -1,8 +1,10 @@
 
-import unittest, slapd
+import unittest
 import _ldap
 import logging
 
+from Tests import slapd
+
 reusable_server = None
 def get_reusable_server():
     global reusable_server
diff --git a/setup.py b/setup.py
index 0088b8f..5b1241a 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.77 2017/02/14 19:07:15 stroeder Exp $
+$Id: setup.py,v 1.78 2017/02/14 21:38:13 stroeder Exp $
 """
 
 has_setuptools = False
@@ -180,5 +180,6 @@ class OpenLDAP2:
   ],
   package_dir = {'': 'Lib',},
   data_files = LDAP_CLASS.extra_files,
+  test_suite = 'Tests',
   **kwargs
 )
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000..d11ce1c
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,13 @@
+# Tox (http://tox.testrun.org/) is a tool for running tests
+# in multiple virtualenvs. This configuration file will run the
+# test suite on all supported python versions. To use it, "pip install tox"
+# and then run "tox" from this directory.
+
+[tox]
+envlist = py27
+
+[testenv]
+commands = {envpython} setup.py test
+deps =
+    pyasn1
+    pyasn1_modules

From f9dcc60c662c3914a7725b5fa276ad4fc5aff8ab Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 13:40:49 +0000
Subject: [PATCH 325/868] removed obsolete import statement

---
 Tests/t_ldap_schema_tokenizer.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index c77b20d..ddff528 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -1,7 +1,6 @@
 import unittest
 
 import ldap.schema
-from ldap.schema.tokenizer import split_tokens,extract_tokens
 
 class TestTokenize(unittest.TestCase):
     testcases_split_tokens = (

From 99604c45c730175459e6b637f9dd76f702614f3d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 14:16:11 +0000
Subject: [PATCH 326/868] refactored tests, make pylint happy

---
 Tests/t_ldap_schema_tokenizer.py | 79 +++++++++++++++++++++-----------
 1 file changed, 52 insertions(+), 27 deletions(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index ddff528..f89487c 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -1,34 +1,59 @@
+"""
+test module ldap.schema.tokenizer
+"""
+
 import unittest
 
 import ldap.schema
 
-class TestTokenize(unittest.TestCase):
-    testcases_split_tokens = (
-        (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
-        ("BLUBBER DI BLUBB",["BLUBBER","DI","BLUBB"]),
-        ("BLUBBER  DI   BLUBB  ",["BLUBBER","DI","BLUBB"]),
-        ("BLUBBER  DI  'BLUBB'   ",["BLUBBER","DI","BLUBB"]),
-        ("BLUBBER ( DI ) 'BLUBB'   ",["BLUBBER","(","DI",")","BLUBB"]),
-        ("BLUBBER(DI)",["BLUBBER","(","DI",")"]),
-        ("BLUBBER ( DI)",["BLUBBER","(","DI",")"]),
-        ("BLUBBER ''",["BLUBBER",""]),
-        ("( BLUBBER (DI 'BLUBB'))",["(","BLUBBER","(","DI","BLUBB",")",")"]),
-        ("BLUBB (DA$BLAH)",['BLUBB',"(","DA","BLAH",")"]),
-        ("BLUBB ( DA $  BLAH )",['BLUBB',"(","DA","BLAH",")"]),
-        ("BLUBB (DA$ BLAH)",['BLUBB',"(","DA","BLAH",")"]),
-        ("BLUBB (DA $BLAH)",['BLUBB',"(","DA","BLAH",")"]),
-        ("BLUBB 'DA$BLAH'",['BLUBB',"DA$BLAH"]),
-        ("BLUBB DI 'BLU B B ER' DA 'BLAH' ",['BLUBB','DI','BLU B B ER','DA','BLAH']),
-        ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER",['BLUBB','DI','BLU B B ER','DA','BLAH','LABER']),
-
-        #("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]), # for Oracle
-        #("BLUBB DI 'BLU B B ER'MUST 'BLAH' ",['BLUBB','DI','BLU B B ER','MUST','BLAH']) # for Oracle
-    )
-
-    def test_split_tokens(self):
-        for t, r in self.testcases_split_tokens:
-            l = ldap.schema.tokenizer.split_tokens(t, {'MUST':None})
-            self.assertEqual(l, r)
+# all basic test cases
+TESTCASES_BASIC = (
+    (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
+    ("BLUBBER DI BLUBB", ["BLUBBER", "DI", "BLUBB"]),
+    ("BLUBBER  DI   BLUBB  ", ["BLUBBER", "DI", "BLUBB"]),
+    ("BLUBBER  DI  'BLUBB'   ", ["BLUBBER", "DI", "BLUBB"]),
+    ("BLUBBER ( DI ) 'BLUBB'   ", ["BLUBBER", "(", "DI", ")", "BLUBB"]),
+    ("BLUBBER(DI)", ["BLUBBER", "(", "DI", ")"]),
+    ("BLUBBER ( DI)", ["BLUBBER", "(", "DI", ")"]),
+    ("BLUBBER ''", ["BLUBBER", ""]),
+    ("( BLUBBER (DI 'BLUBB'))", ["(", "BLUBBER", "(", "DI", "BLUBB", ")", ")"]),
+    ("BLUBB (DA$BLAH)", ['BLUBB', "(", "DA", "BLAH", ")"]),
+    ("BLUBB ( DA $  BLAH )", ['BLUBB', "(", "DA", "BLAH", ")"]),
+    ("BLUBB (DA$ BLAH)", ['BLUBB', "(", "DA", "BLAH", ")"]),
+    ("BLUBB (DA $BLAH)", ['BLUBB', "(", "DA", "BLAH", ")"]),
+    ("BLUBB 'DA$BLAH'", ['BLUBB', "DA$BLAH"]),
+    ("BLUBB DI 'BLU B B ER' DA 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'DA', 'BLAH']),
+    ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER", ['BLUBB', 'DI', 'BLU B B ER', 'DA', 'BLAH', 'LABER']),
+)
+# for broken schema of Oracle Internet Directory
+TESTCASES_OID = (
+    ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
+    ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH'])
+)
+
+
+class TestSplitTokens(unittest.TestCase):
+    """
+    test function ldap.schema.tokenizer.split_tokens()
+    """
+
+    def _run_split_tokens_tests(self, test_cases):
+        for test_value, test_result in test_cases:
+            token_list = ldap.schema.tokenizer.split_tokens(test_value, None)
+            self.assertEqual(token_list, test_result)
+
+    def test_basic(self):
+        """
+        run test cases specified in constant TESTCASES_BASIC
+        """
+        self._run_split_tokens_tests(TESTCASES_BASIC)
+
+    @unittest.expectedFailure
+    def test_oid(self):
+        """
+        run test cases specified in constant TESTCASES_OID
+        """
+        self._run_split_tokens_tests(TESTCASES_OID)
 
 
 if __name__ == '__main__':

From ff314a98aae67377bdbf50e10a659bddb12e8d5a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 14:32:23 +0000
Subject: [PATCH 327/868] use imported symbol ldap.schema.split_tokens()
 (without sub-module name)

---
 Tests/t_ldap_schema_tokenizer.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index f89487c..c0fe950 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -39,7 +39,7 @@ class TestSplitTokens(unittest.TestCase):
 
     def _run_split_tokens_tests(self, test_cases):
         for test_value, test_result in test_cases:
-            token_list = ldap.schema.tokenizer.split_tokens(test_value, None)
+            token_list = ldap.schema.split_tokens(test_value, None)
             self.assertEqual(token_list, test_result)
 
     def test_basic(self):

From 892833cc900e7545af8c2c698ff79fb77af23844 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 14:50:24 +0000
Subject: [PATCH 328/868] started 2.4.33

---
 CHANGES              | 5 ++++-
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1c5ef5c..463bb00 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+----------------------------------------------------------------
+Released 2.4.33 2017-02-xx
+
 ----------------------------------------------------------------
 Released 2.4.32 2017-02-14
 
@@ -1336,4 +1339,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.409 2017/02/14 21:38:13 stroeder Exp $
+$Id: CHANGES,v 1.410 2017/02/18 14:50:24 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 0129313..b8392fe 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.49 2017/02/14 21:36:01 stroeder Exp $
+$Id: dsml.py,v 1.50 2017/02/18 14:50:25 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.32'
+__version__ = '2.4.33'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 09dfa0c..0ada853 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.110 2017/02/14 21:36:01 stroeder Exp $
+$Id: __init__.py,v 1.111 2017/02/18 14:50:25 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.32'
+__version__ = '2.4.33'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 53171e8..c73b6bf 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.85 2017/02/14 21:36:01 stroeder Exp $
+\$Id: ldapurl.py,v 1.86 2017/02/18 14:50:25 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.32'
+__version__ = '2.4.33'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 84b3783..f34f52a 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.105 2017/02/14 21:36:01 stroeder Exp $
+$Id: ldif.py,v 1.106 2017/02/18 14:50:25 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.32'
+__version__ = '2.4.33'
 
 __all__ = [
   # constants

From 22528752893a090adbc8f00a48cb04e2cc97df10 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 15:32:01 +0000
Subject: [PATCH 329/868] split_tokens(): removed unused argument keywordDict

---
 Lib/ldap/schema/models.py    | 4 ++--
 Lib/ldap/schema/tokenizer.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index f7a7bd5..a4b4bab 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: models.py,v 1.48 2015/06/06 09:21:38 stroeder Exp $
+\$Id: models.py,v 1.49 2017/02/18 15:32:01 stroeder Exp $
 """
 
 import UserDict,ldap.cidict
@@ -54,7 +54,7 @@ class SchemaElement:
 
   def __init__(self,schema_element_str=None):
     if schema_element_str:
-      l = split_tokens(schema_element_str,self.token_defaults)
+      l = split_tokens(schema_element_str)
       self.set_id(l[1])
       d = extract_tokens(l,self.token_defaults)
       self._set_attrs(l,d)
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index 469c326..b03b043 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -3,11 +3,11 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: tokenizer.py,v 1.13 2009/04/29 18:13:55 stroeder Exp $
+\$Id: tokenizer.py,v 1.14 2017/02/18 15:32:01 stroeder Exp $
 """
 
 
-def split_tokens(s,keywordDict):
+def split_tokens(s):
   """
   Returns list of syntax elements with quotes and spaces
   stripped.

From e8081a84a2e398805e0c281a42372933845ffbd5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 15:32:56 +0000
Subject: [PATCH 330/868] some more re-factoring

---
 Tests/t_ldap_schema_tokenizer.py | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index c0fe950..79a12e9 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -6,7 +6,7 @@
 
 import ldap.schema
 
-# all basic test cases
+# basic test cases
 TESTCASES_BASIC = (
     (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
     ("BLUBBER DI BLUBB", ["BLUBBER", "DI", "BLUBB"]),
@@ -25,12 +25,18 @@
     ("BLUBB DI 'BLU B B ER' DA 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'DA', 'BLAH']),
     ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER", ['BLUBB', 'DI', 'BLU B B ER', 'DA', 'BLAH', 'LABER']),
 )
-# for broken schema of Oracle Internet Directory
-TESTCASES_OID = (
+
+# broken schema of Oracle Internet Directory
+TESTCASES_BROKEN_OID = (
     ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
     ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH'])
 )
 
+# for quoted single quotes inside string values
+TESTCASES_ESCAPED_QUOTES = (
+    ("BLUBBER DI 'BLU\'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
+)
+
 
 class TestSplitTokens(unittest.TestCase):
     """
@@ -39,7 +45,7 @@ class TestSplitTokens(unittest.TestCase):
 
     def _run_split_tokens_tests(self, test_cases):
         for test_value, test_result in test_cases:
-            token_list = ldap.schema.split_tokens(test_value, None)
+            token_list = ldap.schema.split_tokens(test_value)
             self.assertEqual(token_list, test_result)
 
     def test_basic(self):
@@ -49,11 +55,18 @@ def test_basic(self):
         self._run_split_tokens_tests(TESTCASES_BASIC)
 
     @unittest.expectedFailure
-    def test_oid(self):
+    def test_broken_oid(self):
+        """
+        run test cases specified in constant TESTCASES_BROKEN_OID
+        """
+        self._run_split_tokens_tests(TESTCASES_BROKEN_OID)
+
+    @unittest.expectedFailure
+    def test_escaped_quotes(self):
         """
-        run test cases specified in constant TESTCASES_OID
+        run test cases specified in constant TESTCASES_ESCAPED_QUOTES
         """
-        self._run_split_tokens_tests(TESTCASES_OID)
+        self._run_split_tokens_tests(TESTCASES_ESCAPED_QUOTES)
 
 
 if __name__ == '__main__':

From 2145b73c994b909d035e9958de17f26c8ecb73d3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 17:24:51 +0000
Subject: [PATCH 331/868] new test script t_ldap_schema_subentry.py

---
 .../ldif/subschema-ipa.demo1.freeipa.org.ldif | 6809 ++++++++++++++
 Tests/ldif/subschema-openldap-all.ldif        | 8017 +++++++++++++++++
 Tests/t_ldap_schema_subentry.py               |   32 +
 3 files changed, 14858 insertions(+)
 create mode 100644 Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif
 create mode 100644 Tests/ldif/subschema-openldap-all.ldif
 create mode 100644 Tests/t_ldap_schema_subentry.py

diff --git a/Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif b/Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif
new file mode 100644
index 0000000..a420a1a
--- /dev/null
+++ b/Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif
@@ -0,0 +1,6809 @@
+########################################################################
+# LDIF export by web2ldap 1.2.80, see http://www.web2ldap.de
+# Date and time: Saturday, 2017-02-18 17:09:08 GMT
+# Bind-DN: u'uid=admin,cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org'
+# LDAP-URL of search:
+# ldap://ipa.demo1.freeipa.org/cn%3Dschema?matchingRuleUse,ldapSyntaxes,nameForms,dITStructureRules,attributeTypes,matchingRules,dITContentRules,objectClasses,objectClass,cn?base?%28objectClass%3D%2A%29?bindname=uid%3Dadmin%2Ccn%3Dusers%2Ccn%3Daccounts%2Cdc%3Ddemo1%2Cdc%3Dfreeipa%2Cdc%3Dorg
+########################################################################
+version: 1
+
+dn: cn=schema
+attributeTypes: ( 2.16.840.1.113730.3.1.582 NAME 'nsDS5ReplicaCredentials' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who 
+ may  run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.51 NAME 'ipaAllowedToPerform' DES
+ C 'DNs allowed to perform an operation' SUP distinguishedName EQUALITY dist
+ inguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'IPA v4.
+ 0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2274 NAME 'nsslapd-instancedir' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.24.1 NAME 'krbHostServer'  EQUAL
+ ITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.18.0.2.4.1139 NAME 'printer-info' DESC 'Descriptive in
+ formation about this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'r
+ fc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.4 NAME 'ipatokenNotAfter' DESC 
+ 'Token expiration date' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.24 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.532 NAME 'ntUserCountryCode' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 0.9.2342.19200300.100.1.26 NAME 'aRecord'  EQUALITY caseIg
+ noreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'LDAP referrals a
+ ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'LDAPv3 referr
+ als Internet Draft' )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.4 NAME ( 'nsAIMid' 'nscpaimscreenname'
+  )  EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.50 X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.52 NAME 'ipk11Verify' DESC 'Key
+  supports verification where the signature is an appendix to the data' EQUA
+ LITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN
+  ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.204 NAME 'replicaNickName' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Directory Server' )
+attributeTypes: ( sslVersionMin-oid NAME 'sslVersionMin' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord' DESC 'Key, RFC 2
+ 535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.2 NAME 'ipaNTSecurityIdentifier' 
+ DESC 'NT Security ID' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IP
+ A v3' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' DES
+ C 'Base at which the samba RID generation algorithm should operate' EQUALIT
+ Y integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2243 NAME 'nsslapd-securelistenhost'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( modified-oid NAME 'modified' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2108 NAME 'nsPagedLookThroughLimit' 
+ DESC 'Binder-based simple paged search operation look through limit' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE directoryOperation X-ORIG
+ IN '389' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.7 NAME 'FTPStatus' DESC 'Account sta
+ tus: enabled or disabled' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.7 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( notBefore-oid NAME 'notBefore' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2091 NAME 'nsslapd-suffix' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN
+  'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.24 NAME 'ipaEntitlementId' DESC 'E
+ ntitlement Unique identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreO
+ rderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'NT Gro
+ up Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE )
+attributeTypes: ( nsUserRDNComponent-oid NAME 'nsUserRDNComponent' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Administration Services' )
+attributeTypes: ( 1.3.18.0.2.4.1117 NAME 'printer-media-local-supported' DES
+ C 'Site-specific names of media supported by this printer.' EQUALITY caseIg
+ noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.5.4.51 NAME 'houseIdentifier'  EQUALITY caseIgnoreMatch 
+ SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORI
+ GIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2301 NAME 'nsslapd-plugin-logging' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822mailbox' ) 
+  EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 4524' X-DEPRECATED 'rfc822mailbox'
+  )
+attributeTypes: ( 2.16.840.1.113730.3.1.607 NAME 'nsDS5Flags' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsTaskLabel-oid NAME 'nsTaskLabel' DESC 'Netscape defined 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.47 NAME 'nSECRecord' DESC 'NSEC, RFC
+  3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.2068 NAME 'pamExcludeSuffix' DESC 'S
+ uffixes to exclude from PAM authentication' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.12 X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2157 NAME 'dnaRemoteBindCred' DESC '
+ Remote bind credentials' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ X-ORIGIN '389 Directory Server' )
+attributeTypes: ( nsBindDN-oid NAME 'nsBindDN' DESC 'Netscape defined attrib
+ ute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
+attributeTypes: ( requestError-oid NAME 'requestError' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( Clone-oid NAME 'Clone'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 7 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( tokenMsg-oid NAME 'tokenMsg' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.44 NAME 'ipaPermExcludedAttr' DES
+ C 'IPA permission explicitly excluded attribute' EQUALITY caseIgnoreMatch O
+ RDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.5.4.18 NAME 'postOfficeBox'  EQUALITY caseIgnoreMatch SU
+ BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2261 NAME 'nsslapd-attribute-name-ex
+ ceptions' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.527 NAME 'ntUserLastLogoff' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 1.3.6.1.4.1.250.1.2 NAME 'multiLineDescription' DESC 'Pilo
+ t attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Internet W
+ hite Pages Pilot' )
+attributeTypes: ( 2.16.840.1.113730.3.1.102 NAME ( 'passwordChange' 'pwdAllo
+ wUserChange' ) DESC 'Netscape defined password policy attribute type' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory S
+ erver' )
+attributeTypes: ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' DESC 'Standard LDAP a
+ ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN '
+ RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.21 NAME 'mailQuota' DESC 'Netscape M
+ essaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 1.2.840.113556.1.4.482 NAME 'calOtherCalURIs' DESC 'RFC273
+ 9: multi-value URI for snapshots of other calendars' EQUALITY caseIgnoreIA5
+ Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .26 X-ORIGIN 'rfc2739' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2238 NAME 'nsslapd-security' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( ownerName-oid NAME 'ownerName' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.1.1.14 NAME 'nisNetIdHost' DESC 'nisNe
+ tIdHost' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-
+ ORIGIN ( 'RFC2307bis' 'user defined' ) )
+attributeTypes: ( numberOfResets-oid NAME 'numberOfResets' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2327 NAME 'nsslapd-auditfaillog' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6 NAME 'javaClassName' DESC 'Fully
+  qualified name of distinguished Java class or interface' EQUALITY caseExac
+ tMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 2713
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.240 NAME 'replicatedattributelist' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2175 NAME 'nsslapd-accesslog-logrota
+ tionsync-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsRevisionNumber-oid NAME 'nsRevisionNumber' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.11 NAME 'externalHost' DESC 'Multi
+ value string attribute that allows storing host names.' EQUALITY caseIgnore
+ Match ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.62 NAME 'ipaAnchorUUID' DESC 'Uni
+ que Anchor Identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrdering
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4'
+  'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2207 NAME 'nsslapd-rootdn' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsHelpRef-oid NAME 'nsHelpRef' DESC 'Netscape defined attr
+ ibute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' DESC 'Maxi
+ mum time an agent or service allows for a search to complete' EQUALITY inte
+ gerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.15.2.1 NAME 'krbPrincipalAuthInd'  E
+ QUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA
+  v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.43 NAME 'ntUserDeleteAccount' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.9 NAME 'ipaMaxUsernameLength'  EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.217 NAME 'replicaCFUpdated' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.61 NAME 'ipk11Sensitive' DESC '
+ Key is sensitive' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+  SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.6 NAME 'targetDn' DESC 'Changelog at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Changelog Inte
+ rnet Draft' )
+attributeTypes: ( transId-oid NAME 'transId' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon
+  Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SI
+ NGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.25 NAME 'internationalISDNNumber'  EQUALITY numericS
+ tringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.36 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.998 NAME ( 'passwordGraceUserTime' '
+ pwdGraceUserTime' ) DESC 'Netscape defined password policy attribute type' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE USAGE directoryOperation 
+ X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.9.1 NAME 'krbMaxTicketLife'  EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.3 NAME 'cmdCategory' DESC 'Additio
+ nal classification for commands' EQUALITY caseIgnoreMatch ORDERING caseIgno
+ reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord' DESC 'host inf
+ ormation, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substri
+ ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' DESC 'Standard LDA
+ P attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGI
+ N 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2225 NAME 'nsslapd-workingdir' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier'  EQUA
+ LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.781 NAME 'mgrpAddHeader' DESC 'Netsc
+ ape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.65 NAME 'ntUserLogonServer' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2295 NAME 'nsslapd-allowed-sasl-mech
+ anisms' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2162 NAME 'winSyncDirectoryFilter' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of t
+ ime interval for which the entry is valid' EQUALITY generalizedTimeMatch OR
+ DERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 X-
+ ORIGIN 'SUDO' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.59 NAME 'ipaKeyUsage' DESC 'Allow
+ ed key usage' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Ful
+ ly qualified name of the domain with which a trust exists' EQUALITY caseIgn
+ oreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' 'user
+  defined' ) )
+attributeTypes: ( 1.3.18.0.2.4.1121 NAME 'printer-resolution-supported' DESC
+  'List of resolutions supported for printing documents by this printer.' EQ
+ UALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.12 NAME 'ipatokenTOTPtimeStep' 
+ DESC 'TOTP time-step' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( tokenKeyType-oid NAME 'tokenKeyType' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2139 NAME 'winSyncMoveAction' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.14 NAME 'idnsForwardPolicy' DESC '
+ forward policy: only or first' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnor
+ eIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORI
+ GIN ( 'IPA v2' 'user defined' ) )
+attributeTypes: ( nsExpirationDate-oid NAME 'nsExpirationDate' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( dateOfArchival-oid NAME 'dateOfArchival' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( unrevokedCerts-oid NAME 'unrevokedCerts' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.1 NAME 'eduPersonAffiliation' DESC 
+ 'Affiliation' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'http://middlew
+ are.internet2.edu/eduperson/' )
+attributeTypes: ( nsVendor-oid NAME 'nsVendor' DESC 'Netscape defined attrib
+ ute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2332 NAME 'allowWeakDHParam' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.87 NAME 'cirUpdateSchedule' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'Netscape Directory Server' )
+attributeTypes: ( thisUpdate-oid NAME 'thisUpdate' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.253 NAME 'nsValueSyntax' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape servers - value item' )
+attributeTypes: ( 2.5.4.32 NAME 'owner'  SUP distinguishedName EQUALITY dist
+ inguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 4519'
+  )
+attributeTypes: ( nsLdapSchemaVersion-oid NAME 'nsLdapSchemaVersion' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.44.1 NAME 'krbPwdHistory'  EQUAL
+ ITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113730.3.1.2100 NAME 'autoMemberInclusiveRegex'
+  DESC 'Auto Membership inclusive regex rule' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' DESC 'Obje
+ ct class mappings used, required, or supported by an agent or service' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'RF
+ C4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2089 NAME 'mepMappedAttr' DESC 'Mana
+ ged Entries mapped attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN
+  '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2212 NAME 'nsslapd-useroc' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.6 NAME 'ipaReplTopoSegmentGener
+ ated' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2282 NAME 'nsslapd-rundir' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( tokenResult-oid NAME 'tokenResult' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.3 NAME 'mozillaHomeLocalityName'  SUP 
+ name EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' DESC 'Disc
+ onnect Users outside logon hours (default: -1 => off, 0 => on)' EQUALITY in
+ tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.10 NAME ( 'o' 'organizationname' )  SUP name EQUALIT
+ Y caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'organizationname' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2259 NAME 'nsslapd-return-exact-case
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsAdminAccessAddresses-oid NAME 'nsAdminAccessAddresses' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus'  EQ
+ UALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( nsAdminUsers-oid NAME 'nsAdminUsers' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape A
+ dministration Services' )
+attributeTypes: ( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' DESC 'Standard LDAP a
+ ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN '
+ RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.19 NAME 'mailMessageStore' DESC 'Net
+ scape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2126 NAME 'dnaHostname' DESC 'DNA ho
+ stname of replica to get new range of values' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.221 NAME 'passwordStorageScheme' DES
+ C 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2230 NAME 'nsslapd-ldapiautobind' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2196 NAME 'nsslapd-accesslog-logexpi
+ rationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.576 NAME 'nsRoleFilter' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALU
+ E X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.70 NAME 'serverRoot' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape Administration Services' )
+attributeTypes: ( 5.3.6.1.1.1.1.0 NAME 'trustModel' DESC 'Access scheme' EQU
+ ALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'nss_ldap/pam_ldap' )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.2 NAME 'krbPwdAttributes'  EQUALITY
+  integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 
+ 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.248 NAME 'nsValueDN' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Nets
+ cape servers - value item' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.41 NAME 'parentOrganization'  EQU
+ ALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VA
+ LUE X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.8 NAME 'hostCategory' DESC 'Additi
+ onal classification for hosts' EQUALITY caseIgnoreMatch ORDERING caseIgnore
+ OrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) imp
+ ersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( nsAdminEnableDSGW-oid NAME 'nsAdminEnableDSGW' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Administration Services' )
+attributeTypes: ( 1.3.18.0.2.4.1132 NAME 'printer-multiple-document-jobs-sup
+ ported' DESC 'Indicates whether or not this printer supports more than one 
+ document per job.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 7 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.21 NAME 'ipatokenHOTPcounter' D
+ ESC 'HOTP counter' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.1 NAME 'ipaCertProfileStoreIssu
+ ed' DESC 'Store certificates issued using this profile' EQUALITY booleanMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.2' '
+ user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1 NAME ( 'mozillaNickname' 'xmozillani
+ ckname' )  SUP name EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.27 NAME 'idnsSecAlgorithm' DESC 'D
+ NSKEY algorithm: string used as mnemonic' EQUALITY caseIgnoreIA5Match SUBST
+ R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
+ VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( notAfter-oid NAME 'notAfter' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp'  EQUALITY generalizedTimeM
+ atch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN 'R
+ FC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.92 NAME ( 'passwordExpWarned' 'pwdEx
+ pirationWarned' ) DESC 'Netscape defined password policy attribute type' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE USAGE directoryOperation X-
+ ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.1 NAME 'krbPwdMaxFailure'  EQUALITY 
+ integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.5 NAME 'ipaNTHash' DESC 'NT Hash 
+ of user password' EQUALITY octetStringMatch ORDERING octetStringOrderingMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'u
+ ser defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2246 NAME 'nsslapd-maxdescriptors' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.23 NAME 'ipaNTTrustedDomainSID' D
+ ESC 'NT Trusted Domain Security ID' EQUALITY caseIgnoreIA5Match SUBSTR case
+ IgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE 
+ X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.11 NAME 'ipaUserObjectClasses'  SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.32.1 NAME 'krbPwdMinDiffChars'  
+ EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2113 NAME 'internalModifiersName' DE
+ SC 'plugin dn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MO
+ DIFICATION USAGE directoryOperation X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.20 NAME 'ipk11PublicKeyInfo' DE
+ SC 'DER-encoding of SubjectPublicKeyInfo of associated public key' EQUALITY
+  octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN ( 'IPA v4.1
+ ' 'user defined' ) )
+attributeTypes: ( issueInfo-oid NAME 'issueInfo' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2094 NAME 'nsslapd-parent-suffix' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X
+ -ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.692 NAME 'inetUserStatus' DESC '"act
+ ive", "inactive", or "deleted" status of a user' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape subscriber interoperability' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC 'Nex
+ t NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.18.0.2.4.1110 NAME 'printer-job-priority-supported' DE
+ SC 'Indicates the number of job priority levels supported by this printer.'
+  EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2183 NAME 'nsslapd-audit-logrotation
+ syncmin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.789 NAME 'mgrpNoDuplicateChecks' DES
+ C 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2304 NAME 'nsslapd-dynamic-plugins' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.602 NAME 'entrydn' DESC 'internal se
+ rver defined attribute type' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOpe
+ ration )
+attributeTypes: ( 2.16.840.1.113730.3.1.1098 NAME 'nsds5replicaSessionPauseT
+ ime' DESC 'Netscape defined attribute type' EQUALITY integerMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Serve
+ r' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2073 NAME 'pamSecure' DESC 'Require 
+ secure (TLS/SSL) connection for PAM auth' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .7 SINGLE-VALUE X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2264 NAME 'nsslapd-max-filter-nest-l
+ evel' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.41 NAME 'ipaRangeType' DESC 'Rang
+ e type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 1.3.18.0.2.4.1129 NAME 'printer-color-supported' DESC 'Ind
+ icates whether this printer is capable of any type of color printing at all
+ , including highlight color.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.7 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.5.21.2 NAME 'dITContentRules'  EQUALITY objectIdentifier
+ FirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOpe
+ ration X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher'  EQUAL
+ ITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.522 NAME 'ntUserComment' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VAL
+ UE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( nsmsgDisallowAccess-oid NAME 'nsmsgDisallowAccess' DESC 'N
+ etscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.24 NAME 'mailRoutingAddress' DESC 'N
+ etscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 1.2.840.113556.1.4.485 NAME 'calOtherCalAdrURIs' DESC 'RFC
+ 2739: multi-value URI to other request destinations' EQUALITY caseIgnoreIA5
+ Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .26 X-ORIGIN 'rfc2739' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2131 NAME 'pamFilter' DESC 'Filter t
+ o match entries that should use PAM authentication' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.42 NAME 'ipk11Derive' DESC 'Key
+  supports key derivation' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.234 NAME 'nsSNMPLocation' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ 'Netscape Directory Server' )
+attributeTypes: ( tokenIssuer-oid NAME 'tokenIssuer' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord' DESC 'Naming A
+ uthority Pointer, RFC 2915' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA
+ 5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion'  S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 USAGE dSAOperation X-ORIGIN 'RFC 4512' 
+ )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.9 NAME 'eduPersonScopedAffiliation'
+  DESC 'Scoped Affiliation' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'h
+ ttp://middleware.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.16 NAME 'ipaNTTrustAuthIncoming' 
+ DESC 'Authentication information for the incoming portion of a trust' EQUAL
+ ITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( requestFlag-oid NAME 'requestFlag' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( nsHostLocation-oid NAME 'nsHostLocation' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netsca
+ pe' )
+attributeTypes: ( 2.16.840.1.113730.3.1.590 NAME 'nsDS5ReplicaName' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2178 NAME 'nsslapd-accesslog-logrota
+ tionsynchour' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.15 NAME 'ipk11Destroyable' DESC
+  'Can be destroyed by application' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2081 NAME ( 'passwordMaxRepeats' 'pw
+ dMaxRepeats' ) DESC 'Netscape defined password policy attribute type' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory S
+ erver' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.14 NAME 'accessTime' DESC 'Access 
+ time' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.687 NAME 'nsds5replicaChangesSentSin
+ ceStartup' DESC 'Netscape defined attribute type' EQUALITY integerMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION X-ORIGI
+ N 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1107 NAME 'printer-xri-supported' DESC 'The u
+ nordered list of XRI (extended resource identifiers) supported by this prin
+ ter.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.46 NAME 'ntGroupDeleteGroup' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.4 NAME 'ipaSearchRecordsLimit'  EQ
+ UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.32 NAME 'ipaLocation' DESC 'Refere
+ nce to IPA location' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.12 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.9 NAME 'newRdn' DESC 'Changelog attr
+ ibute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Changelog Intern
+ et Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2147 NAME 'rootdn-allow-host' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORI
+ GIN 'Netscape Directory Server' )
+attributeTypes: ( autoRenew-oid NAME 'autoRenew' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.34 NAME 'ipaIDRangeSize' DESC 'Si
+ ze of a Posix ID range' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2251 NAME 'nsslapd-accesscontrol' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.28 NAME 'preferredDeliveryMethod'  SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.14 SINGLE-VALUE X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer'  SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 USAGE dSAOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.11 NAME 'newSuperior' DESC 'Changelo
+ g attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Changelog 
+ Internet Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.1.229 NAME 'nsslapd-pluginVendor' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.18 NAME 'aFSDBRecord' DESC 'for AFS 
+ Data Base location, RFC 1183' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnore
+ IA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( clientId-oid NAME 'clientId' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home di
+ rectory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2228 NAME 'nsslapd-ldapifilepath' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' DESC 'Standard LDAP a
+ ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN '
+ RFC 2307' )
+attributeTypes: ( 2.5.4.47 NAME 'enhancedSearchGuide'  SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.21 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2317 NAME 'nsslapd-auditfaillog-logr
+ otationsync-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.68 NAME 'ntUserPasswordExpired' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SING
+ LE-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.7 NAME 'idnsSOAretry' DESC 'SOA re
+ try value' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2298 NAME 'nsslapd-enable-turbo-mode
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.585 NAME 'nsDS5ReplicatedAttributeLi
+ st' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2165 NAME 'schemaUpdateObjectclassAc
+ cept' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.52 NAME 'ipaProtectedOperation' D
+ ESC 'Operation to be protected' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2277 NAME 'nsslapd-tmpdir' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.1002 NAME 'nsds7NewWinUserSyncEnable
+ d' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.7 NAME 'ipatokenSerial' DESC 'O
+ TP Token Serial number' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.19 NAME 'ipatokenRadiusRetries'
+  DESC 'Number of allowed Retries' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.23 NAME 'lastModifiedTime' DESC 'o
+ ld variant of modifyTimestamp' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'RFC 1274' )
+attributeTypes: ( 2.16.840.1.113730.3.1.535 NAME 'ntUserHomeDirDrive' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.110 NAME 'ntGroupId' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALUE X-
+ ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.33 NAME 'mgrpModerator' DESC 'Netsca
+ pe Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.207 NAME 'vlvBase' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netsca
+ pe Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.51 NAME 'ipk11Encrypt' DESC 'Ke
+ y supports encryption' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( nsServerMigrationClassname-oid NAME 'nsServerMigrationClas
+ sname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLPersonalitySSL-oid NAME 'nsSSLPersonalitySSL' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' DESC 'A s
+ tring option' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.35 NAME 'userPassword'  EQUALITY octetStringMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( crlExtensions-oid NAME 'crlExtensions' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName'  EQUALITY 1.3.6.1.4.1.1466.1
+ 09.114.1 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE NO-USER-MODIFICA
+ TION USAGE dSAOperation X-ORIGIN 'RFC 3045' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.4 NAME 'FTPDownloadRatio' DESC 'Rati
+ o (compared with FTPRatioUp) for downloaded files' EQUALITY integerMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.16 NAME 'dereferenceAliases' DESC '
+ Specifies if a service or agent either requires, supports, or uses derefere
+ ncing of aliases.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 7 SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.18 NAME 'ipk11StartDate' DESC '
+ Validity start date' EQUALITY generalizedTimeMatch ORDERING generalizedTime
+ OrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN ( 
+ 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.801 NAME 'mgrpRemoveHeader' DESC 'Ne
+ tscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.27 NAME 'ipaSELinuxUserMapOrder' D
+ ESC 'Available SELinux user context ordering' EQUALITY caseIgnoreMatch ORDE
+ RING caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.70 NAME 'ipaPermTargetTo' DESC 'D
+ estination location to move an entry IPA permission ACI' EQUALITY distingui
+ shedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN ( 
+ 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2215 NAME 'nsslapd-allow-unauthentic
+ ated-binds' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1118 NAME 'printer-copies-supported' DESC 'Th
+ e maximum number of copies of a document that may be printed as a single jo
+ b on this printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.55 NAME 'aci' DESC 'Netscape defined
+  access control information attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( tokenOp-oid NAME 'tokenOp' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber'  EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2285 NAME 'nsslapd-hash-filters' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.7 NAME ( 'l' 'locality' 'localityname' )  SUP name E
+ QUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'locality localityname'
+  )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.44 NAME 'sSHFPRecord' DESC 'SSH Key 
+ Fingerprint, draft-ietf-secsh-dns-05.txt' EQUALITY caseIgnoreIA5Match SUBST
+ R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( nsSSL3SessionTimeout-oid NAME 'nsSSL3SessionTimeout' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeo
+ ut' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( dataType-oid NAME 'dataType' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.52.1 NAME 'krbObjectReferences' 
+  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' DESC '
+ Lockout duration in minutes (default: 30, -1 => forever)' EQUALITY integerM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.49 NAME 'ipaPermTarget' DESC 'IPA
+  permission target' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.105 NAME ( 'passwordLockout' 'pwdLoc
+ kOut' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' 
+ )
+attributeTypes: ( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' DESC 'Standard LDAP 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 
+ 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2129 NAME 'dnaNextRange' DESC 'DNA r
+ ange of values to get from replica' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( nsSSL3-oid NAME 'nsSSL3' DESC 'Netscape defined attribute 
+ type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windo
+ ws NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2199 NAME 'nsslapd-accesslog-logexpi
+ rationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.571 NAME 'nsSizeLimit' DESC 'Binder-
+ based search operation size limit (entries)' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Directory S
+ erver' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.1.1.13 NAME 'nisNetIdGroup' DESC 'nisN
+ etIdGroup' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
+ X-ORIGIN ( 'RFC2307bis' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2322 NAME 'nsslapd-auditfaillog-logm
+ infreediskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.77 NAME 'changeTime' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.243 NAME 'nsValueCIS' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Net
+ scape servers - value item' )
+attributeTypes: ( 2.16.840.1.113730.3.8.18.2.3 NAME 'ipaVaultPublicKey' DESC
+  'IPA vault public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.40 X-ORIGIN ( 'IPA v4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2170 NAME 'nsslapd-accesslog-level' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.3 NAME 'enrolledBy' DESC 'DN of ad
+ ministrator who performed manual enrollment of the host' SUP distinguishedN
+ ame EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-
+ ORIGIN 'IPA v2' )
+attributeTypes: ( publicKeyFormat-oid NAME 'publicKeyFormat' DESC 'CMS defin
+ ed attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.1.2202 NAME 'nsslapd-accesslog-logging
+ -enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( classId-oid NAME 'classId' DESC 'Certificate profile class
+  ID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod' DESC 
+ 'Identifies the types of authentication methods either used, required, or p
+ rovided by a service or peer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( '
+ RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.4 NAME 'ipaCaCategory' DESC 'Ad
+ ditional classification for CAs' EQUALITY caseIgnoreMatch ORDERING caseIgno
+ reOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 X-ORIGIN ( 'IPA v4.2' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Automou
+ nt information' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.26 SINGLE-VALUE X-ORIGIN 'RFC 2307bis' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.29.1 NAME 'krbAdmServers'  EQUAL
+ ITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.64 NAME 'ipk11SignRecover' DESC
+  'Key supports signatures where data can be recovered from the signature' E
+ QUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORI
+ GIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( publishingStatus-oid NAME 'publishingStatus' DESC 'CMS def
+ ined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'vehicle li
+ cense or registration plate' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2798' )
+attributeTypes: ( nsCertConfig-oid NAME 'nsCertConfig' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape C
+ ertificate Management System' )
+attributeTypes: ( 2.16.840.1.113730.3.1.99 NAME ( 'passwordMinLength' 'pwdMi
+ nLength' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Serve
+ r' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.8 NAME 'ipaNTHomeDirectory' DESC 
+ 'User Home Directory Path' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrde
+ ringMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2249 NAME 'nsslapd-idletimeout' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.20 NAME 'telephoneNumber'  EQUALITY telephoneNumberM
+ atch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.50 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.6 NAME 'ipaSudoRunAs' DESC 'Refere
+ nce to a user or group that the commands can be run as.' SUP memberUser EQU
+ ALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 
+ 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2116 NAME 'dnaPrefix' DESC 'DNA stri
+ ng prefix for dna value' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2220 NAME 'nsslapd-minssf-exclude-ro
+ otdse' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'Standard LDAP attri
+ bute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 
+ 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2186 NAME 'nsslapd-auditlog-logrotat
+ iontime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle'  EQUALITY 
+ caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.60 NAME 'ntUserAuthFlags' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VAL
+ UE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( DomainManager-oid NAME 'DomainManager'  SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2290 NAME 'nsslapd-disk-monitoring-t
+ hreshold' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2076 NAME ( 'passwordMinAlphas' 'pwd
+ MinAlphas' ) DESC 'Netscape defined password policy attribute type' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Ser
+ ver' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.49 NAME 'DHCIDRecord' DESC 'Dynamic 
+ Host Configuration Protocol (DHCP) Information, RFC 4701' EQUALITY caseIgno
+ reIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.40.1 NAME 'krbTicketPolicyRefere
+ nce'  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 
+ SINGLE-VALUE )
+attributeTypes: ( authorityKeyHost-oid NAME 'authorityKeyHost' DESC 'Authori
+ ty Key Hosts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.1.406 NAME 'nsSynchUserIDFormat' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS
+  name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 1.3.18.0.2.4.1122 NAME 'printer-media-supported' DESC 'The
+  standard names/types/sizes (and optional color suffixes) of the media supp
+ orted by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.5.21.5 NAME 'attributeTypes'  EQUALITY objectIdentifierF
+ irstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOper
+ ation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.11 NAME 'ipatokenTOTPclockOffse
+ t' DESC 'TOTP clock offset' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( nsAdminEnableEnduser-oid NAME 'nsAdminEnableEnduser' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Administration Services' )
+attributeTypes: ( 1.3.6.1.1.1.1.26 NAME 'nisMapName' DESC 'Standard LDAP att
+ ribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.17 NAME 'idnsPersistentSearch' DES
+ C 'allow persistent searches' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2134 NAME 'nsds5ReplicaStripAttrs' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.544 NAME 'nsParentUniqueId' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.4 NAME 'eduPersonOrgUnitDN' DESC 'O
+ rganizational Unit DN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'http:
+ //middleware.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.82 NAME 'cirBindDn' DESC 'Netscape d
+ efined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netsc
+ ape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.13 NAME 'ipaNTTrustDirection' DES
+ C 'Direction of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE )
+attributeTypes: ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'a JPEG i
+ mage' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 X-ORIGIN 'RFC 2798' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.13 NAME 'javaClassNames' DESC 'Ful
+ ly qualified Java class or interface name' EQUALITY caseExactMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2713' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2103 NAME 'autoMemberDisabled' DESC 
+ 'Auto Membership disabled attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.809 NAME 'nsds5replicaLastInitStatus
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2084 NAME 'nsSymmetricKey' DESC 'A s
+ ymmetric key - currently used by attribute encryption' SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'attribute encryption' )
+attributeTypes: ( 2.16.840.1.113730.3.1.682 NAME 'nsds5ReplicaPurgeDelay' DE
+ SC 'Netscape defined attribute type' EQUALITY integerMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress'  EQUAL
+ ITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.41 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 1.3.6.1.4.1.1.1.1.12 NAME 'nisDomain' DESC 'NIS domain' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'RFC2307bis' 'user defined' )
+  )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.1 NAME 'ipaReplTopoConfRoot' DE
+ SC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( requestInfo-oid NAME 'requestInfo' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( nsTLS1-oid NAME 'nsTLS1' DESC 'Netscape defined attribute 
+ type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( keySize-oid NAME 'keySize' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2063 NAME 'nsEncryptionAlgorithm' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.4 NAME 'mozillaHomeState'  SUP name EQ
+ UALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.31 NAME 'ipaSshPubKey' DESC 'SSH 
+ public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 
+ X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.5.4.13 NAME 'description'  EQUALITY caseIgnoreMatch SUBS
+ TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2254 NAME 'nsslapd-pwpolicy-local' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( keyState-oid NAME 'keyState' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.14 NAME 'mailAutoReplyMode' DESC 'Ne
+ tscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( tokenPolicy-oid NAME 'tokenPolicy' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2121 NAME 'dnaScope' DESC 'DNA base 
+ DN for finding entries' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X
+ -ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.224 NAME 'nsslapd-pluginPath' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.2.1.2 NAME 'acctPolicySubentry' DESC 'A
+ ccount policy pointer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE US
+ AGE directoryOperation X-ORIGIN 'Account Policy Plugin' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Timest
+ amp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2233 NAME 'nsslapd-ldapiuidnumbertyp
+ e' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2191 NAME 'nsslapd-errorlog-logmaxdi
+ skspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.579 NAME 'nsDS5ReplicaPort' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.2 NAME 'idnsZoneActive' DESC 'defi
+ ne if the zone is considered in use' EQUALITY booleanMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.610 NAME 'nsAccountLock' DESC 'Opera
+ tional attribute for Account Inactivation' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.1 NAME 'krbCanonicalName'  EQUALITY
+  caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( proofOfArchival-oid NAME 'proofOfArchival' DESC 'CMS defin
+ ed attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.707 NAME 'vacationstartdate' DESC 'N
+ etscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.580 NAME 'nsDS5ReplicaTransportInfo'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2168 NAME 'schemaUpdateAttributeReje
+ ct' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( metaInfo-oid NAME 'metaInfo' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s
+ ) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.79 NAME 'sambaTrustPosixOffset' DESC 
+ 'POSIX offset of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE )
+attributeTypes: ( dateOfRevocation-oid NAME 'dateOfRevocation' DESC 'CMS def
+ ined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined
+ ' )
+attributeTypes: ( 1.3.18.0.2.4.1137 NAME 'printer-generated-natural-language
+ -supported' DESC 'Natural language(s) supported for this directory entry.' 
+ EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.1005 NAME 'nsds7DirsyncCookie' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.530 NAME 'ntUserLogonHours' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-V
+ ALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.24 NAME 'ipatokenTOTPsyncWindow
+ ' DESC 'TOTP Sync Window (maximum synchronization variance in seconds)' EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIG
+ IN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.24 NAME 'lastModifiedBy' DESC 'old
+  variant of modifiersName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'R
+ FC 1274' )
+attributeTypes: ( 2.16.840.1.113730.3.1.36 NAME 'nsLicensedFor' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'N
+ etscape Administration Services' )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.2 NAME ( 'mozillaSecondEmail' 'xmozill
+ asecondemail' )  EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Mozilla A
+ ddress Book' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.22 NAME 'idnsSecKeyInactive' DESC 
+ 'DNSSEC key (planned) inactivation time' EQUALITY generalizedTimeMatch ORDE
+ RING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SING
+ LE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.202 NAME 'replicaCredentials' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIG
+ IN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.3023 NAME 'nsViewFilter' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Directory Server' )
+attributeTypes: ( nsSSL2Ciphers-oid NAME 'nsSSL2Ciphers' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( nsServerAddress-oid NAME 'nsServerAddress' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.91 NAME 'passwordExpirationTime' DES
+ C 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.24 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Dire
+ ctory Server' )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.2 NAME 'krbPwdFailureCountInterval' 
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2241 NAME 'nsslapd-errorlog' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsProductName-oid NAME 'nsProductName' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 2.5.4.38 NAME 'authorityRevocationList' DESC 'X.509 author
+ ity revocation list' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.40 X-ORIGIN 'RFC 4523' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2027 NAME 'nsruvReplicaLastModified'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2097 NAME 'autoMemberScope' DESC 'Au
+ to Membership scope criteria' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-V
+ ALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'Times
+ tamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.695 NAME 'inetSubscriberChallenge' D
+ ESC 'Used to confirm subscriberIdentity.  This attribute holds the challeng
+ e phrase and is used in conjunction with the inetSubscriberResponse' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Netscape subscriber i
+ nteroperability' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.49.1 NAME 'krbLastFailedAuth'  E
+ QUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VA
+ LUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2218 NAME 'nsslapd-localssf' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1115 NAME 'printer-stacking-order-supported' 
+ DESC 'The possible stacking order of pages as they are printed and ejected 
+ from this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.15.1 NAME 'krbLdapServers'  EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.2.840.113556.1.4.479 NAME 'calFBURL' DESC 'RFC2739: URI 
+ to the users default freebusy data' EQUALITY caseIgnoreIA5Match SUBSTR case
+ IgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'rfc
+ 2739' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2307 NAME 'nsslapd-allow-hashed-pass
+ words' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.58 NAME 'replicaBindDn' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'N
+ etscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.605 NAME 'entryid' DESC 'internal se
+ rver defined attribute type' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.1.2288 NAME 'nsslapd-defaultnamingcont
+ ext' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.12 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( authorityParentID-oid NAME 'authorityParentID' DESC 'Autho
+ rity Parent ID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 
+ 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.9 NAME 'mozillaWorkUrl'  EQUALITY case
+ IgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Moz
+ illa Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.42 NAME 'ipaPermDefaultAttr' DESC
+  'IPA permission default attribute' EQUALITY caseIgnoreMatch ORDERING caseI
+ gnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.
+ 0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2267 NAME 'nsslapd-certmap-basedn' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.525 NAME 'ntUserWorkstations' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.100 NAME 'passwordKeepHistory' DESC 
+ 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.23 NAME 'mgrpAllowedDomain' DESC 'Ne
+ tscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 1.2.840.113556.1.4.480 NAME 'calCAPURI' DESC 'RFC2739: URI
+  used to communicate with the users calendar' EQUALITY caseIgnoreIA5Match S
+ UBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-O
+ RIGIN 'rfc2739' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.41 NAME 'ipk11KeyType' DESC 'Ke
+ y type' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.237 NAME 'nsSNMPMasterHost' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( profileID-oid NAME 'profileID' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( nsDefaultAcceptLanguage-oid NAME 'nsDefaultAcceptLanguage'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.6.1 NAME 'krbPrincipalExpiration
+ '  EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2325 NAME 'nsslapd-auditfaillog-logg
+ ing-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( requestOwner-oid NAME 'requestOwner' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.593 NAME 'nsSNMPName' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Net
+ scape Directory Server' )
+attributeTypes: ( nextRange-oid NAME 'nextRange' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.17 NAME 'hostCApolicy' DESC 'Polic
+ y on how to treat host requests for cert operations.' EQUALITY caseIgnoreMa
+ tch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.60 NAME 'ipaKeyExtUsage' DESC 'Al
+ lowed extended key usage' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.38 X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2205 NAME 'nsslapd-auditlog-logging-
+ hide-unhashed-pw' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1108 NAME 'printer-aliases' DESC 'List of sit
+ e-specific administrative names of this printer in addition to the value sp
+ ecified for printer-name.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord'  EQUALITY ca
+ seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.45 NAME 'ntGroupCreateNewGroup' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.7 NAME 'ipaDefaultLoginShell'  EQU
+ ALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.63 NAME 'ipk11Sign' DESC 'Key s
+ upports signatures where the signature is an appendix to the data' EQUALITY
+  booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( '
+ IPA v4.1' 'user defined' ) )
+attributeTypes: ( serialno-oid NAME 'serialno' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.215 NAME 'oid' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape D
+ irectory Server' )
+attributeTypes: ( userDN-oid NAME 'userDN' DESC 'CMS defined attribute' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'type of 
+ employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2798' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2142 NAME 'nsSaslMapPriority' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.39 NAME 'ipaNTSIDBlacklistOutgoin
+ g' DESC 'Extra SIDs filtered out from outgoing MS-PAC' EQUALITY caseIgnoreI
+ A5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 X-ORIGIN 'IPA v3' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' DESC 'Trust
+  Password Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.26 )
+attributeTypes: ( publicKeyData-oid NAME 'publicKeyData' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2119 NAME 'dnaMagicRegen' DESC 'DNA 
+ value that will trigger regeneration of attribute value' SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.1 NAME 'memberAllowCmd' DESC 'Refe
+ rence to a command or group of commands that are allowed by the rule.' SUP 
+ distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.12 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.47.1 NAME 'krbPrincipalAliases' 
+  EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 'Tim
+ estamp of when the user is allowed to update the password' EQUALITY integer
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( sessionContext-oid NAME 'sessionContext' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.5.4.42 NAME 'givenName'  SUP name EQUALITY caseIgnoreMat
+ ch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'RFC 4519' )
+attributeTypes: ( tokenType-oid NAME 'tokenType' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2189 NAME 'nsslapd-auditlog-logrotat
+ iontimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.12 NAME 'hostMask' DESC 'IP mask t
+ o identify a subnet.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMatch SUB
+ STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2312 NAME 'dnaExcludeScope' DESC 'DN
+  of a subtree excluded from DNA plugin scope' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.12 X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.67 NAME 'ntUserProfile' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALU
+ E X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( revokedCerts-oid NAME 'revokedCerts' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2079 NAME ( 'passwordMinSpecials' 'p
+ wdMinSpecials' ) DESC 'Netscape defined password policy attribute type' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory
+  Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.588 NAME 'nsDS5ReplicaId' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2160 NAME 'dnaRemoteBindMethod' DESC
+  'Remote bind method: SIMPLE, SSL, SASL/DIGEST-MD5, or SASL/GSSAPI' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' 
+ )
+attributeTypes: ( 1.3.6.1.4.1.13769.4.3 NAME 'mozillaCustom3'  EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.71 NAME 'sambaTrustAttributes' DESC '
+ Trust attributes for a trusted domain' EQUALITY integerMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.57 NAME 'ipaCertIssuerSerial' DES
+ C 'Issuer name and serial number' EQUALITY caseIgnoreMatch SUBSTR caseIgnor
+ eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.1'
+  'user defined' ) )
+attributeTypes: ( transStatus-oid NAME 'transStatus' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2272 NAME 'nsslapd-plugin-binddn-tra
+ cking' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.2 NAME 'ipatokenDisabled' DESC 
+ 'Optionally marks token as Disabled' EQUALITY booleanMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse'  EQUALITY objectIdentifier
+ FirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOpe
+ ration X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME ( 'labeledURI' 'labeledurl' )  E
+ QUALITY caseExactMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 X-ORIGIN 'RFC 2079' X-DEPRECATED 'labeledurl' )
+attributeTypes: ( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'Standard LDAP 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.54 NAME 'ipk11Wrap' DESC 'Key s
+ upports wrapping' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+  SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( beginRange-oid NAME 'beginRange' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( signingAlgorithmId-oid NAME 'signingAlgorithmId' DESC 'CMS
+  defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user def
+ ined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2330 NAME 'nsslapd-logging-backend' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.89 NAME 'cirSyncInterval' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption' DESC 
+ 'A string list option' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass' DESC 'The class of
+  a resource record' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.251 NAME 'nsValueFlags' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'N
+ etscape servers - value item' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.1 NAME 'FTPQuotaFiles' DESC 'Quota (
+ in number of files) for an FTP user' EQUALITY integerMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel' DE
+ SC 'Specifies the type of credentials either used, required, or supported b
+ y a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2106 NAME 'nsIDListScanLimit' DESC '
+ Binder-based search operation ID list scan limit (candidate entries)' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE directoryOperation X-ORI
+ GIN '389' )
+attributeTypes: ( 2.16.840.1.113730.3.1.804 NAME 'nsSchemaCSN' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
+  USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsServerSecurity-oid NAME 'nsServerSecurity' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.22 NAME 'ipaMigrationEnabled' DESC
+  'Enable adding user entries with pre-hashed passwords.' SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.75 NAME 'ipaNTAdditionalSuffixes'
+  DESC 'Suffix for the user principal name associated with the domain' EQUAL
+ ITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4
+ .4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2210 NAME 'nsslapd-auditlog' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.50 NAME 'replicaBeginOrc' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.4 NAME 'ipaReplTopoSegmentRight
+ Node' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDrink' 
+ )  EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4524' X-DEPRECATED 'favouriteDrink' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2280 NAME 'nsslapd-bakdir' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.4 NAME ( 'sn' 'surName' )  SUP name EQUALITY caseIgn
+ oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'surName' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2066 NAME 'nsSaslMapFilterTemplate' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.1 NAME 'mozillaHomeStreet'  EQUALITY c
+ aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.1.198 NAME 'memberURL' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Nets
+ cape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservationWindo
+ w' DESC 'Reset time after lockout in minutes (default: 30)' EQUALITY intege
+ rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.16 NAME 'postalAddress'  EQUALITY caseIgnoreListMatc
+ h SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41
+  X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.108 NAME 'passwordUnlock' DESC 'Nets
+ cape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' DESC 'Standard L
+ DAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2307
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2124 NAME 'dnaRemainingValues' DESC 
+ 'DNA remaining values left to assign' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( nsSSLClientAuth-oid NAME 'nsSSLClientAuth' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape' )
+attributeTypes: ( duration-oid NAME 'duration' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( tokenID-oid NAME 'tokenID' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2236 NAME 'nsslapd-anonlimitsdn' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2194 NAME 'nsslapd-errorlog-logminfr
+ eediskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.574 NAME 'nsRole' DESC 'Netscape def
+ ined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICAT
+ ION USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsAdminGroupName-oid NAME 'nsAdminGroupName' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.19.2.2 NAME 'ipaMinDomainLevel' DESC
+  'Minimal supported Domain Level value' EQUALITY numericStringMatch ORDERIN
+ G numericStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE X-OR
+ IGIN ( 'IPA v4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.72 NAME 'serverVersionNumber' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORI
+ GIN 'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.246 NAME 'nsValueInt' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'Net
+ scape servers - value item' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.43 NAME 'preferredTimeZone' DESC 
+ 'preferred time zone for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGI
+ N 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2173 NAME 'nsslapd-errorlog-maxlogsi
+ ze' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.6 NAME 'userCategory' DESC 'Additi
+ onal classification for users' EQUALITY caseIgnoreMatch ORDERING caseIgnore
+ OrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s)
+  impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( SecureAdminPort-oid NAME 'SecureAdminPort'  SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.18.0.2.4.1130 NAME 'printer-document-format-supported'
+  DESC 'The possible source document formats which may be interpreted and pr
+ inted by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals' DESC 'An a
+ gent or service does or should follow referrals' EQUALITY booleanMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user def
+ ined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.29 NAME 'nSRecord'  EQUALITY caseI
+ gnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.23 NAME 'ipatokenTOTPauthWindow
+ ' DESC 'TOTP Auth Window (maximum authentication variance in seconds)' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGI
+ N ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.7 NAME 'ipaCaIssuerDN' DESC 'Is
+ suer DN' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.12 X-ORIGIN ( 'IPA v4.4 Lightweight CAs' 'user define
+ d' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.25 NAME 'idnsSecKeyRevoke' DESC 'D
+ NSKEY REVOKE flag (equivalent to bit 8): RFC 5011' EQUALITY booleanMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user 
+ defined' ) )
+attributeTypes: ( requestId-oid NAME 'requestId' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.552 NAME 'costargettree' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VAL
+ UE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.94 NAME 'retryCountResetTime' DESC '
+ Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.24 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Directo
+ ry Server' )
+attributeTypes: ( tokenNotBefore-oid NAME 'tokenNotBefore' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.21 NAME 'ipaAllowToImpersonate' D
+ ESC 'Principals that can be impersonated' SUP distinguishedName EQUALITY di
+ stinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'IPA-v
+ 3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2244 NAME 'nnslapd-threadnumber' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that th
+ e entry belongs to' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape
+  Delegated Administrator' )
+attributeTypes: ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' )  SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.22 X-ORIGIN 'RFC 4519' X-DEPRECATED 'fax' )
+attributeTypes: ( authorityEnabled-oid NAME 'authorityEnabled' DESC 'Authori
+ ty Enabled' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'user
+  defined' )
+attributeTypes: ( nsDirectoryURL-oid NAME 'nsDirectoryURL' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netsca
+ pe' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2111 NAME 'tombstoneNumSubordinates'
+  DESC 'count of immediate subordinates for tombstone entries' EQUALITY inte
+ gerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN '389 d
+ irectory server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.9 NAME 'ipaSudoRunAsGroup' DESC 'R
+ eference to group that the commands can be run as.' SUP memberUser EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA 
+ v2' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.22 NAME 'ipk11Subject' DESC 'DE
+ R-encoding of subject name' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.40 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( deltaSize-oid NAME 'deltaSize' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.690 NAME 'inetDomainBaseDN' DESC 'Ba
+ se DN of user subtree for a DNS domain' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 2 SINGLE-VALUE X-ORIGIN 'Netscape subscriber interoperability' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID'
+  EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user define
+ d' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2223 NAME 'nsslapd-localhost' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'Standard LDAP a
+ ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN '
+ RFC 2307' )
+attributeTypes: ( ServerCertExtractFile-oid NAME 'ServerCertExtractFile' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2181 NAME 'nsslapd-accesslog-logrota
+ tionsyncmin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.569 NAME 'cosPriority' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE
+  X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsOsVersion-oid NAME 'nsOsVersion' DESC 'Netscape defined 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsJarfilename-oid NAME 'nsJarfilename' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2293 NAME 'nsslapd-ndn-cache-enabled
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2071 NAME 'pamIDAttr' DESC 'Name of 
+ attribute holding PAM ID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Re
+ d Hat Directory Server' )
+attributeTypes: ( tokenSerial-oid NAME 'tokenSerial' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( password-oid NAME 'password' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2158 NAME 'dnaRemoteBindDN' DESC 'Re
+ mote bind DN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN '3
+ 89 Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.3.1 NAME 'krbPrincipalType'  EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.69 NAME 'sambaPreviousClearTextPasswo
+ rd' DESC 'Previous clear text password (used for trusted domain passwords)'
+  EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.18.0.2.4.1127 NAME 'printer-pages-per-minute' DESC 'Th
+ e nominal number of pages per minute which may be output by this printer.' 
+ EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.14 NAME 'ipatokenRadiusUserName
+ ' DESC 'Corresponding Radius username' EQUALITY caseIgnoreMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' 
+ ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.54 NAME 'ditRedirect' DESC 'Standa
+ rd LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 
+ 1274' )
+attributeTypes: ( 2.16.840.1.113730.3.1.520 NAME 'nswmExtendedUserPrefs' DES
+ C 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.26 NAME 'mgrpErrorsTo' DESC 'Netscap
+ e Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .26 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2137 NAME 'nsds5ReplicaAbortCleanRUV
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.12 NAME 'idnsAllowTransfer' DESC '
+ BIND9 allow-transfer ACL element' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v2' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures'  EQUALITY 
+ objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperati
+ on X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.232 NAME 'nsSNMPEnabled' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VAL
+ UE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( algorithmId-oid NAME 'algorithmId' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord' DESC 'certifica
+ te, RFC 2538' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.17 NAME 'ldapSchemas'  SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.15 USAGE directoryOperation X-ORIGIN 'RFC 2927' )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.7 NAME 'eduPersonEntitlement' DESC 
+ 'Entitlement' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'http://middlew
+ are.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2328 NAME 'nsslapd-auditfaillog-list
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.81 NAME 'cirPort' DESC 'Netscape def
+ ined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscap
+ e Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.14 NAME 'ipaNTTrustPartner' DESC 
+ 'Fully qualified name of the domain with which a trust exists' EQUALITY cas
+ eIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' '
+ user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.9 NAME 'FTPgid' DESC 'System uid (ov
+ errides gidNumber if present)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.17 NAME 'ipk11CheckValue' DESC 
+ 'Checksum' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X
+ -ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2087 NAME 'mepManagedEntry' DESC 'Ma
+ naged Entries pointer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN '389 D
+ irectory Server' )
+attributeTypes: ( nsAdminSIEDN-oid NAME 'nsAdminSIEDN' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.1.685 NAME 'nsds5replicaLastUpdateStar
+ t' DESC 'Netscape defined attribute type' EQUALITY generalizedTimeMatch ORD
+ ERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SIN
+ GLE-VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2208 NAME 'nsslapd-rootdnpw' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.48 NAME 'replicaPort' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Net
+ scape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.2 NAME 'ipaGroupSearchFields'  EQU
+ ALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.30 NAME 'idnsSubstitutionVariable'
+  DESC 'User defined variable for DNS plugin' EQUALITY caseIgnoreIA5Match SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.210 NAME 'vlvSort' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netsca
+ pe Directory Server' )
+attributeTypes: ( dateOfModify-oid NAME 'dateOfModify' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.51 NAME 'nSEC3PARAMRecord' DESC 'RFC
+  5155' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user
+  defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2145 NAME 'rootdn-close-time' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2257 NAME 'nsslapd-accesslog-logbuff
+ ering' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.32 NAME 'ipaKrbPrincipalAlias' DE
+ SC 'DEPRECATED - DO NOT USE' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOr
+ deringMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlycountrynam
+ e' )  EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 4524' X-DEPRECATED 'friendlycountry
+ name' )
+attributeTypes: ( extension-oid NAME 'extension' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.13 NAME 'mailAlternateAddress' DESC 
+ 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.227 NAME 'nsslapd-pluginId' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roam
+ ing profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.45 NAME 'x500UniqueIdentifier'  EQUALITY bitStringMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.5 NAME 'idnsSOAserial' DESC 'SOA s
+ erial number' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2315 NAME 'nsDS5ReplicaWaitForAsyncR
+ esults' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.613 NAME 'copiedFrom' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsServerPort-oid NAME 'nsServerPort' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' 
+ )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.4 NAME 'krbPwdMaxRenewableLife'  EQ
+ UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORI
+ GIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.8 NAME 'javaSerializedData' DESC '
+ Serialized form of a Java object' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SING
+ LE-VALUE X-ORIGIN 'RFC 2713' )
+attributeTypes: ( deltaNumber-oid NAME 'deltaNumber' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.583 NAME 'nsDS5ReplicaBindMethod' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2275 NAME 'nsslapd-schemadir' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsSSLActivation-oid NAME 'nsSSLActivation' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape' )
+attributeTypes: ( 1.3.18.0.2.4.1138 NAME 'printer-make-and-model' DESC 'Make
+  and model of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'rfc
+ 3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.5 NAME 'ipatokenVendor' DESC 'O
+ ptional Vendor identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA
+  OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.1000 NAME 'nsds7WindowsReplicaSubtre
+ e' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.21 NAME 'secretary'  EQUALITY dist
+ inguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 4524'
+  )
+attributeTypes: ( 2.16.840.1.113730.3.1.533 NAME 'ntUserCodePage' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VAL
+ UE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.35 NAME 'changeLog' DESC 'the distin
+ guished name of the entry which contains the set of entries comprising this
+  servers changelog' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.12 X-ORIGIN 'Changelog Internet Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.53 NAME 'ipk11VerifyRecover' DE
+ SC 'Key supports verification where data is recovered from the signature' E
+ QUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORI
+ GIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.205 NAME 'changeLogMaximumConcurrent
+ Writes' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord' DESC 'Signature,
+  RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' DESC 'A boo
+ lean option' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SING
+ LE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.3 NAME 'ipaNTFlatName' DESC 'Flat
+ /Netbios Name' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SU
+ BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( nsDirectoryInfoRef-oid NAME 'nsDirectoryInfoRef' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN
+  'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.6 NAME 'FTPDownloadBandwidth' DESC '
+ Bandwidth (in KB/s) to limit download speeds to' EQUALITY integerMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2109 NAME 'nsPagedIDListScanLimit' D
+ ESC 'Binder-based simple paged search operation ID list scan limit' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE directoryOperation X-ORIGI
+ N '389' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2092 NAME 'nsslapd-ldapiautodnsuffix
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 12 X-ORIGIN 'Netscape' )
+attributeTypes: ( transOps-oid NAME 'transOps' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.25 NAME 'ipaPermissionType' DESC '
+ IPA permission flags' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingM
+ atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'X.509 supported 
+ algorithms' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 
+ X-ORIGIN 'RFC 4523' )
+attributeTypes: ( 1.3.18.0.2.4.1116 NAME 'printer-output-features-supported'
+  DESC 'The possible output features supported by this printer.' EQUALITY ca
+ seIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2302 NAME 'nsslapd-listen-backlog-si
+ ze' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.57 NAME 'replicaRoot' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Net
+ scape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.608 NAME 'nsDS5Task' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape Directory Server' )
+attributeTypes: ( nextUpdate-oid NAME 'nextUpdate' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2069 NAME 'pamMissingSuffix' DESC 'H
+ ow to handle missing include or exclude suffixes' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 SINGLE-VALUE X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.5.4.9 NAME ( 'street' 'streetaddress' )  EQUALITY caseIg
+ noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'streetaddress' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.46 NAME 'rRSIGRecord' DESC 'RRSIG, R
+ FC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.28.1 NAME 'krbPrincNamingAttr'  
+ EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.1.2150 NAME 'rootdn-deny-ip' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Directory Server' )
+attributeTypes: ( nsGroupRDNComponent-oid NAME 'nsGroupRDNComponent' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Administration Services' )
+attributeTypes: ( algorithm-oid NAME 'algorithm' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' DESC 'Maximu
+ m password age, in seconds (default: -1 => never expire passwords)' EQUALIT
+ Y integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.47 NAME 'ipaPermRight' DESC 'IPA 
+ permission rights' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 X-ORIGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2262 NAME 'nsslapd-maxbersize' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.19 NAME 'physicalDeliveryOfficeName'  EQUALITY caseI
+ gnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.528 NAME 'ntUserAcctExpires' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.103 NAME ( 'passwordCheckSyntax' 'pw
+ dCheckSyntax' ) DESC 'Netscape defined password policy attribute type' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory 
+ Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' DESC 'Standard L
+ DAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 2307
+ ' )
+attributeTypes: ( 1.2.840.113556.1.4.483 NAME 'calOtherFBURLs' DESC 'RFC2739
+ : multi-value URI for other free/busy data' EQUALITY caseIgnoreIA5Match SUB
+ STR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORI
+ GIN 'rfc2739' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.44 NAME 'ipk11AllowedMechanisms
+ ' DESC 'Space-separated list of mechanisms allowed to be used with this key
+ ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2239 NAME 'nsslapd-SSL3ciphers' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2320 NAME 'nsslapd-auditfaillog-logr
+ otationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.79 NAME 'cirReplicaRoot' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN '
+ Netscape Directory Server' )
+attributeTypes: ( issuerName-oid NAME 'issuerName' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'preferr
+ ed name of a person to be used when displaying entries' EQUALITY caseIgnore
+ Match SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'RFC 2798' )
+attributeTypes: ( nsProductVersion-oid NAME 'nsProductVersion' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.18.2.1 NAME 'ipaVaultType' DESC 'IPA
+  vault type' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN ( 'IPA v4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2176 NAME 'nsslapd-errorlog-logrotat
+ ionsync-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.1 NAME 'ipaUniqueID' DESC 'Unique 
+ identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( endRange-oid NAME 'endRange' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.12 NAME 'sourceHostCategory' DESC 
+ 'Additional classification for hosts' EQUALITY caseIgnoreMatch ORDERING cas
+ eIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.43.1 NAME 'krbSupportedEncSaltTy
+ pes'  EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.65 NAME 'ipaWrappingMech' DESC 'P
+ KCS#11 wrapping mechanism equivalent to CK_MECHANISM_TYPE' EQUALITY caseIgn
+ oreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA 
+ v4.1' 'user defined' ) )
+attributeTypes: ( crlCache-oid NAME 'crlCache' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2200 NAME 'nsslapd-errorlog-logexpir
+ ationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList' DESC 'Li
+ st of default servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'RFC4876
+ ' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' DESC 
+ 'signed message used to support S/MIME' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5
+  X-ORIGIN 'RFC 2798' )
+attributeTypes: ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount M
+ ap Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SI
+ NGLE-VALUE X-ORIGIN 'RFC 2307bis' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.28 NAME 'idnsSecKeyRef' DESC 'PKCS
+ #11 URI of the key' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( nsSecureServerPort-oid NAME 'nsSecureServerPort' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.218 NAME 'replicaAbandonedChanges' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.66 NAME 'ipk11Extractable' DESC
+  'Key is extractable and can be wrapped' EQUALITY booleanMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' )
+  )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord' DESC 'Location, 
+ RFC 1876' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( authorityKeyNickname-oid NAME 'authorityKeyNickname' DESC 
+ 'Authority key nickname' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE 
+ X-ORIGIN ( 'user-defined' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.7 NAME 'changeType' DESC 'Changelog 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Changelog In
+ ternet Draft' )
+attributeTypes: ( usertype-oid NAME 'usertype' DESC 'Distinguish whether the
+  user is administrator, agent or subsystem.' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC '
+ Concatenated MD5 hashes of the salted NT passwords used on this account' EQ
+ UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( '
+ IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.26 NAME 'registeredAddress'  SUP postalAddress EQUAL
+ ITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.41 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.999 NAME ( 'passwordGraceLimit' 'pwd
+ GraceLoginLimit' ) DESC 'Netscape defined password policy attribute type' S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directo
+ ry Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2114 NAME 'internalCreatorsName' DES
+ C 'plugin dn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MOD
+ IFICATION USAGE directoryOperation X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.4 NAME 'externalUser' DESC 'Multiv
+ alue string attribute that allows storing user names.' EQUALITY caseIgnoreM
+ atch ORDERING caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( nsBindPassword-oid NAME 'nsBindPassword' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netsca
+ pe' )
+attributeTypes: ( 2.16.840.1.113730.3.1.812 NAME 'netscapeReversiblePassword
+ ' DESC 'password for HTTP Digest/MD5 authentication' EQUALITY octetStringMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'Netscape Web Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord' DESC 'domain nam
+ e pointer, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.6 NAME 'shadowMin' DESC 'Standard LDAP attri
+ bute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 
+ 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2226 NAME 'nsslapd-listenhost' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2184 NAME 'nsslapd-accesslog-logrota
+ tiontime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.10 NAME 'manager'  EQUALITY distin
+ guishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.62 NAME 'ntUserParms' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2296 NAME 'nsslapd-ignore-virtual-at
+ trs' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2074 NAME 'pamService' DESC 'Service
+  name to pass to pam_start' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VAL
+ UE X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.26.1 NAME 'krbPrincipalReference
+ s'  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.1 NAME 'ipk11UniqueId' DESC 'Me
+ aningless unique identifier' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2163 NAME 'winSyncWindowsFilter' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.13769.4.4 NAME 'mozillaCustom4'  EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( resourceACLS-oid NAME 'resourceACLS' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.72 NAME 'sambaTrustDirection' DESC 'D
+ irection of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.58 NAME 'ipaKeyTrust' DESC 'Key t
+ rust (unknown, trusted, distrusted)' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' )
+  )
+attributeTypes: ( 1.3.18.0.2.4.1120 NAME 'printer-print-quality-supported' D
+ ESC 'List of print qualities supported for printing documents on this print
+ er.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.13 NAME 'ipatokenOwner' DESC 'U
+ ser entry that owns this token' SUP distinguishedName EQUALITY distinguishe
+ dNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN ( 'IP
+ A OTP' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Standard LDAP attri
+ bute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.15 NAME 'idnsForwarders' DESC 'lis
+ t of forwarders' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v2' 'user define
+ d' ) )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.2 NAME 'eduPersonNickName' DESC 'Ni
+ ckName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'http://middleware.in
+ ternet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.542 NAME 'nsUniqueId' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN 'Netscape Directory 
+ Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2333 NAME 'nsds5ReplicaReleaseTimeou
+ t' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.84 NAME 'cirUseSsl' DESC 'Netscape d
+ efined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netsc
+ ape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.11 NAME 'ipaNTTrustType' DESC 'Ty
+ pe of trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE )
+attributeTypes: ( nsServerID-oid NAME 'nsServerID' DESC 'Netscape defined at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.254 NAME 'nsValueHelpURL' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 
+ 'Netscape servers - value item' )
+attributeTypes: ( expiredCerts-oid NAME 'expiredCerts' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.0.2 NAME 'dNSdefaultTTL' DESC 'An inte
+ ger denoting default time to live, RFC 2308' EQUALITY integerMatch ORDERING
+  integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN ( 'IPA 
+ v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.33 NAME 'roleOccupant'  SUP distinguishedName EQUALI
+ TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RF
+ C 4519' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' DESC 'Ide
+ ntifies type of credentials either used, required, or supported by an agent
+  or service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2101 NAME 'autoMemberDefaultGroup' D
+ ESC 'Auto Membership default group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-
+ ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.12 NAME 'ipk11Modifiable' DESC 
+ 'Can be modified by application' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.807 NAME 'nsds5replicaLastInitStart'
+  DESC 'Netscape defined attribute type' EQUALITY generalizedTimeMatch ORDER
+ ING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.31.1 NAME 'krbMinPwdLife'  EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2213 NAME 'nsslapd-userat' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.7 NAME 'ipaReplTopoManagedAgree
+ mentState' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.8 NAME 'userClass'  EQUALITY caseI
+ gnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.80 NAME 'sambaSupportedEncryptionType
+ s' DESC 'Supported encryption types of a trust' EQUALITY integerMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2283 NAME 'nsslapd-SSLclientAuth' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.1 NAME 'aliasedObjectName'  EQUALITY distinguishedNa
+ meMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'RFC 451
+ 2' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.2 NAME 'mozillaHomeStreet2'  EQUALITY 
+ caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2148 NAME 'rootdn-deny-host' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength' DESC 
+ 'Length of Password History Entries (default: 0 => off)' EQUALITY integerMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' )  SUP name 
+ EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'organizationalUnitNam
+ e' )
+attributeTypes: ( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier'  EQUALI
+ TY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.16 NAME 'mailDeliveryOption' DESC 'N
+ etscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2127 NAME 'dnaPortNum' DESC 'DNA por
+ t number of replica to get new range of values' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.222 NAME ( 'passwordMinAge' 'pwdMinA
+ ge' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.1.4.1.35 NAME 'lastLoginTime' DESC 'La
+ st login time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE dire
+ ctoryOperation X-ORIGIN 'Account Policy Plugin' )
+attributeTypes: ( SecurePort-oid NAME 'SecurePort'  SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2231 NAME 'nsslapd-ldapimaprootdn' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2197 NAME 'nsslapd-errorlog-logexpir
+ ationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.577 NAME 'cosIndirectSpecifier' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2318 NAME 'nsslapd-auditfaillog-logr
+ otationsynchour' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.71 NAME 'serverProductName' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.0 NAME 'idnsName' DESC 'DNS FQDN' 
+ EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.48.1 NAME 'krbLastSuccessfulAuth
+ '  EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE )
+attributeTypes: ( 5.3.6.1.1.1.1.1 NAME 'accessTo' DESC 'Access to which serv
+ ers user is allowed' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'nss_ldap/pam_ldap'
+  )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.3 NAME 'krbPwdMaxLife'  EQUALITY in
+ tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IP
+ A v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.249 NAME 'nsValueType' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape servers - value item' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.14.1 NAME 'krbRealmReferences'  
+ EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.9 NAME 'ipaEnabledFlag' DESC 'The 
+ flag to show if the association is active or should be ignored' EQUALITY bo
+ oleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'IPA v
+ 2' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s)
+  followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2278 NAME 'nsslapd-certdir' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1135 NAME 'printer-name' DESC 'The site-speci
+ fic administrative name of this printer.' EQUALITY caseIgnoreMatch SUBSTR c
+ aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.26 NAME 'ipatokenHOTPsyncWindow
+ ' DESC 'HOTP Sync Window (maximum synchronization skip-ahead)' EQUALITY int
+ egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA
+  OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.2 NAME 'ipaMemberCa' DESC 'Refe
+ rence to a CA member' SUP distinguishedName EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'IPA v4.2' 'user defined' 
+ ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.38 NAME 'nsLicenseEndTime' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.20 NAME 'idnsSecKeyPublish' DESC '
+ DNSSEC key (planned) publication time' EQUALITY generalizedTimeMatch ORDERI
+ NG generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE
+ -VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.200 NAME 'changeLogMaximumAge' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Directory Server' )
+attributeTypes: ( authorityDN-oid NAME 'authorityDN' DESC 'Authority DN' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.5.18.3 NAME 'creatorsName'  EQUALITY distinguishedNameMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION 
+ USAGE directoryOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.93 NAME 'passwordRetryCount' DESC 'N
+ etscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Director
+ y Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.6 NAME 'ipaNTLogonScript' DESC 'U
+ ser Logon Script Name' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrdering
+ Match SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.22 NAME 'ipaAllowedTarget' DESC '
+ Target principals alowed to get a ticket for' SUP distinguishedName EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'I
+ PA-v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2247 NAME 'nsslapd-conntablesize' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( requestSourceId-oid NAME 'requestSourceId' DESC 'CMS defin
+ ed attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.12 NAME 'ipaGroupObjectClasses'  S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( crlSize-oid NAME 'crlSize' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.21 NAME 'ipk11Distrusted' DESC 
+ 'Must not be trusted by application' EQUALITY booleanMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( nsSuiteSpotUser-oid NAME 'nsSuiteSpotUser' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2095 NAME 'connection' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.693 NAME 'inetUserHttpURL' DESC 'A u
+ sers Web addresses' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape
+  subscriber interoperability' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 h
+ ash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 1.3.18.0.2.4.1113 NAME 'printer-service-person' DESC 'The 
+ identity of the current human service person responsible for servicing this
+  printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2305 NAME 'nsslapd-moddn-aci' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.603 NAME 'dncomp' DESC 'internal ser
+ ver defined attribute type' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 2.16.840.1.113730.3.1.1099 NAME 'winSyncInterval' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.43 NAME 'dSRecord' DESC 'Delegation 
+ Signer, RFC 3658' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( revokedOn-oid NAME 'revokedOn' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( nsBaseDN-oid NAME 'nsBaseDN' DESC 'Netscape defined attrib
+ ute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.40 NAME 'ipaUserAuthType' DESC 'A
+ llowed authentication methods' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2265 NAME 'nsslapd-versionstring' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1128 NAME 'printer-compression-supported' DES
+ C 'Compression algorithms supported by this printer.' EQUALITY caseIgnoreMa
+ tch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.523 NAME 'ntUserFlags' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALUE 
+ X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.25 NAME 'mgrpDeliverTo' DESC 'Netsca
+ pe Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2132 NAME 'nsds5ReplicaEnabled' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsExecRef-oid NAME 'nsExecRef' DESC 'Netscape defined attr
+ ibute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.235 NAME 'nsSNMPContact' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.43 NAME 'ipk11KeyGenMechanism' 
+ DESC 'Mechanism used to generate this key' EQUALITY caseIgnoreMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defi
+ ned' ) )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.46.1 NAME 'krbMKey'  EQUALITY oc
+ tetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.19 NAME 'ipaNTSupportedEncryption
+ Types' DESC 'Supported encryption types of a trust' EQUALITY integerMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.591 NAME 'nsDS5ReplicaReferral' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2179 NAME 'nsslapd-errorlog-logrotat
+ ionsynchour' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2082 NAME ( 'passwordMinCategories' 
+ 'pwdMinCategories' ) DESC 'Netscape defined password policy attribute type'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Direc
+ tory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.15 NAME 'nisDomainName' DESC 'NIS 
+ domain name.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUB
+ STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.688 NAME 'nsds5replicaLastUpdateStat
+ us' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server'
+  )
+attributeTypes: ( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain'  EQUALI
+ TY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.26 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.5 NAME 'ipaCustomFields'  EQUALITY
+  caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.33 NAME 'ipaServiceWeight' DESC 'W
+ eight for the server in IPA location' EQUALITY integerMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.213 NAME 'vlvEnabled' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'Net
+ scape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2140 NAME 'passwordTrackUpdateTime' 
+ DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.37 NAME 'ipaKrbAuthzData' DESC 't
+ ype of PAC preferred by a service' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.15 X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security
+  ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
+ X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2252 NAME 'nsslapd-groupevalnestleve
+ l' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.51.1 NAME 'krbExtraData'  EQUALI
+ TY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 
+ 'List of user workstations the user is allowed to logon to' EQUALITY caseIg
+ noreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA
+  v4.4.2' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' DESC 'Standard LDAP 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 
+ 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.8.12.33 NAME 'ipaAssignedIDView' DESC 
+ 'DN of view assigned to this particular host' SUP distinguishedName EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE 
+ X-ORIGIN ( 'IPA v4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2229 NAME 'nsslapd-ldapilisten' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.40 NAME 'crossCertificatePair' DESC 'X.509 cross cer
+ tificate pair' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 40 X-ORIGIN 'RFC 4523' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.10 NAME 'ipaSudoRunAsExtGroup' DES
+ C 'Multivalue string attribute that allows storing group name the command c
+ an be run as' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMatch SUBSTR case
+ IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2
+ ' )
+attributeTypes: ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation'  EQUALI
+ TY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.8 NAME 'idnsSOAexpire' DESC 'SOA e
+ xpire value' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2310 NAME 'nsds5ReplicaFlowControlWi
+ ndow' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.69 NAME 'subtreeACI' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Nets
+ cape Directory Server 1.0' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2299 NAME 'nsslapd-connection-buffer
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2166 NAME 'schemaUpdateObjectclassRe
+ ject' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( revokedBy-oid NAME 'revokedBy' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.586 NAME 'nsDS5ReplicaUpdateSchedule
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.13769.4.1 NAME 'mozillaCustom1'  EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.55 NAME 'ipaSecretKey' DESC 'Encr
+ ypted secret key data' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.40 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2270 NAME 'nsslapd-auditlog-list' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.1003 NAME 'nsds7NewWinGroupSyncEnabl
+ ed' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.536 NAME 'ntGroupAttributes' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-
+ VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.111 NAME 'ntUniqueId' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'Standard LDA
+ P attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGI
+ N 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.30 NAME 'mgrpRFC822MailMember' DESC 
+ 'mgrpRFC822MailMember' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.26 X-ORIGIN ( 'RFC2307bis' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.18 NAME 'idnsSecInlineSigning' DES
+ C 'allow inline DNSSEC signing' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.208 NAME 'vlvScope' DESC 'Netscape d
+ efined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'Netsc
+ ape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'Non-Term
+ inal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUBSTR cas
+ eIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE
+  )
+attributeTypes: ( privateKeyData-oid NAME 'privateKeyData' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.34.1 NAME 'krbPwdHistoryLength' 
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( nsNickName-oid NAME 'nsNickName' DESC 'Netscape defined at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' DESC 'An
+  integer option' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE )
+attributeTypes: ( 2.5.4.36 NAME 'userCertificate' DESC 'X.509 user certifica
+ te' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN
+  'RFC 4523' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2104 NAME 'nsslapd-pluginConfigArea'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 2 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion'  EQUALITY 1.3.6.1.4.1.146
+ 6.109.114.1 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE NO-USER-MODIF
+ ICATION USAGE dSAOperation X-ORIGIN 'RFC 3045' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.3 NAME 'FTPUploadRatio' DESC 'Ratio 
+ (compared with FTPRatioDown) for uploaded files' EQUALITY integerMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMetho
+ d' DESC 'Specifies types authentication methods either used, required, or s
+ upported by a particular service' EQUALITY caseIgnoreMatch SUBSTR caseIgnor
+ eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'RFC4876' 
+ 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.19 NAME 'ipk11EndDate' DESC 'Va
+ lidity end date' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrde
+ ringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN ( 'IPA
+  v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.802 NAME 'nsds5ReplicaLegacyConsumer
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.20 NAME 'memberService' DESC 'Refe
+ rence to the pam service of this operation.' SUP distinguishedName EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA 
+ v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2216 NAME 'nsslapd-require-secure-bi
+ nds' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsKeyfile-oid NAME 'nsKeyfile' DESC 'Netscape defined attr
+ ibute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.52 NAME 'replicaUpdateSchedule' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.7 NAME 'photo'  SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.23 X-ORIGIN 'RFC 1274' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.70 NAME 'ipk11UnwrapTemplate' D
+ ESC 'DN of template to apply to keys unwrapped using this key' EQUALITY dis
+ tinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORI
+ GIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2286 NAME 'nsslapd-outbound-ldap-io-
+ timeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.6 NAME ( 'c' 'countryName' )  SUP name EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.11 SINGLE-VALUE X-ORIGIN 'RFC 4519' X-DEPRECATED 'countryName' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2064 NAME 'nsSaslMapRegexString' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2153 NAME ( 'passwordAdminDN' 'pwdAd
+ minDN' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server'
+  )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' DESC 'Minimu
+ m password age, in seconds (default: 0 => allow immediate password change)'
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.48 NAME 'ipaPermTargetFilter' DES
+ C 'IPA permission target filter' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.5.4.14 NAME 'searchGuide'  SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.25 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( version-oid NAME 'version' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.106 NAME ( 'passwordMaxFailure' 'pwd
+ MaxFailure' ) DESC 'Netscape defined password policy attribute type' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Se
+ rver' )
+attributeTypes: ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Standard L
+ DAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 2307
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2234 NAME 'nsslapd-ldapigidnumbertyp
+ e' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.572 NAME 'nsTimeLimit' DESC 'Binder-
+ based search operation time limit (seconds)' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Directory S
+ erver' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2323 NAME 'nsslapd-auditfaillog-loge
+ xpirationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.74 NAME 'administratorContactInfo' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsClassname-oid NAME 'nsClassname' DESC 'Netscape defined 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.244 NAME 'nsValueCES' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Net
+ scape servers - value item' )
+attributeTypes: ( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService' DESC 'IAN
+ A GSS-API authorized service name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 X-ORIGIN 'NSS LDAP schema' )
+attributeTypes: ( allowWeakCipher-oid NAME 'allowWeakCipher' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2171 NAME 'nsslapd-accesslog-maxlogs
+ perdir' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.4 NAME 'fqdn' DESC 'FQDN' EQUALITY
+  caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2203 NAME 'nsslapd-errorlog-logging-
+ enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' DESC 'Time to l
+ ive, in seconds, before a profile is considered stale' EQUALITY integerMatc
+ h ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE
+ -VALUE X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.5 NAME 'ipaCertProfileCategory'
+  DESC 'Additional classification for certificate profiles' EQUALITY caseIgn
+ oreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.2' 'user defined' )
+  )
+attributeTypes: ( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key v
+ alue' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGL
+ E-VALUE X-ORIGIN 'RFC 2307bis' )
+attributeTypes: ( nsDeleteclassname-oid NAME 'nsDeleteclassname' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Administration Services' )
+attributeTypes: ( nsmsgNumMsgQuota-oid NAME 'nsmsgNumMsgQuota' DESC 'Netscap
+ e Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.65 NAME 'ipk11Unwrap' DESC 'Key
+  supports unwrapping' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( nsAdminCgiWaitPid-oid NAME 'nsAdminCgiWaitPid' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC 'iden
+ tifies a department within an organization' EQUALITY caseIgnoreMatch SUBSTR
+  caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'R
+ FC 2798' )
+attributeTypes: ( 2.16.840.1.113730.3.1.550 NAME 'cosAttribute' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'N
+ etscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.96 NAME ( 'passwordHistory' 'pwdHist
+ ory' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.5 USAGE directoryOperation X-ORIGIN 'Netscape Director
+ y Server' )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.5 NAME 'krbLastAdminUnlock'  EQUALIT
+ Y generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' DESC '
+ Time of the last bad password attempt' EQUALITY integerMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.9 NAME 'ipaNTHomeDirectoryDrive' 
+ DESC 'User Home Drive Letter' EQUALITY caseIgnoreMatch ORDERING caseIgnoreO
+ rderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.5.4.21 NAME 'telexNumber'  SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.52 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( numberOfRenewals-oid NAME 'numberOfRenewals' DESC 'CMS def
+ ined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2117 NAME 'dnaNextValue' DESC 'DNA n
+ ext available value for assignment' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SI
+ NGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.7 NAME 'ipaSudoRunAsExtUser' DESC 
+ 'Multivalue string attribute that allows storing user name the command can 
+ be run as' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMatch SUBSTR caseIgn
+ oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2098 NAME 'autoMemberFilter' DESC 'A
+ uto Membership filter criteria' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.17 NAME 'RPRecord' DESC 'Responsible
+  Person, RFC 1183' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user 
+ defined' ) )
+attributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'Standard LDAP attri
+ bute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 
+ 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2221 NAME 'nsslapd-validate-cert' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2187 NAME 'nsslapd-accesslog-logrota
+ tiontimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2308 NAME 'nstombstonecsn' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.61 NAME 'ntUserUsrComment' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2291 NAME 'nsslapd-disk-monitoring-g
+ race-period' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2077 NAME ( 'passwordMinUppers' 'pwd
+ MinUppers' ) DESC 'Netscape defined password policy attribute type' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Ser
+ ver' )
+attributeTypes: ( SecureEEClientAuthPort-oid NAME 'SecureEEClientAuthPort'  
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.407 NAME 'nsSynchUniqueAttribute' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DES
+ C 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 
+ ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2268 NAME 'nsslapd-accesslog-list' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1125 NAME 'printer-finishings-supported' DESC
+  'The possible finishing operations supported by this printer.' EQUALITY ca
+ seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.8 NAME 'ipatokenOTPkey' DESC 'O
+ TP Token Key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.4
+ 0 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 2.5.21.6 NAME 'objectClasses'  EQUALITY objectIdentifierFi
+ rstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOpera
+ tion X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.16 NAME 'ipatokenRadiusServer' 
+ DESC 'Server String Configuration' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( cmsUserGroup-oid NAME 'cmsUserGroup' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.28 NAME 'mgrpMsgRejectAction' DESC '
+ Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 1.3.6.1.1.1.1.29 NAME 'nisSecretkey' DESC 'nisSecretkey' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 
+ 'RFC2307bis' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2135 NAME 'nsds5ReplicaCleanRUV' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.10 NAME 'idnsUpdatePolicy' DESC 'D
+ NS dynamic updates policy' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 
+ 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.230 NAME 'nsslapd-pluginDescription'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsAdminCacheLifetime-oid NAME 'nsAdminCacheLifetime' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.327 NAME 'nsIndexType' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.545 NAME 'nscpEntryDN' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE
+  NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN 'Netscape Directory
+  Server' )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.5 NAME 'eduPersonPrimaryAffiliation
+ ' DESC 'Primary Affiliation' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE X-ORIGIN 'http://middleware.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.83 NAME 'cirUsePersistentSearch' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.12 NAME 'ipaNTTrustAttributes' DE
+ SC 'Trust attributes for a trusted domain' EQUALITY integerMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.10 NAME 'javaFactory' DESC 'Fully 
+ qualified Java class name of a JNDI object factory' EQUALITY caseExactMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 2713' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.11 NAME 'ipk11Private' DESC 'Is
+  private to application' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry'  EQUALITY distinguished
+ NameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFIC
+ ATION USAGE directoryOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2085 NAME 'isReplicated' DESC 'Chang
+ elog attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 X-ORIGIN 'Netscape
+  Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.18 NAME 'managedBy' DESC 'DNs of e
+ ntries allowed to manage' SUP distinguishedName EQUALITY distinguishedNameM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.683 NAME 'nsds5ReplicaTombstonePurge
+ Interval' DESC 'Netscape defined attribute type' EQUALITY integerMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory 
+ Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'Sta
+ ndard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 
+ 'RFC 1274' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.2 NAME 'ipaReplTopoSegmentDirec
+ tion' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.1100 NAME 'oneWaySync' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
+  X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.68 NAME 'ipk11NeverExtractable'
+  DESC 'Key has never been extractable' EQUALITY booleanMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( nsConfigRoot-oid NAME 'nsConfigRoot' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' 
+ )
+attributeTypes: ( requestType-oid NAME 'requestType' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.10.1 NAME 'krbMaxRenewableAge'  
+ EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.7 NAME 'mozillaHomeUrl'  EQUALITY case
+ IgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Moz
+ illa Address Book' )
+attributeTypes: ( issuedBy-oid NAME 'issuedBy' DESC 'CMS defined attribute' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.30 NAME 'ipaSELinuxUser' DESC 'An
+  SELinux user' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SU
+ BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2255 NAME 'passwordIsGlobalPolicy' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( requestState-oid NAME 'requestState' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTelephon
+ eNumber' )  EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 X-ORIGIN 'RFC 4524' X-DEPRECATED 
+ 'mobileTelephoneNumber' )
+attributeTypes: ( nsAdminDomainName-oid NAME 'nsAdminDomainName' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.15 NAME 'mailAutoReplyText' DESC 'Ne
+ tscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2122 NAME 'dnaMaxValue' DESC 'DNA ma
+ ximum value to assign' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-
+ ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.225 NAME 'nsslapd-pluginInitfunc' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsAdminEndUserHTMLIndex-oid NAME 'nsAdminEndUserHTMLIndex'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.2.1.3 NAME 'accountInactivityLimit' DES
+ C 'Account inactivity limit' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE X-ORIGIN 'Account Policy Plugin' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver
+  letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined
+ ' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2192 NAME 'nsslapd-auditlog-logmaxdi
+ skspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsBuildSecurity-oid NAME 'nsBuildSecurity' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.3 NAME 'idnsSOAmName' DESC 'SOA Na
+ me' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.708 NAME 'vacationenddate' DESC 'Net
+ scape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.581 NAME 'nsDS5ReplicaBindDN' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORI
+ GIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2169 NAME 'nsslapd-pagedsizelimit' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( mgrpApprovePassword-oid NAME 'mgrpApprovePassword' DESC 'N
+ etscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' D
+ ESC 'Forest trust information for a trusted domain object' EQUALITY caseExa
+ ctMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' 'user 
+ defined' ) )
+attributeTypes: ( 1.3.18.0.2.4.1136 NAME 'printer-location' DESC 'The physic
+ al location of this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'rf
+ c3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.25 NAME 'ipatokenHOTPauthWindow
+ ' DESC 'HOTP Auth Window (maximum authentication skip-ahead)' EQUALITY inte
+ gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA 
+ OTP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.531 NAME 'ntUserBadPwCount' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-V
+ ALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord'  EQUALITY caseI
+ gnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.37 NAME 'nsLicenseStartTime' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.23 NAME 'idnsSecKeyDelete' DESC 'D
+ NSSEC key (planned) deletion timestamp' EQUALITY generalizedTimeMatch ORDER
+ ING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.203 NAME 'replicaEntryFilter' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORI
+ GIN 'Netscape Directory Server' )
+attributeTypes: ( authorityID-oid NAME 'authorityID' DESC 'Authority ID' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' DESC 'Share 
+ Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.1 NAME 'ipaExternalMember' DESC '
+ External Group Member Identifier' EQUALITY caseIgnoreMatch ORDERING caseIgn
+ oreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v3' '
+ user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2242 NAME 'nsslapd-securePort' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.39 NAME 'certificateRevocationList' DESC 'X.509 cert
+ ificate revocation list' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.40 X-ORIGIN 'RFC 4523' )
+attributeTypes: ( nsAdminAccountInfo-oid NAME 'nsAdminAccountInfo' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.24 NAME 'ipk11Local' DESC 'Was 
+ created locally on token' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2090 NAME 'mepRDNAttr' DESC 'Managed
+  Entries RDN attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '389 
+ Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.696 NAME 'inetSubscriberResponse' DE
+ SC 'Used to confirm subscriberIdentity.  This attribute holds the response 
+ phrase and is used in conjunction with the inetSubscriberChallenge' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Netscape subscriber in
+ teroperability' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Accoun
+ t Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
+ INGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.50 NAME 'uniqueMember'  EQUALITY uniqueMemberMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.34 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2219 NAME 'nsslapd-minssf' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1114 NAME 'printer-delivery-orientation-suppo
+ rted' DESC 'The possible delivery orientations of pages as they are printed
+  and ejected from this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 1.3.6.1.4.1.250.1.60 NAME ( 'ttl' 'timeToLive' ) DESC 'tim
+ e to live in seconds for cached objects' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 X-ORIGIN 'LDAP Caching Internet Draft' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.42.1 NAME 'krbDefaultEncSaltType
+ s'  EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.1.2300 NAME 'nsslapd-connection-nocano
+ n' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.59 NAME 'ntUserPriv' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALUE X-
+ ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2289 NAME 'nsslapd-disk-monitoring' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsDefaultObjectClass-oid NAME 'nsDefaultObjectClass' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Administration Services' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.8 NAME 'mozillaWorkStreet2'  EQUALITY 
+ caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2156 NAME 'nsslapd-sasl-max-buffer-s
+ ize' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2260 NAME 'nsslapd-result-tweak' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.45 NAME 'ipaPermBindRuleType' DES
+ C 'IPA permission bind rule type' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.526 NAME 'ntUserLastLogon' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.101 NAME ( 'passwordInHistory' 'pwdI
+ nHistory' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' DESC 'Standard LDAP att
+ ribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RF
+ C 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.20 NAME 'mailProgramDeliveryInfo' DE
+ SC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 1.2.840.113556.1.4.481 NAME 'calCalAdrURI' DESC 'RFC2739: 
+ URI for event equests destination' EQUALITY caseIgnoreIA5Match SUBSTR caseI
+ gnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'rfc2
+ 739' )
+attributeTypes: ( 2.16.840.1.113730.3.1.238 NAME 'nsSNMPMasterPort' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an integer
+  to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrder
+ ingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'SUDO' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2326 NAME 'nsslapd-auditfaillog-logg
+ ing-hide-unhashed-pw' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.7 NAME 'javaCodebase' DESC 'URL(s)
+  specifying the location of class definition' EQUALITY caseExactIA5Match SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 2713' )
+attributeTypes: ( firstUnsaved-oid NAME 'firstUnsaved' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.594 NAME 'nsDS5ReplicatedAttributeLi
+ stTotal' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2174 NAME 'nsslapd-auditlog-maxlogsi
+ ze' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.10 NAME 'sourceHost' DESC 'Link to
+  a host or group of hosts' SUP memberHost EQUALITY distinguishedNameMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2206 NAME 'nsslapd-unhashed-pw-switc
+ h' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.63 NAME 'ipaOriginalUid' DESC 'Or
+ iginal UID of overriden user' EQUALITY caseIgnoreMatch ORDERING caseIgnoreO
+ rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( '
+ IPA v4' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList' DESC '
+ List of preferred servers' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'RFC
+ 4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.42 NAME 'ntUserCreateNewAccount' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.8 NAME 'ipaDefaultPrimaryGroup'  E
+ QUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'PKCS #12
+  PFX PDU for exchange of personal identity information' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.5 X-ORIGIN 'RFC 2798' )
+attributeTypes: ( 2.16.840.1.113730.3.1.5 NAME 'changeNumber' DESC 'Changelo
+ g attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'Changelog 
+ Internet Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2143 NAME 'nsslapd-sasl-mapping-fall
+ back' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'if TRUE, subordinate
+  entries may exist' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .7 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN 'num
+ Subordinates Internet Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.38 NAME 'ipaNTSIDBlacklistIncomin
+ g' DESC 'Extra SIDs filtered out from incoming MS-PAC' EQUALITY caseIgnoreI
+ A5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 X-ORIGIN 'IPA v3' )
+attributeTypes: ( SecureAgentPort-oid NAME 'SecureAgentPort'  SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.5.4.24 NAME 'x121Address'  EQUALITY numericStringMatch S
+ UBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 X-O
+ RIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.997 NAME 'pwdpolicysubentry' DESC 'N
+ etscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.12 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Director
+ y Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.2 NAME 'memberDenyCmd' DESC 'Refer
+ ence to a command or group of commands that are denied by the rule.' SUP di
+ stinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.12 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2224 NAME 'nsslapd-port' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VAL
+ UE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'Standard LDAP attr
+ ibute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'RFC
+  2307' )
+attributeTypes: ( 2.5.4.43 NAME 'initials'  SUP name EQUALITY caseIgnoreMatc
+ h SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.30.1 NAME 'krbMaxPwdLife'  EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.13 NAME 'sudoCmd' DESC 'Command(s)
+  to be executed by sudo' EQUALITY caseExactMatch ORDERING caseExactMatch SU
+ BSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2313 NAME 'nsslapd-changelogtrim-int
+ erval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.64 NAME 'ntUserNumLogons' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VAL
+ UE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2294 NAME 'nsslapd-ndn-cache-max-siz
+ e' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2161 NAME 'nsIndexIDListScanLimit' D
+ ESC 'fine grained idlistscanlimit - per index/type/value' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.589 NAME 'nsDS5ReplicaType' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.13769.4.2 NAME 'mozillaCustom2'  EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Start o
+ f time interval for which the entry is valid' EQUALITY generalizedTimeMatch
+  ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  X-ORIGIN 'SUDO' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.70 NAME 'sambaTrustType' DESC 'Type o
+ f trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.56 NAME 'ipaCertSubject' DESC 'Su
+ bject name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2273 NAME 'nsslapd-config' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass'  EQUALITY objectIden
+ tifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIF
+ ICATION USAGE directoryOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.3 NAME 'ipatokenNotBefore' DESC
+  'Token validity date' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.24 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( nsDisplayName-oid NAME 'nsDisplayName' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+  Administration Services' )
+attributeTypes: ( authorityParentDN-oid NAME 'authorityParentDN' DESC 'Autho
+ rity Parent DN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 
+ 'user defined' )
+attributeTypes: ( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'Standard LDAP att
+ ribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2138 NAME 'nsslapd-readonly' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.55 NAME 'ipk11WrapTemplate' DES
+ C 'DN of template of keys which can be wrapped using this key' EQUALITY dis
+ tinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORI
+ GIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2331 NAME 'nsslapd-logging-hr-timest
+ amps-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.86 NAME 'cirLastUpdateApplied' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Directory Server' )
+attributeTypes: ( certProfileConfig-oid NAME 'certProfileConfig' DESC 'Certi
+ ficate profile configuration' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN
+  'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.0.0 NAME 'dNSTTL' DESC 'An integer den
+ oting time to live' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 )
+attributeTypes: ( 2.5.4.31 NAME 'member'  SUP distinguishedName EQUALITY dis
+ tinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 4519
+ ' )
+attributeTypes: ( sslVersionMax-oid NAME 'sslVersionMax' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 2.16.840.1.113730.3.1.252 NAME 'nsValueDescription' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORI
+ GIN 'Netscape servers - value item' )
+attributeTypes: ( userstate-oid NAME 'userstate' DESC 'Distinguish whether t
+ he user is administrator, agent or subsystem.' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2107 NAME 'nsPagedSizeLimit' DESC 'B
+ inder-based simple paged search operation size limit' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 SINGLE-VALUE USAGE directoryOperation X-ORIGIN '389' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.17.1 NAME 'krbKdcServers'  EQUAL
+ ITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope' DESC '
+ Default scope used when performing a search' EQUALITY caseIgnoreIA5Match SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user 
+ defined' ) )
+attributeTypes: ( tokenSubject-oid NAME 'tokenSubject' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.805 NAME 'nsds5replicaTimeout' DESC 
+ 'Netscape defined attribute type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2088 NAME 'mepStaticAttr' DESC 'Mana
+ ged Entries static attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN
+  '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.23 NAME 'ipaCertificateSubjectBase
+ '  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( keyInfo-oid NAME 'keyInfo' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.74 NAME 'ipaDNSVersion' DESC 'IPA
+  DNS data version' EQUALITY integerMatch ORDERING integerOrderingMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA v4.3' 'user d
+ efined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2211 NAME 'nsslapd-dynamicconf' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.51 NAME 'replicaUpdateReplayed' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.5 NAME 'ipaReplTopoSegmentStatu
+ s' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2281 NAME 'nsslapd-saslpath' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' )  SUP name EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'commonName' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2067 NAME 'pamIncludeSuffix' DESC 'S
+ uffixes to include for PAM authentication' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.12 X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( UnSecurePort-oid NAME 'UnSecurePort'  SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.199 NAME 'memberCertificateDescripti
+ on' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.26 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2312.4.3.3.1 NAME 'sabayonProfileURL' DESC 'Th
+ e URL of a sabayon profile' SUP labeledURI EQUALITY caseExactMatch SUBSTR c
+ aseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Saba
+ yon' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdChange'
+  DESC 'Allow Machine Password changes (default: 0 => off)' EQUALITY integer
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.17 NAME 'postalCode'  EQUALITY caseIgnoreMatch SUBST
+ R caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2258 NAME 'nsslapd-csnlogging' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsSSL2-oid NAME 'nsSSL2' DESC 'Netscape defined attribute 
+ type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.109 NAME ( 'passwordLockoutDuration'
+  'pwdLockoutDuration' ) DESC 'Netscape defined password policy attribute ty
+ pe' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Di
+ rectory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'Standard LDAP a
+ ttribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'Netscape Me
+ ssaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2125 NAME 'dnaThreshold' DESC 'DNA t
+ hreshold for getting next range of values' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.220 NAME ( 'passwordMustChange' 'pwd
+ MustChange' ) DESC 'Netscape defined password policy attribute type' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Se
+ rver' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2237 NAME 'nsslapd-counters' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2195 NAME 'nsslapd-auditlog-logminfr
+ eediskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.575 NAME 'nsRoleDN' DESC 'Netscape d
+ efined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE directory
+ Operation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.19.2.3 NAME 'ipaMaxDomainLevel' DESC
+  'Maximal supported Domain Level value' EQUALITY numericStringMatch ORDERIN
+ G numericStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE X-OR
+ IGIN ( 'IPA v4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.73 NAME 'installationTimeStamp' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.247 NAME 'nsValueBin' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'Nets
+ cape servers - value item' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.7 NAME 'memberHost' DESC 'Referenc
+ e to a device where the operation takes place (usually host).' SUP distingu
+ ishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .12 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(
+ s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( 1.3.18.0.2.4.1133 NAME 'printer-ipp-versions-supported' DE
+ SC 'IPP protocol version(s) that this printer supports.' EQUALITY caseIgnor
+ eMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.20 NAME 'ipatokenUserMapAttribu
+ te' DESC 'Attribute to map from the user entry for RADIUS server authentica
+ tion' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.28 NAME 'mXRecord'  EQUALITY caseI
+ gnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.26 NAME 'idnsSecKeySep' DESC 'DNSK
+ EY SEP flag (equivalent to bit 15): RFC 4035' EQUALITY booleanMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defin
+ ed' ) )
+attributeTypes: ( 2.5.18.1 NAME 'createTimestamp'  EQUALITY generalizedTimeM
+ atch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN 'R
+ FC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.553 NAME 'costemplatedn' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VAL
+ UE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.95 NAME 'accountUnlockTime' DESC 'Ne
+ tscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.24 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Directory
+  Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.20 NAME 'memberPrincipal' DESC 'P
+ rincipal names member of a groupOfPrincipals group' EQUALITY caseIgnoreMatc
+ h SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN ( 'IPA-v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.4 NAME 'ipaNTFallbackPrimaryGroup
+ ' DESC 'Fallback Group to set the Primary group Security Identifier for use
+ rs with UPGs' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2245 NAME 'nsslapd-maxthreadsperconn
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.39.1 NAME 'krbPrincipalKey'  EQU
+ ALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.10 NAME 'ipaPwdExpAdvNotify'  EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2112 NAME 'ntGroupType' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALU
+ E X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.23 NAME 'ipk11Id' DESC 'Key ass
+ ociation identifier' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.40 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( numberOfEnrollments-oid NAME 'numberOfEnrollments' DESC 'C
+ MS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user d
+ efined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord' DESC 'mailbox 
+ or mail list information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR case
+ IgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC '
+ Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.691 NAME 'inetDomainStatus' DESC '"a
+ ctive", "inactive", or "deleted" status of a domain' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape subscriber interoperability'
+  )
+attributeTypes: ( 1.3.18.0.2.4.1111 NAME 'printer-job-k-octets-supported' DE
+ SC 'The maximum size in kilobytes (1,024 octets actually) incoming print jo
+ b that this printer will accept.' EQUALITY integerMatch ORDERING integerOrd
+ eringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'rfc3
+ 712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2182 NAME 'nsslapd-errorlog-logrotat
+ ionsyncmin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.788 NAME 'mgrpBroadcasterPolicy' DES
+ C 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( crlNumber-oid NAME 'crlNumber' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.601 NAME 'adminRole' DESC 'Administr
+ ative role' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Delegat
+ ed Administrator' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2072 NAME 'pamFallback' DESC 'Fallba
+ ck to regular LDAP BIND if PAM auth fails' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.7 SINGLE-VALUE X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2159 NAME 'dnaRemoteConnProtocol' DE
+ SC 'Connection protocol: LDAP, TLS, or SSL' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( nsLogSuppress-oid NAME 'nsLogSuppress' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.68 NAME 'sambaClearTextPassword' DESC
+  'Clear text password (used for trusted domain passwords)' EQUALITY octetSt
+ ringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.5.21.1 NAME 'dITStructureRules'  EQUALITY integerFirstCo
+ mponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOperation 
+ X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 1.3.18.0.2.4.1126 NAME 'printer-pages-per-minute-color' DE
+ SC 'The nominal number of color pages per minute which may be output by thi
+ s printer.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.521 NAME 'ntUserHomeDir' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VAL
+ UE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.15 NAME 'ipatokenRadiusConfigLi
+ nk' DESC 'Corresponding Radius Configuration link' SUP distinguishedName EQ
+ UALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-V
+ ALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 1.2.840.113556.1.4.484 NAME 'calOtherCAPURIs' DESC 'RFC273
+ 9: multi-value URI to other calendars' EQUALITY caseIgnoreIA5Match SUBSTR c
+ aseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN '
+ rfc2739' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.50.1 NAME 'krbLoginFailedCount' 
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.13 NAME 'idnsAllowSyncPTR' DESC 'p
+ ermit synchronization of PTR records' EQUALITY booleanMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2130 NAME 'dnaRangeRequestTimeout' D
+ ESC 'DNA timeout for querying replica for next range of values' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.233 NAME 'nsSNMPOrganization' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORI
+ GIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord' DESC 'Key Exchang
+ e Delegation, RFC 2230' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Sub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms'
+   SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation X-ORIGIN 'RFC 451
+ 2' )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.8 NAME 'eduPersonPrimaryOrgUnitDN' 
+ DESC 'Primary Organizational Unit' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-O
+ RIGIN 'http://middleware.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2329 NAME ( 'passwordSendExpiringTim
+ e' 'pwdSendExpiringTime' ) DESC 'Netscape defined password policy attribute
+  type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape
+  Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.17 NAME 'ipaNTTrustForestTrustInf
+ o' DESC 'Forest trust information for a trusted domain object' EQUALITY oct
+ etStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( nsHardwarePlatform-oid NAME 'nsHardwarePlatform' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.8 NAME 'FTPuid' DESC 'System uid (ov
+ errides uidNumber if present)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( transName-oid NAME 'transName' DESC 'CMS defined attribute
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.14 NAME 'ipk11Copyable' DESC 'C
+ an be copied by application' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2080 NAME ( 'passwordMin8bit' 'pwdMi
+ n8bit' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server'
+  )
+attributeTypes: ( 2.16.840.1.113730.3.1.686 NAME 'nsds5replicaLastUpdateEnd'
+  DESC 'Netscape defined attribute type' EQUALITY generalizedTimeMatch ORDER
+ ING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2209 NAME 'nsslapd-rootpwstoragesche
+ me' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.49 NAME 'replicaUpdateFailedAt' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.3 NAME 'ipaSearchTimeLimit'  EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.31 NAME 'idnsServerId' DESC 'DNS s
+ erver identifier' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.8 NAME 'changes' DESC 'Changelog att
+ ribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN 'Changelog Intern
+ et Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2146 NAME 'rootdn-days-allowed' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.37.1 NAME 'krbPasswordExpiration
+ '  EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.35 NAME 'ipaBaseRID' DESC 'First 
+ value of a RID range' EQUALITY integerMatch ORDERING integerOrderingMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user 
+ defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2250 NAME 'nsslapd-ioblocktimeout' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension'  SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelephoneN
+ umber' )  EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 X-ORIGIN 'RFC 4524' X-DEPRECATED 'p
+ agerTelephoneNumber' )
+attributeTypes: ( 2.16.840.1.113730.3.1.10 NAME 'deleteOldRdn' DESC 'Changel
+ og attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 X-ORIGIN 'Changelog 
+ Internet Draft' )
+attributeTypes: ( 2.16.840.1.113730.3.1.228 NAME 'nsslapd-pluginVersion' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logo
+ n script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.46 NAME 'dnQualifier'  EQUALITY caseIgnoreMatch ORDE
+ RING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.44 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2316 NAME 'nsslapd-auditfaillog-maxl
+ ogsize' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.6 NAME 'idnsSOArefresh' DESC 'SOA 
+ refresh value' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.614 NAME 'copyingFrom' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
+  USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.5 NAME 'krbPwdAllowedKeysalts'  EQU
+ ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE 
+ X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( nsSSLToken-oid NAME 'nsSSLToken' DESC 'Netscape defined at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.584 NAME 'nsDS5ReplicaRoot' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2164 NAME 'winSyncSubtreePair' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.53 NAME 'ipaPublicKey' DESC 'Publ
+ ic key as DER-encoded SubjectPublicKeyInfo (RFC 5280)' EQUALITY octetString
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN ( 'IPA v4.1' 'user defi
+ ned' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2276 NAME 'nsslapd-lockdir' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.6 NAME 'ipatokenModel' DESC 'Op
+ tional Model identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA O
+ TP' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.1001 NAME 'nsds7DirectoryReplicaSubt
+ ree' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.534 NAME 'ntUserPrimaryGroupId' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SING
+ LE-VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.18 NAME 'ipatokenRadiusTimeout'
+  DESC 'Server Timeout' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTelepho
+ neNumber' )  EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 X-ORIGIN 'RFC 4524' X-DEPRECATED
+  'homeTelephoneNumber' )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.8 NAME 'ipaCaSubjectDN' DESC 'S
+ ubject DN' SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'IPA v4.4 Lightweight CAs' 'user defi
+ ned' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.32 NAME 'mgrpMsgMaxSize' DESC 'Netsc
+ ape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.206 NAME 'filterInfo' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Net
+ scape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1140 NAME 'printer-uri' DESC 'A URI supported
+  by this printer.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2334 NAME 'ntUserNtPassword' DESC 'N
+ etscape defined attribute type, synced or generated NT Password hash' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALUE X-ORIGIN 'Netscape NT Synchroni
+ zation' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Optio
+ n Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.5.4.34 NAME 'seeAlso'  SUP distinguishedName EQUALITY di
+ stinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 451
+ 9' )
+attributeTypes: ( nsSSL3Ciphers-oid NAME 'nsSSL3Ciphers' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.5 NAME 'FTPUploadBandwidth' DESC 'Ba
+ ndwidth (in KB/s) to limit upload speeds to' EQUALITY integerMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2093 NAME 'nsslapd-changelogsuffix' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
+  X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.26 NAME 'ipaSELinuxUserMapDefault'
+  DESC 'Default SELinux user' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMa
+ tch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( nsUniqueAttribute-oid NAME 'nsUniqueAttribute' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.71 NAME 'ipaPermTargetFrom' DESC 
+ 'Source location from where moving an entry IPA permission ACI' EQUALITY di
+ stinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-OR
+ IGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2214 NAME 'nsslapd-svrtab' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.53 NAME 'deltaRevocationList' DESC 'X.509 delta revo
+ cation list' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
+  X-ORIGIN 'RFC 4523' )
+attributeTypes: ( 1.3.18.0.2.4.1119 NAME 'printer-natural-language-configure
+ d' DESC 'The configured natural language in which error and status messages
+  will be generated (by default) by this printer.' EQUALITY caseIgnoreMatch 
+ SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.1.1 NAME 'krbPrincipalName'  EQU
+ ALITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.2303 NAME 'nsslapd-ignore-time-skew'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.54 NAME 'replicaUseSSL' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'N
+ etscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' )  EQUALIT
+ Y caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'userid' )
+attributeTypes: ( 2.16.840.1.113730.3.1.609 NAME 'nsds5BeginReplicaRefresh' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2284 NAME 'nsslapd-ssl-check-hostnam
+ e' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.1097 NAME 'nsds5replicaBusyWaitTime'
+  DESC 'Netscape defined attribute type' EQUALITY integerMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' )  SUP name EQUA
+ LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 X-ORIGIN 'RFC 4519' X-DEPRECATED 'stateOrProvinceName' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.45 NAME 'IPSECKEYRecord' DESC 'IPSEC
+ KEY, RFC 4025' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user defi
+ ned' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME 'nsslapd-plugin-depends-on
+ -type' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsViewConfiguration-oid NAME 'nsViewConfiguration' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.25.1 NAME 'krbSearchScope'  EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' DESC 'Fo
+ rce Users to logon for password change (default: 0 => off, 2 => on)' EQUALI
+ TY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.46 NAME 'ipaPermLocation' DESC 'L
+ ocation of IPA permission ACI' EQUALITY distinguishedNameMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN ( 'IPA v4.0' 'user defined' 
+ ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2263 NAME 'nsslapd-maxsasliosize' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 S
+ INGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.529 NAME 'ntUserMaxStorage' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-V
+ ALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( CACertExtractFile-oid NAME 'CACertExtractFile' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.104 NAME ( 'passwordWarning' 'pwdExp
+ ireWarning' ) DESC 'Netscape defined password policy attribute type' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Se
+ rver' )
+attributeTypes: ( 1.3.6.1.1.1.1.12 NAME 'memberUid' DESC 'Standard LDAP attr
+ ibute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'RFC 2307' )
+attributeTypes: ( nsAccessLog-oid NAME 'nsAccessLog' DESC 'Netscape defined 
+ attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2128 NAME 'dnaSecurePortNum' DESC 'D
+ NA secure port number of replica to get new range of values' SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( dateOfRecovery-oid NAME 'dateOfRecovery' DESC 'CMS defined
+  attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( ServerKeyExtractFile-oid NAME 'ServerKeyExtractFile' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Next NT 
+ rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( nsPidLog-oid NAME 'nsPidLog' DESC 'Netscape defined attrib
+ ute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2198 NAME 'nsslapd-auditlog-logexpir
+ ationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.570 NAME 'nsLookThroughLimit' DESC '
+ Binder-based search operation look through limit (candidate entries)' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE directoryOperation X-ORI
+ GIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.1.1.12 NAME 'nisNetIdUser' DESC 'nisNe
+ tIdUser' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-
+ ORIGIN ( 'RFC2307bis' 'user defined' ) )
+attributeTypes: ( nsCertfile-oid NAME 'nsCertfile' DESC 'Netscape defined at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2321 NAME 'nsslapd-auditfaillog-logm
+ axdiskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.76 NAME 'serverHostName' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.242 NAME 'nsSystemIndex' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '
+ Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.18.2.2 NAME 'ipaVaultSalt' DESC 'IPA
+  vault salt' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
+  X-ORIGIN ( 'IPA v4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2177 NAME 'nsslapd-auditlog-logrotat
+ ionsync-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.2 NAME 'ipaClientVersion' DESC 'Te
+ xt string describing client version of the IPA software installed' EQUALITY
+  caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.13 NAME 'accessRuleType' DESC 'The
+  flag to represent if it is allow or deny rule.' EQUALITY caseIgnoreMatch O
+ RDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.64 NAME 'ipaSecretKeyRef' DESC 'D
+ N of the ipa key object' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.12 X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2201 NAME 'nsslapd-auditlog-logexpir
+ ationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase' DESC 'De
+ fault base for searches' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.12 SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( nsServerCreationClassname-oid NAME 'nsServerCreationClassn
+ ame' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.41 NAME 'ntUserDomainId' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VAL
+ UE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.29 NAME 'idnsTemplateAttribute' DE
+ SC 'Template attribute for dynamic attribute generation' EQUALITY caseIgnor
+ eIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4' 'user 
+ defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.67 NAME 'ipk11AlwaysSensitive' 
+ DESC 'Key has always been sensitive' EQUALITY booleanMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.219 NAME 'vlvUses' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'Netsca
+ pe Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord' DESC 'IPv6 addr
+ ess, RFC 1886' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.973 NAME 'nsds5ReplConflict' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE 
+ directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.18.4 NAME 'modifiersName'  EQUALITY distinguishedNameM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION
+  USAGE directoryOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.98 NAME 'passwordExp' DESC 'Netscape
+  defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.27 NAME 'destinationIndicator'  EQUALITY caseIgnoreM
+ atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 
+ X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2248 NAME 'nsslapd-reservedescriptor
+ s' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( tokenIP-oid NAME 'tokenIP' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2115 NAME 'dnaType' DESC 'DNA attrib
+ ute type to maintain' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '389 Di
+ rectory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.5 NAME 'ipaSudoOpt' DESC 'Options(
+ s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 X-ORIGIN 'IPA v2' )
+attributeTypes: ( subjectName-oid NAME 'subjectName' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2227 NAME 'nsslapd-snmp-index' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.7 NAME 'shadowMax' DESC 'Standard LDAP attri
+ bute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'RFC 
+ 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2185 NAME 'nsslapd-errorlog-logrotat
+ iontime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion'  EQUALIT
+ Y caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.63 NAME 'ntUserUnitsPerWeek' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-
+ VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2297 NAME 'nsslapd-search-return-ori
+ ginal-type-switch' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2075 NAME ( 'passwordMinDigits' 'pwd
+ MinDigits' ) DESC 'Netscape defined password policy attribute type' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Ser
+ ver' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' DESC
+  'Authentication information for the outgoing portion of a trust' EQUALITY 
+ caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2'
+  'user defined' ) )
+attributeTypes: ( 1.3.18.0.2.4.1123 NAME 'printer-sides-supported' DESC 'The
+  number of impression sides (one or two) and the two-sided impression rotat
+ ions supported by this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.5.21.4 NAME 'matchingRules'  EQUALITY objectIdentifierFi
+ rstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOpera
+ tion X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.10 NAME 'ipatokenOTPdigits' DES
+ C 'OTP Token Number of digits' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' DESC 'Standard LDAP at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'R
+ FC 2307' )
+attributeTypes: ( requestResult-oid NAME 'requestResult' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.16 NAME 'idnsZoneRefresh' DESC 'zo
+ ne refresh interval' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE X-ORIGIN ( 'IPA v2' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord' DESC 'service lo
+ cation, RFC 2782' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.3 NAME 'eduPersonOrgDN' DESC 'Organ
+ ization DN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'htt
+ p://middleware.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.543 NAME 'nsState' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALUE X-OR
+ IGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.85 NAME 'cirBindCredentials' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIG
+ IN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.10 NAME 'ipaNTDomainGUID' DESC 'N
+ T Domain GUID' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v3' '
+ user defined' ) )
+attributeTypes: ( dateOfCreate-oid NAME 'dateOfCreate' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.8.1 NAME 'krbTicketFlags'  EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.12 NAME 'javaDoc' DESC 'The Java d
+ ocumentation for the class' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 X-ORIGIN 'RFC 2713' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2102 NAME 'autoMemberGroupingAttr' D
+ ESC 'Auto Membership grouping attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 SINGLE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.13 NAME 'ipk11Label' DESC 'Desc
+ ription' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.808 NAME 'nsds5replicaLastInitEnd' D
+ ESC 'Netscape defined attribute type' EQUALITY generalizedTimeMatch ORDERIN
+ G generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-
+ VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsUserIDFormat-oid NAME 'nsUserIDFormat' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netsca
+ pe Administration Services' )
+attributeTypes: ( 0.9.2342.19200300.100.1.9 NAME 'host'  EQUALITY caseIgnore
+ Match SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  X-ORIGIN 'RFC 4524' )
+attributeTypes: ( nsAdminOneACLDir-oid NAME 'nsAdminOneACLDir' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape Administration Services' )
+attributeTypes: ( 2.5.4.0 NAME 'objectClass'  EQUALITY objectIdentifierMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 X-ORIGIN 'RFC 4512' )
+attributeTypes: ( nsBuildNumber-oid NAME 'nsBuildNumber' DESC 'Netscape defi
+ ned attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.5 NAME 'mozillaHomePostalCode'  EQUALI
+ TY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2149 NAME 'rootdn-allow-ip' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2312.4.3.3.2 NAME 'sabayonProfileName' DESC 'T
+ he Name of a sabayon profile' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Sa
+ bayon' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' DESC 'Min
+ imal password length (default: 5)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.12 NAME 'title'  SUP name EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'RFC 4519' )
+attributeTypes: ( authoritySerial-oid NAME 'authoritySerial' DESC 'Authority
+  certificate serial number' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VAL
+ UE X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.17 NAME 'mailForwardingAddress' DESC
+  'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( revInfo-oid NAME 'revInfo' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2120 NAME 'dnaFilter' DESC 'DNA filt
+ er for finding entries' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X
+ -ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.223 NAME ( 'passwordResetFailureCoun
+ t' 'pwdFailureCountInterval' ) DESC 'Netscape defined password policy attri
+ bute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Nets
+ cape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'Times
+ tamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.49 NAME ( 'distinguishedName' 'dn' )  EQUALITY disti
+ nguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 4519' 
+ X-DEPRECATED 'dn' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2232 NAME 'nsslapd-ldapimaptoentries
+ ' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.578 NAME 'nsDS5ReplicaHost' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2190 NAME 'nsslapd-accesslog-logmaxd
+ iskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.1 NAME 'idnsAllowDynUpdate' DESC '
+ permit dynamic updates on this zone' EQUALITY booleanMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2319 NAME 'nsslapd-auditfaillog-logr
+ otationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.45.1 NAME 'krbLastPwdChange'  EQ
+ UALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VAL
+ UE )
+attributeTypes: ( 2.5.21.10 NAME 'governingStructureRule'  EQUALITY integerM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION
+  USAGE directoryOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who 
+ may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2279 NAME 'nsslapd-ldifdir' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1134 NAME 'printer-more-info' DESC 'A URI for
+  more information about this specific printer.' EQUALITY caseIgnoreMatch SU
+ BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' DESC 'Attribu
+ te mappings used, required, or supported by an agent or service' EQUALITY c
+ aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'RFC4876'
+  'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.1004 NAME 'nsds7WindowsDomain' DESC 
+ 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
+ LE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' )
+  DESC 'Standard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR cas
+ eIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE
+  X-ORIGIN ( 'RFC 2247' 'user defined' ) )
+attributeTypes: ( certStatus-oid NAME 'certStatus' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.3 NAME 'ipaMemberCertProfile' D
+ ESC 'Reference to a certificate profile member' SUP distinguishedName EQUAL
+ ITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 
+ 'IPA v4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'pr
+ eferred written or spoken language for a person' EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'RFC 2798' )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.3 NAME ( 'mozillaUseHtmlMail' 'xmozill
+ ausehtmlmail' )  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 
+ 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.21 NAME 'idnsSecKeyActivate' DESC 
+ 'DNSSEC key (planned) activation time' EQUALITY generalizedTimeMatch ORDERI
+ NG generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE
+ -VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.201 NAME 'changeLogMaximumSize' DESC
+  'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-O
+ RIGIN 'Netscape Directory Server' )
+attributeTypes: ( adminMessages-oid NAME 'adminMessages' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( nsSerialNumber-oid NAME 'nsSerialNumber' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netsca
+ pe' )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.3 NAME 'krbPwdLockoutDuration'  EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.90 NAME 'cirBeginORC' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Net
+ scape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.7 NAME 'ipaNTProfilePath' DESC 'U
+ ser Profile Path' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch
+  SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
+ LE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2240 NAME 'nsslapd-accesslog' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.13 NAME 'ipaDefaultEmailDomain'  E
+ QUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.99 NAME 'SPFRecord' DESC 'Sender Pol
+ icy Framework (SPF) for Authorizing Use of Domains in Email, RFC 7208' EQUA
+ LITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2096 NAME 'entryusn' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE N
+ O-USER-MODIFICATION USAGE directoryOperation X-ORIGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanMa
+ nager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.694 NAME 'inetSubscriberAccountId' D
+ ESC 'A unique attribute linking the subscriber to a billing system' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape subscriber interoperabilit
+ y' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.18.1 NAME 'krbPwdServers'  EQUAL
+ ITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.18.0.2.4.1112 NAME 'printer-current-operator' DESC 'Th
+ e identity of the current human operator responsible for operating this pri
+ nter.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2306 NAME 'nsslapd-return-default-op
+ attr' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 USAGE directoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.2.840.113556.1.4.478 NAME 'calCalURI' DESC 'RFC2739: URI
+  of entire default calendar' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreI
+ A5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'rfc2739' )
+attributeTypes: ( tokenNotAfter-oid NAME 'tokenNotAfter' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.604 NAME 'parentid' DESC 'internal s
+ erver defined attribute type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.42 NAME 'APLRecord' DESC 'Lists of A
+ ddress Prefixes, RFC 3132' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2
+ ' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.43 NAME 'ipaPermIncludedAttr' DES
+ C 'IPA permission explicitly included attribute' EQUALITY caseIgnoreMatch O
+ RDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2266 NAME 'nsslapd-enquote-sup-oc' D
+ ESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.524 NAME 'ntUserScriptPath' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.1.22 NAME 'mgrpAllowedBroadcaster' DES
+ C 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2133 NAME 'pwdUpdateTime' DESC 'Last
+  password update time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE US
+ AGE directoryOperation X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.236 NAME 'nsSNMPDescription' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl'  SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2324 NAME 'nsslapd-auditfaillog-loge
+ xpirationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsPreference-oid NAME 'nsPreference' DESC 'Netscape define
+ d attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape A
+ dministration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.18 NAME 'ipaNTTrustPosixOffset' D
+ ESC 'POSIX offset of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.33.1 NAME 'krbPwdMinLength'  EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( crlName-oid NAME 'crlName' DESC 'CMS defined attribute' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( status-oid NAME 'status' DESC 'CMS defined attribute' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.592 NAME 'nsDS5ReplicaAutoReferral' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( requestAgentGroup-oid NAME 'requestAgentGroup' DESC 'CMS d
+ efined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defin
+ ed' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2083 NAME ( 'passwordMinTokenLength'
+  'pwdMinTokenLength' ) DESC 'Netscape defined password policy attribute typ
+ e' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Dir
+ ectory Server' )
+attributeTypes: ( numberOfRecoveries-oid NAME 'numberOfRecoveries' DESC 'CMS
+  defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user def
+ ined' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.16 NAME 'ipaConfigString' DESC 'Ge
+ neric configuration stirng' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMat
+ ch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.689 NAME 'nsds5replicaUpdateInProgre
+ ss' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.7 SINGLE-VALUE NO-USER-MODIFICATION X-ORIGIN 'Netscape Directory Server' 
+ )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.61 NAME 'ipaWrappingKey' DESC 'PK
+ CS#11 URI of the wrapping key' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2204 NAME 'nsslapd-auditlog-logging-
+ enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1109 NAME 'printer-charset-configured' DESC '
+ The configured charset in which error and status messages will be generated
+  (by default) by this printer.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.1.44 NAME 'ntGroupDomainId' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.8 NAME 'ipaReplTopoManagedSuffi
+ x' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.6 NAME 'ipaHomesRootDir'  EQUALITY
+  caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.214 NAME 'passwordAllowChangeTime' D
+ ESC 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.24 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Di
+ rectory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.62 NAME 'ipk11Decrypt' DESC 'Ke
+ y supports decryption' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( tokenStatus-oid NAME 'tokenStatus' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.55 NAME 'HIPRecord' DESC 'Host Ident
+ ity Protocol (HIP) Domain Name System (DNS) Extension, RFC 5205' EQUALITY c
+ aseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2141 NAME 'dsOnlyMemberUid' DESC 'El
+ ements from a memberuid attribute created to reflect dynamic group membersh
+ ip' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Red Hat Directory Server
+ ' )
+attributeTypes: ( nsDirectoryFailoverList-oid NAME 'nsDirectoryFailoverList'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLSessionTimeout-oid NAME 'nsSSLSessionTimeout' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.36 NAME 'ipaSecondaryBaseRID' DES
+ C 'First value of a secondary RID range' EQUALITY integerMatch ORDERING int
+ egerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGI
+ N ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2253 NAME 'nsslapd-nagle' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2118 NAME 'dnaInterval' DESC 'DNA in
+ terval between values' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-
+ ORIGIN '389 Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC 'Ti
+ mestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.41 NAME 'name'  EQUALITY caseIgnoreMatch SUBSTR case
+ IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 45
+ 19' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2188 NAME 'nsslapd-errorlog-logrotat
+ iontimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.32769 NAME 'DLVRecord' DESC 'DNSSEC 
+ Lookaside Validation, RFC 4431' EQUALITY caseIgnoreIA5Match SUBSTR caseIgno
+ reIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v
+ 4.4.2' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor'  EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'RFC 
+ 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.11 NAME 'ipaSudoRunAsGroupCategory
+ ' DESC 'Additional classification for groups' SUP userCategory EQUALITY cas
+ eIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2311 NAME 'nsds5ReplicaFlowControlPa
+ use' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.66 NAME 'ntUserUniqueId' DESC 'Netsc
+ ape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALU
+ E X-ORIGIN 'Netscape NT Synchronization' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.9 NAME 'idnsSOAminimum' DESC 'SOA 
+ minimum value' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2078 NAME ( 'passwordMinLowers' 'pwd
+ MinLowers' ) DESC 'Netscape defined password policy attribute type' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Ser
+ ver' )
+attributeTypes: ( 2.16.840.1.113730.3.1.587 NAME 'nsds50ruv' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Nets
+ cape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2167 NAME 'schemaUpdateAttributeAcce
+ pt' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2271 NAME 'nsslapd-rewrite-rfc1274' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.54 NAME 'ipaPrivateKey' DESC 'Pri
+ vate key as DER-encoded EncryptedPrivateKeyInfo (RFC 5958)' EQUALITY octetS
+ tringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN ( 'IP
+ A v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.1 NAME 'ipatokenUniqueID' DESC 
+ 'Token Unique Identifier' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'Standard LDA
+ P attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGI
+ N 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.31 NAME 'mailEnhancedUniqueMember' D
+ ESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.12 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.5.1 NAME 'krbUPEnabled' DESC 'Bo
+ olean' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.19 NAME 'idnsSecKeyCreated' DESC '
+ DNSSEC key creation timestamp' EQUALITY generalizedTimeMatch ORDERING gener
+ alizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X
+ -ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.209 NAME 'vlvFilter' DESC 'Netscape 
+ defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Nets
+ cape Directory Server' )
+attributeTypes: ( nsErrorLog-oid NAME 'nsErrorLog' DESC 'Netscape defined at
+ tribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record' DESC 'A6 Record T
+ ype, RFC 2874' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.1.88 NAME 'cirUpdateFailedat' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base6
+ 4 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.250 NAME 'nsValueDefault' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ 'Netscape servers - value item' )
+attributeTypes: ( 2.5.4.37 NAME 'cACertificate' DESC 'X.509 CA certificate' 
+ EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'RF
+ C 4523' )
+attributeTypes: ( 1.3.6.1.4.1.6981.11.3.2 NAME 'FTPQuotaMBytes' DESC 'Quota 
+ (in megabytes) for an FTP user' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Pure-FTPd' )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor' D
+ ESC 'Specifies search descriptors required, used, or supported by a particu
+ lar service or agent' EQUALITY caseExactMatch SUBSTR caseExactSubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'RFC4876' 'user defined'
+  ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2105 NAME 'autoMemberTargetGroup' DE
+ SC 'Auto Membership target group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING
+ LE-VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.803 NAME 'nsBackendSuffix' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE di
+ rectoryOperation X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2217 NAME 'nsslapd-allow-anonymous-a
+ ccess' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.53 NAME 'replicaBindMethod' DESC 'Ne
+ tscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGI
+ N 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.4 NAME 'info'  EQUALITY caseIgnore
+ Match SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.71 NAME 'ipk11AlwaysAuthenticat
+ e' DESC 'User has to authenticate for each use with this key' EQUALITY bool
+ eanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v
+ 4.1' 'user defined' ) )
+attributeTypes: ( nsSSLSupportedCiphers-oid NAME 'nsSSLSupportedCiphers' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2287 NAME 'nsslapd-force-sasl-extern
+ al' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2065 NAME 'nsSaslMapBaseDNTemplate' 
+ DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.5.4.5 NAME 'serialNumber'  EQUALITY caseIgnoreMatch SUBS
+ TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 X-ORIGIN 
+ 'RFC 4519' )
+attributeTypes: ( p12Expiration-oid NAME 'p12Expiration' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( tokenUserID-oid NAME 'tokenUserID' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.197 NAME 'replicaHost' DESC 'Netscap
+ e defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Ne
+ tscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold' DESC 
+ 'Lockout users after bad logon attempts (default: 0 => off)' EQUALITY integ
+ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( tokenReason-oid NAME 'tokenReason' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.5.4.15 NAME 'businessCategory'  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-OR
+ IGIN 'RFC 4519' )
+attributeTypes: ( 0.9.2342.19200300.100.1.48 NAME 'buildingName'  EQUALITY c
+ aseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( 2.16.840.1.113730.3.1.107 NAME 'passwordResetDuration' DES
+ C 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' DESC 'Standard LD
+ AP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIG
+ IN 'RFC 2307' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2235 NAME 'nsslapd-ldapientrysearchb
+ ase' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.12 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( tokenAppletID-oid NAME 'tokenAppletID' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( extensions-oid NAME 'extensions' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( nsInstalledLocation-oid NAME 'nsInstalledLocation' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape' )
+attributeTypes: ( 2.16.840.1.113730.3.1.573 NAME 'nsIdleTimeout' DESC 'Binde
+ r-based connection idle timeout (seconds)' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE USAGE directoryOperation X-ORIGIN 'Netscape Directory Ser
+ ver' )
+attributeTypes: ( 2.16.840.1.113730.3.8.19.2.1 NAME 'ipaDomainLevel' DESC 'D
+ omain Level value' EQUALITY numericStringMatch ORDERING numericStringMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE X-ORIGIN ( 'IPA v4' 'user
+  defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.4 NAME 'UnknownRecord' DESC 'unknown D
+ NS record, RFC 3597' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'use
+ r defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.75 NAME 'adminUrl' DESC 'Netscape de
+ fined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netsca
+ pe Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.245 NAME 'nsValueTel' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 X-ORIGIN 'Net
+ scape servers - value item' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.42 NAME 'preferredLocale' DESC 'p
+ referred locale for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Ne
+ tscape' )
+attributeTypes: ( nsNYR-oid NAME 'nsNYR' DESC 'Netscape defined attribute ty
+ pe' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration 
+ Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2172 NAME 'nsslapd-accesslog-maxlogs
+ ize' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.5 NAME 'memberUser' DESC 'Referenc
+ e to a principal that performs an action (usually user).' SUP distinguished
+ Name EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X
+ -ORIGIN 'IPA v2' )
+attributeTypes: ( userMessages-oid NAME 'userMessages' DESC 'CMS defined att
+ ribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.18.0.2.4.1131 NAME 'printer-charset-supported' DESC 'S
+ et of charsets supported for the attribute values of syntax DirectoryString
+  for this directory entry.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.22 NAME 'ipatokenTOTPwatermark'
+  DESC 'TOTP watermark' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit' DESC 'Maximu
+ m time an agent or service allows for a bind operation to complete' EQUALIT
+ Y integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE X-ORIGIN ( 'RFC4876' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.21.1.6 NAME 'ipaCaId' DESC 'Dogtag A
+ uthority ID' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBS
+ TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ ( 'IPA v4.4 Lightweight CAs' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.24 NAME 'idnsSecKeyZone' DESC 'DNS
+ KEY ZONE flag (equivalent to bit 7): RFC 4035' EQUALITY booleanMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defi
+ ned' ) )
+attributeTypes: ( archivedBy-oid NAME 'archivedBy' DESC 'CMS defined attribu
+ te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.53.1 NAME 'krbPrincContainerRef'
+   EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'numeri
+ cally identifies an employee within an organization' EQUALITY caseIgnoreMat
+ ch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'RFC 2798' )
+attributeTypes: ( 2.16.840.1.113730.3.1.551 NAME 'cosspecifier' DESC 'Netsca
+ pe defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALU
+ E X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.97 NAME ( 'passwordMaxAge' 'pwdMaxAg
+ e' ) DESC 'Netscape defined password policy attribute type' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.4 NAME 'krbAllowedToDelegateTo'  EQU
+ ALITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' DESC 
+ 'Bad password attempt count' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.22 NAME 'teletexTerminalIdentifier'  SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.51 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.8 NAME 'ipaSudoRunAsUserCategory' 
+ DESC 'Additional classification for users' SUP userCategory EQUALITY caseIg
+ noreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2099 NAME 'autoMemberExclusiveRegex'
+  DESC 'Auto Membership exclusive regex rule' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord' DESC 'text strin
+ g, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'Standard LDAP attribute
+  type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'RFC 2307
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 'Next
+  NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.2222 NAME 'nsslapd-localuser' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2180 NAME 'nsslapd-auditlog-logrotat
+ ionsynchour' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2309 NAME 'nsds5ReplicaPreciseTombst
+ onePurging' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( tokenOrigin-oid NAME 'tokenOrigin' DESC 'CMS defined attri
+ bute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2292 NAME 'nsslapd-disk-monitoring-l
+ ogging-critical' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2070 NAME 'pamIDMapMethod' DESC 'How
+  to map BIND DN to PAM identity' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Red Hat Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.408 NAME 'replicaLastRelevantChange'
+  DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 7 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' DESC
+  'Authentication information for the incoming portion of a trust' EQUALITY 
+ caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.4.2'
+  'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2269 NAME 'nsslapd-errorlog-list' DE
+ SC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X
+ -ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.18.0.2.4.1124 NAME 'printer-number-up-supported' DESC 
+ 'The possible numbers of print-stream pages to impose upon a single side of
+  an instance of a selected medium.' EQUALITY integerMatch ORDERING integerO
+ rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'rfc3712' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.9 NAME 'ipatokenOTPalgorithm' D
+ ESC 'OTP Token Algorithm' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( allowPinReset-oid NAME 'allowPinReset' DESC 'CMS defined a
+ ttribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
+attributeTypes: ( 2.5.21.7 NAME 'nameForms'  EQUALITY objectIdentifierFirstC
+ omponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOperation
+  X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.8.16.1.17 NAME 'ipatokenRadiusSecret' 
+ DESC 'Server Secret' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.40 SINGLE-VALUE X-ORIGIN ( 'IPA OTP' 'user defined' ) )
+attributeTypes: ( 0.9.2342.19200300.100.1.55 NAME 'audio'  EQUALITY octetStr
+ ingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'RFC 1274' )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.36.1 NAME 'krbPwdPolicyReference
+ '  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.28 NAME 'nisPublickey' DESC 'nisPublickey' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 
+ 'RFC2307bis' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.29 NAME 'mgrpMsgRejectText' DESC 'Ne
+ tscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2136 NAME 'nsds5ReplicaCleanRUVNotif
+ ied' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.11 NAME 'idnsAllowQuery' DESC 'BIN
+ D9 allow-query ACL element' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 SINGLE-VALUE X-ORIGIN ( 'IPA v2' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.231 NAME 'nsslapd-pluginEnabled' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsWellKnownJarfiles-oid NAME 'nsWellKnownJarfiles' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIG
+ IN 'Netscape Administration Services' )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord' DESC 'non-exista
+ nt, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes'  EQUALITY 
+ objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 US
+ AGE directoryOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( nsAdminAccessHosts-oid NAME 'nsAdminAccessHosts' DESC 'Net
+ scape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN
+  'Netscape Administration Services' )
+attributeTypes: ( 2.16.840.1.113730.3.1.328 NAME 'nsMatchingRule' DESC 'Nets
+ cape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
+ 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.6 NAME 'eduPersonPrincipalName' DES
+ C 'Principal Name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIG
+ IN 'http://middleware.internet2.edu/eduperson/' )
+attributeTypes: ( 2.16.840.1.113730.3.1.80 NAME 'cirHost' DESC 'Netscape def
+ ined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscap
+ e Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.15 NAME 'ipaNTTrustAuthOutgoing' 
+ DESC 'Authentication information for the outgoing portion of a trust' EQUAL
+ ITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.11 NAME 'javaReferenceAddress' DES
+ C 'Addresses associated with a JNDI Reference' EQUALITY caseExactMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2713' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.16 NAME 'ipk11Trusted' DESC 'Ca
+ n be trusted by application' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2086 NAME 'mepManagedBy' DESC 'Manag
+ ed Entries backpointer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN '389 
+ Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.3.19 NAME 'serviceCategory' DESC 'Ad
+ ditional classification for services' EQUALITY caseIgnoreMatch ORDERING cas
+ eIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.684 NAME 'nsds5ReplicaChangeCount' D
+ ESC 'Netscape defined attribute type' EQUALITY integerMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.1.1 NAME 'ipaUserSearchFields'  EQUA
+ LITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113730.3.8.20.2.3 NAME 'ipaReplTopoSegmentLeftN
+ ode' DESC 'IPA defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  X-ORIGIN ( 'FreeIPA' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.1101 NAME 'nsRoleScopeDN' DESC 'Scop
+ e of a role' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN '38
+ 9 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.17.1.69 NAME 'ipk11WrapWithTrusted' 
+ DESC 'Key can only be wrapped with a trusted wrapping key' EQUALITY boolean
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN ( 'IPA v4.1
+ ' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.41.1 NAME 'krbSubTrees'  EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.52 NAME 'TLSARecord' DESC 'DNS-Based
+  Authentication of Named Entities - Transport Layer Security Protocol, RFC 
+ 6698' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN ( 'IPA v4.4.2' 'user defined' ) )
+attributeTypes: ( 1.3.1.1.4.1.453.16.2.103 NAME 'numSubordinates' DESC 'coun
+ t of immediate subordinates' EQUALITY integerMatch ORDERING integerOrdering
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATIO
+ N USAGE directoryOperation X-ORIGIN 'numSubordinates Internet Draft' )
+attributeTypes: ( 1.3.6.1.4.1.13769.3.6 NAME 'mozillaHomeCountryName'  SUP n
+ ame EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Mozilla Address Book' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2144 NAME 'rootdn-open-time' DESC 'N
+ etscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.11.33 NAME 'ipaBaseID' DESC 'First v
+ alue of a Posix ID range' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE X-ORIGIN ( 'IPA v3' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2256 NAME 'passwordLegacyPolicy' DES
+ C 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.9999999 NAME 'nsds5debugreplicatimeo
+ ut' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle'  EQUALITY 
+ caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 X-ORIGIN 'RFC 4524' )
+attributeTypes: ( SubsystemName-oid NAME 'SubsystemName'  SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts'  SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperation X-ORIGIN 'RFC 4512' )
+attributeTypes: ( 2.16.840.1.113730.3.1.12 NAME 'mailAccessDomain' DESC 'Net
+ scape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2123 NAME 'dnaSharedCfgDN' DESC 'DNA
+  shared configuration entry DN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE
+ -VALUE X-ORIGIN '389 Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.226 NAME 'nsslapd-pluginType' DESC '
+ Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC 'Time
+ stamp of when the user will be logged off automatically' EQUALITY integerMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.44 NAME 'generationQualifier'  SUP name EQUALITY cas
+ eIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 X-ORIGIN 'RFC 4519' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2193 NAME 'nsslapd-accesslog-logminf
+ reediskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.7.14 NAME 'ipaSudoRunAsExtUserGroup'
+  DESC 'Multivalue string attribute that allows storing groups of users that
+  are not managed by IPA the command can be run as' EQUALITY caseIgnoreMatch
+  ORDERING caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.15 X-ORIGIN ( 'IPA v4.0' 'user defined' ) )
+attributeTypes: ( 2.16.840.1.113730.3.1.2314 NAME 'nsslapd-changelogcompactd
+ b-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.8.5.4 NAME 'idnsSOArName' DESC 'SOA ro
+ ot Name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'IPA v2' )
+attributeTypes: ( 2.16.840.1.113730.3.1.612 NAME 'generation' DESC 'Netscape
+  defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Net
+ scape Directory Server' )
+cn: schema
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'DirectoryString' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'DN' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Numb
+ er' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'FAX' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'GeneralizedTime' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'INTEGER' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'OctetString' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'TelephoneNumber' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identif
+ ier' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )
+matchingRules: ( 2.5.13.17 NAME 'octetStringMatch' DESC 'The octetStringMatc
+ h rule compares an assertion value of the Octet String syntax to an attribu
+ te value of a syntax (e.g., the Octet String or JPEG syntax) whose correspo
+ nding ASN.1 type is the OCTET STRING ASN.1 type.  The rule evaluates to TRU
+ E if and only if the attribute value and the assertion value are the same l
+ ength and corresponding octets (by position) are the same.' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.40 )
+matchingRules: ( 2.5.13.18 NAME 'octetStringOrderingMatch' DESC 'The octetSt
+ ringOrderingMatch rule compares an assertion value of the Octet String synt
+ ax to an attribute value of a syntax (e.g., the Octet String or JPEG syntax
+ ) whose corresponding ASN.1 type is the OCTET STRING ASN.1 type.  The rule 
+ evaluates to TRUE if and only if the attribute value appears earlier in the
+  collation order than the assertion value.  The rule compares octet strings
+  from the first octet to the last octet, and from the most significant bit 
+ to the least significant bit within the octet.  The first occurrence of a d
+ ifferent bit determines the ordering of the strings.  A zero bit precedes a
+  one bit.  If the strings contain different numbers of octets but the longe
+ r string is identical to the shorter string up to the length of the shorter
+  string, then the shorter string precedes the longer string.' SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.40 )
+matchingRules: ( 2.5.13.16 NAME 'bitStringMatch' DESC 'The bitStringMatch ru
+ le compares an assertion value of the Bit String syntax to an attribute val
+ ue of a syntax (e.g., the Bit String syntax) whose corresponding ASN.1 type
+  is BIT STRING.  If the corresponding ASN.1 type of the attribute syntax do
+ es not have a named bit list [ASN.1] (which is the case for the Bit String 
+ syntax), then the rule evaluates to TRUE if and only if the attribute value
+  has the same number of bits as the assertion value and the bits match on a
+  bitwise basis.  If the corresponding ASN.1 type does have a named bit list
+ , then bitStringMatch operates as above, except that trailing zero bits in 
+ the attribute and assertion values are treated as absent.' SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.6 )
+matchingRules: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' DESC 'T
+ he caseExactIA5Match rule compares an assertion value of the IA5 String syn
+ tax to an attribute value of a syntax (e.g., the IA5 String syntax) whose c
+ orresponding ASN.1 type is IA5String. The rule evaluates to TRUE if and onl
+ y if the prepared attribute value character string and the prepared asserti
+ on value character string have the same number of characters and correspond
+ ing characters have the same code point. In preparing the attribute value a
+ nd assertion value for comparison, characters are not case folded in the Ma
+ p preparation step, and only Insignificant Space Handling is applied in the
+  Insignificant Character Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 )
+matchingRules: ( 2.5.13.5 NAME 'caseExactMatch' DESC 'The caseExactMatch rul
+ e compares an assertion value of the Directory String syntax to an attribut
+ e value of a syntax (e.g., the Directory String, Printable String, Country 
+ String, or Telephone Number syntax) whose corresponding ASN.1 type is Direc
+ toryString or one of the alternative string types of DirectoryString, such 
+ as PrintableString (the other alternatives do not correspond to any syntax 
+ defined in this document). The rule evaluates to TRUE if and only if the pr
+ epared attribute value character string and the prepared assertion value ch
+ aracter string have the same number of characters and corresponding charact
+ ers have the same code point. In preparing the attribute value and assertio
+ n value for comparison, characters are not case folded in the Map preparati
+ on step, and only Insignificant Space Handling is applied in the Insignific
+ ant Character Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.5.13.6 NAME 'caseExactOrderingMatch' DESC 'The caseExactO
+ rderingMatch rule compares an assertion value of the Directory String synta
+ x to an attribute value of a syntax (e.g., the Directory String, Printable 
+ String, Country String, or Telephone Number syntax) whose corresponding ASN
+ .1 type is DirectoryString or one of its alternative string types. The rule
+  evaluates to TRUE if and only if, in the code point collation order, the p
+ repared attribute value character string appears earlier than the prepared 
+ assertion value character string; i.e., the attribute value is "less than" 
+ the assertion value. In preparing the attribute value and assertion value f
+ or comparison, characters are not case folded in the Map preparation step, 
+ and only Insignificant Space Handling is applied in the Insignificant Chara
+ cter Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' DESC 'The caseExac
+ tSubstringsMatch rule compares an assertion value of the Substring Assertio
+ n syntax to an attribute value of a syntax (e.g., the Directory String, Pri
+ ntable String, Country String, or Telephone Number syntax) whose correspond
+ ing ASN.1 type is DirectoryString or one of its alternative string types. T
+ he rule evaluates to TRUE if and only if (1) the prepared substrings of the
+  assertion value match disjoint portions of the prepared attribute value ch
+ aracter string in the order of the substrings in the assertion value, (2) a
+ n <initial> substring, if present, matches the beginning of the prepared at
+ tribute value character string, and (3) a <final> substring, if present, ma
+ tches the end of the prepared attribute value character string.  A prepared
+  substring matches a portion of the prepared attribute value character stri
+ ng if corresponding characters have the same code point. In preparing the a
+ ttribute value and assertion value substrings for comparison, characters ar
+ e not case folded in the Map preparation step, and only Insignificant Space
+  Handling is applied in the Insignificant Character Handling step.' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.58 )
+matchingRules: ( 2.16.840.1.113730.3.3.1 NAME 'caseExactIA5SubstringsMatch' 
+ DESC 'The caseExactIA5SubstringsMatch rule compares an assertion value of t
+ he Substring Assertion syntax to an attribute value of a syntax (e.g., the 
+ IA5 syntax) whose corresponding ASN.1 type is IA5 String or one of its alte
+ rnative string types. The rule evaluates to TRUE if and only if (1) the pre
+ pared substrings of the assertion value match disjoint portions of the prep
+ ared attribute value character string in the order of the substrings in the
+  assertion value, (2) an <initial> substring, if present, matches the begin
+ ning of the prepared attribute value character string, and (3) a <final> su
+ bstring, if present, matches the end of the prepared attribute value charac
+ ter string.  A prepared substring matches a portion of the prepared attribu
+ te value character string if corresponding characters have the same code po
+ int. In preparing the attribute value and assertion value substrings for co
+ mparison, characters are not case folded in the Map preparation step, and o
+ nly Insignificant Space Handling is applied in the Insignificant Character 
+ Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.27 NAME 'generalizedTimeMatch' DESC 'The rule evalua
+ tes to TRUE if and only if the attribute value represents the same universa
+ l coordinated time as the assertion value.' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.24 )
+matchingRules: ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' DESC 'The rul
+ e evaluates to TRUE if and only if the attribute value represents a univers
+ al coordinated time that is earlier than the universal coordinated time rep
+ resented by the assertion value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
+matchingRules: ( 2.5.13.13 NAME 'booleanMatch' DESC 'The booleanMatch rule c
+ ompares an assertion value of the Boolean syntax to an attribute value of a
+  syntax (e.g., the Boolean syntax) whose corresponding ASN.1 type is BOOLEA
+ N.  The rule evaluates to TRUE if and only if the attribute value and the a
+ ssertion value are both TRUE or both FALSE.' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.7 )
+matchingRules: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' DESC '
+ The caseIgnoreIA5Match rule compares an assertion value of the IA5 String s
+ yntax to an attribute value of a syntax (e.g., the IA5 String syntax) whose
+  corresponding ASN.1 type is IA5String.  The rule evaluates to TRUE if and 
+ only if the prepared attribute value character string and the prepared asse
+ rtion value character string have the same number of characters and corresp
+ onding characters have the same code point.  In preparing the attribute val
+ ue and assertion value for comparison, characters are case folded in the Ma
+ p preparation step, and only Insignificant Space Handling is applied in the
+  Insignificant Character Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 )
+matchingRules: ( 1.3.6.1.4.1.1466.109.114.3 NAME 'caseIgnoreIA5SubstringsMat
+ ch' DESC 'The caseIgnoreIA5SubstringsMatch rule compares an assertion value
+  of the Substring Assertion syntax to an attribute value of a syntax (e.g.,
+  the IA5 String syntax) whose corresponding ASN.1 type is IA5String.  The r
+ ule evaluates to TRUE if and only if (1) the prepared substrings of the ass
+ ertion value match disjoint portions of the prepared attribute value charac
+ ter string in the order of the substrings in the assertion value, (2) an <i
+ nitial> substring, if present, matches the beginning of the prepared attrib
+ ute value character string, and (3) a <final> substring, if present, matche
+ s the end of the prepared attribute value character string.  A prepared sub
+ string matches a portion of the prepared attribute value character string i
+ f corresponding characters have the same code point.  In preparing the attr
+ ibute value and assertion value substrings for comparison, characters are c
+ ase folded in the Map preparation step, and only Insignificant Space Handli
+ ng is applied in the Insignificant Character Handling step.' SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.2 NAME 'caseIgnoreMatch' DESC 'The caseIgnoreMatch r
+ ule compares an assertion value of the Directory String syntax to an attrib
+ ute value of a syntax (e.g., the Directory String, Printable String, Countr
+ y String, or Telephone Number syntax) whose corresponding ASN.1 type is Dir
+ ectoryString or one of its alternative string types.  The rule evaluates to
+  TRUE if and only if the prepared attribute value character string and the 
+ prepared assertion value character string have the same number of character
+ s and corresponding characters have the same code point. In preparing the a
+ ttribute value and assertion value for comparison, characters are case fold
+ ed in the Map preparation step, and only Insignificant Space Handling is ap
+ plied in the Insignificant Character Handling step.' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15 )
+matchingRules: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' DESC 'The caseIgnor
+ eOrderingMatch rule compares an assertion value of the Directory String syn
+ tax to an attribute value of a syntax (e.g., the Directory String, Printabl
+ e String, Country String, or Telephone Number syntax) whose corresponding A
+ SN.1 type is DirectoryString or one of its alternative string types. The ru
+ le evaluates to TRUE if and only if, in the code point collation order, the
+  prepared attribute value character string appears earlier than the prepare
+ d assertion value character string; i.e., the attribute value is "less than
+ " the assertion value. In preparing the attribute value and assertion value
+  for comparison, characters are case folded in the Map preparation step, an
+ d only Insignificant Space Handling is applied in the Insignificant Charact
+ er Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' DESC 'The caseIgn
+ oreSubstringsMatch rule compares an assertion value of the Substring Assert
+ ion syntax to an attribute value of a syntax (e.g., the Directory String, P
+ rintable String, Country String, or Telephone Number syntax) whose correspo
+ nding ASN.1 type is DirectoryString or one of its alternative string types.
+  The rule evaluates to TRUE if and only if (1) the prepared substrings of t
+ he assertion value match disjoint portions of the prepared attribute value 
+ character string in the order of the substrings in the assertion value, (2)
+  an <initial> substring, if present, matches the beginning of the prepared 
+ attribute value character string, and (3) a <final> substring, if present, 
+ matches the end of the prepared attribute value character string.  A prepar
+ ed substring matches a portion of the prepared attribute value character st
+ ring if corresponding characters have the same code point. In preparing the
+  attribute value and assertion value substrings for comparison, characters 
+ are case folded in the Map preparation step, and only Insignificant Space H
+ andling is applied in the Insignificant Character Handling step.' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.11 NAME 'caseIgnoreListMatch' DESC 'The caseIgnoreLi
+ stMatch rule compares an assertion value that is a sequence of strings to a
+ n attribute value of a syntax (e.g., the Postal Address syntax) whose corre
+ sponding ASN.1 type is a SEQUENCE OF the DirectoryString ASN.1 type. The ru
+ le evaluates to TRUE if and only if the attribute value and the assertion v
+ alue have the same number of strings and corresponding strings (by position
+ ) match according to the caseIgnoreMatch matching rule. In [X.520], the ass
+ ertion syntax for this matching rule is defined to be:       SEQUENCE OF Di
+ rectoryString {ub-match} That is, it is different from the corresponding ty
+ pe for the Postal Address syntax.  The choice of the Postal Address syntax 
+ for the assertion syntax of the caseIgnoreListMatch in LDAP should not be s
+ een as limiting the matching rule to apply only to attributes with the Post
+ al Address syntax.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
+matchingRules: ( 2.5.13.12 NAME 'caseIgnoreListSubstringsMatch' DESC 'The ca
+ seIgnoreListSubstringsMatch rule compares an assertion value of the Substri
+ ng Assertion syntax to an attribute value of a syntax (e.g., the Postal Add
+ ress syntax) whose corresponding ASN.1 type is a SEQUENCE OF the DirectoryS
+ tring ASN.1 type. The rule evaluates to TRUE if and only if the assertion v
+ alue matches, per the caseIgnoreSubstringsMatch rule, the character string 
+ formed by concatenating the strings of the attribute value, except that non
+ e of the <initial>, <any>, or <final> substrings of the assertion value are
+  considered to match a substring of the concatenated string which spans mor
+ e than one of the original strings of the attribute value. Note that, in te
+ rms of the LDAP-specific encoding of the Postal Address syntax, the concate
+ nated string omits the <DOLLAR> line separator and the escaping of "\" and 
+ "$" characters.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.0 NAME 'objectIdentifierMatch' DESC 'The objectIdent
+ ifierMatch rule compares an assertion value of the OID syntax to an attribu
+ te value of a syntax (e.g., the OID syntax) whose corresponding ASN.1 type 
+ is OBJECT IDENTIFIER. The rule evaluates to TRUE if and only if the asserti
+ on value and the attribute value represent the same object identifier; that
+  is, the same sequence of integers, whether represented explicitly in the <
+ numericoid> form of <oid> or implicitly in the <descr> form (see [RFC4512])
+ . If an LDAP client supplies an assertion value in the <descr> form and the
+  chosen descriptor is not recognized by the server, then the objectIdentifi
+ erMatch rule evaluates to Undefined.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 
+ )
+matchingRules: ( 2.5.13.31 NAME 'directoryStringFirstComponentMatch' DESC 'T
+ he directoryStringFirstComponentMatch rule compares an assertion value of t
+ he Directory String syntax to an attribute value of a syntax whose correspo
+ nding ASN.1 type is a SEQUENCE with a mandatory first component of the Dire
+ ctoryString ASN.1 type. Note that the assertion syntax of this matching rul
+ e differs from the attribute syntax of attributes for which this is the equ
+ ality matching rule. The rule evaluates to TRUE if and only if the assertio
+ n value matches the first component of the attribute value using the rules 
+ of caseIgnoreMatch.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' DESC '
+ The objectIdentifierFirstComponentMatch rule compares an assertion value of
+  the OID syntax to an attribute value of a syntax (e.g., the Attribute Type
+  Description, DIT Content Rule Description, LDAP Syntax Description, Matchi
+ ng Rule Description, Matching Rule Use Description, Name Form Description, 
+ or Object Class Description syntax) whose corresponding ASN.1 type is a SEQ
+ UENCE with a mandatory first component of the OBJECT IDENTIFIER ASN.1 type.
+  Note that the assertion syntax of this matching rule differs from the attr
+ ibute syntax of attributes for which this is the equality matching rule. Th
+ e rule evaluates to TRUE if and only if the assertion value matches the fir
+ st component of the attribute value using the rules of objectIdentifierMatc
+ h.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+matchingRules: ( 2.5.13.1 NAME 'distinguishedNameMatch' DESC 'The distinguis
+ hedNameMatch rule compares an assertion value of the DN syntax to an attrib
+ ute value of a syntax (e.g., the DN syntax) whose corresponding ASN.1 type 
+ is DistinguishedName. The rule evaluates to TRUE if and only if the attribu
+ te value and the assertion value have the same number of relative distingui
+ shed names and corresponding relative distinguished names (by position) are
+  the same.  A relative distinguished name (RDN) of the assertion value is t
+ he same as an RDN of the attribute value if and only if they have the same 
+ number of attribute value assertions and each attribute value assertion (AV
+ A) of the first RDN is the same as the AVA of the second RDN with the same 
+ attribute type.  The order of the AVAs is not significant.  Also note that 
+ a particular attribute type may appear in at most one AVA in an RDN.  Two A
+ VAs with the same attribute type are the same if their values are equal acc
+ ording to the equality matching rule of the attribute type.  If one or more
+  of the AVA comparisons evaluate to Undefined and the remaining AVA compari
+ sons return TRUE then the distinguishedNameMatch rule evaluates to Undefine
+ d.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+matchingRules: ( 2.5.13.14 NAME 'integerMatch' DESC 'The rule evaluates to T
+ RUE if and only if the attribute value and the assertion value are the same
+  integer value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+matchingRules: ( 2.5.13.15 NAME 'integerOrderingMatch' DESC 'The rule evalua
+ tes to TRUE if and only if the integer value of the attribute value is less
+  than the integer value of the assertion value.' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.27 )
+matchingRules: ( 2.5.13.29 NAME 'integerFirstComponentMatch' DESC 'The integ
+ erFirstComponentMatch rule compares an assertion value of the Integer synta
+ x to an attribute value of a syntax (e.g., the DIT Structure Rule Descripti
+ on syntax) whose corresponding ASN.1 type is a SEQUENCE with a mandatory fi
+ rst component of the INTEGER ASN.1 type.  Note that the assertion syntax of
+  this matching rule differs from the attribute syntax of attributes for whi
+ ch this is the equality matching rule.  The rule evaluates to TRUE if and o
+ nly if the assertion value and the first component of the attribute value a
+ re the same integer value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.0.1 NAME 'caseIgnoreOrderingMatch-d
+ efault' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.0.1.6 NAME 'caseIgnoreSubstringMatc
+ h-default' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.1.1 NAME 'caseIgnoreOrderingMatch-a
+ r' DESC 'ar' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.1.1.6 NAME 'caseIgnoreSubstringMatc
+ h-ar' DESC 'ar' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.2.1 NAME 'caseIgnoreOrderingMatch-b
+ e' DESC 'be' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.2.1.6 NAME 'caseIgnoreSubstringMatc
+ h-be' DESC 'be' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.3.1 NAME 'caseIgnoreOrderingMatch-b
+ g' DESC 'bg' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.3.1.6 NAME 'caseIgnoreSubstringMatc
+ h-bg' DESC 'bg' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.4.1 NAME 'caseIgnoreOrderingMatch-c
+ a' DESC 'ca' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.4.1.6 NAME 'caseIgnoreSubstringMatc
+ h-ca' DESC 'ca' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.5.1 NAME 'caseIgnoreOrderingMatch-c
+ s' DESC 'cs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.5.1.6 NAME 'caseIgnoreSubstringMatc
+ h-cs' DESC 'cs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.6.1 NAME 'caseIgnoreOrderingMatch-d
+ a' DESC 'da' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.6.1.6 NAME 'caseIgnoreSubstringMatc
+ h-da' DESC 'da' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.7.1 NAME 'caseIgnoreOrderingMatch-d
+ e' DESC 'de' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.7.1.6 NAME 'caseIgnoreSubstringMatc
+ h-de' DESC 'de' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.8.1 NAME 'caseIgnoreOrderingMatch-d
+ e-AT' DESC 'de-AT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.8.1.6 NAME 'caseIgnoreSubstringMatc
+ h-de-AT' DESC 'de-AT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.9.1 NAME 'caseIgnoreOrderingMatch-d
+ e-CH' DESC 'de-CH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.9.1.6 NAME 'caseIgnoreSubstringMatc
+ h-de-CH' DESC 'de-CH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.10.1 NAME 'caseIgnoreOrderingMatch-
+ el' DESC 'el' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.10.1.6 NAME 'caseIgnoreSubstringMat
+ ch-el' DESC 'el' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.11.1 NAME 'caseIgnoreOrderingMatch-
+ en' DESC 'en' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.11.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en' DESC 'en' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.12.1 NAME 'caseIgnoreOrderingMatch-
+ en-CA' DESC 'en-CA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.12.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-CA' DESC 'en-CA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.13.1 NAME 'caseIgnoreOrderingMatch-
+ en-GB' DESC 'en-GB' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.13.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-GB' DESC 'en-GB' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.14.1 NAME 'caseIgnoreOrderingMatch-
+ en-IE' DESC 'en-IE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.14.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-IE' DESC 'en-IE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.15.1 NAME 'caseIgnoreOrderingMatch-
+ es' DESC 'es' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.15.1.6 NAME 'caseIgnoreSubstringMat
+ ch-es' DESC 'es' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.16.1 NAME 'caseIgnoreOrderingMatch-
+ et' DESC 'et' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.16.1.6 NAME 'caseIgnoreSubstringMat
+ ch-et' DESC 'et' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.17.1 NAME 'caseIgnoreOrderingMatch-
+ fi' DESC 'fi' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.17.1.6 NAME 'caseIgnoreSubstringMat
+ ch-fi' DESC 'fi' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.18.1 NAME 'caseIgnoreOrderingMatch-
+ fr' DESC 'fr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.18.1.6 NAME 'caseIgnoreSubstringMat
+ ch-fr' DESC 'fr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.19.1 NAME 'caseIgnoreOrderingMatch-
+ fr-BE' DESC 'fr-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.19.1.6 NAME 'caseIgnoreSubstringMat
+ ch-fr-BE' DESC 'fr-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.20.1 NAME 'caseIgnoreOrderingMatch-
+ fr-CA' DESC 'fr-CA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.20.1.6 NAME 'caseIgnoreSubstringMat
+ ch-fr-CA' DESC 'fr-CA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.21.1 NAME 'caseIgnoreOrderingMatch-
+ fr-CH' DESC 'fr-CH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.21.1.6 NAME 'caseIgnoreSubstringMat
+ ch-fr-CH' DESC 'fr-CH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.22.1 NAME 'caseIgnoreOrderingMatch-
+ hr' DESC 'hr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.22.1.6 NAME 'caseIgnoreSubstringMat
+ ch-hr' DESC 'hr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.23.1 NAME 'caseIgnoreOrderingMatch-
+ hu' DESC 'hu' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.23.1.6 NAME 'caseIgnoreSubstringMat
+ ch-hu' DESC 'hu' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.24.1 NAME 'caseIgnoreOrderingMatch-
+ is' DESC 'is' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.24.1.6 NAME 'caseIgnoreSubstringMat
+ ch-is' DESC 'is' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.25.1 NAME 'caseIgnoreOrderingMatch-
+ it' DESC 'it' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.25.1.6 NAME 'caseIgnoreSubstringMat
+ ch-it' DESC 'it' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.26.1 NAME 'caseIgnoreOrderingMatch-
+ it-CH' DESC 'it-CH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.26.1.6 NAME 'caseIgnoreSubstringMat
+ ch-it-CH' DESC 'it-CH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.27.1 NAME 'caseIgnoreOrderingMatch-
+ iw' DESC 'iw' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.27.1.6 NAME 'caseIgnoreSubstringMat
+ ch-iw' DESC 'iw' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.28.1 NAME 'caseIgnoreOrderingMatch-
+ ja' DESC 'ja' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.28.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ja' DESC 'ja' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.29.1 NAME 'caseIgnoreOrderingMatch-
+ ko' DESC 'ko' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.29.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ko' DESC 'ko' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.30.1 NAME 'caseIgnoreOrderingMatch-
+ lt' DESC 'lt' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.30.1.6 NAME 'caseIgnoreSubstringMat
+ ch-lt' DESC 'lt' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.31.1 NAME 'caseIgnoreOrderingMatch-
+ lv' DESC 'lv' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.31.1.6 NAME 'caseIgnoreSubstringMat
+ ch-lv' DESC 'lv' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.32.1 NAME 'caseIgnoreOrderingMatch-
+ mk' DESC 'mk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.32.1.6 NAME 'caseIgnoreSubstringMat
+ ch-mk' DESC 'mk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.33.1 NAME 'caseIgnoreOrderingMatch-
+ nl' DESC 'nl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.33.1.6 NAME 'caseIgnoreSubstringMat
+ ch-nl' DESC 'nl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.34.1 NAME 'caseIgnoreOrderingMatch-
+ nl-BE' DESC 'nl-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.34.1.6 NAME 'caseIgnoreSubstringMat
+ ch-nl-BE' DESC 'nl-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.35.1 NAME 'caseIgnoreOrderingMatch-
+ no' DESC 'no' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.35.1.6 NAME 'caseIgnoreSubstringMat
+ ch-no' DESC 'no' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.36.1 NAME 'caseIgnoreOrderingMatch-
+ no-NO-B' DESC 'no-NO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.36.1.6 NAME 'caseIgnoreSubstringMat
+ ch-no-NO-B' DESC 'no-NO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.37.1 NAME 'caseIgnoreOrderingMatch-
+ no-NO-NY' DESC 'no-NO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.37.1.6 NAME 'caseIgnoreSubstringMat
+ ch-no-NO-NY' DESC 'no-NO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.38.1 NAME 'caseIgnoreOrderingMatch-
+ pl' DESC 'pl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.38.1.6 NAME 'caseIgnoreSubstringMat
+ ch-pl' DESC 'pl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.39.1 NAME 'caseIgnoreOrderingMatch-
+ ro' DESC 'ro' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.39.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ro' DESC 'ro' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.40.1 NAME 'caseIgnoreOrderingMatch-
+ ru' DESC 'ru' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.40.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ru' DESC 'ru' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.41.1 NAME 'caseIgnoreOrderingMatch-
+ sh' DESC 'sh' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.41.1.6 NAME 'caseIgnoreSubstringMat
+ ch-sh' DESC 'sh' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.42.1 NAME 'caseIgnoreOrderingMatch-
+ sk' DESC 'sk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.42.1.6 NAME 'caseIgnoreSubstringMat
+ ch-sk' DESC 'sk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.43.1 NAME 'caseIgnoreOrderingMatch-
+ sl' DESC 'sl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.43.1.6 NAME 'caseIgnoreSubstringMat
+ ch-sl' DESC 'sl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.44.1 NAME 'caseIgnoreOrderingMatch-
+ sq' DESC 'sq' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.44.1.6 NAME 'caseIgnoreSubstringMat
+ ch-sq' DESC 'sq' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.45.1 NAME 'caseIgnoreOrderingMatch-
+ sr' DESC 'sr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.45.1.6 NAME 'caseIgnoreSubstringMat
+ ch-sr' DESC 'sr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.46.1 NAME 'caseIgnoreOrderingMatch-
+ sv' DESC 'sv' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.46.1.6 NAME 'caseIgnoreSubstringMat
+ ch-sv' DESC 'sv' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.47.1 NAME 'caseIgnoreOrderingMatch-
+ tr' DESC 'tr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.47.1.6 NAME 'caseIgnoreSubstringMat
+ ch-tr' DESC 'tr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.48.1 NAME 'caseIgnoreOrderingMatch-
+ uk' DESC 'uk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.48.1.6 NAME 'caseIgnoreSubstringMat
+ ch-uk' DESC 'uk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.49.1 NAME 'caseIgnoreOrderingMatch-
+ zh' DESC 'zh' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.49.1.6 NAME 'caseIgnoreSubstringMat
+ ch-zh' DESC 'zh' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.50.1 NAME 'caseIgnoreOrderingMatch-
+ zh-TW' DESC 'zh-TW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.50.1.6 NAME 'caseIgnoreSubstringMat
+ ch-zh-TW' DESC 'zh-TW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.51.1 NAME 'caseIgnoreOrderingMatch-
+ af' DESC 'af' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.51.1.6 NAME 'caseIgnoreSubstringMat
+ ch-af' DESC 'af' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.52.1 NAME 'caseIgnoreOrderingMatch-
+ af-NA' DESC 'af-NA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.52.1.6 NAME 'caseIgnoreSubstringMat
+ ch-af-NA' DESC 'af-NA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.53.1 NAME 'caseIgnoreOrderingMatch-
+ af-ZA' DESC 'af-ZA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.53.1.6 NAME 'caseIgnoreSubstringMat
+ ch-af-ZA' DESC 'af-ZA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.54.1 NAME 'caseIgnoreOrderingMatch-
+ ar-AE' DESC 'ar-AE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.54.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-AE' DESC 'ar-AE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.55.1 NAME 'caseIgnoreOrderingMatch-
+ ar-BH' DESC 'ar-BH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.55.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-BH' DESC 'ar-BH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.56.1 NAME 'caseIgnoreOrderingMatch-
+ ar-DZ' DESC 'ar-DZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.56.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-DZ' DESC 'ar-DZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.57.1 NAME 'caseIgnoreOrderingMatch-
+ ar-EG' DESC 'ar-EG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.57.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-EG' DESC 'ar-EG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.58.1 NAME 'caseIgnoreOrderingMatch-
+ ar-IQ' DESC 'ar-IQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.58.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-IQ' DESC 'ar-IQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.59.1 NAME 'caseIgnoreOrderingMatch-
+ ar-JO' DESC 'ar-JO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.59.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-JO' DESC 'ar-JO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.60.1 NAME 'caseIgnoreOrderingMatch-
+ ar-KW' DESC 'ar-KW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.60.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-KW' DESC 'ar-KW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.61.1 NAME 'caseIgnoreOrderingMatch-
+ ar-LB' DESC 'ar-LB' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.61.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-LB' DESC 'ar-LB' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.62.1 NAME 'caseIgnoreOrderingMatch-
+ ar-LY' DESC 'ar-LY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.62.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-LY' DESC 'ar-LY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.63.1 NAME 'caseIgnoreOrderingMatch-
+ ar-MA' DESC 'ar-MA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.63.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-MA' DESC 'ar-MA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.64.1 NAME 'caseIgnoreOrderingMatch-
+ ar-OM' DESC 'ar-OM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.64.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-OM' DESC 'ar-OM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.65.1 NAME 'caseIgnoreOrderingMatch-
+ ar-QA' DESC 'ar-QA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.65.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-QA' DESC 'ar-QA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.66.1 NAME 'caseIgnoreOrderingMatch-
+ ar-SA' DESC 'ar-SA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.66.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-SA' DESC 'ar-SA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.67.1 NAME 'caseIgnoreOrderingMatch-
+ ar-SD' DESC 'ar-SD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.67.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-SD' DESC 'ar-SD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.68.1 NAME 'caseIgnoreOrderingMatch-
+ ar-SY' DESC 'ar-SY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.68.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-SY' DESC 'ar-SY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.69.1 NAME 'caseIgnoreOrderingMatch-
+ ar-TN' DESC 'ar-TN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.69.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-TN' DESC 'ar-TN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.70.1 NAME 'caseIgnoreOrderingMatch-
+ ar-YE' DESC 'ar-YE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.70.1.6 NAME 'caseIgnoreSubstringMat
+ ch-ar-YE' DESC 'ar-YE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.71.1 NAME 'caseIgnoreOrderingMatch-
+ as' DESC 'as' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.71.1.6 NAME 'caseIgnoreSubstringMat
+ ch-as' DESC 'as' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.72.1 NAME 'caseIgnoreOrderingMatch-
+ as-IN' DESC 'as-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.72.1.6 NAME 'caseIgnoreSubstringMat
+ ch-as-IN' DESC 'as-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.73.1 NAME 'caseIgnoreOrderingMatch-
+ az' DESC 'az' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.73.1.6 NAME 'caseIgnoreSubstringMat
+ ch-az' DESC 'az' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.74.1 NAME 'caseIgnoreOrderingMatch-
+ az-Latn' DESC 'az-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.74.1.6 NAME 'caseIgnoreSubstringMat
+ ch-az-Latn' DESC 'az-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.75.1 NAME 'caseIgnoreOrderingMatch-
+ az-Latn-AZ' DESC 'az-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.75.1.6 NAME 'caseIgnoreSubstringMat
+ ch-az-Latn-AZ' DESC 'az-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.76.1 NAME 'caseIgnoreOrderingMatch-
+ bn' DESC 'bn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.76.1.6 NAME 'caseIgnoreSubstringMat
+ ch-bn' DESC 'bn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.77.1 NAME 'caseIgnoreOrderingMatch-
+ bn-BD' DESC 'bn-BD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.77.1.6 NAME 'caseIgnoreSubstringMat
+ ch-bn-BD' DESC 'bn-BD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.78.1 NAME 'caseIgnoreOrderingMatch-
+ bn-IN' DESC 'bn-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.78.1.6 NAME 'caseIgnoreSubstringMat
+ ch-bn-IN' DESC 'bn-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.79.1 NAME 'caseIgnoreOrderingMatch-
+ bs' DESC 'bs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.79.1.6 NAME 'caseIgnoreSubstringMat
+ ch-bs' DESC 'bs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.80.1 NAME 'caseIgnoreOrderingMatch-
+ chr' DESC 'chr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.80.1.6 NAME 'caseIgnoreSubstringMat
+ ch-chr' DESC 'chr' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.81.1 NAME 'caseIgnoreOrderingMatch-
+ chr-US' DESC 'chr-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.81.1.6 NAME 'caseIgnoreSubstringMat
+ ch-chr-US' DESC 'chr-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.82.1 NAME 'caseIgnoreOrderingMatch-
+ cy' DESC 'cy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.82.1.6 NAME 'caseIgnoreSubstringMat
+ ch-cy' DESC 'cy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.83.1 NAME 'caseIgnoreOrderingMatch-
+ de-BE' DESC 'de-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.83.1.6 NAME 'caseIgnoreSubstringMat
+ ch-de-BE' DESC 'de-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.84.1 NAME 'caseIgnoreOrderingMatch-
+ de-LI' DESC 'de-LI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.84.1.6 NAME 'caseIgnoreSubstringMat
+ ch-de-LI' DESC 'de-LI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.85.1 NAME 'caseIgnoreOrderingMatch-
+ de-LU' DESC 'de-LU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.85.1.6 NAME 'caseIgnoreSubstringMat
+ ch-de-LU' DESC 'de-LU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.86.1 NAME 'caseIgnoreOrderingMatch-
+ el-CY' DESC 'el-CY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.86.1.6 NAME 'caseIgnoreSubstringMat
+ ch-el-CY' DESC 'el-CY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.87.1 NAME 'caseIgnoreOrderingMatch-
+ el-GR' DESC 'el-GR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.87.1.6 NAME 'caseIgnoreSubstringMat
+ ch-el-GR' DESC 'el-GR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.88.1 NAME 'caseIgnoreOrderingMatch-
+ en-AS' DESC 'en-AS' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.88.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-AS' DESC 'en-AS' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.89.1 NAME 'caseIgnoreOrderingMatch-
+ en-AU' DESC 'en-AU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.89.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-AU' DESC 'en-AU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.90.1 NAME 'caseIgnoreOrderingMatch-
+ en-BE' DESC 'en-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.90.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-BE' DESC 'en-BE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.91.1 NAME 'caseIgnoreOrderingMatch-
+ en-BW' DESC 'en-BW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.91.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-BW' DESC 'en-BW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.92.1 NAME 'caseIgnoreOrderingMatch-
+ en-BZ' DESC 'en-BZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.92.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-BZ' DESC 'en-BZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.93.1 NAME 'caseIgnoreOrderingMatch-
+ en-GU' DESC 'en-GU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.93.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-GU' DESC 'en-GU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.94.1 NAME 'caseIgnoreOrderingMatch-
+ en-GY' DESC 'en-GY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.94.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-GY' DESC 'en-GY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.95.1 NAME 'caseIgnoreOrderingMatch-
+ en-HK' DESC 'en-HK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.95.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-HK' DESC 'en-HK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.96.1 NAME 'caseIgnoreOrderingMatch-
+ en-IN' DESC 'en-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.96.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-IN' DESC 'en-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.97.1 NAME 'caseIgnoreOrderingMatch-
+ en-JM' DESC 'en-JM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.97.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-JM' DESC 'en-JM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.98.1 NAME 'caseIgnoreOrderingMatch-
+ en-MH' DESC 'en-MH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.98.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-MH' DESC 'en-MH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.99.1 NAME 'caseIgnoreOrderingMatch-
+ en-MP' DESC 'en-MP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.99.1.6 NAME 'caseIgnoreSubstringMat
+ ch-en-MP' DESC 'en-MP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.100.1 NAME 'caseIgnoreOrderingMatch
+ -en-MT' DESC 'en-MT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.100.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-MT' DESC 'en-MT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.101.1 NAME 'caseIgnoreOrderingMatch
+ -en-MU' DESC 'en-MU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.101.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-MU' DESC 'en-MU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.102.1 NAME 'caseIgnoreOrderingMatch
+ -en-NA' DESC 'en-NA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.102.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-NA' DESC 'en-NA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.103.1 NAME 'caseIgnoreOrderingMatch
+ -en-NZ' DESC 'en-NZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.103.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-NZ' DESC 'en-NZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.104.1 NAME 'caseIgnoreOrderingMatch
+ -en-PH' DESC 'en-PH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.104.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-PH' DESC 'en-PH' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.105.1 NAME 'caseIgnoreOrderingMatch
+ -en-PK' DESC 'en-PK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.105.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-PK' DESC 'en-PK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.106.1 NAME 'caseIgnoreOrderingMatch
+ -en-SG' DESC 'en-SG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.106.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-SG' DESC 'en-SG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.107.1 NAME 'caseIgnoreOrderingMatch
+ -en-TT' DESC 'en-TT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.107.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-TT' DESC 'en-TT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.108.1 NAME 'caseIgnoreOrderingMatch
+ -en-UM' DESC 'en-UM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.108.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-UM' DESC 'en-UM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.109.1 NAME 'caseIgnoreOrderingMatch
+ -en-US' DESC 'en-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.109.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-US' DESC 'en-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.110.1 NAME 'caseIgnoreOrderingMatch
+ -en-US-POSIX' DESC 'en-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.110.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-US-POSIX' DESC 'en-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.111.1 NAME 'caseIgnoreOrderingMatch
+ -en-VI' DESC 'en-VI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.111.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-VI' DESC 'en-VI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.112.1 NAME 'caseIgnoreOrderingMatch
+ -en-ZA' DESC 'en-ZA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.112.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-ZA' DESC 'en-ZA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.113.1 NAME 'caseIgnoreOrderingMatch
+ -en-ZW' DESC 'en-ZW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.113.1.6 NAME 'caseIgnoreSubstringMa
+ tch-en-ZW' DESC 'en-ZW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.114.1 NAME 'caseIgnoreOrderingMatch
+ -es-AR' DESC 'es-AR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.114.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-AR' DESC 'es-AR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.115.1 NAME 'caseIgnoreOrderingMatch
+ -es-BO' DESC 'es-BO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.115.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-BO' DESC 'es-BO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.116.1 NAME 'caseIgnoreOrderingMatch
+ -es-CL' DESC 'es-CL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.116.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-CL' DESC 'es-CL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.117.1 NAME 'caseIgnoreOrderingMatch
+ -es-CO' DESC 'es-CO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.117.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-CO' DESC 'es-CO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.118.1 NAME 'caseIgnoreOrderingMatch
+ -es-CR' DESC 'es-CR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.118.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-CR' DESC 'es-CR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.119.1 NAME 'caseIgnoreOrderingMatch
+ -es-DO' DESC 'es-DO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.119.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-DO' DESC 'es-DO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.120.1 NAME 'caseIgnoreOrderingMatch
+ -es-EC' DESC 'es-EC' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.120.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-EC' DESC 'es-EC' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.121.1 NAME 'caseIgnoreOrderingMatch
+ -es-ES' DESC 'es-ES' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.121.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-ES' DESC 'es-ES' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.122.1 NAME 'caseIgnoreOrderingMatch
+ -es-GQ' DESC 'es-GQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.122.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-GQ' DESC 'es-GQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.123.1 NAME 'caseIgnoreOrderingMatch
+ -es-GT' DESC 'es-GT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.123.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-GT' DESC 'es-GT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.124.1 NAME 'caseIgnoreOrderingMatch
+ -es-HN' DESC 'es-HN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.124.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-HN' DESC 'es-HN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.125.1 NAME 'caseIgnoreOrderingMatch
+ -es-MX' DESC 'es-MX' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.125.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-MX' DESC 'es-MX' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.126.1 NAME 'caseIgnoreOrderingMatch
+ -es-NI' DESC 'es-NI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.126.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-NI' DESC 'es-NI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.127.1 NAME 'caseIgnoreOrderingMatch
+ -es-PA' DESC 'es-PA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.127.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-PA' DESC 'es-PA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.128.1 NAME 'caseIgnoreOrderingMatch
+ -es-PE' DESC 'es-PE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.128.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-PE' DESC 'es-PE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.129.1 NAME 'caseIgnoreOrderingMatch
+ -es-PR' DESC 'es-PR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.129.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-PR' DESC 'es-PR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.130.1 NAME 'caseIgnoreOrderingMatch
+ -es-PY' DESC 'es-PY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.130.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-PY' DESC 'es-PY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.131.1 NAME 'caseIgnoreOrderingMatch
+ -es-SV' DESC 'es-SV' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.131.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-SV' DESC 'es-SV' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.132.1 NAME 'caseIgnoreOrderingMatch
+ -es-US' DESC 'es-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.132.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-US' DESC 'es-US' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.133.1 NAME 'caseIgnoreOrderingMatch
+ -es-UY' DESC 'es-UY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.133.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-UY' DESC 'es-UY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.134.1 NAME 'caseIgnoreOrderingMatch
+ -es-VE' DESC 'es-VE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.134.1.6 NAME 'caseIgnoreSubstringMa
+ tch-es-VE' DESC 'es-VE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.135.1 NAME 'caseIgnoreOrderingMatch
+ -fa' DESC 'fa' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.135.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fa' DESC 'fa' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.136.1 NAME 'caseIgnoreOrderingMatch
+ -fil' DESC 'fil' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.136.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fil' DESC 'fil' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.137.1 NAME 'caseIgnoreOrderingMatch
+ -fo' DESC 'fo' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.137.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fo' DESC 'fo' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.138.1 NAME 'caseIgnoreOrderingMatch
+ -fr-BF' DESC 'fr-BF' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.138.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-BF' DESC 'fr-BF' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.139.1 NAME 'caseIgnoreOrderingMatch
+ -fr-BI' DESC 'fr-BI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.139.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-BI' DESC 'fr-BI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.140.1 NAME 'caseIgnoreOrderingMatch
+ -fr-BJ' DESC 'fr-BJ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.140.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-BJ' DESC 'fr-BJ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.141.1 NAME 'caseIgnoreOrderingMatch
+ -fr-BL' DESC 'fr-BL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.141.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-BL' DESC 'fr-BL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.142.1 NAME 'caseIgnoreOrderingMatch
+ -fr-CD' DESC 'fr-CD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.142.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-CD' DESC 'fr-CD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.143.1 NAME 'caseIgnoreOrderingMatch
+ -fr-CF' DESC 'fr-CF' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.143.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-CF' DESC 'fr-CF' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.144.1 NAME 'caseIgnoreOrderingMatch
+ -fr-CG' DESC 'fr-CG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.144.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-CG' DESC 'fr-CG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.145.1 NAME 'caseIgnoreOrderingMatch
+ -fr-CI' DESC 'fr-CI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.145.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-CI' DESC 'fr-CI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.146.1 NAME 'caseIgnoreOrderingMatch
+ -fr-CM' DESC 'fr-CM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.146.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-CM' DESC 'fr-CM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.147.1 NAME 'caseIgnoreOrderingMatch
+ -fr-DJ' DESC 'fr-DJ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.147.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-DJ' DESC 'fr-DJ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.148.1 NAME 'caseIgnoreOrderingMatch
+ -fr-GA' DESC 'fr-GA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.148.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-GA' DESC 'fr-GA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.149.1 NAME 'caseIgnoreOrderingMatch
+ -fr-GN' DESC 'fr-GN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.149.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-GN' DESC 'fr-GN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.150.1 NAME 'caseIgnoreOrderingMatch
+ -fr-GP' DESC 'fr-GP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.150.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-GP' DESC 'fr-GP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.151.1 NAME 'caseIgnoreOrderingMatch
+ -fr-GQ' DESC 'fr-GQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.151.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-GQ' DESC 'fr-GQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.152.1 NAME 'caseIgnoreOrderingMatch
+ -fr-KM' DESC 'fr-KM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.152.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-KM' DESC 'fr-KM' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.153.1 NAME 'caseIgnoreOrderingMatch
+ -fr-LU' DESC 'fr-LU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.153.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-LU' DESC 'fr-LU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.154.1 NAME 'caseIgnoreOrderingMatch
+ -fr-MC' DESC 'fr-MC' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.154.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-MC' DESC 'fr-MC' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.155.1 NAME 'caseIgnoreOrderingMatch
+ -fr-MF' DESC 'fr-MF' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.155.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-MF' DESC 'fr-MF' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.156.1 NAME 'caseIgnoreOrderingMatch
+ -fr-MG' DESC 'fr-MG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.156.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-MG' DESC 'fr-MG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.157.1 NAME 'caseIgnoreOrderingMatch
+ -fr-ML' DESC 'fr-ML' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.157.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-ML' DESC 'fr-ML' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.158.1 NAME 'caseIgnoreOrderingMatch
+ -fr-MQ' DESC 'fr-MQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.158.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-MQ' DESC 'fr-MQ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.159.1 NAME 'caseIgnoreOrderingMatch
+ -fr-NE' DESC 'fr-NE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.159.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-NE' DESC 'fr-NE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.160.1 NAME 'caseIgnoreOrderingMatch
+ -fr-RE' DESC 'fr-RE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.160.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-RE' DESC 'fr-RE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.161.1 NAME 'caseIgnoreOrderingMatch
+ -fr-RW' DESC 'fr-RW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.161.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-RW' DESC 'fr-RW' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.162.1 NAME 'caseIgnoreOrderingMatch
+ -fr-SN' DESC 'fr-SN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.162.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-SN' DESC 'fr-SN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.163.1 NAME 'caseIgnoreOrderingMatch
+ -fr-TD' DESC 'fr-TD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.163.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-TD' DESC 'fr-TD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.164.1 NAME 'caseIgnoreOrderingMatch
+ -fr-TG' DESC 'fr-TG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.164.1.6 NAME 'caseIgnoreSubstringMa
+ tch-fr-TG' DESC 'fr-TG' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.165.1 NAME 'caseIgnoreOrderingMatch
+ -ga' DESC 'ga' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.165.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ga' DESC 'ga' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.166.1 NAME 'caseIgnoreOrderingMatch
+ -ga-IE' DESC 'ga-IE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.166.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ga-IE' DESC 'ga-IE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.167.1 NAME 'caseIgnoreOrderingMatch
+ -ga-IN' DESC 'ga-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.167.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ga-IN' DESC 'ga-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.168.1 NAME 'caseIgnoreOrderingMatch
+ -ha' DESC 'ha' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.168.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ha' DESC 'ha' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.169.1 NAME 'caseIgnoreOrderingMatch
+ -ha-Latn' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.169.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ha-Latn' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.170.1 NAME 'caseIgnoreOrderingMatch
+ -ha-Latn-GH' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.170.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ha-Latn-GH' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.171.1 NAME 'caseIgnoreOrderingMatch
+ -ha-Latn-NE' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.171.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ha-Latn-NE' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.172.1 NAME 'caseIgnoreOrderingMatch
+ -ha-Latn-NG' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.172.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ha-Latn-NG' DESC 'ha-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.173.1 NAME 'caseIgnoreOrderingMatch
+ -he' DESC 'he' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.173.1.6 NAME 'caseIgnoreSubstringMa
+ tch-he' DESC 'he' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.174.1 NAME 'caseIgnoreOrderingMatch
+ -hi' DESC 'hi' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.174.1.6 NAME 'caseIgnoreSubstringMa
+ tch-hi' DESC 'hi' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.175.1 NAME 'caseIgnoreOrderingMatch
+ -hy' DESC 'hy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.175.1.6 NAME 'caseIgnoreSubstringMa
+ tch-hy' DESC 'hy' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.176.1 NAME 'caseIgnoreOrderingMatch
+ -id' DESC 'id' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.176.1.6 NAME 'caseIgnoreSubstringMa
+ tch-id' DESC 'id' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.177.1 NAME 'caseIgnoreOrderingMatch
+ -ig' DESC 'ig' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.177.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ig' DESC 'ig' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.178.1 NAME 'caseIgnoreOrderingMatch
+ -it-IT' DESC 'it-IT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.178.1.6 NAME 'caseIgnoreSubstringMa
+ tch-it-IT' DESC 'it-IT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.179.1 NAME 'caseIgnoreOrderingMatch
+ -ka' DESC 'ka' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.179.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ka' DESC 'ka' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.180.1 NAME 'caseIgnoreOrderingMatch
+ -ka-GE' DESC 'ka-GE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.180.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ka-GE' DESC 'ka-GE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.181.1 NAME 'caseIgnoreOrderingMatch
+ -kk' DESC 'kk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.181.1.6 NAME 'caseIgnoreSubstringMa
+ tch-kk' DESC 'kk' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.182.1 NAME 'caseIgnoreOrderingMatch
+ -kl' DESC 'kl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.182.1.6 NAME 'caseIgnoreSubstringMa
+ tch-kl' DESC 'kl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.183.1 NAME 'caseIgnoreOrderingMatch
+ -kn' DESC 'kn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.183.1.6 NAME 'caseIgnoreSubstringMa
+ tch-kn' DESC 'kn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.184.1 NAME 'caseIgnoreOrderingMatch
+ -kok' DESC 'kok' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.184.1.6 NAME 'caseIgnoreSubstringMa
+ tch-kok' DESC 'kok' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.185.1 NAME 'caseIgnoreOrderingMatch
+ -ml' DESC 'ml' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.185.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ml' DESC 'ml' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.186.1 NAME 'caseIgnoreOrderingMatch
+ -ms' DESC 'ms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.186.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ms' DESC 'ms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.187.1 NAME 'caseIgnoreOrderingMatch
+ -ms-BN' DESC 'ms-BN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.187.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ms-BN' DESC 'ms-BN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.188.1 NAME 'caseIgnoreOrderingMatch
+ -ms-MY' DESC 'ms-MY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.188.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ms-MY' DESC 'ms-MY' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.189.1 NAME 'caseIgnoreOrderingMatch
+ -mt' DESC 'mt' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.189.1.6 NAME 'caseIgnoreSubstringMa
+ tch-mt' DESC 'mt' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.190.1 NAME 'caseIgnoreOrderingMatch
+ -nl-NL' DESC 'nl-NL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.190.1.6 NAME 'caseIgnoreSubstringMa
+ tch-nl-NL' DESC 'nl-NL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.191.1 NAME 'caseIgnoreOrderingMatch
+ -nn' DESC 'nn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.191.1.6 NAME 'caseIgnoreSubstringMa
+ tch-nn' DESC 'nn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.192.1 NAME 'caseIgnoreOrderingMatch
+ -om' DESC 'om' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.192.1.6 NAME 'caseIgnoreSubstringMa
+ tch-om' DESC 'om' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.193.1 NAME 'caseIgnoreOrderingMatch
+ -om-ET' DESC 'om-ET' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.193.1.6 NAME 'caseIgnoreSubstringMa
+ tch-om-ET' DESC 'om-ET' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.194.1 NAME 'caseIgnoreOrderingMatch
+ -om-KE' DESC 'om-KE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.194.1.6 NAME 'caseIgnoreSubstringMa
+ tch-om-KE' DESC 'om-KE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.195.1 NAME 'caseIgnoreOrderingMatch
+ -or' DESC 'or' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.195.1.6 NAME 'caseIgnoreSubstringMa
+ tch-or' DESC 'or' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.196.1 NAME 'caseIgnoreOrderingMatch
+ -pa' DESC 'pa' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.196.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pa' DESC 'pa' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.197.1 NAME 'caseIgnoreOrderingMatch
+ -pa-Arab' DESC 'pa-Arab' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.197.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pa-Arab' DESC 'pa-Arab' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.198.1 NAME 'caseIgnoreOrderingMatch
+ -pa-Arab-PK' DESC 'pa-Arab' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.198.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pa-Arab-PK' DESC 'pa-Arab' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.199.1 NAME 'caseIgnoreOrderingMatch
+ -pa-Guru' DESC 'pa-Guru' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.199.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pa-Guru' DESC 'pa-Guru' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.200.1 NAME 'caseIgnoreOrderingMatch
+ -pa-Guru-IN' DESC 'pa-Guru' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.200.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pa-Guru-IN' DESC 'pa-Guru' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.201.1 NAME 'caseIgnoreOrderingMatch
+ -ps' DESC 'ps' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.201.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ps' DESC 'ps' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.202.1 NAME 'caseIgnoreOrderingMatch
+ -pt' DESC 'pt' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.202.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pt' DESC 'pt' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.203.1 NAME 'caseIgnoreOrderingMatch
+ -pt-BR' DESC 'pt-BR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.203.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pt-BR' DESC 'pt-BR' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.204.1 NAME 'caseIgnoreOrderingMatch
+ -pt-PT' DESC 'pt-PT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.204.1.6 NAME 'caseIgnoreSubstringMa
+ tch-pt-PT' DESC 'pt-PT' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.205.1 NAME 'caseIgnoreOrderingMatch
+ -ro-MD' DESC 'ro-MD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.205.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ro-MD' DESC 'ro-MD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.206.1 NAME 'caseIgnoreOrderingMatch
+ -ro-RO' DESC 'ro-RO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.206.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ro-RO' DESC 'ro-RO' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.207.1 NAME 'caseIgnoreOrderingMatch
+ -ru-MD' DESC 'ru-MD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.207.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ru-MD' DESC 'ru-MD' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.208.1 NAME 'caseIgnoreOrderingMatch
+ -ru-RU' DESC 'ru-RU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.208.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ru-RU' DESC 'ru-RU' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.209.1 NAME 'caseIgnoreOrderingMatch
+ -ru-UA' DESC 'ru-UA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.209.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ru-UA' DESC 'ru-UA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.210.1 NAME 'caseIgnoreOrderingMatch
+ -si' DESC 'si' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.210.1.6 NAME 'caseIgnoreSubstringMa
+ tch-si' DESC 'si' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.211.1 NAME 'caseIgnoreOrderingMatch
+ -sk-SK' DESC 'sk-SK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.211.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sk-SK' DESC 'sk-SK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.212.1 NAME 'caseIgnoreOrderingMatch
+ -sl-SI' DESC 'sl-SI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.212.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sl-SI' DESC 'sl-SI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.213.1 NAME 'caseIgnoreOrderingMatch
+ -sq-AL' DESC 'sq-AL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.213.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sq-AL' DESC 'sq-AL' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.214.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Cyrl' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.214.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Cyrl' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.215.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Cyrl-BA' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.215.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Cyrl-BA' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.216.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Cyrl-ME' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.216.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Cyrl-ME' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.217.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Cyrl-RS' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.217.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Cyrl-RS' DESC 'sr-Cyrl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.218.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Latn' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.218.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Latn' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.219.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Latn-BA' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.219.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Latn-BA' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.220.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Latn-ME' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.220.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Latn-ME' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.221.1 NAME 'caseIgnoreOrderingMatch
+ -sr-Latn-RS' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.221.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sr-Latn-RS' DESC 'sr-Latn' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.222.1 NAME 'caseIgnoreOrderingMatch
+ -sv-FI' DESC 'sv-FI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.222.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sv-FI' DESC 'sv-FI' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.223.1 NAME 'caseIgnoreOrderingMatch
+ -sv-SE' DESC 'sv-SE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.223.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sv-SE' DESC 'sv-SE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.224.1 NAME 'caseIgnoreOrderingMatch
+ -sw' DESC 'sw' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.224.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sw' DESC 'sw' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.225.1 NAME 'caseIgnoreOrderingMatch
+ -sw-KE' DESC 'sw-KE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.225.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sw-KE' DESC 'sw-KE' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.226.1 NAME 'caseIgnoreOrderingMatch
+ -sw-TZ' DESC 'sw-TZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.226.1.6 NAME 'caseIgnoreSubstringMa
+ tch-sw-TZ' DESC 'sw-TZ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.227.1 NAME 'caseIgnoreOrderingMatch
+ -ta' DESC 'ta' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.227.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ta' DESC 'ta' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.228.1 NAME 'caseIgnoreOrderingMatch
+ -ta-IN' DESC 'ta-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.228.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ta-IN' DESC 'ta-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.229.1 NAME 'caseIgnoreOrderingMatch
+ -ta-LK' DESC 'ta-LK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.229.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ta-LK' DESC 'ta-LK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.230.1 NAME 'caseIgnoreOrderingMatch
+ -te' DESC 'te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.230.1.6 NAME 'caseIgnoreSubstringMa
+ tch-te' DESC 'te' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.231.1 NAME 'caseIgnoreOrderingMatch
+ -th' DESC 'th' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.231.1.6 NAME 'caseIgnoreSubstringMa
+ tch-th' DESC 'th' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.232.1 NAME 'caseIgnoreOrderingMatch
+ -ur' DESC 'ur' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.232.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ur' DESC 'ur' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.233.1 NAME 'caseIgnoreOrderingMatch
+ -ur-IN' DESC 'ur-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.233.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ur-IN' DESC 'ur-IN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.234.1 NAME 'caseIgnoreOrderingMatch
+ -ur-PK' DESC 'ur-PK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.234.1.6 NAME 'caseIgnoreSubstringMa
+ tch-ur-PK' DESC 'ur-PK' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.235.1 NAME 'caseIgnoreOrderingMatch
+ -vi' DESC 'vi' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.235.1.6 NAME 'caseIgnoreSubstringMa
+ tch-vi' DESC 'vi' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.236.1 NAME 'caseIgnoreOrderingMatch
+ -yo' DESC 'yo' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.236.1.6 NAME 'caseIgnoreSubstringMa
+ tch-yo' DESC 'yo' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.237.1 NAME 'caseIgnoreOrderingMatch
+ -zh-Hans' DESC 'zh-Hans' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.237.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zh-Hans' DESC 'zh-Hans' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.238.1 NAME 'caseIgnoreOrderingMatch
+ -zh-Hans-CN' DESC 'zh-Hans' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.238.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zh-Hans-CN' DESC 'zh-Hans' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.239.1 NAME 'caseIgnoreOrderingMatch
+ -zh-Hans-SG' DESC 'zh-Hans' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.239.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zh-Hans-SG' DESC 'zh-Hans' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.240.1 NAME 'caseIgnoreOrderingMatch
+ -zh-Hant-HK' DESC 'zh-Hant' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.240.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zh-Hant-HK' DESC 'zh-Hant' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.241.1 NAME 'caseIgnoreOrderingMatch
+ -zh-Hant-MO' DESC 'zh-Hant' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.241.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zh-Hant-MO' DESC 'zh-Hant' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.242.1 NAME 'caseIgnoreOrderingMatch
+ -zh-Hant-TW' DESC 'zh-Hant' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.242.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zh-Hant-TW' DESC 'zh-Hant' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.243.1 NAME 'caseIgnoreOrderingMatch
+ -zu' DESC 'zu' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.243.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zu' DESC 'zu' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.244.1 NAME 'caseIgnoreOrderingMatch
+ -zu-ZA' DESC 'zu-ZA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.244.1.6 NAME 'caseIgnoreSubstringMa
+ tch-zu-ZA' DESC 'zu-ZA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.0.3 SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.0.3.6 SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.11.3 NAME 'caseExactOrderingMatch-e
+ n' DESC 'en' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.16.840.1.113730.3.3.2.11.3.6 NAME 'caseExactSubstringMatc
+ h-en' DESC 'en' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+matchingRules: ( 2.5.13.23 NAME 'uniqueMemberMatch' DESC 'The uniqueMemberMa
+ tch rule compares an assertion value of the Name And Optional UID syntax to
+  an attribute value of a syntax (e.g., the Name And Optional UID syntax) wh
+ ose corresponding ASN.1 type is NameAndOptionalUID.  The rule evaluates to 
+ TRUE if and only if the <distinguishedName> components of the assertion val
+ ue and attribute value match according to the distinguishedNameMatch rule a
+ nd either, (1) the <BitString> component is absent from both the attribute 
+ value and assertion value, or (2) the <BitString> component is present in b
+ oth the attribute value and the assertion value and the <BitString> compone
+ nt of the assertion value matches the <BitString> component of the attribut
+ e value according to the bitStringMatch rule.  Note that this matching rule
+  has been altered from its description in X.520 [X.520] in order to make th
+ e matching rule commutative.  Server implementors should consider using the
+  original X.520 semantics (where the matching was less exact) for approxima
+ te matching of attributes with uniqueMemberMatch as the equality matching r
+ ule.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )
+matchingRules: ( 2.5.13.8 NAME 'numericStringMatch' DESC 'The rule evaluates
+  to TRUE if and only if the prepared attribute value character string and t
+ he prepared assertion value character string have the same number of charac
+ ters and corresponding characters have the same code point.' SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.36 )
+matchingRules: ( 2.5.13.9 NAME 'numericStringOrderingMatch' DESC 'The rule e
+ valuates to TRUE if and only if, in the code point collation order, the pre
+ pared attribute value character string appears earlier than the prepared as
+ sertion value character string; i.e., the attribute value is less than the 
+ assertion value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )
+matchingRules: ( 2.5.13.10 NAME 'numericStringSubstringsMatch' DESC 'The rul
+ e evaluates to TRUE if and only if (1) the prepared substrings of the asser
+ tion value match disjoint portions of the prepared attribute value, (2) an 
+ initial substring, if present, matches the beginning of the prepared attrib
+ ute value character string, and (3) a final substring, if present, matches 
+ the end of the prepared attribute value character string.' SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.20 NAME 'telephoneNumberMatch' DESC 'The telephoneNu
+ mberMatch rule compares an assertion value of the Telephone Number syntax t
+ o an attribute value of a syntax (e.g., the Telephone Number syntax) whose 
+ corresponding ASN.1 type is a PrintableString representing a telephone numb
+ er. The rule evaluates to TRUE if and only if the prepared attribute value 
+ character string and the prepared assertion value character string have the
+  same number of characters and corresponding characters have the same code 
+ point. In preparing the attribute value and assertion value for comparison,
+  characters are case folded in the Map preparation step, and only telephone
+ Number Insignificant Character Handling is applied in the Insignificant Cha
+ racter Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )
+matchingRules: ( 2.5.13.21 NAME 'telephoneNumberSubstringsMatch' DESC 'The t
+ elephoneNumberSubstringsMatch rule compares an assertion value of the Subst
+ ring Assertion syntax to an attribute value of a syntax (e.g., the Telephon
+ e Number syntax) whose corresponding ASN.1 type is a PrintableString repres
+ enting a telephone number. The rule evaluates to TRUE if and only if (1) th
+ e prepared substrings of the assertion value match disjoint portions of the
+  prepared attribute value character string in the order of the substrings i
+ n the assertion value, (2) an <initial> substring, if present, matches the 
+ beginning of the prepared attribute value character string, and (3) a <fina
+ l> substring, if present, matches the end of the prepared attribute value c
+ haracter string.  A prepared substring matches a portion of the prepared at
+ tribute value character string if corresponding characters have the same co
+ de point. In preparing the attribute value and assertion value substrings f
+ or comparison, characters are case folded in the Map preparation step, and 
+ only telephoneNumber Insignificant Character Handling is applied in the Ins
+ ignificant Character Handling step.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
+objectClass: top
+objectClass: ldapSubentry
+objectClass: subschema
+objectClasses: ( 2.5.6.0 NAME 'top' ABSTRACT MUST objectClass X-ORIGIN 'RFC 
+ 4512' )
+objectClasses: ( 2.5.6.1 NAME 'alias' SUP top STRUCTURAL MUST aliasedObjectN
+ ame X-ORIGIN 'RFC 4512' )
+objectClasses: ( 2.5.20.1 NAME 'subschema' AUXILIARY MAY ( dITStructureRules
+  $ nameForms $ dITContentRules $ objectClasses $ attributeTypes $ matchingR
+ ules $ matchingRuleUse ) X-ORIGIN 'RFC 4512' )
+objectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' SUP to
+ p AUXILIARY X-ORIGIN 'RFC 4512' )
+objectClasses: ( 2.5.6.11 NAME 'applicationProcess' SUP top STRUCTURAL MUST 
+ cn MAY ( seeAlso $ ou $ l $ description ) X-ORIGIN 'RFC 4519' )
+objectClasses: ( 2.5.6.2 NAME 'country' SUP top STRUCTURAL MUST c MAY ( sear
+ chGuide $ description ) X-ORIGIN 'RFC 4519' )
+objectClasses: ( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'Standard LDAP ob
+ jectclass' SUP top AUXILIARY MUST dc X-ORIGIN ( 'IPA v4.4.2' 'user defined'
+  ) )
+objectClasses: ( 2.5.6.14 NAME 'device' SUP top STRUCTURAL MUST cn MAY ( ser
+ ialNumber $ seeAlso $ owner $ ou $ o $ l $ description ) X-ORIGIN 'RFC 4519
+ ' )
+objectClasses: ( 2.5.6.9 NAME 'groupOfNames' SUP top STRUCTURAL MUST cn MAY 
+ ( member $ businessCategory $ seeAlso $ owner $ ou $ o $ description ) X-OR
+ IGIN 'RFC 4519' )
+objectClasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' SUP top STRUCTURAL MUST 
+ cn MAY ( uniqueMember $ businessCategory $ seeAlso $ owner $ ou $ o $ descr
+ iption ) X-ORIGIN 'RFC 4519' )
+objectClasses: ( 2.5.6.3 NAME 'locality' SUP top STRUCTURAL MAY ( street $ s
+ eeAlso $ searchGuide $ st $ l $ description ) X-ORIGIN 'RFC 4519' )
+objectClasses: ( 2.5.6.4 NAME 'organization' SUP top STRUCTURAL MUST o MAY (
+  userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ re
+ gisteredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNum
+ ber $ teletexTerminalIdentifier $ telephoneNumber $ internationalISDNNumber
+  $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalA
+ ddress $ physicalDeliveryOfficeName $ st $ l $ description ) X-ORIGIN 'RFC 
+ 4519' )
+objectClasses: ( 2.5.6.6 NAME 'person' SUP top STRUCTURAL MUST ( sn $ cn ) M
+ AY ( userPassword $ telephoneNumber $ seeAlso $ description ) X-ORIGIN 'RFC
+  4519' )
+objectClasses: ( 2.5.6.7 NAME 'organizationalPerson' SUP person STRUCTURAL M
+ AY ( title $ x121Address $ registeredAddress $ destinationIndicator $ prefe
+ rredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ internationa
+ lISDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCod
+ e $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l ) X-ORIGIN 'RF
+ C 4519' )
+objectClasses: ( 2.5.6.8 NAME 'organizationalRole' SUP top STRUCTURAL MUST c
+ n MAY ( x121Address $ registeredAddress $ destinationIndicator $ preferredD
+ eliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $
+  internationalISDNNumber $ facsimileTelephoneNumber $ seeAlso $ roleOccupan
+ t $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryO
+ fficeName $ ou $ st $ l $ description ) X-ORIGIN 'RFC 4519' )
+objectClasses: ( 2.5.6.5 NAME 'organizationalUnit' SUP top STRUCTURAL MUST o
+ u MAY ( businessCategory $ description $ destinationIndicator $ facsimileTe
+ lephoneNumber $ internationalISDNNumber $ l $ physicalDeliveryOfficeName $ 
+ postalAddress $ postalCode $ postOfficeBox $ preferredDeliveryMethod $ regi
+ steredAddress $ searchGuide $ seeAlso $ st $ street $ telephoneNumber $ tel
+ etexTerminalIdentifier $ telexNumber $ userPassword $ x121Address ) X-ORIGI
+ N 'RFC 4519' )
+objectClasses: ( 2.5.6.10 NAME 'residentialPerson' SUP person STRUCTURAL MUS
+ T l MAY ( businessCategory $ x121Address $ registeredAddress $ destinationI
+ ndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifie
+ r $ internationalISDNNumber $ facsimileTelephoneNumber $ street $ postOffic
+ eBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) X
+ -ORIGIN 'RFC 4519' )
+objectClasses: ( 1.3.6.1.1.3.1 NAME 'uidObject' SUP top AUXILIARY MUST uid X
+ -ORIGIN 'RFC 4519' )
+objectClasses: ( 2.16.840.1.113719.2.142.6.1.1 NAME 'ldapSubEntry' DESC 'LDA
+ P Subentry class, version 1' SUP top STRUCTURAL MAY cn X-ORIGIN 'LDAP Suben
+ try Internet Draft' )
+objectClasses: ( 2.16.840.1.113730.3.2.40 NAME 'directoryServerFeature' DESC
+  'Netscape defined objectclass' SUP top STRUCTURAL MAY ( oid $ cn $ multiLi
+ neDescription ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.41 NAME 'nsslapdPlugin' DESC 'Netscap
+ e defined objectclass' SUP top STRUCTURAL MUST ( cn $ nsslapd-pluginPath $ 
+ nsslapd-pluginInitfunc $ nsslapd-pluginType $ nsslapd-pluginId $ nsslapd-pl
+ uginVersion $ nsslapd-pluginVendor $ nsslapd-pluginDescription $ nsslapd-pl
+ uginEnabled ) MAY ( nsslapd-pluginConfigArea $ nsslapd-plugin-depends-on-ty
+ pe ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.44 NAME 'nsIndex' DESC 'Netscape defi
+ ned objectclass' SUP top STRUCTURAL MUST ( cn $ nsSystemIndex ) MAY ( descr
+ iption $ nsIndexType $ nsMatchingRule $ nsIndexIDListScanLimit ) X-ORIGIN '
+ Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.109 NAME 'nsBackendInstance' DESC 'Ne
+ tscape defined objectclass' SUP top STRUCTURAL MUST cn X-ORIGIN 'Netscape D
+ irectory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.110 NAME 'nsMappingTree' DESC 'Netsca
+ pe defined objectclass' SUP top STRUCTURAL MUST cn X-ORIGIN 'Netscape Direc
+ tory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.104 NAME 'nsContainer' DESC 'Netscape
+  defined objectclass' SUP top STRUCTURAL MUST cn X-ORIGIN 'Netscape Directo
+ ry Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.108 NAME 'nsDS5Replica' DESC 'Netscap
+ e defined objectclass' SUP top STRUCTURAL MUST ( nsDS5ReplicaRoot $ nsDS5Re
+ plicaId ) MAY ( cn $ nsds5ReplicaPreciseTombstonePurging $ nsds5ReplicaClea
+ nRUV $ nsds5ReplicaAbortCleanRUV $ nsDS5ReplicaType $ nsDS5ReplicaBindDN $ 
+ nsState $ nsDS5ReplicaName $ nsDS5Flags $ nsDS5Task $ nsDS5ReplicaReferral 
+ $ nsDS5ReplicaAutoReferral $ nsds5ReplicaPurgeDelay $ nsds5ReplicaTombstone
+ PurgeInterval $ nsds5ReplicaChangeCount $ nsds5ReplicaLegacyConsumer $ nsds
+ 5ReplicaProtocolTimeout $ nsds5ReplicaBackoffMin $ nsds5ReplicaBackoffMax $
+  nsds5ReplicaReleaseTimeout ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.113 NAME 'nsTombstone' DESC 'Netscape
+  defined objectclass' SUP top STRUCTURAL MAY ( nstombstonecsn $ nsParentUni
+ queId $ nscpEntryDN ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.103 NAME 'nsDS5ReplicationAgreement' 
+ DESC 'Netscape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsds5R
+ eplicaCleanRUVNotified $ nsDS5ReplicaHost $ nsDS5ReplicaPort $ nsDS5Replica
+ TransportInfo $ nsDS5ReplicaBindDN $ nsDS5ReplicaCredentials $ nsDS5Replica
+ BindMethod $ nsDS5ReplicaRoot $ nsDS5ReplicatedAttributeList $ nsDS5Replica
+ tedAttributeListTotal $ nsDS5ReplicaUpdateSchedule $ nsds5BeginReplicaRefre
+ sh $ description $ nsds50ruv $ nsruvReplicaLastModified $ nsds5replicaTimeo
+ ut $ nsds5replicaChangesSentSinceStartup $ nsds5replicaLastUpdateEnd $ nsds
+ 5replicaLastUpdateStart $ nsds5replicaLastUpdateStatus $ nsds5replicaUpdate
+ InProgress $ nsds5replicaLastInitEnd $ nsds5ReplicaEnabled $ nsds5replicaLa
+ stInitStart $ nsds5replicaLastInitStatus $ nsds5debugreplicatimeout $ nsds5
+ replicaBusyWaitTime $ nsds5ReplicaStripAttrs $ nsds5replicaSessionPauseTime
+  $ nsds5ReplicaProtocolTimeout $ nsds5ReplicaFlowControlWindow $ nsds5Repli
+ caFlowControlPause $ nsDS5ReplicaWaitForAsyncResults ) X-ORIGIN 'Netscape D
+ irectory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.39 NAME 'nsslapdConfig' DESC 'Netscap
+ e defined objectclass' SUP top STRUCTURAL MAY cn X-ORIGIN 'Netscape Directo
+ ry Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.317 NAME 'nsSaslMapping' DESC 'Netsca
+ pe defined objectclass' SUP top STRUCTURAL MUST ( cn $ nsSaslMapRegexString
+  $ nsSaslMapBaseDNTemplate $ nsSaslMapFilterTemplate ) MAY nsSaslMapPriorit
+ y X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.43 NAME 'nsSNMP' DESC 'Netscape defin
+ ed objectclass' SUP top STRUCTURAL MUST ( cn $ nsSNMPEnabled ) MAY ( nsSNMP
+ Organization $ nsSNMPLocation $ nsSNMPContact $ nsSNMPDescription $ nsSNMPN
+ ame $ nsSNMPMasterHost $ nsSNMPMasterPort ) X-ORIGIN 'Netscape Directory Se
+ rver' )
+objectClasses: ( nsEncryptionConfig-oid NAME 'nsEncryptionConfig' DESC 'Nets
+ cape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsCertfile $ nsK
+ eyfile $ nsSSL2 $ nsSSL3 $ nsTLS1 $ sslVersionMin $ sslVersionMax $ nsSSLSe
+ ssionTimeout $ nsSSL3SessionTimeout $ nsSSLClientAuth $ nsSSL2Ciphers $ nsS
+ SL3Ciphers $ nsSSLSupportedCiphers $ allowWeakCipher $ CACertExtractFile $ 
+ allowWeakDHParam ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsEncryptionModule-oid NAME 'nsEncryptionModule' DESC 'Nets
+ cape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsSSLToken $ nsS
+ SLPersonalitySSL $ nsSSLActivation $ ServerKeyExtractFile $ ServerCertExtra
+ ctFile ) X-ORIGIN 'Netscape' )
+objectClasses: ( 2.16.840.1.113730.3.2.327 NAME 'rootDNPluginConfig' DESC 'N
+ etscape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( rootdn-open-t
+ ime $ rootdn-close-time $ rootdn-days-allowed $ rootdn-allow-host $ rootdn-
+ deny-host $ rootdn-allow-ip $ rootdn-deny-ip ) X-ORIGIN 'Netscape' )
+objectClasses: ( 2.16.840.1.113730.3.2.328 NAME 'nsSchemaPolicy' DESC 'Netsc
+ ape defined objectclass' SUP top STRUCTURAL MAY ( cn $ schemaUpdateObjectcl
+ assAccept $ schemaUpdateObjectclassReject $ schemaUpdateAttributeAccept $ s
+ chemaUpdateAttributeReject ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.31 NAME 'groupOfCertificates' DESC 'N
+ etscape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( memberCertifi
+ cateDescription $ businessCategory $ description $ o $ ou $ owner $ seeAlso
+  ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.33 NAME 'groupOfURLs' DESC 'Netscape 
+ defined objectclass' SUP top STRUCTURAL MUST cn MAY ( memberURL $ businessC
+ ategory $ description $ o $ ou $ owner $ seeAlso ) X-ORIGIN 'Netscape Direc
+ tory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.35 NAME 'LDAPServer' DESC 'Netscape d
+ efined objectclass' SUP top STRUCTURAL MUST cn MAY ( description $ l $ ou $
+  seeAlso $ generation $ changeLogMaximumAge $ changeLogMaximumSize ) X-ORIG
+ IN 'Netscape Directory Server' )
+objectClasses: ( 1.3.6.1.4.1.250.3.18 NAME 'cacheObject' DESC 'object that c
+ ontains the TTL (time to live) attribute type' SUP top STRUCTURAL MAY ttl X
+ -ORIGIN 'LDAP Caching Internet Draft' )
+objectClasses: ( 2.16.840.1.113730.3.2.10 NAME 'netscapeServer' DESC 'Netsca
+ pe defined objectclass' SUP top STRUCTURAL MUST cn MAY ( description $ serv
+ erRoot $ serverProductName $ serverVersionNumber $ installationTimeStamp $ 
+ administratorContactInfo $ userPassword $ adminUrl $ serverHostName ) X-ORI
+ GIN 'Netscape Administration Services' )
+objectClasses: ( 2.16.840.1.113730.3.2.7 NAME 'nsLicenseUser' DESC 'Netscape
+  defined objectclass' SUP top STRUCTURAL MAY ( nsLicensedFor $ nsLicenseSta
+ rtTime $ nsLicenseEndTime ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( 2.16.840.1.113730.3.2.1 NAME 'changeLogEntry' DESC 'LDAP ch
+ angelog objectclass' SUP top STRUCTURAL MUST ( targetDn $ changeTime $ chan
+ geNumber $ changeType ) MAY ( changes $ newRdn $ deleteOldRdn $ newSuperior
+  ) X-ORIGIN 'Changelog Internet Draft' )
+objectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'LDAP referral
+ s objectclass' SUP top STRUCTURAL MAY ref X-ORIGIN 'LDAPv3 referrals Intern
+ et Draft' )
+objectClasses: ( 2.16.840.1.113730.3.2.12 NAME 'passwordObject' DESC 'Netsca
+ pe defined password policy objectclass' SUP top STRUCTURAL MAY ( pwdpolicys
+ ubentry $ passwordExpirationTime $ passwordExpWarned $ passwordRetryCount $
+  retryCountResetTime $ accountUnlockTime $ passwordHistory $ passwordAllowC
+ hangeTime $ passwordGraceUserTime ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.13 NAME 'passwordPolicy' DESC 'Netsca
+ pe defined password policy objectclass' SUP top STRUCTURAL MAY ( passwordMa
+ xAge $ passwordExp $ passwordMinLength $ passwordKeepHistory $ passwordInHi
+ story $ passwordChange $ passwordWarning $ passwordLockout $ passwordMaxFai
+ lure $ passwordResetDuration $ passwordUnlock $ passwordLockoutDuration $ p
+ asswordCheckSyntax $ passwordMustChange $ passwordStorageScheme $ passwordM
+ inAge $ passwordResetFailureCount $ passwordGraceLimit $ passwordMinDigits 
+ $ passwordMinAlphas $ passwordMinUppers $ passwordMinLowers $ passwordMinSp
+ ecials $ passwordMin8bit $ passwordMaxRepeats $ passwordMinCategories $ pas
+ swordMinTokenLength $ passwordTrackUpdateTime $ passwordAdminDN ) X-ORIGIN 
+ 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.30 NAME 'glue' DESC 'Netscape defined
+  objectclass' SUP top STRUCTURAL X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.32 NAME 'netscapeMachineData' DESC 'N
+ etscape defined objectclass' SUP top STRUCTURAL X-ORIGIN 'Netscape Director
+ y Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.38 NAME 'vlvSearch' DESC 'Netscape de
+ fined objectclass' SUP top STRUCTURAL MUST ( cn $ vlvBase $ vlvScope $ vlvF
+ ilter ) MAY multiLineDescription X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.42 NAME 'vlvIndex' DESC 'Netscape def
+ ined objectclass' SUP top STRUCTURAL MUST ( cn $ vlvSort ) MAY ( vlvEnabled
+  $ vlvUses ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.84 NAME 'cosDefinition' DESC 'Netscap
+ e defined objectclass' SUP top STRUCTURAL MAY ( costargettree $ costemplate
+ dn $ cosspecifier $ cosAttribute $ aci $ cn $ uid ) X-ORIGIN 'Netscape Dire
+ ctory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.93 NAME 'nsRoleDefinition' DESC 'Nets
+ cape defined objectclass' SUP ldapSubEntry STRUCTURAL MAY ( description $ n
+ sRoleScopeDN ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.94 NAME 'nsSimpleRoleDefinition' DESC
+  'Netscape defined objectclass' SUP nsRoleDefinition STRUCTURAL X-ORIGIN 'N
+ etscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.95 NAME 'nsComplexRoleDefinition' DES
+ C 'Netscape defined objectclass' SUP nsRoleDefinition STRUCTURAL X-ORIGIN '
+ Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.96 NAME 'nsManagedRoleDefinition' DES
+ C 'Netscape defined objectclass' SUP nsSimpleRoleDefinition STRUCTURAL X-OR
+ IGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.97 NAME 'nsFilteredRoleDefinition' DE
+ SC 'Netscape defined objectclass' SUP nsComplexRoleDefinition STRUCTURAL MU
+ ST nsRoleFilter X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.98 NAME 'nsNestedRoleDefinition' DESC
+  'Netscape defined objectclass' SUP nsComplexRoleDefinition STRUCTURAL MUST
+  nsRoleDN X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.99 NAME 'cosSuperDefinition' DESC 'Ne
+ tscape defined objectclass' SUP ldapSubEntry STRUCTURAL MUST cosAttribute M
+ AY description X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.100 NAME 'cosClassicDefinition' DESC 
+ 'Netscape defined objectclass' SUP cosSuperDefinition STRUCTURAL MAY ( cost
+ emplatedn $ cosspecifier ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.101 NAME 'cosPointerDefinition' DESC 
+ 'Netscape defined objectclass' SUP cosSuperDefinition STRUCTURAL MAY costem
+ platedn X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.102 NAME 'cosIndirectDefinition' DESC
+  'Netscape defined objectclass' SUP cosSuperDefinition STRUCTURAL MAY cosIn
+ directSpecifier X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.503 NAME 'nsDSWindowsReplicationAgree
+ ment' DESC 'Netscape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( 
+ nsDS5ReplicaHost $ nsDS5ReplicaPort $ nsDS5ReplicaTransportInfo $ nsDS5Repl
+ icaBindDN $ nsDS5ReplicaCredentials $ nsDS5ReplicaBindMethod $ nsDS5Replica
+ Root $ nsDS5ReplicatedAttributeList $ nsDS5ReplicaUpdateSchedule $ nsds5Beg
+ inReplicaRefresh $ description $ nsds50ruv $ nsruvReplicaLastModified $ nsd
+ s5replicaTimeout $ nsds5replicaChangesSentSinceStartup $ nsds5replicaLastUp
+ dateEnd $ nsds5replicaLastUpdateStart $ nsds5replicaLastUpdateStatus $ nsds
+ 5replicaUpdateInProgress $ nsds5replicaLastInitEnd $ nsds5replicaLastInitSt
+ art $ nsds5replicaLastInitStatus $ nsds5debugreplicatimeout $ nsds5replicaB
+ usyWaitTime $ nsds5replicaSessionPauseTime $ nsds7WindowsReplicaSubtree $ n
+ sds7DirectoryReplicaSubtree $ nsds7NewWinUserSyncEnabled $ nsds7NewWinGroup
+ SyncEnabled $ nsds7WindowsDomain $ nsds7DirsyncCookie $ winSyncInterval $ o
+ neWaySync $ winSyncMoveAction $ nsds5ReplicaEnabled $ winSyncDirectoryFilte
+ r $ winSyncWindowsFilter $ winSyncSubtreePair ) X-ORIGIN 'Netscape Director
+ y Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.128 NAME 'costemplate' DESC 'Netscape
+  defined objectclass' SUP top STRUCTURAL MAY ( cn $ cosPriority ) X-ORIGIN 
+ 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.304 NAME 'nsView' DESC 'Netscape defi
+ ned objectclass' SUP top AUXILIARY MAY ( nsViewFilter $ description ) X-ORI
+ GIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.316 NAME 'nsAttributeEncryption' DESC
+  'Netscape defined objectclass' SUP top STRUCTURAL MUST ( cn $ nsEncryption
+ Algorithm ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.5.6.21 NAME 'pkiUser' DESC 'X.509 PKI User' SUP top AUXIL
+ IARY MAY userCertificate X-ORIGIN 'RFC 4523' )
+objectClasses: ( 2.5.6.22 NAME 'pkiCA' DESC 'X.509 PKI Certificate Authority
+ ' SUP top AUXILIARY MAY ( cACertificate $ certificateRevocationList $ autho
+ rityRevocationList $ crossCertificatePair ) X-ORIGIN 'RFC 4523' )
+objectClasses: ( 2.5.6.19 NAME 'cRLDistributionPoint' DESC 'X.509 CRL distri
+ bution point' SUP top STRUCTURAL MUST cn MAY ( certificateRevocationList $ 
+ authorityRevocationList $ deltaRevocationList ) X-ORIGIN 'RFC 4523' )
+objectClasses: ( 2.5.6.23 NAME 'deltaCRL' DESC 'X.509 delta CRL' SUP top AUX
+ ILIARY MAY deltaRevocationList X-ORIGIN 'RFC 4523' )
+objectClasses: ( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'X.521 strong
+  authentication user' SUP top AUXILIARY MUST userCertificate X-ORIGIN 'RFC 
+ 4523' )
+objectClasses: ( 2.5.6.18 NAME 'userSecurityInformation' DESC 'X.521 user se
+ curity information' SUP top AUXILIARY MAY supportedAlgorithms X-ORIGIN 'RFC
+  4523' )
+objectClasses: ( 2.5.6.16 NAME 'certificationAuthority' DESC 'X.509 certific
+ ate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ certifica
+ teRevocationList $ cACertificate ) MAY crossCertificatePair X-ORIGIN 'RFC 4
+ 523' )
+objectClasses: ( 2.5.6.16.2 NAME 'certificationAuthority-V2' DESC 'X.509 cer
+ tificate authority, version 2' SUP certificationAuthority AUXILIARY MAY del
+ taRevocationList X-ORIGIN 'RFC 4523' )
+objectClasses: ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL
+  MUST uid MAY ( description $ seeAlso $ l $ o $ ou $ host ) X-ORIGIN 'RFC 4
+ 524' )
+objectClasses: ( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUCTURA
+ L MUST documentIdentifier MAY ( cn $ description $ seeAlso $ l $ o $ ou $ d
+ ocumentTitle $ documentVersion $ documentAuthor $ documentLocation $ docume
+ ntPublisher ) X-ORIGIN 'RFC 4524' )
+objectClasses: ( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top STR
+ UCTURAL MUST cn MAY ( description $ l $ o $ ou $ seeAlso $ telephoneNumber 
+ ) X-ORIGIN 'RFC 4524' )
+objectClasses: ( 0.9.2342.19200300.100.4.13 NAME 'domain' DESC 'Standard LDA
+ P objectclass' SUP top STRUCTURAL MUST dc MAY ( associatedName $ businessCa
+ tegory $ description $ destinationIndicator $ facsimileTelephoneNumber $ in
+ ternationalISDNNumber $ l $ o $ physicalDeliveryOfficeName $ postOfficeBox 
+ $ postalAddress $ postalCode $ preferredDeliveryMethod $ registeredAddress 
+ $ searchGuide $ seeAlso $ st $ street $ telephoneNumber $ teletexTerminalId
+ entifier $ telexNumber $ userPassword $ x121Address ) X-ORIGIN ( 'IPA v4.4.
+ 2' 'user defined' ) )
+objectClasses: ( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' SUP t
+ op AUXILIARY MUST associatedDomain X-ORIGIN 'RFC 4524' )
+objectClasses: ( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP count
+ ry STRUCTURAL MUST co X-ORIGIN 'RFC 4524' )
+objectClasses: ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' DESC 'Pil
+ ot objectclass' SUP domain STRUCTURAL MAY ( cn $ sn ) X-ORIGIN ( 'IPA v4.4.
+ 2' 'user defined' ) )
+objectClasses: ( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURAL MU
+ ST cn MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) X-ORIGIN
+  'RFC 4524' )
+objectClasses: ( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject' SUP 
+ top AUXILIARY MUST userPassword X-ORIGIN 'RFC 4524' )
+objectClasses: ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' SUP organizati
+ onalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departm
+ entNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homeP
+ hone $ homePostalAddress $ initials $ jpegPhoto $ labeledURI $ mail $ manag
+ er $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertif
+ icate $ x500UniqueIdentifier $ preferredLanguage $ userSMIMECertificate $ u
+ serPKCS12 ) X-ORIGIN 'RFC 2798' )
+objectClasses: ( 2.16.840.1.113730.3.2.322 NAME 'autoMemberDefinition' DESC 
+ 'Auto Membership Config Definition Entry' SUP top STRUCTURAL MUST ( cn $ au
+ toMemberScope $ autoMemberFilter $ autoMemberGroupingAttr ) MAY ( autoMembe
+ rDefaultGroup $ autoMemberDisabled ) X-ORIGIN '389 Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.323 NAME 'autoMemberRegexRule' DESC '
+ Auto Membership Regex Rule Entry' SUP top STRUCTURAL MUST ( cn $ autoMember
+ TargetGroup ) MAY ( autoMemberExclusiveRegex $ autoMemberInclusiveRegex $ d
+ escription ) X-ORIGIN '389 Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.324 NAME 'dnaPluginConfig' DESC 'DNA 
+ plugin configuration' SUP top AUXILIARY MAY ( dnaType $ dnaPrefix $ dnaNext
+ Value $ dnaMaxValue $ dnaInterval $ dnaMagicRegen $ dnaFilter $ dnaScope $ 
+ dnaExcludeScope $ dnaSharedCfgDN $ dnaThreshold $ dnaNextRange $ dnaRangeRe
+ questTimeout $ dnaRemoteBindDN $ dnaRemoteBindCred $ cn ) X-ORIGIN '389 Dir
+ ectory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.325 NAME 'dnaSharedConfig' DESC 'DNA 
+ Shared Configuration' SUP top AUXILIARY MAY ( dnaHostname $ dnaPortNum $ dn
+ aSecurePortNum $ dnaRemoteBindMethod $ dnaRemoteConnProtocol $ dnaRemaining
+ Values ) X-ORIGIN '389 Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.319 NAME 'mepManagedEntry' DESC 'Mana
+ ged Entries Managed Entry' SUP top AUXILIARY MAY mepManagedBy X-ORIGIN '389
+  Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.320 NAME 'mepOriginEntry' DESC 'Manag
+ ed Entries Origin Entry' SUP top AUXILIARY MAY mepManagedEntry X-ORIGIN '38
+ 9 Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.321 NAME 'mepTemplateEntry' DESC 'Man
+ aged Entries Template Entry' SUP top AUXILIARY MAY ( cn $ mepStaticAttr $ m
+ epMappedAttr $ mepRDNAttr ) X-ORIGIN '389 Directory Server' )
+objectClasses: ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Standard LDAP obj
+ ectclass' SUP top AUXILIARY MUST ( cn $ uid $ uidNumber $ gidNumber $ homeD
+ irectory ) MAY ( userPassword $ loginShell $ gecos $ description ) X-ORIGIN
+  'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Standard LDAP ob
+ jectclass' SUP top AUXILIARY MUST uid MAY ( userPassword $ shadowLastChange
+  $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ 
+ shadowFlag $ description ) X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Standard LDAP objec
+ tclass' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ mem
+ berUid $ description ) X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Standard LDAP object
+ class' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipServiceProtocol ) M
+ AY description X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Standard LDAP objec
+ tclass' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber ) MAY description X
+ -ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Standard LDAP objectcla
+ ss' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber ) MAY description X-ORIGIN 
+ 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Standard LDAP objectcla
+ ss' SUP top AUXILIARY MUST ( ipHostNumber $ cn ) MAY ( manager $ descriptio
+ n $ l $ o $ ou $ owner $ seeAlso $ serialNumber ) X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Standard LDAP object
+ class' SUP top STRUCTURAL MUST ( ipNetworkNumber $ cn ) MAY ( ipNetmaskNumb
+ er $ manager $ l $ description ) X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Standard LDAP obje
+ ctclass' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberNisNetg
+ roup $ description ) X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'Standard LDAP objec
+ tclass' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY descr
+ iption X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'Standard LDAP o
+ bjectclass' SUP top AUXILIARY MUST cn MAY ( macAddress $ description $ l $ 
+ o $ ou $ owner $ seeAlso $ serialNumber ) X-ORIGIN 'RFC 2307' )
+objectClasses: ( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'Standard LDAP 
+ objectclass' SUP top AUXILIARY MUST cn MAY ( bootFile $ bootParameter $ des
+ cription $ l $ o $ ou $ owner $ seeAlso $ serialNumber ) X-ORIGIN 'RFC 2307
+ ' )
+objectClasses: ( 1.3.6.1.1.1.2.13 NAME 'nisMap' DESC 'Standard LDAP objectcl
+ ass' SUP top STRUCTURAL MUST nisMapName MAY description X-ORIGIN 'RFC 2307'
+  )
+objectClasses: ( 2.16.840.1.113730.3.2.129 NAME 'inetDomain' DESC 'Auxiliary
+  class for virtual domain nodes' SUP top AUXILIARY MAY ( inetDomainBaseDN $
+  inetDomainStatus ) X-ORIGIN 'Netscape subscriber interoperability' )
+objectClasses: ( 2.16.840.1.113730.3.2.130 NAME 'inetUser' DESC 'Auxiliary c
+ lass which must be present in an entry for delivery of subscriber services'
+  SUP top AUXILIARY MAY ( uid $ inetUserStatus $ inetUserHttpURL $ userPassw
+ ord $ memberOf ) X-ORIGIN 'Netscape subscriber interoperability' )
+objectClasses: ( 1.3.6.1.4.1.1466.101.120.141 NAME 'NetscapeLinkedOrganizati
+ on' AUXILIARY MAY parentOrganization X-ORIGIN 'Netscape' )
+objectClasses: ( 1.3.6.1.4.1.1466.101.120.142 NAME 'NetscapePreferences' AUX
+ ILIARY MAY ( preferredLanguage $ preferredLocale $ preferredTimeZone ) X-OR
+ IGIN 'Netscape' )
+objectClasses: ( 2.16.840.1.113730.3.2.134 NAME 'inetSubscriber' SUP top AUX
+ ILIARY MAY ( inetSubscriberAccountId $ inetSubscriberChallenge $ inetSubscr
+ iberResponse ) X-ORIGIN 'Netscape subscriber interoperability' )
+objectClasses: ( 2.16.840.1.113730.3.2.112 NAME 'inetAdmin' DESC 'Marker for
+  an administrative group or user' SUP top AUXILIARY MAY ( aci $ memberOf $ 
+ adminRole ) X-ORIGIN 'Netscape Delegated Administrator' )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.1 NAME 'javaContainer' DESC 'Contai
+ ner for a Java object' SUP top STRUCTURAL MUST cn X-ORIGIN 'RFC 2713' )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.4 NAME 'javaObject' DESC 'Java obje
+ ct representation' SUP top ABSTRACT MUST javaClassName MAY ( javaClassNames
+  $ javaCodebase $ javaDoc $ description ) X-ORIGIN 'RFC 2713' )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.5 NAME 'javaSerializedObject' DESC 
+ 'Java serialized object' SUP javaObject AUXILIARY MUST javaSerializedData X
+ -ORIGIN 'RFC 2713' )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.7 NAME 'javaNamingReference' DESC '
+ JNDI reference' SUP javaObject AUXILIARY MAY ( javaReferenceAddress $ javaF
+ actory ) X-ORIGIN 'RFC 2713' )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.8 NAME 'javaMarshalledObject' DESC 
+ 'Java marshalled object' SUP javaObject AUXILIARY MUST javaSerializedData X
+ -ORIGIN 'RFC 2713' )
+objectClasses: ( 0.9.2342.19200300.100.4.3 NAME 'pilotObject' DESC 'Standard
+  LDAP objectclass' SUP top STRUCTURAL MAY ( audio $ ditRedirect $ info $ jp
+ egPhoto $ lastModifiedBy $ lastModifiedTime $ manager $ photo $ uniqueIdent
+ ifier ) X-ORIGIN 'RFC 1274' )
+objectClasses: ( nsAdminDomain-oid NAME 'nsAdminDomain' DESC 'Netscape defin
+ ed objectclass' SUP organizationalUnit STRUCTURAL MAY nsAdminDomainName X-O
+ RIGIN 'Netscape' )
+objectClasses: ( nsHost-oid NAME 'nsHost' DESC 'Netscape defined objectclass
+ ' SUP top STRUCTURAL MUST cn MAY ( serverHostName $ description $ l $ nsHos
+ tLocation $ nsHardwarePlatform $ nsOsVersion ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsAdminGroup-oid NAME 'nsAdminGroup' DESC 'Netscape defined
+  objectclass' SUP top STRUCTURAL MUST cn MAY ( nsAdminGroupName $ descripti
+ on $ nsConfigRoot $ nsAdminSIEDN ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsApplication-oid NAME 'nsApplication' DESC 'Netscape defin
+ ed objectclass' SUP top STRUCTURAL MUST cn MAY ( nsVendor $ description $ n
+ sProductName $ nsNickName $ nsProductVersion $ nsBuildNumber $ nsRevisionNu
+ mber $ nsSerialNumber $ nsInstalledLocation $ installationTimeStamp $ nsExp
+ irationDate $ nsBuildSecurity $ nsLdapSchemaVersion $ nsServerMigrationClas
+ sname $ nsServerCreationClassname ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsResourceRef-oid NAME 'nsResourceRef' DESC 'Netscape defin
+ ed objectclass' SUP top STRUCTURAL MUST cn MAY seeAlso X-ORIGIN 'Netscape' 
+ )
+objectClasses: ( nsTask-oid NAME 'nsTask' DESC 'Netscape defined objectclass
+ ' SUP top STRUCTURAL MUST cn MAY ( nsTaskLabel $ nsHelpRef $ nsExecRef $ ns
+ LogSuppress ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsTaskGroup-oid NAME 'nsTaskGroup' DESC 'Netscape defined o
+ bjectclass' SUP top STRUCTURAL MUST cn MAY nsTaskLabel X-ORIGIN 'Netscape' 
+ )
+objectClasses: ( nsAdminObject-oid NAME 'nsAdminObject' DESC 'Netscape defin
+ ed objectclass' SUP top STRUCTURAL MUST cn MAY ( nsJarfilename $ nsClassnam
+ e ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsConfig-oid NAME 'nsConfig' DESC 'Netscape defined objectc
+ lass' SUP top STRUCTURAL MUST cn MAY ( description $ nsServerPort $ nsServe
+ rAddress $ nsSuiteSpotUser $ nsErrorLog $ nsPidLog $ nsAccessLog $ nsDefaul
+ tAcceptLanguage $ nsServerSecurity ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsDirectoryInfo-oid NAME 'nsDirectoryInfo' DESC 'Netscape d
+ efined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsBindDN $ nsBindPassw
+ ord $ nsDirectoryURL $ nsDirectoryFailoverList $ nsDirectoryInfoRef ) X-ORI
+ GIN 'Netscape' )
+objectClasses: ( nsAdminServer-oid NAME 'nsAdminServer' DESC 'Netscape defin
+ ed objectclass' SUP top STRUCTURAL MUST ( cn $ nsServerID ) MAY description
+  X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminConfig-oid NAME 'nsAdminConfig' DESC 'Netscape defin
+ ed objectclass' SUP nsConfig STRUCTURAL MAY ( nsAdminCgiWaitPid $ nsAdminUs
+ ers $ nsAdminAccessHosts $ nsAdminAccessAddresses $ nsAdminOneACLDir $ nsAd
+ minEnableDSGW $ nsAdminEnableEnduser $ nsAdminCacheLifetime ) X-ORIGIN 'Net
+ scape Administration Services' )
+objectClasses: ( nsAdminResourceEditorExtension-oid NAME 'nsAdminResourceEdi
+ torExtension' DESC 'Netscape defined objectclass' SUP nsAdminObject STRUCTU
+ RAL MAY ( nsAdminAccountInfo $ nsDeleteclassname ) X-ORIGIN 'Netscape Admin
+ istration Services' )
+objectClasses: ( nsAdminGlobalParameters-oid NAME 'nsAdminGlobalParameters' 
+ DESC 'Netscape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsAdmi
+ nEndUserHTMLIndex $ nsNickName ) X-ORIGIN 'Netscape Administration Services
+ ' )
+objectClasses: ( nsGlobalParameters-oid NAME 'nsGlobalParameters' DESC 'Nets
+ cape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsUniqueAttribut
+ e $ nsUserIDFormat $ nsUserRDNComponent $ nsGroupRDNComponent $ nsWellKnown
+ Jarfiles $ nsNYR ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsDefaultObjectClasses-oid NAME 'nsDefaultObjectClasses' DE
+ SC 'Netscape defined objectclass' SUP top STRUCTURAL MUST cn MAY nsDefaultO
+ bjectClass X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminConsoleUser-oid NAME 'nsAdminConsoleUser' DESC 'Nets
+ cape defined objectclass' SUP top STRUCTURAL MUST cn MAY nsPreference X-ORI
+ GIN 'Netscape Administration Services' )
+objectClasses: ( nsCustomView-oid NAME 'nsCustomView' DESC 'Netscape defined
+  objectclass' SUP nsAdminObject STRUCTURAL MAY nsDisplayName X-ORIGIN 'Nets
+ cape Administration Services' )
+objectClasses: ( nsTopologyCustomView-oid NAME 'nsTopologyCustomView' DESC '
+ Netscape defined objectclass' SUP nsCustomView STRUCTURAL MAY nsViewConfigu
+ ration X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsTopologyPlugin-oid NAME 'nsTopologyPlugin' DESC 'Netscape
+  defined objectclass' SUP nsAdminObject STRUCTURAL X-ORIGIN 'Netscape Admin
+ istration Services' )
+objectClasses: ( 2.16.840.1.113730.3.2.18 NAME 'netscapeCertificateServer' D
+ ESC 'Netscape defined objectclass' SUP top STRUCTURAL X-ORIGIN 'Netscape Ce
+ rtificate Management System' )
+objectClasses: ( nsCertificateServer-oid NAME 'nsCertificateServer' DESC 'Ne
+ tscape defined objectclass' SUP top STRUCTURAL MUST nsServerID MAY ( server
+ HostName $ nsServerPort $ nsCertConfig ) X-ORIGIN 'Netscape Certificate Man
+ agement System' )
+objectClasses: ( 2.16.840.1.113730.3.2.23 NAME 'netscapeDirectoryServer' DES
+ C 'Netscape defined objectclass' SUP top STRUCTURAL X-ORIGIN 'Netscape Dire
+ ctory Server' )
+objectClasses: ( nsDirectoryServer-oid NAME 'nsDirectoryServer' DESC 'Netsca
+ pe defined objectclass' SUP top STRUCTURAL MUST nsServerID MAY ( serverHost
+ Name $ nsServerPort $ nsSecureServerPort $ nsBindPassword $ nsBindDN $ nsBa
+ seDN ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.8 NAME 'ntUser' DESC 'Netscape define
+ d objectclass' SUP top STRUCTURAL MUST ntUserDomainId MAY ( description $ l
+  $ ou $ seeAlso $ ntUserPriv $ ntUserHomeDir $ ntUserComment $ ntUserFlags 
+ $ ntUserScriptPath $ ntUserAuthFlags $ ntUserUsrComment $ ntUserParms $ ntU
+ serWorkstations $ ntUserLastLogon $ ntUserLastLogoff $ ntUserAcctExpires $ 
+ ntUserMaxStorage $ ntUserUnitsPerWeek $ ntUserLogonHours $ ntUserBadPwCount
+  $ ntUserNumLogons $ ntUserLogonServer $ ntUserCountryCode $ ntUserCodePage
+  $ ntUserUniqueId $ ntUserPrimaryGroupId $ ntUserProfile $ ntUserHomeDirDri
+ ve $ ntUserPasswordExpired $ ntUserCreateNewAccount $ ntUserDeleteAccount $
+  ntUniqueId $ ntUserNtPassword ) X-ORIGIN 'Netscape NT Synchronization' )
+objectClasses: ( 2.16.840.1.113730.3.2.9 NAME 'ntGroup' DESC 'Netscape defin
+ ed objectclass' SUP top STRUCTURAL MUST ntUserDomainId MAY ( description $ 
+ l $ ou $ seeAlso $ ntGroupId $ ntGroupAttributes $ ntGroupCreateNewGroup $ 
+ ntGroupDeleteGroup $ ntGroupType $ ntUniqueId $ mail ) X-ORIGIN 'Netscape N
+ T Synchronization' )
+objectClasses: ( 2.16.840.1.113730.3.2.82 NAME 'nsChangelog4Config' DESC 'Ne
+ tscape defined objectclass' SUP top STRUCTURAL MAY cn X-ORIGIN 'Netscape Di
+ rectory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.114 NAME 'nsConsumer4Config' DESC 'Ne
+ tscape defined objectclass' SUP top STRUCTURAL MAY cn X-ORIGIN 'Netscape Di
+ rectory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.36 NAME 'LDAPReplica' DESC 'Netscape 
+ defined objectclass' SUP top STRUCTURAL MUST cn MAY ( description $ l $ ou 
+ $ seeAlso $ replicaRoot $ replicaHost $ replicaPort $ replicaBindDn $ repli
+ caCredentials $ replicaBindMethod $ replicaUseSSL $ replicaUpdateSchedule $
+  replicaUpdateReplayed $ replicaUpdateFailedAt $ replicaBeginOrc $ replicaN
+ ickName $ replicaEntryFilter $ replicatedattributelist $ replicaCFUpdated $
+  replicaAbandonedChanges $ replicaLastRelevantChange ) X-ORIGIN 'Netscape D
+ irectory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.11 NAME 'cirReplicaSource' DESC 'Nets
+ cape defined objectclass' SUP top STRUCTURAL MUST cn MAY ( cirReplicaRoot $
+  cirHost $ cirPort $ cirBindDn $ cirUsePersistentSearch $ cirUseSsl $ cirBi
+ ndCredentials $ cirLastUpdateApplied $ cirUpdateSchedule $ cirSyncInterval 
+ $ cirUpdateFailedat $ cirBeginORC $ replicaNickName $ replicaEntryFilter $ 
+ replicatedattributelist ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.3 NAME 'mailRecipient' DESC 'Netscape
+  Messaging Server 4.x defined objectclass' SUP top AUXILIARY MAY ( cn $ mai
+ l $ mailAlternateAddress $ mailHost $ mailRoutingAddress $ mailAccessDomain
+  $ mailAutoReplyMode $ mailAutoReplyText $ mailDeliveryOption $ mailForward
+ ingAddress $ mailMessageStore $ mailProgramDeliveryInfo $ mailQuota $ multi
+ LineDescription $ uid $ userPassword ) X-ORIGIN 'Netscape Messaging Server 
+ 4.x' )
+objectClasses: ( 2.16.840.113730.3.2.37 NAME 'nsMessagingServerUser' DESC 'N
+ etscape Messaging Server 4.x defined objectclass' SUP top AUXILIARY MAY ( c
+ n $ mailAccessDomain $ mailAutoReplyMode $ mailAutoReplyText $ mailDelivery
+ Option $ mailForwardingAddress $ mailMessageStore $ mailProgramDeliveryInfo
+  $ mailQuota $ nsmsgDisallowAccess $ nsmsgNumMsgQuota $ nswmExtendedUserPre
+ fs $ vacationstartdate $ vacationenddate ) X-ORIGIN 'Netscape Messaging Ser
+ ver 4.x' )
+objectClasses: ( 2.16.840.1.113730.3.2.4 NAME 'mailGroup' DESC 'mailGroup' S
+ UP top STRUCTURAL MUST mail MAY ( cn $ mgrpRFC822MailMember ) X-ORIGIN ( 'I
+ PA v4.4.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.2.5 NAME 'groupOfMailEnhancedUniqueName
+ s' DESC 'Netscape Messaging Server 4.x defined objectclass' SUP top AUXILIA
+ RY MUST cn MAY ( businessCategory $ description $ mailEnhancedUniqueMember 
+ $ o $ ou $ owner $ seeAlso ) X-ORIGIN 'Netscape Messaging Server 4.x' )
+objectClasses: ( 2.16.840.1.113730.3.2.24 NAME 'netscapeMailServer' DESC 'Ne
+ tscape Messaging Server 4.x defined objectclass' SUP top AUXILIARY X-ORIGIN
+  'Netscape Messaging Server 4.x' )
+objectClasses: ( 2.16.840.1.113730.3.2.45 NAME 'nsValueItem' DESC 'Netscape 
+ defined objectclass' SUP top STRUCTURAL MUST cn MAY ( nsValueCIS $ nsValueC
+ ES $ nsValueTel $ nsValueInt $ nsValueBin $ nsValueDN $ nsValueType $ nsVal
+ ueSyntax $ nsValueDescription $ nsValueHelpURL $ nsValueFlags $ nsValueDefa
+ ult ) X-ORIGIN 'Netscape servers - value item' )
+objectClasses: ( 2.16.840.1.113730.3.2.29 NAME 'netscapeWebServer' DESC 'Net
+ scape defined objectclass' SUP top STRUCTURAL MUST ( cn $ nsServerID ) MAY 
+ ( description $ nsServerPort ) X-ORIGIN 'Netscape Web Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.154 NAME 'netscapeReversiblePasswordO
+ bject' DESC 'object that contains an netscapeReversiblePassword' AUXILIARY 
+ MAY netscapeReversiblePassword X-ORIGIN 'Netscape Web Server' )
+objectClasses: ( 1.3.6.1.4.1.11.1.3.2.2.1 NAME 'accountPolicy' DESC 'Account
+  policy entry' SUP top AUXILIARY MAY accountInactivityLimit X-ORIGIN 'Accou
+ nt Policy Plugin' )
+objectClasses: ( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount informati
+ on' SUP top STRUCTURAL MUST ( automountKey $ automountInformation ) MAY des
+ cription X-ORIGIN ( 'RFC 2307bis' 'user defined' ) )
+objectClasses: ( 1.3.6.1.1.1.2.16 NAME 'automountMap' DESC 'Automount Map in
+ formation' SUP top STRUCTURAL MUST automountMapName MAY description X-ORIGI
+ N ( 'RFC 2307bis' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.4.1 NAME 'ipaHost' AUXILIARY MUST fqd
+ n MAY ( userPassword $ ipaClientVersion $ enrolledBy $ memberOf $ userClass
+  $ ipaAssignedIDView ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.4.12 NAME 'ipaObject' DESC 'IPA objec
+ tclass' AUXILIARY MUST ipaUniqueID X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.14 NAME 'ipaEntitlement' DESC 'IPA 
+ Entitlement object' AUXILIARY MUST ipaEntitlementId MAY ( userPKCS12 $ user
+ Certificate ) X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.15 NAME 'ipaPermission' DESC 'IPA P
+ ermission objectclass' AUXILIARY MAY ipaPermissionType X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.2 NAME 'ipaService' DESC 'IPA servi
+ ce objectclass' AUXILIARY MAY ( memberOf $ managedBy $ ipaKrbAuthzData ) X-
+ ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.3 NAME 'nestedGroup' DESC 'Group th
+ at supports nesting' SUP groupOfNames STRUCTURAL MAY memberOf X-ORIGIN 'IPA
+  v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.4 NAME 'ipaUserGroup' DESC 'IPA use
+ r group object class' SUP nestedGroup STRUCTURAL X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.5 NAME 'ipaHostGroup' DESC 'IPA hos
+ t group object class' SUP nestedGroup STRUCTURAL X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.6 NAME 'ipaAssociation' ABSTRACT MU
+ ST ( ipaUniqueID $ cn ) MAY ( memberUser $ userCategory $ memberHost $ host
+ Category $ ipaEnabledFlag $ description ) X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.7 NAME 'ipaHBACRule' SUP ipaAssocia
+ tion STRUCTURAL MUST accessRuleType MAY ( sourceHost $ sourceHostCategory $
+  serviceCategory $ memberService $ externalHost $ accessTime ) X-ORIGIN 'IP
+ A v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.8 NAME 'ipaNISNetgroup' DESC 'IPA v
+ ersion of NIS netgroup' SUP ipaAssociation STRUCTURAL MAY ( externalHost $ 
+ nisDomainName $ member $ memberOf ) X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.9 NAME 'ipaCAaccess' STRUCTURAL MAY
+  ( member $ hostCApolicy ) X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.10 NAME 'ipaHBACService' STRUCTURAL
+  MUST cn MAY ( description $ memberOf ) X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.11 NAME 'ipaHBACServiceGroup' DESC 
+ 'IPA HBAC service group object class' SUP groupOfNames STRUCTURAL X-ORIGIN 
+ 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.12.1 NAME 'ipaExternalGroup' SUP top 
+ STRUCTURAL MUST cn MAY ( ipaExternalMember $ memberOf $ description $ owner
+  ) X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.2 NAME 'ipaNTUserAttrs' SUP top AU
+ XILIARY MUST ipaNTSecurityIdentifier MAY ( ipaNTHash $ ipaNTLogonScript $ i
+ paNTProfilePath $ ipaNTHomeDirectory $ ipaNTHomeDirectoryDrive ) X-ORIGIN (
+  'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.3 NAME 'ipaNTGroupAttrs' SUP top A
+ UXILIARY MUST ipaNTSecurityIdentifier X-ORIGIN ( 'IPA v3' 'user defined' ) 
+ )
+objectClasses: ( 2.16.840.1.113730.3.8.12.4 NAME 'ipaNTDomainAttrs' SUP top 
+ AUXILIARY MUST ( ipaNTSecurityIdentifier $ ipaNTFlatName $ ipaNTDomainGUID 
+ ) MAY ipaNTFallbackPrimaryGroup X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.5 NAME 'ipaNTTrustedDomain' DESC '
+ Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( ipaNTTrustType $ ip
+ aNTTrustAttributes $ ipaNTTrustDirection $ ipaNTTrustPartner $ ipaNTFlatNam
+ e $ ipaNTTrustAuthOutgoing $ ipaNTTrustAuthIncoming $ ipaNTTrustedDomainSID
+  $ ipaNTTrustForestTrustInfo $ ipaNTTrustPosixOffset $ ipaNTSupportedEncryp
+ tionTypes $ ipaNTSIDBlacklistIncoming $ ipaNTSIDBlacklistOutgoing $ ipaNTAd
+ ditionalSuffixes ) X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.6 NAME 'groupOfPrincipals' SUP top
+  AUXILIARY MUST cn MAY memberPrincipal X-ORIGIN ( 'IPA v3' 'user defined' )
+  )
+objectClasses: ( 2.16.840.1.113730.3.8.12.7 NAME 'ipaKrb5DelegationACL' SUP 
+ groupOfPrincipals STRUCTURAL MAY ( ipaAllowToImpersonate $ ipaAllowedTarget
+  ) X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.10 NAME 'ipaSELinuxUserMap' SUP ip
+ aAssociation STRUCTURAL MUST ipaSELinuxUser MAY ( accessTime $ seeAlso ) X-
+ ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.11 NAME 'ipaSshGroupOfPubKeys' ABS
+ TRACT MAY ipaSshPubKey X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.12 NAME 'ipaSshUser' SUP ipaSshGro
+ upOfPubKeys AUXILIARY X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.13 NAME 'ipaSshHost' SUP ipaSshGro
+ upOfPubKeys AUXILIARY X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.14 NAME 'ipaIDobject' SUP top AUXI
+ LIARY MAY ( uidNumber $ gidNumber $ ipaNTSecurityIdentifier ) X-ORIGIN ( 'I
+ PA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.15 NAME 'ipaIDrange' ABSTRACT MUST
+  ( cn $ ipaBaseID $ ipaIDRangeSize $ ipaRangeType ) X-ORIGIN ( 'IPA v3' 'us
+ er defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.16 NAME 'ipaDomainIDRange' SUP ipa
+ IDrange STRUCTURAL MAY ( ipaBaseRID $ ipaSecondaryBaseRID ) X-ORIGIN ( 'IPA
+  v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.17 NAME 'ipaTrustedADDomainRange' 
+ SUP ipaIDrange STRUCTURAL MUST ( ipaBaseRID $ ipaNTTrustedDomainSID ) X-ORI
+ GIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.19 NAME 'ipaUserAuthTypeClass' DES
+ C 'Class for authentication methods definition' SUP top AUXILIARY MAY ipaUs
+ erAuthType X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY ( edu
+ PersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $ eduPersonOrgUnitDN
+  $ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlem
+ ent $ eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation ) X-ORIGIN 'ht
+ tp://middleware.internet2.edu/eduperson/' )
+objectClasses: ( 2.16.840.1.113730.3.8.2.1 NAME 'ipaGuiConfig' AUXILIARY MAY
+  ( ipaUserSearchFields $ ipaGroupSearchFields $ ipaSearchTimeLimit $ ipaSea
+ rchRecordsLimit $ ipaCustomFields $ ipaHomesRootDir $ ipaDefaultLoginShell 
+ $ ipaDefaultPrimaryGroup $ ipaMaxUsernameLength $ ipaPwdExpAdvNotify $ ipaU
+ serObjectClasses $ ipaGroupObjectClasses $ ipaDefaultEmailDomain $ ipaMigra
+ tionEnabled $ ipaCertificateSubjectBase $ ipaSELinuxUserMapDefault $ ipaSEL
+ inuxUserMapOrder $ ipaKrbAuthzData ) X-ORIGIN 'user defined' )
+objectClasses: ( 2.16.840.1.113730.3.8.4.13 NAME 'ipaConfigObject' DESC 'gen
+ eric config object for IPA' AUXILIARY MAY ipaConfigString X-ORIGIN 'IPA v2'
+  )
+objectClasses: ( 2.16.840.1.113730.3.8.6.0 NAME 'idnsRecord' DESC 'dns Recor
+ d, usually a host' SUP top STRUCTURAL MUST idnsName MAY ( cn $ idnsAllowDyn
+ Update $ dNSTTL $ dNSClass $ aRecord $ aAAARecord $ a6Record $ nSRecord $ c
+ NAMERecord $ pTRRecord $ sRVRecord $ tXTRecord $ mXRecord $ mDRecord $ hInf
+ oRecord $ mInfoRecord $ aFSDBRecord $ SigRecord $ KeyRecord $ LocRecord $ n
+ XTRecord $ nAPTRRecord $ kXRecord $ certRecord $ dNameRecord $ dSRecord $ s
+ SHFPRecord $ rRSIGRecord $ nSECRecord $ DLVRecord $ TLSARecord $ UnknownRec
+ ord $ RPRecord $ APLRecord $ IPSECKEYRecord $ DHCIDRecord $ HIPRecord $ SPF
+ Record ) X-ORIGIN ( 'IPA v4.2.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.1 NAME 'idnsZone' DESC 'Zone class'
+  SUP idnsRecord STRUCTURAL MUST ( idnsZoneActive $ idnsSOAmName $ idnsSOArN
+ ame $ idnsSOAserial $ idnsSOArefresh $ idnsSOAretry $ idnsSOAexpire $ idnsS
+ OAminimum ) MAY ( idnsUpdatePolicy $ idnsAllowQuery $ idnsAllowTransfer $ i
+ dnsAllowSyncPTR $ idnsForwardPolicy $ idnsForwarders $ idnsSecInlineSigning
+  $ nSEC3PARAMRecord $ dNSdefaultTTL ) X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user 
+ defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.2 NAME 'idnsConfigObject' DESC 'DNS
+  global config options' STRUCTURAL MAY ( idnsForwardPolicy $ idnsForwarders
+  $ idnsAllowSyncPTR $ idnsZoneRefresh $ idnsPersistentSearch ) X-ORIGIN 'us
+ er defined' )
+objectClasses: ( 2.16.840.1.113730.3.8.12.18 NAME 'ipaDNSZone' SUP top AUXIL
+ IARY MUST idnsName MAY managedBy X-ORIGIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.1.1 NAME 'krbContainer' SUP top S
+ TRUCTURAL MUST cn )
+objectClasses: ( 2.16.840.1.113719.1.301.6.2.1 NAME 'krbRealmContainer' SUP 
+ top STRUCTURAL MUST cn MAY ( krbMKey $ krbUPEnabled $ krbSubTrees $ krbSear
+ chScope $ krbLdapServers $ krbSupportedEncSaltTypes $ krbDefaultEncSaltType
+ s $ krbTicketPolicyReference $ krbKdcServers $ krbPwdServers $ krbAdmServer
+ s $ krbPrincNamingAttr $ krbPwdPolicyReference $ krbPrincContainerRef ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.3.1 NAME 'krbService' SUP top ABS
+ TRACT MUST cn MAY ( krbHostServer $ krbRealmReferences ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.4.1 NAME 'krbKdcService' SUP krbS
+ ervice STRUCTURAL )
+objectClasses: ( 2.16.840.1.113719.1.301.6.5.1 NAME 'krbPwdService' SUP krbS
+ ervice STRUCTURAL )
+objectClasses: ( 2.16.840.1.113719.1.301.6.8.1 NAME 'krbPrincipalAux' AUXILI
+ ARY MAY ( krbPrincipalName $ krbCanonicalName $ krbUPEnabled $ krbPrincipal
+ Key $ krbTicketPolicyReference $ krbPrincipalExpiration $ krbPasswordExpira
+ tion $ krbPwdPolicyReference $ krbPrincipalType $ krbPwdHistory $ krbLastPw
+ dChange $ krbPrincipalAliases $ krbLastSuccessfulAuth $ krbLastFailedAuth $
+  krbLoginFailedCount $ krbExtraData $ krbLastAdminUnlock $ krbAllowedToDele
+ gateTo $ krbPrincipalAuthInd ) X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined
+ ' ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.9.1 NAME 'krbPrincipal' SUP top S
+ TRUCTURAL MUST krbPrincipalName MAY krbObjectReferences )
+objectClasses: ( 2.16.840.1.113719.1.301.6.11.1 NAME 'krbPrincRefAux' SUP to
+ p AUXILIARY MAY krbPrincipalReferences )
+objectClasses: ( 2.16.840.1.113719.1.301.6.13.1 NAME 'krbAdmService' SUP krb
+ Service STRUCTURAL )
+objectClasses: ( 2.16.840.1.113719.1.301.6.14.1 NAME 'krbPwdPolicy' SUP top 
+ STRUCTURAL MUST cn MAY ( krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars
+  $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailure
+ CountInterval $ krbPwdLockoutDuration $ krbPwdAttributes $ krbPwdMaxLife $ 
+ krbPwdMaxRenewableLife $ krbPwdAllowedKeysalts ) X-ORIGIN ( 'IPA v4.3.0' 'u
+ ser defined' ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.16.1 NAME 'krbTicketPolicyAux' AU
+ XILIARY MAY ( krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.17.1 NAME 'krbTicketPolicy' SUP t
+ op STRUCTURAL MUST cn )
+objectClasses: ( 1.3.6.1.4.1.13769.9.1 NAME 'mozillaAbPersonAlpha' SUP top A
+ UXILIARY MUST cn MAY ( c $ description $ displayName $ facsimileTelephoneNu
+ mber $ givenName $ homePhone $ l $ mail $ mobile $ mozillaCustom1 $ mozilla
+ Custom2 $ mozillaCustom3 $ mozillaCustom4 $ mozillaHomeCountryName $ mozill
+ aHomeLocalityName $ mozillaHomePostalCode $ mozillaHomeState $ mozillaHomeS
+ treet $ mozillaHomeStreet2 $ mozillaHomeUrl $ mozillaNickname $ mozillaSeco
+ ndEmail $ mozillaUseHtmlMail $ mozillaWorkStreet2 $ mozillaWorkUrl $ nsAIMi
+ d $ o $ ou $ pager $ postalCode $ postOfficeBox $ sn $ st $ street $ teleph
+ oneNumber $ title ) X-ORIGIN 'Mozilla Address Book' )
+objectClasses: ( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject' DESC
+  'Auxiliary object class for adding authorizedService attribute' SUP top AU
+ XILIARY MAY authorizedService X-ORIGIN 'NSS LDAP schema' )
+objectClasses: ( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject' DESC 'Auxiliary o
+ bject class for adding host attribute' SUP top AUXILIARY MAY host X-ORIGIN 
+ 'NSS LDAP schema' )
+objectClasses: ( 2.16.840.1.113730.3.2.318 NAME 'pamConfig' DESC 'PAM plugin
+  configuration' SUP top AUXILIARY MAY ( cn $ pamMissingSuffix $ pamExcludeS
+ uffix $ pamIncludeSuffix $ pamIDAttr $ pamIDMapMethod $ pamFallback $ pamSe
+ cure $ pamService $ pamFilter ) X-ORIGIN 'Red Hat Directory Server' )
+objectClasses: ( 2.16.840.1.113730.3.2.326 NAME 'dynamicGroup' DESC 'Group c
+ ontaining internal dynamically-generated members' SUP posixGroup AUXILIARY 
+ MAY dsOnlyMemberUid X-ORIGIN 'Red Hat Directory Server' )
+objectClasses: ( 1.3.6.1.4.1.6981.11.2.3 NAME 'PureFTPdUser' DESC 'PureFTPd 
+ user with optional quota, throttling and ratio' STRUCTURAL MAY ( FTPStatus 
+ $ FTPQuotaFiles $ FTPQuotaMBytes $ FTPUploadRatio $ FTPDownloadRatio $ FTPU
+ ploadBandwidth $ FTPDownloadBandwidth $ FTPuid $ FTPgid ) X-ORIGIN 'Pure-FT
+ Pd' )
+objectClasses: ( 1.2.840.113556.1.5.87 NAME 'calEntry' DESC 'RFC2739: Calend
+ ar Entry' SUP top AUXILIARY MAY ( calCalURI $ calFBURL $ calOtherCalURIs $ 
+ calOtherFBURLs $ calCAPURI $ calOtherCAPURIs ) X-ORIGIN 'rfc2739' )
+objectClasses: ( 1.3.18.0.2.6.258 NAME 'printerAbstract' DESC 'Printer relat
+ ed information.' SUP top ABSTRACT MAY ( printer-name $ printer-natural-lang
+ uage-configured $ printer-location $ printer-info $ printer-more-info $ pri
+ nter-make-and-model $ printer-multiple-document-jobs-supported $ printer-ch
+ arset-configured $ printer-charset-supported $ printer-generated-natural-la
+ nguage-supported $ printer-document-format-supported $ printer-color-suppor
+ ted $ printer-compression-supported $ printer-pages-per-minute $ printer-pa
+ ges-per-minute-color $ printer-finishings-supported $ printer-number-up-sup
+ ported $ printer-sides-supported $ printer-media-supported $ printer-media-
+ local-supported $ printer-resolution-supported $ printer-print-quality-supp
+ orted $ printer-job-priority-supported $ printer-copies-supported $ printer
+ -job-k-octets-supported $ printer-current-operator $ printer-service-person
+  $ printer-delivery-orientation-supported $ printer-stacking-order-supporte
+ d $ printer-output-features-supported ) X-ORIGIN 'rfc3712' )
+objectClasses: ( 1.3.18.0.2.6.255 NAME 'printerService' DESC 'Printer inform
+ ation.' SUP printerAbstract STRUCTURAL MAY ( printer-uri $ printer-xri-supp
+ orted ) X-ORIGIN 'rfc3712' )
+objectClasses: ( 1.3.18.0.2.6.257 NAME 'printerServiceAuxClass' DESC 'Printe
+ r information.' SUP printerAbstract AUXILIARY MAY ( printer-uri $ printer-x
+ ri-supported ) X-ORIGIN 'rfc3712' )
+objectClasses: ( 1.3.18.0.2.6.256 NAME 'printerIPP' DESC 'Internet Printing 
+ Protocol (IPP) information.' SUP top AUXILIARY MAY ( printer-ipp-versions-s
+ upported $ printer-multiple-document-jobs-supported ) X-ORIGIN 'rfc3712' )
+objectClasses: ( 1.3.18.0.2.6.253 NAME 'printerLPR' DESC 'LPR information.' 
+ SUP top AUXILIARY MUST printer-name MAY printer-aliases X-ORIGIN 'rfc3712' 
+ )
+objectClasses: ( 1.3.6.1.4.1.2312.4.3.4.1 NAME 'sabayonProfile' DESC 'sabayo
+ n profile' SUP top STRUCTURAL MUST cn MAY ( sabayonProfileURL $ description
+  ) X-ORIGIN 'Sabayon' )
+objectClasses: ( 1.3.6.1.4.1.2312.4.3.4.2 NAME 'sabayonProfileNameObject' DE
+ SC 'contains sabayon profile name' SUP top AUXILIARY MUST sabayonProfileNam
+ e X-ORIGIN 'Sabayon' )
+objectClasses: ( 1.3.6.1.4.1.2312.4.3.4.3 NAME 'sabayonProfileURLObject' DES
+ C 'contains sabayon profile' SUP top AUXILIARY MUST cn MAY sabayonProfileUR
+ L X-ORIGIN 'Sabayon' )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3
+ .0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn
+  $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ s
+ ambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange 
+ $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogo
+ nScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPri
+ maryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ 
+ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba
+  Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupT
+ ype ) MAY ( displayName $ description $ sambaSIDList ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Sam
+ ba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassw
+ ord $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domai
+ n Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY (
+  sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidB
+ ase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ samb
+ aMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservatio
+ nWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdC
+ hange ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool fo
+ r allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber
+  ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping
+  from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gid
+ Number ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structura
+ l Class for a SID' SUP top STRUCTURAL MUST sambaSID )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Conf
+ iguration Section' SUP top AUXILIARY MAY description )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share
+  Section' SUP top STRUCTURAL MUST sambaShareName MAY description )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samb
+ a Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( samba
+ BoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListOption
+  $ description ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' D
+ ESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainNa
+ me $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviou
+ sClearTextPassword )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Sam
+ ba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $
+  sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlat
+ Name $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdent
+ ifier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedE
+ ncryptionTypes ) )
+objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer Entrie
+ s' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ sud
+ oRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudo
+ NotAfter $ sudoOrder $ description ) X-ORIGIN 'SUDO' )
+objectClasses: ( 5.3.6.1.1.1.2.0 NAME 'trustAccount' DESC 'Sets trust accoun
+ ts information' SUP top AUXILIARY MUST trustModel MAY accessTo X-ORIGIN 'ns
+ s_ldap/pam_ldap' )
+objectClasses: ( 2.16.840.1.113730.3.8.12.8 NAME 'ipaKrbPrincipal' SUP krbPr
+ incipalAux AUXILIARY MUST ( krbPrincipalName $ ipaKrbPrincipalAlias ) X-ORI
+ GIN ( 'IPA v3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.8.1 NAME 'ipaSudoRule' SUP ipaAssocia
+ tion STRUCTURAL MAY ( externalUser $ externalHost $ hostMask $ memberAllowC
+ md $ memberDenyCmd $ cmdCategory $ ipaSudoOpt $ ipaSudoRunAs $ ipaSudoRunAs
+ ExtUser $ ipaSudoRunAsUserCategory $ ipaSudoRunAsGroup $ ipaSudoRunAsExtGro
+ up $ ipaSudoRunAsGroupCategory $ sudoNotBefore $ sudoNotAfter $ sudoOrder $
+  ipaSudoRunAsExtUserGroup ) X-ORIGIN ( 'IPA v4.0.0' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.8.2 NAME 'ipaSudoCmd' DESC 'IPA objec
+ t class for SUDO command' STRUCTURAL MUST ( ipaUniqueID $ sudoCmd ) MAY ( m
+ emberOf $ description ) X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.8.3 NAME 'ipaSudoCmdGrp' DESC 'IPA ob
+ ject class to store groups of SUDO commands' SUP groupOfNames STRUCTURAL MU
+ ST ipaUniqueID X-ORIGIN 'IPA v2' )
+objectClasses: ( 2.16.840.1.113730.3.8.16.2.1 NAME 'ipaToken' DESC 'Abstract
+  token class for tokens' SUP top ABSTRACT MUST ipatokenUniqueID MAY ( descr
+ iption $ managedBy $ ipatokenOwner $ ipatokenDisabled $ ipatokenNotBefore $
+  ipatokenNotAfter $ ipatokenVendor $ ipatokenModel $ ipatokenSerial ) X-ORI
+ GIN ( 'IPA v4.0.0' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.16.2.2 NAME 'ipatokenTOTP' DESC 'TOTP
+  Token Type' SUP ipaToken STRUCTURAL MAY ( ipatokenOTPkey $ ipatokenOTPalgo
+ rithm $ ipatokenOTPdigits $ ipatokenTOTPclockOffset $ ipatokenTOTPtimeStep 
+ $ ipatokenTOTPwatermark ) X-ORIGIN ( 'IPA v4.1.3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.16.2.3 NAME 'ipatokenRadiusProxyUser'
+  DESC 'Radius Proxy User' SUP top AUXILIARY MAY ( ipatokenRadiusConfigLink 
+ $ ipatokenRadiusUserName ) X-ORIGIN ( 'IPA v4.0.0' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.16.2.4 NAME 'ipatokenRadiusConfigurat
+ ion' DESC 'Proxy Radius Configuration' SUP top STRUCTURAL MUST ( cn $ ipato
+ kenRadiusServer $ ipatokenRadiusSecret ) MAY ( description $ ipatokenRadius
+ Timeout $ ipatokenRadiusRetries $ ipatokenUserMapAttribute ) X-ORIGIN ( 'IP
+ A OTP' 'user defined' ) )
+objectClasses: ( cmsuser-oid NAME 'cmsuser' DESC 'CMS User' SUP top STRUCTUR
+ AL MUST usertype MAY userstate X-ORIGIN 'user defined' )
+objectClasses: ( CertACLS-oid NAME 'CertACLS' DESC 'CMS defined class' SUP t
+ op STRUCTURAL MUST cn MAY resourceACLS X-ORIGIN 'user defined' )
+objectClasses: ( repository-oid NAME 'repository' DESC 'CMS defined class' S
+ UP top STRUCTURAL MUST ou MAY ( serialno $ description $ nextRange $ publis
+ hingStatus ) X-ORIGIN 'user defined' )
+objectClasses: ( request-oid NAME 'request' DESC 'CMS defined class' SUP top
+  STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $ dateOfModify $ request
+ State $ requestResult $ requestOwner $ requestAgentGroup $ requestSourceId 
+ $ requestType $ requestFlag $ requestError $ userMessages $ adminMessages )
+  X-ORIGIN 'user defined' )
+objectClasses: ( transaction-oid NAME 'transaction' DESC 'CMS defined class'
+  SUP top STRUCTURAL MUST cn MAY ( transId $ description $ transName $ trans
+ Status $ transOps ) X-ORIGIN 'user defined' )
+objectClasses: ( crlIssuingPointRecord-oid NAME 'crlIssuingPointRecord' DESC
+  'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOf
+ Modify $ crlNumber $ crlSize $ thisUpdate $ nextUpdate $ deltaNumber $ delt
+ aSize $ firstUnsaved $ certificateRevocationList $ deltaRevocationList $ cr
+ lCache $ revokedCerts $ unrevokedCerts $ expiredCerts $ cACertificate ) X-O
+ RIGIN 'user defined' )
+objectClasses: ( certificateRecord-oid NAME 'certificateRecord' DESC 'CMS de
+ fined class' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $ dat
+ eOfModify $ certStatus $ autoRenew $ issueInfo $ metaInfo $ revInfo $ versi
+ on $ duration $ notAfter $ notBefore $ algorithmId $ subjectName $ signingA
+ lgorithmId $ userCertificate $ issuedBy $ revokedBy $ revokedOn $ extension
+  $ publicKeyData $ issuerName ) X-ORIGIN 'user defined' )
+objectClasses: ( userDetails-oid NAME 'userDetails' DESC 'CMS defined class'
+  SUP top STRUCTURAL MUST userDN MAY ( dateOfCreate $ dateOfModify $ passwor
+ d $ p12Expiration ) X-ORIGIN 'user defined' )
+objectClasses: ( keyRecord-oid NAME 'keyRecord' DESC 'CMS defined class' SUP
+  top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $ dateOfModify $ keyS
+ tate $ privateKeyData $ ownerName $ keySize $ metaInfo $ dateOfArchival $ d
+ ateOfRecovery $ algorithm $ publicKeyFormat $ publicKeyData $ archivedBy $ 
+ clientId $ dataType $ status ) X-ORIGIN 'user defined' )
+objectClasses: ( pkiSecurityDomain-oid NAME 'pkiSecurityDomain' DESC 'CMS de
+ fined class' SUP top STRUCTURAL MUST ( ou $ name ) X-ORIGIN 'user defined' 
+ )
+objectClasses: ( pkiSecurityGroup-oid NAME 'pkiSecurityGroup' DESC 'CMS defi
+ ned class' SUP top STRUCTURAL MUST cn X-ORIGIN 'user defined' )
+objectClasses: ( pkiSubsystem-oid NAME 'pkiSubsystem' DESC 'CMS defined clas
+ s' SUP top STRUCTURAL MUST ( cn $ host $ SecurePort $ SubsystemName $ Clone
+  ) MAY ( DomainManager $ SecureAgentPort $ SecureAdminPort $ SecureEEClient
+ AuthPort $ UnSecurePort ) X-ORIGIN 'user defined' )
+objectClasses: ( pkiRange-oid NAME 'pkiRange' DESC 'CMS defined class' SUP t
+ op STRUCTURAL MUST ( cn $ beginRange $ endRange $ host $ SecurePort ) X-ORI
+ GIN 'user defined' )
+objectClasses: ( securityDomainSessionEntry-oid NAME 'securityDomainSessionE
+ ntry' DESC 'CMS defined class' SUP top STRUCTURAL MUST ( cn $ host $ uid $ 
+ cmsUserGroup $ dateOfCreate ) X-ORIGIN 'user defined' )
+objectClasses: ( 1.3.6.1.1.1.2.14 NAME 'nisKeyObject' DESC 'nisKeyObject' SU
+ P top STRUCTURAL MUST ( cn $ nisPublickey $ nisSecretkey ) MAY ( uidNumber 
+ $ description ) X-ORIGIN 'user defined' )
+objectClasses: ( 1.3.1.6.1.1.1.2.15 NAME 'nisDomainObject' DESC 'nisDomainOb
+ ject' SUP top AUXILIARY MUST nisDomain X-ORIGIN 'user defined' )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.1.2.6 NAME 'nisNetId' DESC 'nisNetId' S
+ UP top STRUCTURAL MUST cn MAY ( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost
+  ) X-ORIGIN 'user defined' )
+objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.5 NAME 'DUAConfigProfile' DESC 'Abst
+ raction of a base configuration for a DUA' SUP top STRUCTURAL MUST cn MAY (
+  defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearc
+ hScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authentication
+ Method $ followReferrals $ dereferenceAliases $ serviceSearchDescriptor $ s
+ erviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attr
+ ibuteMap $ profileTTL ) X-ORIGIN ( 'RFC4876' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.22 NAME 'ipaAllowedOperations' DES
+ C 'Class to apply access controls to arbitrary operations' SUP top AUXILIAR
+ Y MAY ( ipaAllowedToPerform $ ipaProtectedOperation ) X-ORIGIN ( 'IPA v4.0.
+ 0' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.21 NAME 'ipaPermissionV2' DESC 'IP
+ A Permission objectclass, version 2' SUP ipaPermission AUXILIARY MUST ( ipa
+ PermBindRuleType $ ipaPermLocation ) MAY ( ipaPermDefaultAttr $ ipaPermIncl
+ udedAttr $ ipaPermExcludedAttr $ ipaPermRight $ ipaPermTargetFilter $ ipaPe
+ rmTarget $ ipaPermTargetTo $ ipaPermTargetFrom ) X-ORIGIN ( 'IPA v4.2.2' 'u
+ ser defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.20 NAME 'ipaUser' AUXILIARY MUST u
+ id MAY ( userClass $ ipaKrbAuthzData ) X-ORIGIN ( 'IPA v4.3.1' 'user define
+ d' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.3 NAME 'idnsForwardZone' DESC 'Forw
+ ard Zone class' SUP top STRUCTURAL MUST ( idnsName $ idnsZoneActive ) MAY (
+  idnsForwarders $ idnsForwardPolicy ) X-ORIGIN ( 'IPA v4.0.0' 'user defined
+ ' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.16.2.5 NAME 'ipatokenHOTP' DESC 'HOTP
+  Token Type' SUP ipaToken STRUCTURAL MUST ( ipatokenOTPkey $ ipatokenOTPalg
+ orithm $ ipatokenOTPdigits $ ipatokenHOTPcounter ) X-ORIGIN ( 'IPA v4.0.0' 
+ 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.25 NAME 'ipaPrivateKeyObject' DESC
+  'Wrapped private keys' SUP top AUXILIARY MUST ( ipaPrivateKey $ ipaWrappin
+ gKey $ ipaWrappingMech ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.24 NAME 'ipaPublicKeyObject' DESC 
+ 'Wrapped public keys' SUP top AUXILIARY MUST ipaPublicKey X-ORIGIN ( 'IPA v
+ 4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.34 NAME 'ipaSecretKeyRefObject' DE
+ SC 'Indirect storage for encoded key material' SUP top AUXILIARY MUST ipaSe
+ cretKeyRef X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.26 NAME 'ipaSecretKeyObject' DESC 
+ 'Wrapped secret keys' SUP top AUXILIARY MUST ( ipaSecretKey $ ipaWrappingKe
+ y $ ipaWrappingMech ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.17.2.1 NAME 'ipk11Object' DESC 'Objec
+ t' SUP top STRUCTURAL MUST ipk11UniqueId X-ORIGIN ( 'IPA v4.1.2' 'user defi
+ ned' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.17.2.2 NAME 'ipk11StorageObject' DESC
+  'Storage object' SUP top ABSTRACT MAY ( ipk11Private $ ipk11Modifiable $ i
+ pk11Label $ ipk11Copyable $ ipk11Destroyable ) X-ORIGIN ( 'IPA v4.1.2' 'use
+ r defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.17.2.5 NAME 'ipk11Key' DESC 'Key' SUP
+  ipk11StorageObject ABSTRACT MAY ( ipk11KeyType $ ipk11Id $ ipk11StartDate 
+ $ ipk11EndDate $ ipk11Derive $ ipk11Local $ ipk11KeyGenMechanism $ ipk11All
+ owedMechanisms ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.17.2.7 NAME 'ipk11PrivateKey' DESC 'P
+ rivate key' SUP ipk11Key AUXILIARY MAY ( ipk11Subject $ ipk11Sensitive $ ip
+ k11Decrypt $ ipk11Sign $ ipk11SignRecover $ ipk11Unwrap $ ipk11Extractable 
+ $ ipk11AlwaysSensitive $ ipk11NeverExtractable $ ipk11WrapWithTrusted $ ipk
+ 11UnwrapTemplate $ ipk11AlwaysAuthenticate $ ipk11PublicKeyInfo ) X-ORIGIN 
+ ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.17.2.8 NAME 'ipk11SecretKey' DESC 'Se
+ cret key' SUP ipk11Key AUXILIARY MAY ( ipk11Sensitive $ ipk11Encrypt $ ipk1
+ 1Decrypt $ ipk11Sign $ ipk11Verify $ ipk11Wrap $ ipk11Unwrap $ ipk11Extract
+ able $ ipk11AlwaysSensitive $ ipk11NeverExtractable $ ipk11CheckValue $ ipk
+ 11WrapWithTrusted $ ipk11Trusted $ ipk11WrapTemplate $ ipk11UnwrapTemplate 
+ ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.17.2.6 NAME 'ipk11PublicKey' DESC 'Pu
+ blic key' SUP ipk11Key AUXILIARY MAY ( ipk11Subject $ ipk11Encrypt $ ipk11V
+ erify $ ipk11VerifyRecover $ ipk11Wrap $ ipk11Trusted $ ipk11WrapTemplate $
+  ipk11Distrusted $ ipk11PublicKeyInfo ) X-ORIGIN ( 'IPA v4.1.2' 'user defin
+ ed' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.4 NAME 'idnsSecKey' DESC 'DNSSEC ke
+ y metadata' SUP top STRUCTURAL MUST ( idnsSecKeyRef $ idnsSecKeyCreated $ i
+ dnsSecAlgorithm ) MAY ( idnsSecKeyPublish $ idnsSecKeyActivate $ idnsSecKey
+ Inactive $ idnsSecKeyDelete $ idnsSecKeyZone $ idnsSecKeyRevoke $ idnsSecKe
+ ySep $ cn ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.27 NAME 'ipaCertificate' SUP top S
+ TRUCTURAL MUST ( cn $ ipaCertIssuerSerial $ ipaCertSubject $ ipaPublicKey )
+  MAY ipaConfigString X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.28 NAME 'ipaKeyPolicy' SUP top AUX
+ ILIARY MAY ( ipaKeyTrust $ ipaKeyUsage $ ipaKeyExtUsage ) X-ORIGIN ( 'IPA v
+ 4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.29 NAME 'ipaIDView' SUP nsContaine
+ r STRUCTURAL MAY description X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.35 NAME 'ipaOverrideTarget' SUP to
+ p STRUCTURAL MUST ipaAnchorUUID X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.30 NAME 'ipaOverrideAnchor' SUP to
+ p STRUCTURAL MUST ipaAnchorUUID MAY description X-ORIGIN ( 'IPA v4.1.2' 'us
+ er defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.31 NAME 'ipaUserOverride' DESC 'Ov
+ erride for User Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( uid $ ui
+ dNumber $ gidNumber $ homeDirectory $ loginShell $ gecos $ ipaOriginalUid $
+  userCertificate ) X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.32 NAME 'ipaGroupOverride' DESC 'O
+ verride for Group Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( gidNum
+ ber $ cn ) X-ORIGIN ( 'IPA v4.1.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.16.2.6 NAME 'ipatokenOTPConfig' DESC 
+ 'OTP Global Configuration' SUP top STRUCTURAL MUST cn MAY ( ipatokenTOTPaut
+ hWindow $ ipatokenTOTPsyncWindow $ ipatokenHOTPauthWindow $ ipatokenHOTPsyn
+ cWindow ) X-ORIGIN ( 'IPA v4.1.3' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.18.1.1 NAME 'ipaVault' DESC 'IPA vaul
+ t' SUP top STRUCTURAL MUST cn MAY ( description $ ipaVaultType $ ipaVaultSa
+ lt $ ipaVaultPublicKey $ owner $ member ) X-ORIGIN ( 'IPA v4.2.2' 'user def
+ ined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.18.1.2 NAME 'ipaVaultContainer' DESC 
+ 'IPA vault container' SUP top STRUCTURAL MUST cn MAY ( description $ owner 
+ ) X-ORIGIN ( 'IPA v4.2.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.21.2.1 NAME 'ipaCertProfile' SUP top 
+ STRUCTURAL MUST ( cn $ description $ ipaCertProfileStoreIssued ) X-ORIGIN (
+  'IPA v4.2.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.21.2.2 NAME 'ipaCaAcl' SUP ipaAssocia
+ tion STRUCTURAL MAY ( ipaCaCategory $ ipaCertProfileCategory $ serviceCateg
+ ory $ ipaMemberCa $ ipaMemberCertProfile $ memberService ) X-ORIGIN ( 'IPA 
+ v4.4.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.20.1.2 NAME 'ipaReplTopoSegment' DESC
+  'IPA defined objectclass' SUP top STRUCTURAL MUST ( ipaReplTopoSegmentDire
+ ction $ ipaReplTopoSegmentLeftNode $ ipaReplTopoSegmentRightNode ) MAY ( cn
+  $ ipaReplTopoSegmentStatus $ ipaReplTopoSegmentGenerated $ nsDS5Replicated
+ AttributeList $ nsDS5ReplicatedAttributeListTotal $ nsds5BeginReplicaRefres
+ h $ description $ nsds5replicaTimeout $ nsds5ReplicaEnabled $ nsds5ReplicaS
+ tripAttrs $ nsds5replicaSessionPauseTime $ nsds5ReplicaProtocolTimeout ) X-
+ ORIGIN ( 'IPA v4.2.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.20.1.1 NAME 'ipaReplTopoConf' DESC 'I
+ PA defined objectclass' SUP top STRUCTURAL MUST ipaReplTopoConfRoot MAY ( c
+ n $ nsDS5ReplicaRoot $ nsDS5ReplicatedAttributeList $ nsDS5ReplicatedAttrib
+ uteListTotal $ nsds5ReplicaStripAttrs ) X-ORIGIN ( 'IPA v4.3.0' 'user defin
+ ed' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.20.1.4 NAME 'ipaReplTopoManagedServer
+ ' DESC 'part of managed replication topology' SUP top AUXILIARY MAY ipaRepl
+ TopoManagedSuffix X-ORIGIN ( 'IPA v4.2.2' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.20.1.3 NAME 'ipaReplTopoManagedAgreem
+ ent' DESC 'marker objectclass for managed replication agreements' SUP top A
+ UXILIARY MAY ipaReplTopoManagedAgreementState X-ORIGIN ( 'IPA v4.2.2' 'user
+  defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.19.1.2 NAME 'ipaSupportedDomainLevelC
+ onfig' DESC 'Supported Domain Level Configuration' SUP ipaConfigObject AUXI
+ LIARY MUST ( ipaMinDomainLevel $ ipaMaxDomainLevel ) X-ORIGIN ( 'IPA v4.2.2
+ ' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.19.1.1 NAME 'ipaDomainLevelConfig' DE
+ SC 'Domain Level Configuration' SUP ipaConfigObject AUXILIARY MUST ipaDomai
+ nLevel X-ORIGIN ( 'IPA v4.2.2' 'user defined' ) )
+objectClasses: ( certProfile-oid NAME 'certProfile' DESC 'Certificate profil
+ e' SUP top STRUCTURAL MUST cn MAY ( classId $ certProfileConfig ) X-ORIGIN 
+ 'user defined' )
+objectClasses: ( tokenRecord-oid NAME 'tokenRecord' DESC 'CMS defined class'
+  SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ modified $ 
+ tokenReason $ tokenUserID $ tokenStatus $ tokenAppletID $ keyInfo $ tokenPo
+ licy $ extensions $ numberOfResets $ numberOfEnrollments $ numberOfRenewals
+  $ numberOfRecoveries $ userCertificate $ tokenType ) X-ORIGIN 'user define
+ d' )
+objectClasses: ( tokenActivity-oid NAME 'tokenActivity' DESC 'CMS defined cl
+ ass' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ tokenOp
+  $ tokenIP $ tokenResult $ tokenID $ tokenUserID $ tokenMsg $ extensions $ 
+ tokenType ) X-ORIGIN 'user defined' )
+objectClasses: ( tokenCert-oid NAME 'tokenCert' DESC 'CMS defined class' SUP
+  top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ userCertificate
+  $ tokenUserID $ tokenID $ tokenIssuer $ tokenOrigin $ tokenSubject $ token
+ Serial $ tokenStatus $ tokenType $ tokenKeyType $ tokenNotBefore $ tokenNot
+ After $ extensions ) X-ORIGIN 'user defined' )
+objectClasses: ( tpsProfileID-oid NAME 'tpsProfileID' DESC 'CMS defined clas
+ s' SUP top AUXILIARY MAY profileID X-ORIGIN ( 'user-defined' 'user defined'
+  ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.7 NAME 'ipaLocationObject' DESC 'Ob
+ ject for storing IPA server location' SUP top STRUCTURAL MUST idnsName MAY 
+ description X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.12.36 NAME 'ipaDNSContainer' DESC 'IP
+ A DNS container' AUXILIARY MUST ipaDNSVersion X-ORIGIN ( 'IPA v4.4.0.alpha1
+ ' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.6 NAME 'idnsServerConfigObject' DES
+ C 'DNS server configuration options' SUP top STRUCTURAL MUST idnsServerId M
+ AY ( idnsSubstitutionVariable $ idnsSOAmName $ idnsForwarders $ idnsForward
+ Policy ) X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.5 NAME 'idnsTemplateObject' DESC 'T
+ emplate object for dynamic DNS attribute generation' AUXILIARY MUST idnsTem
+ plateAttribute X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.6.8 NAME 'ipaLocationMember' DESC 'Me
+ mber object of IPA location' AUXILIARY MAY ( ipaLocation $ ipaServiceWeight
+  ) X-ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( 2.16.840.1.113730.3.8.21.2.3 NAME 'ipaCa' SUP top STRUCTURA
+ L MUST ( cn $ ipaCaId $ ipaCaSubjectDN $ ipaCaIssuerDN ) MAY description X-
+ ORIGIN ( 'IPA v4.4.0.alpha1' 'user defined' ) )
+objectClasses: ( authority-oid NAME 'authority' DESC 'Certificate Authority'
+  SUP top STRUCTURAL MUST ( cn $ authorityID $ authorityKeyNickname $ author
+ ityEnabled $ authorityDN ) MAY ( authoritySerial $ authorityParentID $ auth
+ orityParentDN $ authorityKeyHost $ description ) X-ORIGIN ( 'IPA v4.4.0.alp
+ ha1' 'user defined' ) )
+
diff --git a/Tests/ldif/subschema-openldap-all.ldif b/Tests/ldif/subschema-openldap-all.ldif
new file mode 100644
index 0000000..3e930c6
--- /dev/null
+++ b/Tests/ldif/subschema-openldap-all.ldif
@@ -0,0 +1,8017 @@
+########################################################################
+# LDIF export by web2ldap 1.2.80, see http://www.web2ldap.de
+# Date and time: Saturday, 2017-02-18 17:09:50 GMT
+# Bind-DN: u'cn=Michael Str\xf6der+mail=michael@stroeder.com,ou=Private,dc=stroeder,dc=de'
+# LDAP-URL of search:
+# ldapi:///cn%3DSubschema?matchingRuleUse,ldapSyntaxes,nameForms,dITStructureRules,attributeTypes,matchingRules,dITContentRules,objectClasses,objectClass,cn?base?%28objectClass%3D%2A%29?x-saslmech=EXTERNAL
+########################################################################
+version: 1
+
+dn: cn=Subschema
+attributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes o
+ f the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.38 )
+attributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: struc
+ tural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOper
+ ation )
+attributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which 
+ object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeO
+ rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODI
+ FICATION USAGE directoryOperation )
+attributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which 
+ object was last modified' EQUALITY generalizedTimeMatch ORDERING generalize
+ dTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USE
+ R-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creato
+ r' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SIN
+ GLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last 
+ modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has chi
+ ldren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VAL
+ UE NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of 
+ controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOpe
+ ration )
+attributeTypes: ( 2.5.18.12 NAME 'collectiveAttributeSubentries' DESC 'RFC36
+ 71: collective attribute subentries' EQUALITY distinguishedNameMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE directoryOperatio
+ n )
+attributeTypes: ( 2.5.18.7 NAME 'collectiveExclusions' DESC 'RFC3671: collec
+ tive attribute exclusions' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.38 USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE 
+ NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' E
+ QUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-V
+ ALUE NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change sequ
+ ence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMat
+ ch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION
+  USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change se
+ quence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrde
+ ringMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIF
+ ICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'sync
+ repl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetString
+ OrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MOD
+ IFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the larg
+ est committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch
+  SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOpera
+ tion )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512:
+  alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperati
+ on )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RFC
+ 4512: naming contexts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperat
+ ion )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC '
+ RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSA
+ Operation )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC 
+ 'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 38 USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' DE
+ SC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms'
+  DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC4
+ 512: features supported by the server' EQUALITY objectIdentifierMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'moni
+ tor context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'confi
+ g context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of imple
+ mentation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version of
+  implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: administ
+ rative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.38 USAGE directoryOperation )
+attributeTypes: ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtre
+ e specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE di
+ rectoryOperation )
+attributeTypes: ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT struc
+ ture rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.17 USAGE directoryOperation )
+attributeTypes: ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT content
+  rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.16 USAGE directoryOperation )
+attributeTypes: ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rule
+ s' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.30 USAGE directoryOperation )
+attributeTypes: ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute ty
+ pes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.3 USAGE directoryOperation )
+attributeTypes: ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object classe
+ s' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.37 USAGE directoryOperation )
+attributeTypes: ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQUA
+ LITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 35 USAGE directoryOperation )
+attributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching ru
+ le uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.31 USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC4
+ 512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.54 USAGE directoryOperation )
+attributeTypes: ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) DE
+ SC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subordi
+ nate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 USAGE distributedOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL ent
+ ry pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MOD
+ IFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL 
+ children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-US
+ ER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' ) 
+ DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.4
+ 203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFrom
+ ' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4
+ .1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589: 
+ entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-US
+ ER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'RF
+ C2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIF
+ ICATION USAGE dSAOperation )
+attributeTypes: ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common su
+ pertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.12 )
+attributeTypes: ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of na
+ me attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )
+attributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common n
+ ame(s) for which the entity is known by' SUP name )
+attributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'RF
+ C4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An integer
+  uniquely identifying a user in an administrative domain' EQUALITY integerM
+ atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An integer
+  uniquely identifying a group in an administrative domain' EQUALITY integer
+ Match ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SI
+ NGLE-VALUE )
+attributeTypes: ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password 
+ of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128
+ } )
+attributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Unif
+ orm Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive inf
+ ormation' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15{1024} )
+attributeTypes: ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related objec
+ t' SUP distinguishedName )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.78 NAME 'olcConfigFile' DESC '
+ File for slapd configuration directives' EQUALITY caseIgnoreMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.79 NAME 'olcConfigDir' DESC 'D
+ irectory for slapd configuration backend' EQUALITY caseIgnoreMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.1 NAME 'olcAccess' DESC 'Acces
+ s Control List' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.86 NAME 'olcAddContentAcl' DES
+ C 'Check ACLs against content of Add ops' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.2 NAME 'olcAllows' DESC 'Allow
+ ed set of deprecated features' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.3 NAME 'olcArgsFile' DESC 'Fil
+ e for slapd command line options' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.5 NAME 'olcAttributeOptions' E
+ QUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.4 NAME 'olcAttributeTypes' DES
+ C 'OpenLDAP attributeTypes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.6 NAME 'olcAuthIDRewrite' EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.7 NAME 'olcAuthzPolicy' EQUALI
+ TY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.8 NAME 'olcAuthzRegexp' EQUALI
+ TY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' 
+ )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.9 NAME 'olcBackend' DESC 'A ty
+ pe of backend' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 SINGLE-VALUE X-ORDERED 'SIBLINGS' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.10 NAME 'olcConcurrency' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.11 NAME 'olcConnMaxPending' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.12 NAME 'olcConnMaxPendingAuth
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.13 NAME 'olcDatabase' DESC 'Th
+ e backend type for a database instance' SUP olcBackend SINGLE-VALUE X-ORDER
+ ED 'SIBLINGS' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.14 NAME 'olcDefaultSearchBase'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.15 NAME 'olcDisallows' EQUALIT
+ Y caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.16 NAME 'olcDitContentRules' D
+ ESC 'OpenLDAP DIT content rules' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.20 NAME 'olcExtraAttrs' EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.17 NAME 'olcGentleHUP' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.17 NAME 'olcHidden' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.18 NAME 'olcIdleTimeout' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.19 NAME 'olcInclude' SUP label
+ edURI )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.20 NAME 'olcIndexSubstrIfMinLe
+ n' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.21 NAME 'olcIndexSubstrIfMaxLe
+ n' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.22 NAME 'olcIndexSubstrAnyLen'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.23 NAME 'olcIndexSubstrAnyStep
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.84 NAME 'olcIndexIntLen' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.4 NAME 'olcLastMod' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.85 NAME 'olcLdapSyntaxes' DESC
+  'OpenLDAP ldapSyntax' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.5 NAME 'olcLimits' EQUALITY 
+ caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.93 NAME 'olcListenerThreads' S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.26 NAME 'olcLocalSSF' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.27 NAME 'olcLogFile' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.28 NAME 'olcLogLevel' EQUALITY
+  caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.6 NAME 'olcMaxDerefDepth' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.16 NAME 'olcMirrorMode' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.30 NAME 'olcModuleLoad' EQUALI
+ TY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' 
+ )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.31 NAME 'olcModulePath' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.18 NAME 'olcMonitoring' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.32 NAME 'olcObjectClasses' DES
+ C 'OpenLDAP object classes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.33 NAME 'olcObjectIdentifier' 
+ EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.34 NAME 'olcOverlay' SUP olcDa
+ tabase SINGLE-VALUE X-ORDERED 'SIBLINGS' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.35 NAME 'olcPasswordCryptSaltF
+ ormat' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.36 NAME 'olcPasswordHash' EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.37 NAME 'olcPidFile' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.38 NAME 'olcPlugin' EQUALITY c
+ aseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.39 NAME 'olcPluginLogFile' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.40 NAME 'olcReadOnly' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.41 NAME 'olcReferral' SUP labe
+ ledURI SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.7 NAME 'olcReplica' SUP labe
+ ledURI EQUALITY caseIgnoreMatch X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.43 NAME 'olcReplicaArgsFile' S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.44 NAME 'olcReplicaPidFile' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.45 NAME 'olcReplicationInterva
+ l' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.46 NAME 'olcReplogFile' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.47 NAME 'olcRequires' EQUALITY
+  caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.48 NAME 'olcRestrict' EQUALITY
+  caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.49 NAME 'olcReverseLookup' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.8 NAME 'olcRootDN' EQUALITY 
+ distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.51 NAME 'olcRootDSE' EQUALITY 
+ caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.9 NAME 'olcRootPW' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.89 NAME 'olcSaslAuxprops' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.53 NAME 'olcSaslHost' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.54 NAME 'olcSaslRealm' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.56 NAME 'olcSaslSecProps' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.58 NAME 'olcSchemaDN' EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.59 NAME 'olcSecurity' EQUALITY
+  caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.81 NAME 'olcServerID' EQUALITY
+  caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.60 NAME 'olcSizeLimit' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.61 NAME 'olcSockbufMaxIncoming
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.62 NAME 'olcSockbufMaxIncoming
+ Auth' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.83 NAME 'olcSortVals' DESC 'At
+ tributes whose values will always be sorted' EQUALITY caseIgnoreMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.15 NAME 'olcSubordinate' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.10 NAME 'olcSuffix' EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.19 NAME 'olcSyncUseSubentry'
+  DESC 'Store sync context in a subentry' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.11 NAME 'olcSyncrepl' EQUALI
+ TY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' 
+ )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.90 NAME 'olcTCPBuffer' DESC 'C
+ ustom TCP buffer size' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.66 NAME 'olcThreads' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.67 NAME 'olcTimeLimit' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.68 NAME 'olcTLSCACertificateFi
+ le' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.69 NAME 'olcTLSCACertificatePa
+ th' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.70 NAME 'olcTLSCertificateFile
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.71 NAME 'olcTLSCertificateKeyF
+ ile' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.72 NAME 'olcTLSCipherSuite' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.73 NAME 'olcTLSCRLCheck' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.82 NAME 'olcTLSCRLFile' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.74 NAME 'olcTLSRandFile' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.75 NAME 'olcTLSVerifyClient' S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.77 NAME 'olcTLSDHParamFile' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.87 NAME 'olcTLSProtocolMin' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.80 NAME 'olcToolThreads' SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.12 NAME 'olcUpdateDN' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.13 NAME 'olcUpdateRef' SUP l
+ abeledURI EQUALITY caseIgnoreMatch )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.0.88 NAME 'olcWriteTimeout' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.1 NAME 'olcDbDirectory' DESC
+  'Directory for database content' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.5 NAME 'OpenLDAPaci' DESC 'OpenLDAP
+  access control information (experimental)' EQUALITY OpenLDAPaciMatch SYNTA
+ X 1.3.6.1.4.1.4203.666.2.1 USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.2 NAME 'olcDbCheckpoint' DES
+ C 'Database checkpoint interval in kbytes and minutes' SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.4 NAME 'olcDbNoSync' DESC 'D
+ isable synchronous database writes' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.12.3 NAME 'olcDbEnvFlags' DESC
+  'Database environment flags' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.2 NAME 'olcDbIndex' DESC 'At
+ tribute index parameters' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.12.1 NAME 'olcDbMaxReaders' DE
+ SC 'Maximum number of threads that may access the DB concurrently' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.12.2 NAME 'olcDbMaxSize' DESC 
+ 'Maximum size of DB in bytes' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.3 NAME 'olcDbMode' DESC 'Uni
+ x permissions of database files' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.12.5 NAME 'olcDbRtxnSize' DESC
+  'Number of entries to process in one read transaction' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.9 NAME 'olcDbSearchStack' DE
+ SC 'Depth of search stack in IDLs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.11 NAME 'olcDbCacheFree' DES
+ C 'Number of extra entries to free when max is reached' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.1 NAME 'olcDbCacheSize' DESC
+  'Entry cache size in entries' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.16 NAME 'olcDbChecksum' DESC
+  'Enable database checksum validation' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.13 NAME 'olcDbCryptFile' DES
+ C 'Pathname of file containing the DB encryption key' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.14 NAME 'olcDbCryptKey' DESC
+  'DB encryption key' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.3 NAME 'olcDbConfig' DESC 'B
+ erkeleyDB DB_CONFIG configuration directives' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.15 NAME 'olcDbPageSize' DESC
+  'Page size of specified DB, in Kbytes' EQUALITY caseExactMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.5 NAME 'olcDbDirtyRead' DESC
+  'Allow reads of uncommitted data' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.12 NAME 'olcDbDNcacheSize' D
+ ESC 'DN cache size' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.6 NAME 'olcDbIDLcacheSize' D
+ ESC 'IDL cache size in IDLs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.7 NAME 'olcDbLinearIndex' DE
+ SC 'Index attributes one at a time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.8 NAME 'olcDbLockDetect' DES
+ C 'Deadlock detection algorithm' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGL
+ E-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.1.10 NAME 'olcDbShmKey' DESC '
+ Key for shared memory region' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.0.14 NAME 'olcDbURI' DESC 'URI
+  (list) for remote DSA' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.1 NAME 'olcDbStartTLS' DESC 
+ 'StartTLS' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.2 NAME 'olcDbACLAuthcDn' DES
+ C 'Remote ACL administrative identity' OBSOLETE SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.3 NAME 'olcDbACLPasswd' DESC
+  'Remote ACL administrative identity credentials' OBSOLETE SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.4 NAME 'olcDbACLBind' DESC '
+ Remote ACL administrative identity auth bind configuration' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.5 NAME 'olcDbIDAssertAuthcDn
+ ' DESC 'Remote Identity Assertion administrative identity' OBSOLETE SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.6 NAME 'olcDbIDAssertPasswd'
+  DESC 'Remote Identity Assertion administrative identity credentials' OBSOL
+ ETE SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.7 NAME 'olcDbIDAssertBind' D
+ ESC 'Remote Identity Assertion administrative identity auth bind configurat
+ ion' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.8 NAME 'olcDbIDAssertMode' D
+ ESC 'Remote Identity Assertion mode' OBSOLETE SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.9 NAME 'olcDbIDAssertAuthzFr
+ om' DESC 'Remote Identity Assertion authz rules' EQUALITY caseIgnoreMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.10 NAME 'olcDbRebindAsUser' 
+ DESC 'Rebind as user' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.11 NAME 'olcDbChaseReferrals
+ ' DESC 'Chase referrals' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.12 NAME 'olcDbTFSupport' DES
+ C 'Absolute filters support' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.13 NAME 'olcDbProxyWhoAmI' D
+ ESC 'Proxy whoAmI exop' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.14 NAME 'olcDbTimeout' DESC 
+ 'Per-operation timeouts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.15 NAME 'olcDbIdleTimeout' D
+ ESC 'connection idle timeout' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.16 NAME 'olcDbConnTtl' DESC 
+ 'connection ttl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.17 NAME 'olcDbNetworkTimeout
+ ' DESC 'connection network timeout' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.18 NAME 'olcDbProtocolVersio
+ n' DESC 'protocol version' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALU
+ E )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.19 NAME 'olcDbSingleConn' DE
+ SC 'cache a single connection per identity' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.20 NAME 'olcDbCancel' DESC '
+ abandon/ignore/exop operations when appropriate' SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.21 NAME 'olcDbQuarantine' DE
+ SC 'Quarantine database if connection fails and retry according to rule' SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.22 NAME 'olcDbUseTemporaryCo
+ nn' DESC 'Use temporary connections if the cached one is busy' SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.23 NAME 'olcDbConnectionPool
+ Max' DESC 'Max size of privileged connections pool' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.24 NAME 'olcDbSessionTrackin
+ gRequest' DESC 'Add session tracking control to proxied requests' SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.25 NAME 'olcDbNoRefs' DESC '
+ Do not return search reference responses' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.26 NAME 'olcDbNoUndefFilter'
+  DESC 'Do not propagate undefined search filters' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.108 NAME 'olcDbOnErr' DESC '
+ error handling' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.27 NAME 'olcDbIDAssertPassTh
+ ru' DESC 'Remote Identity Assertion passthru rules' EQUALITY caseIgnoreMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.29 NAME 'olcDbKeepalive' DES
+ C 'TCP keepalive' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.3.1 NAME 'olcChainingBehavior'
+  DESC 'Chaining behavior control parameters (draft-sermersheim-ldap-chainin
+ g)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.3.2 NAME 'olcChainCacheURI' DE
+ SC 'Enables caching of URIs not present in configuration' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.3.3 NAME 'olcChainMaxReferralD
+ epth' DESC 'max referral depth' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.3.4 NAME 'olcChainReturnError'
+  DESC 'Errors are returned instead of the original referral' SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.101 NAME 'olcDbRewrite' DESC
+  'DN rewriting rules' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.102 NAME 'olcDbMap' DESC 'Ma
+ p attribute and objectclass names' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.103 NAME 'olcDbSubtreeExclud
+ e' DESC 'DN of subtree to exclude from target' EQUALITY caseIgnoreMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.104 NAME 'olcDbSubtreeInclud
+ e' DESC 'DN of subtree to include in target' EQUALITY caseIgnoreMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.105 NAME 'olcDbDefaultTarget
+ ' DESC 'Specify the default target' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.106 NAME 'olcDbDnCacheTtl' D
+ ESC 'dncache ttl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.107 NAME 'olcDbBindTimeout' 
+ DESC 'bind timeout' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.109 NAME 'olcDbPseudoRootBin
+ dDefer' DESC 'error handling' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.110 NAME 'olcDbNretries' DES
+ C 'retry handling' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.111 NAME 'olcDbClientPr' DES
+ C 'PagedResults handling' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.100 NAME 'olcMetaSub' DESC '
+ Placeholder to name a Target entry' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.15 SINGLE-VALUE X-ORDERED 'SIBLINGS' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.3.112 NAME 'olcDbFilter' DESC 
+ 'Filter regex pattern to include in target' EQUALITY caseExactMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'mon
+ itored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOpera
+ tion )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'monit
+ or managed info' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'mo
+ nitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DESC
+  'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USA
+ GE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DESC
+  'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USA
+ GE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber'
+  DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION U
+ SAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzDN
+ ' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperat
+ ion )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalAd
+ dress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MO
+ DIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAdd
+ ress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODI
+ FICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC 
+ 'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeO
+ rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODI
+ FICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC 'n
+ ame of overlays defined for a given database' SUP monitoredInfo NO-USER-MOD
+ IFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/wr
+ ite status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' DE
+ SC 'name of restricted operation for a given database' SUP managedInfo )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProtoc
+ ol' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATI
+ ON USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsRec
+ eived' DESC 'monitor number of operations received by the connection' SUP m
+ onitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsExe
+ cuting' DESC 'monitor number of operations in execution within the connecti
+ on' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPen
+ ding' DESC 'monitor number of pending operations within the connection' SUP
+  monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCom
+ pleted' DESC 'monitor number of operations completed within the connection'
+  SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet' D
+ ESC 'number of times connection_get() was called so far' SUP monitorCounter
+  NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead' 
+ DESC 'number of times connection_read() was called so far' SUP monitorCount
+ er NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite'
+  DESC 'number of times connection_write() was called so far' SUP monitorCou
+ nter NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask' 
+ DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE
+  dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListen
+ er' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATI
+ ON USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerDo
+ main' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIF
+ ICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStartT
+ ime' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE
+  NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActivi
+ tyTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE
+ -VALUE NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC '
+ TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC 
+ 'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE
+  dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig' D
+ ESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.30 NAME 'monitorSuperiorDN' DESC
+  'monitor superior DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.2.5.1 NAME 'olcRelay' DESC 'Rela
+ y DN' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.15.1 NAME 'olcAuditlogFile' DE
+ SC 'Filename for auditlogging' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.1 NAME 'olcAccessLogDB' DESC
+  'Suffix of database for log content' SUP distinguishedName SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.2 NAME 'olcAccessLogOps' DES
+ C 'Operation types to log' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.3 NAME 'olcAccessLogPurge' D
+ ESC 'Log cleanup parameters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.4 NAME 'olcAccessLogSuccess'
+  DESC 'Log successful ops only' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.5 NAME 'olcAccessLogOld' DES
+ C 'Log old values when modifying entries matching the filter' SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.6 NAME 'olcAccessLogOldAttr'
+  DESC 'Log old values of these attributes even if unmodified' EQUALITY case
+ IgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.4.7 NAME 'olcAccessLogBase' DE
+ SC 'Operation types to log under a specific branch' EQUALITY caseIgnoreMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.1 NAME 'reqDN' DESC 'Target DN
+  of request' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.2 NAME 'reqStart' DESC 'Start 
+ time of request' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrde
+ ringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.3 NAME 'reqEnd' DESC 'End time
+  of request' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrdering
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.4 NAME 'reqType' DESC 'Type of
+  request' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.5 NAME 'reqSession' DESC 'Sess
+ ion ID of request' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.6 NAME 'reqAuthzID' DESC 'Auth
+ orization ID of requestor' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.7 NAME 'reqResult' DESC 'Resul
+ t code of request' EQUALITY integerMatch ORDERING integerOrderingMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.8 NAME 'reqMessage' DESC 'Erro
+ r text of request' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.9 NAME 'reqReferral' DESC 'Ref
+ errals returned for request' SUP labeledURI )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.10 NAME 'reqControls' DESC 'Re
+ quest controls' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1
+ .4.1.4203.666.11.5.3.1 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.11 NAME 'reqRespControls' DESC
+  'Response controls of request' EQUALITY objectIdentifierFirstComponentMatc
+ h SYNTAX 1.3.6.1.4.1.4203.666.11.5.3.1 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.12 NAME 'reqId' DESC 'ID of Re
+ quest to Abandon' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.13 NAME 'reqVersion' DESC 'Pro
+ tocol version of Bind request' EQUALITY integerMatch ORDERING integerOrderi
+ ngMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.14 NAME 'reqMethod' DESC 'Bind
+  method of request' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.15 NAME 'reqAssertion' DESC 'C
+ ompare Assertion of request' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.16 NAME 'reqMod' DESC 'Modific
+ ations of request' EQUALITY octetStringMatch SUBSTR octetStringSubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.17 NAME 'reqOld' DESC 'Old val
+ ues of entry before request completed' EQUALITY octetStringMatch SUBSTR oct
+ etStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.18 NAME 'reqNewRDN' DESC 'New 
+ RDN of request' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.19 NAME 'reqDeleteOldRDN' DESC
+  'Delete old RDN' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+  SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.20 NAME 'reqNewSuperior' DESC 
+ 'New superior DN of request' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.21 NAME 'reqScope' DESC 'Scope
+  of request' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.22 NAME 'reqDerefAliases' DESC
+  'Disposition of Aliases in request' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.23 NAME 'reqAttrsOnly' DESC 'A
+ ttributes and values of request' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.24 NAME 'reqFilter' DESC 'Filt
+ er of request' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.25 NAME 'reqAttr' DESC 'Attrib
+ utes of request' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.26 NAME 'reqSizeLimit' DESC 'S
+ ize limit of request' EQUALITY integerMatch ORDERING integerOrderingMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.27 NAME 'reqTimeLimit' DESC 'T
+ ime limit of request' EQUALITY integerMatch ORDERING integerOrderingMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.28 NAME 'reqEntries' DESC 'Num
+ ber of entries returned' EQUALITY integerMatch ORDERING integerOrderingMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.29 NAME 'reqData' DESC 'Data o
+ f extended request' EQUALITY octetStringMatch SUBSTR octetStringSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.30 NAME 'auditContext' DESC 'D
+ N of auditContainer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-U
+ SER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.5.1.31 NAME 'reqEntryUUID' DESC 'U
+ UID of entry' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.
+ 1.16.1 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.19.1 NAME 'olcCollectInfo' DES
+ C 'DN of entry and attribute to distribute' EQUALITY caseIgnoreMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.8.1 NAME 'olcDlAttrSet' DESC '
+ Dynamic list: <group objectClass>, <URL attributeDescription>, <member attr
+ ibuteDescription>' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.11.1 NAME 'olcRefintAttribute'
+  DESC 'Attributes for referential integrity' EQUALITY caseIgnoreMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.11.2 NAME 'olcRefintNothing' D
+ ESC 'Replacement DN to supply when needed' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.11.3 NAME 'olcRefintModifiersN
+ ame' DESC 'The DN to use as modifiersName' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.12 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that th
+ e entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.12 USAGE dSAOperation X-ORIGIN 'iPlanet Delegated Administrator'
+  )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.0 NAME 'olcMemberOfDN' DESC
+  'DN to be used as modifiersName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.1 NAME 'olcMemberOfDangling
+ ' DESC 'Behavior with respect to dangling members, constrained to ignore, d
+ rop, error' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.2 NAME 'olcMemberOfRefInt' 
+ DESC 'Take care of referential integrity' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.3 NAME 'olcMemberOfGroupOC'
+  DESC 'Group objectClass' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.4 NAME 'olcMemberOfMemberAD
+ ' DESC 'member attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.5 NAME 'olcMemberOfMemberOf
+ AD' DESC 'memberOf attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.18.7 NAME 'olcMemberOfDangling
+ Error' DESC 'Error code returned in case of dangling back reference' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.1.1 NAME 'olcSpCheckpoint' DES
+ C 'ContextCSN checkpoint interval in ops and minutes' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.1.2 NAME 'olcSpSessionlog' DES
+ C 'Session log size in ops' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VAL
+ UE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.1.3 NAME 'olcSpNoPresent' DESC
+  'Omit Present phase processing' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE
+ -VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.1.4 NAME 'olcSpReloadHint' DES
+ C 'Observe Reload Hint in Request control' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.14.1 NAME 'olcTranslucentStric
+ t' DESC 'Reveal attribute deletion constraint violations' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.14.2 NAME 'olcTranslucentNoGlu
+ e' DESC 'Disable automatic glue records for ADD and MODRDN' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.14.3 NAME 'olcTranslucentLocal
+ ' DESC 'Attributes to use in local search filter' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.14.4 NAME 'olcTranslucentRemot
+ e' DESC 'Attributes to use in remote search filter' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.14.5 NAME 'olcTranslucentBindL
+ ocal' DESC 'Enable local bind' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.14.6 NAME 'olcTranslucentPwMod
+ Local' DESC 'Enable local RFC 3062 Password Modify extended operation' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.10.1 NAME 'olcUniqueBase' DESC
+  'Subtree for uniqueness searches' EQUALITY distinguishedNameMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.10.2 NAME 'olcUniqueIgnore' DE
+ SC 'Attributes for which uniqueness shall not be enforced' EQUALITY caseIgn
+ oreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.10.3 NAME 'olcUniqueAttribute'
+  DESC 'Attributes for which uniqueness shall be enforced' EQUALITY caseIgno
+ reMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.10.4 NAME 'olcUniqueStrict' DE
+ SC 'Enforce uniqueness of null values' EQUALITY booleanMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.10.5 NAME 'olcUniqueURI' DESC 
+ 'List of keywords and LDAP URIs for a uniqueness domain' EQUALITY caseExact
+ Match ORDERING caseExactOrderingMatch SUBSTR caseExactSubstringsMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.13.1 NAME 'olcConstraintAttrib
+ ute' DESC 'constraint for list of attributes' EQUALITY caseIgnoreMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.5.1 NAME 'olcValSortAttr' DESC
+  'Sorting rule for attribute under given DN' EQUALITY caseIgnoreMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.21.1 NAME 'olcSssVlvMax' DESC 
+ 'Maximum number of concurrent Sort requests' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.21.2 NAME 'olcSssVlvMaxKeys' D
+ ESC 'Maximum number of Keys in a Sort request' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.21.3 NAME 'olcSssVlvMaxPerConn
+ ' DESC 'Maximum number of concurrent paged search requests per connection' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.16 NAME 'pwdChangedTime' DESC 'The
+  time the password was last changed' EQUALITY generalizedTimeMatch ORDERING
+  generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-V
+ ALUE NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.17 NAME 'pwdAccountLockedTime' DES
+ C 'The time an user account was locked' EQUALITY generalizedTimeMatch ORDER
+ ING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGL
+ E-VALUE USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.19 NAME 'pwdFailureTime' DESC 'The
+  timestamps of the last consecutive authentication failures' EQUALITY gener
+ alizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.24 NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.20 NAME 'pwdHistory' DESC 'The his
+ tory of users passwords' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.40 NO-USER-MODIFICATION USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.21 NAME 'pwdGraceUseTime' DESC 'Th
+ e timestamps of the grace login once the password has expired' EQUALITY gen
+ eralizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 NO-USER-MODIFICATION
+  USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.22 NAME 'pwdReset' DESC 'The indic
+ ation that the password has been reset' EQUALITY booleanMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE directoryOperation )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.23 NAME 'pwdPolicySubentry' DESC '
+ The pwdPolicy subentry in effect for this object' EQUALITY distinguishedNam
+ eMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE USAGE directoryOpe
+ ration )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.12.1 NAME 'olcPPolicyDefault' 
+ DESC 'DN of a pwdPolicy object for uncustomized objects' SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.12.2 NAME 'olcPPolicyHashClear
+ text' DESC 'Hash passwords on add or modify' SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.12.4 NAME 'olcPPolicyForwardUp
+ dates' DESC 'Allow policy state updates to be forwarded via updateref' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.12.3 NAME 'olcPPolicyUseLockou
+ t' DESC 'Warn clients with AccountLocked' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.57 NAME 'entryExpireTimestamp' DESC
+  'RFC2589 OpenLDAP extension: expire time of a dynamic object, computed as 
+ now + entryTtl' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrder
+ ingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICA
+ TION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.1 NAME 'olcDDSstate' DESC 'R
+ FC2589 Dynamic directory services state' SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.2 NAME 'olcDDSmaxTtl' DESC '
+ RFC2589 Dynamic directory services max TTL' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.3 NAME 'olcDDSminTtl' DESC '
+ RFC2589 Dynamic directory services min TTL' SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.4 NAME 'olcDDSdefaultTtl' DE
+ SC 'RFC2589 Dynamic directory services default TTL' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.5 NAME 'olcDDSinterval' DESC
+  'RFC2589 Dynamic directory services expiration task run interval' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.6 NAME 'olcDDStolerance' DES
+ C 'RFC2589 Dynamic directory services additional TTL in expiration scheduli
+ ng' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.3.9.7 NAME 'olcDDSmaxDynamicObje
+ cts' DESC 'RFC2589 Dynamic directory services max number of dynamic objects
+ ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.453.16.2.188 NAME 'authTimestamp' DESC 'last s
+ uccessful authentication using any method/mech' EQUALITY generalizedTimeMat
+ ch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 24 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.3.4.5.1 NAME 'olcLastBindPrecision
+ ' DESC 'Precision of authTimestamp attribute' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.0.1.1 NAME 'olmDbDirectory' DESC
+  'Path name of the directory where the database environment resides' SUP mo
+ nitoredInfo NO-USER-MODIFICATION USAGE dSAOperation )
+attributeTypes: ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowled
+ ge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15{32768} )
+attributeTypes: ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (famil
+ y) name(s) for which the entity is known by' SUP name )
+attributeTypes: ( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial number o
+ f the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.44{64} )
+attributeTypes: ( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC4519: two-lett
+ er ISO-3166 country code' SUP name SYNTAX 1.3.6.1.4.1.1466.115.121.1.11 SIN
+ GLE-VALUE )
+attributeTypes: ( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: localit
+ y which this object resides in' SUP name )
+attributeTypes: ( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2256:
+  state or province which this object resides in' SUP name )
+attributeTypes: ( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC2256: s
+ treet address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+attributeTypes: ( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256: or
+ ganization this object belongs to' SUP name )
+attributeTypes: ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC 'RFC2
+ 256: organizational unit this object belongs to' SUP name )
+attributeTypes: ( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with
+  the entity' SUP name )
+attributeTypes: ( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search guide, d
+ eprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 )
+attributeTypes: ( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: business c
+ ategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15{128} )
+attributeTypes: ( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal addres
+ s' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.41 )
+attributeTypes: ( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code' EQU
+ ALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15{40} )
+attributeTypes: ( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Office B
+ ox' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15{40} )
+attributeTypes: ( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2256: 
+ Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+attributeTypes: ( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Telephone N
+ umber' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} )
+attributeTypes: ( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Number' S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.52 )
+attributeTypes: ( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC2256: T
+ eletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 )
+attributeTypes: ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'R
+ FC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .22 )
+attributeTypes: ( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Address' 
+ EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.36{15} )
+attributeTypes: ( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256: int
+ ernational ISDN number' EQUALITY numericStringMatch SUBSTR numericStringSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} )
+attributeTypes: ( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: registere
+ d postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
+attributeTypes: ( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: destin
+ ation indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} )
+attributeTypes: ( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC2256: pre
+ ferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: present
+ ation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.43 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'RFC2256:
+  supported application context' EQUALITY objectIdentifierMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a group' S
+ UP distinguishedName )
+attributeTypes: ( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the object)
+ ' SUP distinguishedName )
+attributeTypes: ( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupant of ro
+ le' SUP distinguishedName )
+attributeTypes: ( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.509 user 
+ certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.8 )
+attributeTypes: ( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA cert
+ ificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.8 )
+attributeTypes: ( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC2256: X.5
+ 09 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.9 )
+attributeTypes: ( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC2256: X
+ .509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.9 )
+attributeTypes: ( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X.509 
+ cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 )
+attributeTypes: ( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first na
+ me(s) for which the entity is known by' SUP name )
+attributeTypes: ( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of some o
+ r all of names, but not the surname(s).' SUP name )
+attributeTypes: ( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: name qu
+ alifier indicating a generation' SUP name )
+attributeTypes: ( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X.500 
+ unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.6 )
+attributeTypes: ( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN qualifier' E
+ QUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreS
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 )
+attributeTypes: ( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: enhance
+ d search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 )
+attributeTypes: ( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: protoco
+ l information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.42 )
+attributeTypes: ( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique member 
+ of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.34
+  )
+attributeTypes: ( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: house ident
+ ifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.15{32768} )
+attributeTypes: ( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: support
+ ed algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 )
+attributeTypes: ( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: delta r
+ evocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
+attributeTypes: ( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' SUP na
+ me )
+attributeTypes: ( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudonym for 
+ the object' SUP name )
+attributeTypes: ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) 
+ DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnor
+ eIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainComponent' )
+  DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBSTR c
+ aseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VAL
+ UE )
+attributeTypes: ( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DESC 'R
+ FC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBSTR c
+ aseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'pkcs9e
+ mail' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUALIT
+ Y caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26{128} )
+attributeTypes: ( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUA
+ LITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: gener
+ al information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} )
+attributeTypes: ( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDrink' 
+ ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1274:
+  room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: phot
+ o (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} )
+attributeTypes: ( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC1274: 
+ category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: host 
+ computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC1274: D
+ N of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.12 )
+attributeTypes: ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' DESC 
+ 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR ca
+ seIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC 'RFC1
+ 274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DESC 'RF
+ C1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC
+ 1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DESC 'R
+ FC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR case
+ IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTelepho
+ neNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumberM
+ atch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.50 )
+attributeTypes: ( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC1274:
+  DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.12 )
+attributeTypes: ( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.39 )
+attributeTypes: ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgn
+ oreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY caseIg
+ noreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY caseIg
+ noreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY caseIg
+ noreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseI
+ gnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALITY cas
+ eIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'RFC
+ 1274: DN of entry associated with domain' EQUALITY distinguishedNameMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' DESC '
+ RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnor
+ eListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
+attributeTypes: ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 'RFC1
+ 274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTelephon
+ eNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNumber
+ Match SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.50 )
+attributeTypes: ( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelephoneN
+ umber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumberMat
+ ch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 50 )
+attributeTypes: ( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCountryNam
+ e' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBSTR 
+ caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DESC 'R
+ FC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus' DES
+ C 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC 'RFC12
+ 74: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption' DES
+ C 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC 'RFC12
+ 74: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RFC1274
+ : DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE )
+attributeTypes: ( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' DESC 
+ 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE
+ -VALUE )
+attributeTypes: ( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQuality' DE
+ SC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 
+ SINGLE-VALUE )
+attributeTypes: ( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQuality' DE
+ SC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 
+ SINGLE-VALUE )
+attributeTypes: ( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' DESC '
+ RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23 
+ )
+attributeTypes: ( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'RFC127
+ 4: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.12 )
+attributeTypes: ( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274: aud
+ io (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} )
+attributeTypes: ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' DESC '
+ RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC2798: v
+ ehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR caseI
+ gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC 'RFC2
+ 798: identifies a department within an organization' EQUALITY caseIgnoreMat
+ ch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC2798
+ : preferred name to be used when displaying entries' EQUALITY caseIgnoreMat
+ ch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI
+ NGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RFC279
+ 8: numerically identifies an employee within an organization' EQUALITY case
+ IgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2798:
+  type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgnor
+ eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2798:
+  a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 )
+attributeTypes: ( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RF
+ C2798: preferred written or spoken language for a person' EQUALITY caseIgno
+ reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' DESC 
+ 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.5 )
+attributeTypes: ( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2798:
+  personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.5 )
+attributeTypes: ( 2.16.840.1.113730.3.1.13 NAME 'mailLocalAddress' DESC 'RFC
+ 822 email address of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of the
+  SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26{256} SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113730.3.1.47 NAME 'mailRoutingAddress' DESC 'R
+ FC822 routing address of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.2.1.15 NAME 'rfc822MailMember' DESC 'r
+ fc822 mail address of group member(s)' EQUALITY caseIgnoreIA5Match SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; the co
+ mmon name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolute pa
+ th to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to the lo
+ gin shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integerMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integerMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactIA5Mat
+ ch SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
+ )
+attributeTypes: ( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY caseExa
+ ctIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup t
+ riple' SYNTAX 1.3.6.1.1.1.0.0 )
+attributeTypes: ( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY integerMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name )
+attributeTypes: ( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY integerM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integerMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP address' EQU
+ ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
+attributeTypes: ( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP network' 
+ EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGL
+ E-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netmask' 
+ EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGL
+ E-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
+attributeTypes: ( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootparamd
+  parameter' SYNTAX 1.3.6.1.1.1.0.1 )
+attributeTypes: ( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image name' EQ
+ UALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name )
+attributeTypes: ( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseExactIA5M
+ atch SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6{1024} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6 NAME 'javaClassName' DESC 'Fully
+  qualified name of distinguished Java class or interface' EQUALITY caseExac
+ tMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.7 NAME 'javaCodebase' DESC 'URL(s)
+  specifying the location of class definition' EQUALITY caseExactIA5Match SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.13 NAME 'javaClassNames' DESC 'Ful
+ ly qualified Java class or interface name' EQUALITY caseExactMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.8 NAME 'javaSerializedData' DESC '
+ Serialized form of a Java object' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.10 NAME 'javaFactory' DESC 'Fully 
+ qualified Java class name of a JNDI object factory' EQUALITY caseExactMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.11 NAME 'javaReferenceAddress' DES
+ C 'Addresses associated with a JNDI Reference' EQUALITY caseExactMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.12 NAME 'javaDoc' DESC 'The Java d
+ ocumentation for the class' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.14 NAME 'corbaIor' DESC 'Stringifi
+ ed interoperable object reference of a CORBA object' EQUALITY caseIgnoreIA5
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.15 NAME 'corbaRepositoryId' DESC '
+ Repository ids of interfaces implemented by a CORBA object' EQUALITY caseEx
+ actMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113730.3.1.198 NAME 'memberURL' DESC 'Identifie
+ s an URL associated with each member of a group. Any type of labeled URL ca
+ n be used.' SUP labeledURI )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.8.1.1 NAME 'dgIdentity' DESC 'Iden
+ tity to use when processing the memberURL' SUP distinguishedName SINGLE-VAL
+ UE )
+attributeTypes: ( 1.3.6.1.4.1.4203.666.11.8.1.2 NAME 'dgAuthz' DESC 'Optiona
+ l authorization rules that determine who is allowed to assume the dgIdentit
+ y' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 X-ORDERED 'VALUES' )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY obj
+ ectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY intege
+ rMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 S
+ INGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY intege
+ rMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 S
+ INGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY int
+ egerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUALITY 
+ integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY int
+ egerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUALITY
+  integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQUALI
+ TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY boole
+ anMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' EQUAL
+ ITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUALITY i
+ ntegerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInterval' 
+ EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUALITY b
+ ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUAL
+ ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUALITY b
+ ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailure' EQ
+ UALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'Loadab
+ le module that instantiates check_password() function' EQUALITY caseExactIA
+ 5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.5.4.72 NAME 'role' DESC 'X.509 Role attribute, use ;bina
+ ry' SYNTAX 1.3.6.1.4.1.4203.666.11.10.2.6 )
+attributeTypes: ( 2.5.4.75 NAME 'xmlPrivilegeInfo' DESC 'X.509 XML privilege
+  information attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.5.4.58 NAME 'attributeCertificateAttribute' DESC 'X.509 
+ Attribute certificate attribute, use ;binary' EQUALITY attributeCertificate
+ ExactMatch SYNTAX 1.3.6.1.4.1.4203.666.11.10.2.1 )
+attributeTypes: ( 2.5.4.61 NAME 'aACertificate' DESC 'X.509 AA certificate a
+ ttribute, use ;binary' EQUALITY attributeCertificateExactMatch SYNTAX 1.3.6
+ .1.4.1.4203.666.11.10.2.1 )
+attributeTypes: ( 2.5.4.62 NAME 'attributeDescriptorCertificate' DESC 'X.509
+  Attribute descriptor certificate attribute, use ;binary' EQUALITY attribut
+ eCertificateExactMatch SYNTAX 1.3.6.1.4.1.4203.666.11.10.2.1 )
+attributeTypes: ( 2.5.4.59 NAME 'attributeCertificateRevocationList' DESC 'X
+ .509 Attribute certificate revocation list attribute, use ;binary' SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.9 X-EQUALITY 'certificateListExactMatch, not impl
+ emented yet' )
+attributeTypes: ( 2.5.4.63 NAME 'attributeAuthorityRevocationList' DESC 'X.5
+ 09 AA certificate revocation list attribute, use ;binary' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.9 X-EQUALITY 'certificateListExactMatch, not implemented y
+ et' )
+attributeTypes: ( 2.5.4.73 NAME 'delegationPath' DESC 'X.509 Delegation path
+  attribute, use ;binary' SYNTAX 1.3.6.1.4.1.4203.666.11.10.2.4 )
+attributeTypes: ( 2.5.4.71 NAME 'privPolicy' DESC 'X.509 Privilege policy at
+ tribute, use ;binary' SYNTAX 1.3.6.1.4.1.4203.666.11.10.2.5 )
+attributeTypes: ( 2.5.4.74 NAME 'protPrivPolicy' DESC 'X.509 Protected privi
+ lege policy attribute, use ;binary' EQUALITY attributeCertificateExactMatch
+  SYNTAX 1.3.6.1.4.1.4203.666.11.10.2.1 )
+attributeTypes: ( 2.5.4.76 NAME 'xmlPrivPolicy' DESC 'X.509 XML Protected pr
+ ivilege policy attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.5.4.7.1 NAME 'c-l' SUP l COLLECTIVE )
+attributeTypes: ( 2.5.4.8.1 NAME 'c-st' SUP st COLLECTIVE )
+attributeTypes: ( 2.5.4.9.1 NAME 'c-street' SUP street COLLECTIVE )
+attributeTypes: ( 2.5.4.10.1 NAME 'c-o' SUP o COLLECTIVE )
+attributeTypes: ( 2.5.4.11.1 NAME 'c-ou' SUP ou COLLECTIVE )
+attributeTypes: ( 2.5.4.16.1 NAME 'c-PostalAddress' SUP postalAddress COLLEC
+ TIVE )
+attributeTypes: ( 2.5.4.17.1 NAME 'c-PostalCode' SUP postalCode COLLECTIVE )
+attributeTypes: ( 2.5.4.18.1 NAME 'c-PostOfficeBox' SUP postOfficeBox COLLEC
+ TIVE )
+attributeTypes: ( 2.5.4.19.1 NAME 'c-PhysicalDeliveryOfficeName' SUP physica
+ lDeliveryOfficeName COLLECTIVE )
+attributeTypes: ( 2.5.4.20.1 NAME 'c-TelephoneNumber' SUP telephoneNumber CO
+ LLECTIVE )
+attributeTypes: ( 2.5.4.21.1 NAME 'c-TelexNumber' SUP telexNumber COLLECTIVE
+  )
+attributeTypes: ( 2.5.4.23.1 NAME 'c-FacsimileTelephoneNumber' SUP facsimile
+ TelephoneNumber COLLECTIVE )
+attributeTypes: ( 2.5.4.25.1 NAME 'c-InternationalISDNNumber' SUP internatio
+ nalISDNNumber COLLECTIVE )
+attributeTypes: ( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService' DESC 'IAN
+ A GSS-API authorized service name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList' DESC 'De
+ fault LDAP server host address used by a DUA' EQUALITY caseIgnoreMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase' DESC 'De
+ fault LDAP base DN used by a DUA' EQUALITY distinguishedNameMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList' DESC '
+ Preferred LDAP server host addresses to be used by a            DUA' EQUALI
+ TY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' DESC 'Maxi
+ mum time in seconds a DUA should allow for a            search to complete'
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit' DESC 'Maximu
+ m time in seconds a DUA should allow for the            bind operation to c
+ omplete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals' DESC 'Tell
+ s DUA if it should follow referrals            returned by a DSA search res
+ ult' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.16 NAME 'dereferenceAliases' DESC '
+ Tells DUA if it should dereference aliases' EQUALITY booleanMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod' DESC 
+ 'A keystring which identifies the type of            authentication method 
+ used to contact the DSA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' DESC 'Time to l
+ ive, in seconds, before a client DUA            should re-read this configu
+ ration profile' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor' D
+ ESC 'LDAP search descriptor list used by a DUA' EQUALITY caseExactMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' DESC 'Attribu
+ te mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' DESC 'Ide
+ ntifies type of credentials a DUA should            use when binding to the
+  LDAP server' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' DESC 'Obje
+ ctclass mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope' DESC '
+ Default search scope used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel' DE
+ SC 'Identifies type of credentials a DUA            should use when binding
+  to the LDAP server for a            specific service' EQUALITY caseIgnoreI
+ A5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMetho
+ d' DESC 'Authentication method used by a service of the DUA' EQUALITY caseI
+ gnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.2.840.113533.7.68.10 NAME 'attributeCertificate' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.5 )
+attributeTypes: ( 1.2.840.113533.7.68.0 NAME 'entrustCAInfo' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.5 )
+attributeTypes: ( 1.2.840.113533.7.68.30 NAME 'entrustPolicyCertificate' SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.22 NAME 'entrustRoamFileEncInfo' EQUAL
+ ITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.79.0 NAME 'entrustRoamingCAPAB' EQUALITY 
+ octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.28 NAME 'entrustRoamingEOP' EQUALITY o
+ ctetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.24 NAME 'entrustRoamingPAB' EQUALITY o
+ ctetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.27 NAME 'entrustRoamingPRV' EQUALITY o
+ ctetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.23 NAME 'entrustRoamingProfile' EQUALI
+ TY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.25 NAME 'entrustRoamingRecipList' EQUA
+ LITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.68.26 NAME 'entrustRoamingSLA' EQUALITY o
+ ctetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.114027.22.4 NAME 'entrustAttributeCertificate' 
+ EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.2.840.113533.7.79.1 NAME 'entrustRoamingId' SUP uid )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.1 NAME 'eduPersonAffiliation' DESC 
+ 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SUBSTR case
+ IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.2 NAME 'eduPersonNickname' DESC 'ed
+ uPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SUBSTR caseIgn
+ oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.3 NAME 'eduPersonOrgDN' DESC 'eduPe
+ rson per Internet2 and EDUCAUSE' EQUALITY distinguishedNameMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.4 NAME 'eduPersonOrgUnitDN' DESC 'e
+ duPerson per Internet2 and EDUCAUSE' EQUALITY distinguishedNameMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.5 NAME 'eduPersonPrimaryAffiliation
+ ' DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SUBS
+ TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.6 NAME 'eduPersonPrincipalName' DES
+ C 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SUBSTR ca
+ seIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.7 NAME 'eduPersonEntitlement' DESC 
+ 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseExactMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.8 NAME 'eduPersonPrimaryOrgUnitDN' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.9 NAME 'eduPersonScopedAffiliation'
+  DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.2.1.2 NAME 'eduOrgHomePageURI' DESC 'ed
+ uOrg per Internet2 and EDUCAUSE' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.2.1.3 NAME 'eduOrgIdentityAuthNPolicyUR
+ I' DESC 'eduOrg per Internet2 and EDUCAUSE' EQUALITY caseExactIA5Match SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.2.1.4 NAME 'eduOrgLegalName' DESC 'eduO
+ rg per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.2.1.5 NAME 'eduOrgSuperiorURI' DESC 'ed
+ uOrg per Internet2 and EDUCAUSE' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.2.1.6 NAME 'eduOrgWhitePagesURI' DESC '
+ eduOrg per Internet2 and EDUCAUSE' EQUALITY caseExactIA5Match SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.1 NAME 'schacMotherTongue' DESC 'RFC
+  3066 code for prefered language of communication' EQUALITY caseExactMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.2 NAME 'schacGender' DESC 'Represent
+ ation of human sex (see ISO 5218)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.3 NAME 'schacDateOfBirth' DESC 'Date
+  of birth (format YYYYMMDD, only numeric chars)' EQUALITY numericStringMatc
+ h ORDERING numericStringOrderingMatch SUBSTR numericStringSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.4 NAME 'schacPlaceOfBirth' DESC 'Bir
+ th place of a person' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingM
+ atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.5 NAME 'schacCountryOfCitizenship' D
+ ESC 'Country of citizenship of a person. Format two-letter acronym accordin
+ g to ISO 3166' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.6 NAME 'schacSn1' DESC 'First surnam
+ e of a person' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SU
+ BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.7 NAME 'schacSn2' DESC 'Second surna
+ me of a person' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.8 NAME 'schacPersonalTitle' DESC 'RF
+ C1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.9 NAME 'schacHomeOrganization' DESC 
+ 'Domain name of the home organization' EQUALITY caseIgnoreMatch SUBSTR case
+ IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.10 NAME 'schacHomeOrganizationType' 
+ DESC 'Type of the home organization' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.11 NAME 'schacCountryOfResidence' DE
+ SC 'Country of citizenship of a person. Format two-letter acronym according
+  to ISO 3166' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.12 NAME 'schacUserPresenceID' DESC '
+ Used to store a set of values related to the network presence' EQUALITY cas
+ eExactMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.13 NAME 'schacPersonalPosition' DESC
+  'Position inside an institution' EQUALITY caseIgnoreMatch SUBSTR caseIgnor
+ eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.14 NAME 'schacPersonalUniqueCode' DE
+ SC 'unique code for the subject' EQUALITY caseIgnoreMatch ORDERING caseIgno
+ reOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.15 NAME 'schacPersonalUniqueID' DESC
+  'Unique identifier for the subject' EQUALITY caseExactMatch ORDERING caseE
+ xactOrderingMatch SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.17 NAME 'schacExpiryDate' DESC 'Date
+  from which the set of data is to be considered invalid (format YYYYMMDDhhm
+ mssZ)' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.18 NAME 'schacUserPrivateAttribute' 
+ DESC 'Set of denied access attributes' EQUALITY caseIgnoreIA5Match SUBSTR c
+ aseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.19 NAME 'schacUserStatus' DESC 'Used
+  to store a set of status of a person as user of services' EQUALITY caseIgn
+ oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.20 NAME 'schacProjectMembership' DES
+ C 'Name of the project' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.2.21 NAME 'schacProjectSpecificRole' D
+ ESC 'Used to store a set of roles of a person inside a project' EQUALITY ca
+ seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.25178.1.0.2.3 NAME 'schacYearOfBirth' DESC 'Ye
+ ar of birth (format YYYY, only numeric chars)' EQUALITY numericStringMatch 
+ ORDERING numericStringOrderingMatch SUBSTR numericStringSubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.0.0 NAME 'dNSTTL' DESC 'An integer den
+ oting time to live' EQUALITY integerMatch ORDERING integerOrderingMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass' DESC 'The class of
+  a resource record' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.11 NAME 'wKSRecord' DESC 'a well kno
+ wn service description, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIg
+ noreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord' DESC 'domain nam
+ e pointer, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord' DESC 'host inf
+ ormation, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substri
+ ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord' DESC 'mailbox 
+ or mail list information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR case
+ IgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord' DESC 'text strin
+ g, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.17 NAME 'rPRecord' DESC 'for Respons
+ ible Person, RFC 1183' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.18 NAME 'aFSDBRecord' DESC 'for AFS 
+ Data Base location, RFC 1183' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnore
+ IA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord' DESC 'Signature,
+  RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord' DESC 'Key, RFC 2
+ 535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.27 NAME 'gPosRecord' DESC 'Geographi
+ cal Position, RFC 1712' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Sub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord' DESC 'IPv6 addr
+ ess, RFC 1886' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord' DESC 'Location, 
+ RFC 1876' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord' DESC 'non-exista
+ nt, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord' DESC 'service lo
+ cation, RFC 2782' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord' DESC 'Naming A
+ uthority Pointer, RFC 2915' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA
+ 5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord' DESC 'Key Exchang
+ e Delegation, RFC 2230' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Sub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord' DESC 'certifica
+ te, RFC 2538' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record' DESC 'A6 Record T
+ ype, RFC 2874' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'Non-Term
+ inal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUBSTR cas
+ eIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.42 NAME 'aPLRecord' DESC 'Lists of A
+ ddress Prefixes, RFC 3123' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.43 NAME 'dSRecord' DESC 'Delegation 
+ Signer, RFC 3658' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.44 NAME 'sSHFPRecord' DESC 'SSH Key 
+ Fingerprint, RFC 4255' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.45 NAME 'iPSecKeyRecord' DESC 'SSH K
+ ey Fingerprint, RFC 4025' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5S
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.46 NAME 'rRSIGRecord' DESC 'RRSIG, R
+ FC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.47 NAME 'nSECRecord' DESC 'NSEC, RFC
+  3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.48 NAME 'dNSKeyRecord' DESC 'DNSKEY,
+  RFC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.49 NAME 'dHCIDRecord' DESC 'DHCID, R
+ FC 4701' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.51 NAME 'nSec3ParamRecord' DESC 'par
+ ameters for NSEC3, RFC 5155' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreI
+ A5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.52 NAME 'TLSARecord' DESC 'DNS-Based
+  Authentication of Named Entities - Transport Layer Security Protocol, RFC 
+ 6698' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.99 NAME 'sPFRecord' DESC 'Sender Pol
+ icy Framework, RFC 4408' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.257 NAME 'CAARecord' DESC 'Certifica
+ tion Authority Authorization, RFC 6844' EQUALITY caseIgnoreIA5Match SUBSTR 
+ caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.20.1.32769 NAME 'DLVRecord' DESC 'RFC 443
+ 1: DNSSEC Lookaside Validation' EQUALITY caseIgnoreIA5Match SUBSTR caseIgno
+ reIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.28 NAME 'nisPublickey' DESC 'nisPublickey' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.29 NAME 'nisSecretkey' DESC 'nisSecretkey' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.1.1.30 NAME 'nisDomain' SUP name )
+attributeTypes: ( 2.16.840.1.113730.3.1.30 NAME 'mgrpRFC822MailMember' DESC 
+ 'mgrpRFC822MailMember' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.1.1.12 NAME 'nisNetIdUser' DESC 'nisNe
+ tIdUser' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.1.1.13 NAME 'nisNetIdGroup' DESC 'nisN
+ etIdGroup' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
+ )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.1.1.14 NAME 'nisNetIdHost' DESC 'nisNe
+ tIdHost' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.15 NAME 'SolarisLDAPServers' DESC 
+ 'SolarisLDAPServers' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.16 NAME 'SolarisSearchBaseDN' DESC
+  'SolarisSearchBaseDN' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.17 NAME 'SolarisCacheTTL' DESC 'So
+ larisCacheTTL' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 S
+ INGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.18 NAME 'SolarisBindDN' DESC 'Sola
+ risBindDN' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.19 NAME 'SolarisBindPassword' DESC
+  'SolarisBindPassword' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.20 NAME 'SolarisAuthMethod' DESC '
+ SolarisAuthMethod' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.21 NAME 'SolarisTransportSecurity'
+  DESC 'SolarisTransportSecurity' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.24 NAME 'SolarisDataSearchDN' DESC
+  'SolarisDataSearchDN' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.25 NAME 'SolarisSearchScope' DESC 
+ 'SolarisSearchScope' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.26 NAME 'SolarisSearchTimeLimit' D
+ ESC 'SolarisSearchTimeLimit' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.27 NAME 'SolarisPreferedServer' DE
+ SC 'SolarisPreferedServer' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.28 NAME 'SolarisPreferedServerOnly
+ ' DESC 'SolarisPreferedServerOnly' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.29 NAME 'SolarisSearchReferral' DE
+ SC 'SolarisSearchReferral' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.31 NAME 'homeFax' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.22 )
+attributeTypes: ( 2.16.128.113533.1.1400.1 NAME 'thumbnailPhoto' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.28 )
+attributeTypes: ( 2.16.128.113533.1.1400.2 NAME 'thumbnailLogo' SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.28 )
+attributeTypes: ( 1.3.6.1.4.1.1466.101.120.34 NAME 'middleName' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.1 NAME ( 'xmozillanickname' 'mozilla
+ Nickname' ) SUP name )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.2 NAME ( 'xmozillausehtmlmail' 'mozi
+ llaUseHtmlMail' ) SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.3 NAME 'mozillaSecondEmail' EQUALITY
+  caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.4 NAME 'mozillaHomeLocalityName' EQU
+ ALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15{128} )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.5 NAME 'mozillaPostalAddress2' EQUAL
+ ITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.41 )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.6 NAME 'mozillaHomePostalAddress2' E
+ QUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.41 )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.7 NAME 'mozillaHomeState' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.8 NAME 'mozillaHomePostalCode' EQUAL
+ ITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15{40} )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.9 NAME 'mozillaHomeCountryName' SUP 
+ name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.10 NAME 'mozillaHomeFriendlyCountryN
+ ame' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.11 NAME ( 'homeurl' 'mozillaHomeUrl'
+  ) EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.12 NAME ( 'workurl' 'mozillaWorkUrl'
+  ) EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.13 NAME 'nsAIMid' DESC 'AOL Instant 
+ Messenger (AIM) Identity' EQUALITY telephoneNumberMatch SUBSTR telephoneNum
+ berSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.96 NAME ( 'custom1' 'mozillaCustom1'
+  ) SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.97 NAME ( 'custom2' 'mozillaCustom2'
+  ) SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.98 NAME ( 'custom3' 'mozillaCustom3'
+  ) SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.13769.2.1.99 NAME ( 'custom4' 'mozillaCustom4'
+  ) SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanMa
+ nager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26{32} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 h
+ ash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26{32} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Accoun
+ t Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1
+ 6} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'Times
+ tamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 'Tim
+ estamp of when the user is allowed to update the password' EQUALITY integer
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC 'Ti
+ mestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Timest
+ amp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'Times
+ tamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC 'Time
+ stamp of when the user will be logged off automatically' EQUALITY integerMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' DESC 
+ 'Bad password attempt count' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' DESC '
+ Time of the last bad password attempt' EQUALITY integerMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC 'Logon
+  Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42
+ } SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver
+  letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logo
+ n script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5{255} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roam
+ ing profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15{255} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 
+ 'List of user workstations the user is allowed to logon to' EQUALITY caseIg
+ noreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home di
+ rectory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15{128} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windo
+ ws NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.15{128} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC 'Base6
+ 4 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15{1050} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' DESC '
+ Concatenated MD5 hashes of the salted NT passwords used on this account' EQ
+ UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID'
+  EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC '
+ Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26{64} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Security
+  ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 64} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'NT Gro
+ up Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 'Next
+  NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC 'Nex
+ t NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Next NT 
+ rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' DES
+ C 'Base at which the samba RID generation algorithm should operate' EQUALIT
+ Y integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' DESC 'Share 
+ Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC 'Optio
+ n Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' DESC 'A boo
+ lean option' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' DESC 'An
+  integer option' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' DESC 'A s
+ tring option' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption' DESC 
+ 'A string list option' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' DESC 'Trust
+  Password Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' DESC 'Min
+ imal password length (default: 5)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength' DESC 
+ 'Length of Password History Entries (default: 0 => off)' EQUALITY integerMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' DESC 'Fo
+ rce Users to logon for password change (default: 0 => off, 2 => on)' EQUALI
+ TY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' DESC 'Maximu
+ m password age, in seconds (default: -1 => never expire passwords)' EQUALIT
+ Y integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' DESC 'Minimu
+ m password age, in seconds (default: 0 => allow immediate password change)'
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' DESC '
+ Lockout duration in minutes (default: 30, -1 => forever)' EQUALITY integerM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservationWindo
+ w' DESC 'Reset time after lockout in minutes (default: 30)' EQUALITY intege
+ rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold' DESC 
+ 'Lockout users after bad logon attempts (default: 0 => off)' EQUALITY integ
+ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' DESC 'Disc
+ onnect Users outside logon hours (default: -1 => off, 0 => on)' EQUALITY in
+ tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdChange'
+  DESC 'Allow Machine Password changes (default: 0 => off)' EQUALITY integer
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.68 NAME 'sambaClearTextPassword' DESC
+  'Clear text password (used for trusted domain passwords)' EQUALITY octetSt
+ ringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.69 NAME 'sambaPreviousClearTextPasswo
+ rd' DESC 'Previous clear text password (used for trusted domain passwords)'
+  EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.70 NAME 'sambaTrustType' DESC 'Type o
+ f trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.71 NAME 'sambaTrustAttributes' DESC '
+ Trust attributes for a trusted domain' EQUALITY integerMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.72 NAME 'sambaTrustDirection' DESC 'D
+ irection of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC 'Ful
+ ly qualified name of the domain with which a trust exists' EQUALITY caseIgn
+ oreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'NetBIOS
+  name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15{128} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' DESC
+  'Authentication information for the outgoing portion of a trust' EQUALITY 
+ caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' DESC
+  'Authentication information for the incoming portion of a trust' EQUALITY 
+ caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' DES
+ C 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' D
+ ESC 'Forest trust information for a trusted domain object' EQUALITY caseExa
+ ctMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.79 NAME 'sambaTrustPosixOffset' DESC 
+ 'POSIX offset of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7165.2.1.80 NAME 'sambaSupportedEncryptionType
+ s' DESC 'Supported encryption types of a trust' EQUALITY integerMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.1 NAME 'krb5PrincipalName' DESC 'The
+  unparsed Kerberos principal name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.2 NAME 'krb5KeyVersionNumber' EQUALI
+ TY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.3 NAME 'krb5MaxLife' EQUALITY intege
+ rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.4 NAME 'krb5MaxRenew' EQUALITY integ
+ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.5 NAME 'krb5KDCFlags' EQUALITY integ
+ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.6 NAME 'krb5EncryptionType' EQUALITY
+  integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.7 NAME 'krb5ValidStart' EQUALITY gen
+ eralizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.8 NAME 'krb5ValidEnd' EQUALITY gener
+ alizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.9 NAME 'krb5PasswordEnd' EQUALITY ge
+ neralizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.10 NAME 'krb5Key' DESC 'Encoded ASN1
+  Key as an octet string' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.11 NAME 'krb5PrincipalRealm' DESC 'D
+ istinguished name of krb5Realm entry' SUP distinguishedName )
+attributeTypes: ( 1.3.6.1.4.1.5322.10.1.12 NAME 'krb5RealmName' EQUALITY oct
+ etStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.1.1 NAME 'krbPrincipalName' EQUA
+ LITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.1 NAME 'krbCanonicalName' EQUALITY 
+ caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.3.1 NAME 'krbPrincipalType' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.5.1 NAME 'krbUPEnabled' DESC 'Bo
+ olean' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.6.1 NAME 'krbPrincipalExpiration
+ ' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE
+ -VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.8.1 NAME 'krbTicketFlags' EQUALI
+ TY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.9.1 NAME 'krbMaxTicketLife' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.10.1 NAME 'krbMaxRenewableAge' E
+ QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.14.1 NAME 'krbRealmReferences' E
+ QUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.15.1 NAME 'krbLdapServers' EQUAL
+ ITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.17.1 NAME 'krbKdcServers' EQUALI
+ TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.18.1 NAME 'krbPwdServers' EQUALI
+ TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.24.1 NAME 'krbHostServer' EQUALI
+ TY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.25.1 NAME 'krbSearchScope' EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.26.1 NAME 'krbPrincipalReference
+ s' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.28.1 NAME 'krbPrincNamingAttr' E
+ QUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.29.1 NAME 'krbAdmServers' EQUALI
+ TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.30.1 NAME 'krbMaxPwdLife' EQUALI
+ TY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.31.1 NAME 'krbMinPwdLife' EQUALI
+ TY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.32.1 NAME 'krbPwdMinDiffChars' E
+ QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.33.1 NAME 'krbPwdMinLength' EQUA
+ LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.34.1 NAME 'krbPwdHistoryLength' 
+ EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.1 NAME 'krbPwdMaxFailure' EQUALITY i
+ ntegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.2 NAME 'krbPwdFailureCountInterval' 
+ EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.3 NAME 'krbPwdLockoutDuration' EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.2 NAME 'krbPwdAttributes' EQUALITY 
+ integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.3 NAME 'krbPwdMaxLife' EQUALITY int
+ egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.4 NAME 'krbPwdMaxRenewableLife' EQU
+ ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113554.1.4.1.6.5 NAME 'krbPwdAllowedKeysalts' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.36.1 NAME 'krbPwdPolicyReference
+ ' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING
+ LE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.37.1 NAME 'krbPasswordExpiration
+ ' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE
+ -VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.39.1 NAME 'krbPrincipalKey' EQUA
+ LITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.40.1 NAME 'krbTicketPolicyRefere
+ nce' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 S
+ INGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.41.1 NAME 'krbSubTrees' EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.42.1 NAME 'krbDefaultEncSaltType
+ s' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.43.1 NAME 'krbSupportedEncSaltTy
+ pes' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.44.1 NAME 'krbPwdHistory' EQUALI
+ TY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.45.1 NAME 'krbLastPwdChange' EQU
+ ALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALU
+ E )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.5 NAME 'krbLastAdminUnlock' EQUALITY
+  generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.46.1 NAME 'krbMKey' EQUALITY oct
+ etStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.47.1 NAME 'krbPrincipalAliases' 
+ EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.48.1 NAME 'krbLastSuccessfulAuth
+ ' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE
+ -VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.49.1 NAME 'krbLastFailedAuth' EQ
+ UALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VAL
+ UE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.50.1 NAME 'krbLoginFailedCount' 
+ EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.51.1 NAME 'krbExtraData' EQUALIT
+ Y octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.52.1 NAME 'krbObjectReferences' 
+ EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.301.4.53.1 NAME 'krbPrincContainerRef'
+  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113730.3.8.15.2.1 NAME 'krbPrincipalAuthInd' EQ
+ UALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5322.21.2.4 NAME 'krbAllowedToDelegateTo' EQUA
+ LITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.1 NAME ( 'esgSid' 'esgStreamId' ) 
+ DESC 'String uniquely identifying each stream' EQUALITY caseExactMatch SUBS
+ TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA
+ LUE )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.2 NAME ( 'esgSN' 'esgSessionName' 
+ ) DESC 'Session name/title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.3 NAME ( 'esgInfo' 'esgInformation
+ ' ) DESC 'Short description' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.4 NAME 'esgInfoUri' DESC 'URI to m
+ ore Information' SUP labeledURI )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.4.1 NAME 'esgContact' DESC 'Other co
+ ntact Information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.4.2 NAME 'esgContactMail' DESC 'Emai
+ l-address to contact-person' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreI
+ A5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.4.3 NAME 'esgContactPhone' DESC 'Pho
+ ne number to contact-person' EQUALITY telephoneNumberMatch SUBSTR telephone
+ NumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.4.4 NAME 'esgContactDN' DESC 'LDAP D
+ N to contact-person' SUP distinguishedName )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.6 NAME ( 'esgCategory' 'esgCat' ) 
+ DESC 'Meta-category: meeting, broadcast, test etc.' EQUALITY caseIgnoreMatc
+ h SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64}
+  )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.7 NAME 'esgTool' DESC 'Tool that m
+ ade the announcement (SDP: a=tool:...)' EQUALITY caseIgnoreMatch SUBSTR cas
+ eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.8 NAME 'esgSource' DESC 'How the a
+ nnouncement entered the system' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.3.1 NAME 'esgFormat' DESC 'Media for
+ mat' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.3.10 NAME 'esgStreamUri' DESC 'Direc
+ t absolute url to stream' SUP labeledURI )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.3.11 NAME 'esgSdpUri' DESC 'Url to f
+ ile in sdp-format, if any' SUP labeledURI )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.1 NAME 'esgAlwaysOn' DESC 'Whether
+  the stream is permanent/on-demand or temporary/live' EQUALITY booleanMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.2 NAME 'esgFirstShown' DESC 'When 
+ the stream starts to be transmitted for the first time' EQUALITY generalize
+ dTimeMatch ORDERING generalizedTimeOrderingMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.3 NAME 'esgFinalEnd' DESC 'When th
+ e stream will no longer be transmitted' EQUALITY generalizedTimeMatch ORDER
+ ING generalizedTimeOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.24 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.4 NAME 'esgDuration' DESC 'Duratio
+ n of stream if temporary' EQUALITY numericStringMatch SUBSTR numericStringS
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.5 NAME 'esgRepeatInterval' DESC 'F
+ rom SDP: r=repeatinterval duration offset [offset [offset ...]]' EQUALITY n
+ umericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.36 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.6 NAME 'esgIntervalOffset' DESC 'F
+ rom SDP: r=repeatinterval duration offset [offset [offset ...]]' EQUALITY n
+ umericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.36 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.2.8 NAME 'esgTotalDuration' DESC 'Le
+ ngth if on-demand stream, else: finalend - firsthown' EQUALITY numericStrin
+ gMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.36 )
+attributeTypes: ( 1.3.6.1.4.1.2428.70.1.1.255 NAME 'esgSdp' DESC 'File in sd
+ p-format, if any' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.1 NAME 'dhcpPrimaryDN' DESC 'The
+  DN of the dhcpServer which is the primary server for the configuration.' E
+ QUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-
+ VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.2 NAME 'dhcpSecondaryDN' DESC 'T
+ he DN of dhcpServer(s) which provide backup service for the configuration.'
+  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.3 NAME 'dhcpStatements' DESC 'Fl
+ exible storage for specific data depending on what object this exists in. L
+ ike conditional statements, server parameters, etc. This allows the standar
+ d to evolve without needing to adjust the schema.' EQUALITY caseIgnoreIA5Ma
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.4 NAME 'dhcpRange' DESC 'The sta
+ rting & ending IP Addresses in the range (inclusive), separated by a hyphen
+ ; if the range only contains one address, then just the address can be spec
+ ified with no hyphen.  Each range is defined as a separate value.' EQUALITY
+  caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.5 NAME 'dhcpPermitList' DESC 'Th
+ is attribute contains the permit lists associated with a pool. Each permit 
+ list is defined as a separate value.' EQUALITY caseIgnoreIA5Match SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.6 NAME 'dhcpNetMask' DESC 'The s
+ ubnet mask length for the subnet.  The mask can be easily computed from thi
+ s length.' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
+ E-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.7 NAME 'dhcpOption' DESC 'Encode
+ d option values to be sent to clients.  Each value represents a single opti
+ on and contains (OptionTag, Length, OptionValue) encoded in the format used
+  by DHCP.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+  )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.8 NAME 'dhcpClassData' DESC 'Enc
+ oded text string or list of bytes expressed in hexadecimal, separated by co
+ lons.  Clients match subclasses based on matching the class data with the r
+ esults of match or spawn with statements in the class name declarations.' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALU
+ E )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.9 NAME 'dhcpOptionsDN' DESC 'The
+  distinguished name(s) of the dhcpOption objects containing the configurati
+ on options provided by the server.' EQUALITY distinguishedNameMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.10 NAME 'dhcpHostDN' DESC 'the d
+ istinguished name(s) of the dhcpHost objects.' EQUALITY distinguishedNameMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.11 NAME 'dhcpPoolDN' DESC 'The d
+ istinguished name(s) of pools.' EQUALITY distinguishedNameMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.12 NAME 'dhcpGroupDN' DESC 'The 
+ distinguished name(s)   of the groups.' EQUALITY distinguishedNameMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.13 NAME 'dhcpSubnetDN' DESC 'The
+  distinguished name(s) of the subnets.' EQUALITY distinguishedNameMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.14 NAME 'dhcpLeaseDN' DESC 'The 
+ distinguished name of a client address.' EQUALITY distinguishedNameMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.15 NAME 'dhcpLeasesDN' DESC 'The
+  distinguished name(s) client addresses.' EQUALITY distinguishedNameMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.16 NAME 'dhcpClassesDN' DESC 'Th
+ e distinguished name(s) of a class(es) in a subclass.' EQUALITY distinguish
+ edNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.17 NAME 'dhcpSubclassesDN' DESC 
+ 'The distinguished name(s) of subclass(es).' EQUALITY distinguishedNameMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.18 NAME 'dhcpSharedNetworkDN' DE
+ SC 'The distinguished name(s) of sharedNetworks.' EQUALITY distinguishedNam
+ eMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.19 NAME 'dhcpServiceDN' DESC 'Th
+ e DN of dhcpService object(s)which contain the configuration information. E
+ ach dhcpServer object has this attribute identifying the DHCP configuration
+ (s) that the server is associated with.' EQUALITY distinguishedNameMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.20 NAME 'dhcpVersion' DESC 'The 
+ version attribute of this object.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.21 NAME 'dhcpImplementation' DES
+ C 'Description of the DHCP Server implementation e.g. DHCP Servers vendor.'
+  EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA
+ LUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.22 NAME 'dhcpAddressState' DESC 
+ 'This stores information about the current binding-status of an address.  F
+ or dynamic addresses managed by DHCP, the values should be restricted to th
+ e following: "FREE", "ACTIVE", "EXPIRED", "RELEASED", "RESET", "ABANDONED",
+  "BACKUP".  For other addresses, it SHOULD be one of the following: "UNKNOW
+ N", "RESERVED" (an address that is managed by DHCP that is reserved for a s
+ pecific client), "RESERVED-ACTIVE" (same as reserved, but address is curren
+ tly in use), "ASSIGNED" (assigned manually or by some other mechanism), "UN
+ ASSIGNED", "NOTASSIGNABLE".' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.23 NAME 'dhcpExpirationTime' DES
+ C 'This is the time the current lease for an address expires.' EQUALITY gen
+ eralizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.24 NAME 'dhcpStartTimeOfState' D
+ ESC 'This is the time of the last state change for a leased address.' EQUAL
+ ITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE 
+ )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.25 NAME 'dhcpLastTransactionTime
+ ' DESC 'This is the last time a valid DHCP packet was received from the cli
+ ent.' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SI
+ NGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.26 NAME 'dhcpBootpFlag' DESC 'Th
+ is indicates whether the address was assigned via BOOTP.' EQUALITY booleanM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.27 NAME 'dhcpDomainName' DESC 'T
+ his is the name of the domain sent to the client by the server.  It is esse
+ ntially the same as the value for DHCP option 15 sent to the client, and re
+ presents only the domain - not the full FQDN.  To obtain the full FQDN assi
+ gned to the client you must prepend the "dhcpAssignedHostName" to this valu
+ e with a ".".' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.28 NAME 'dhcpDnsStatus' DESC 'Th
+ is indicates the status of updating DNS resource records on behalf of the c
+ lient by the DHCP server for this address.  The value is a 16-bit bitmask.'
+  EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.29 NAME 'dhcpRequestedHostName' 
+ DESC 'This is the hostname that was requested by the client.' EQUALITY case
+ IgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.30 NAME 'dhcpAssignedHostName' D
+ ESC 'This is the actual hostname that was assigned to a client. It may not 
+ be the name that was requested by the client.  The fully qualified domain n
+ ame can be determined by appending the value of "dhcpDomainName" (with a do
+ t separator) to this name.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.31 NAME 'dhcpReservedForClient' 
+ DESC 'The distinguished name of a "dhcpClient" that an address is reserved 
+ for.  This may not be the same as the "dhcpAssignedToClient" attribute if t
+ he address is being reassigned but the current lease has not yet expired.' 
+ EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE
+ -VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.32 NAME 'dhcpAssignedToClient' D
+ ESC 'This is the distinguished name of a "dhcpClient" that an address is cu
+ rrently assigned to.  This attribute is only present in the class when the 
+ address is leased.' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.33 NAME 'dhcpRelayAgentInfo' DES
+ C 'If the client request was received via a relay agent, this contains info
+ rmation about the relay agent that was available from the DHCP request.  Th
+ is is a hex-encoded option value.' EQUALITY octetStringMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.34 NAME 'dhcpHWAddress' DESC 'Th
+ e clients hardware address that requested this IP address.' EQUALITY caseIg
+ noreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.35 NAME 'dhcpHashBucketAssignmen
+ t' DESC 'HashBucketAssignment bit map for the DHCP Server, as defined in DH
+ C Load Balancing Algorithm [RFC 3074].' EQUALITY octetStringMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.36 NAME 'dhcpDelayedServiceParam
+ eter' DESC 'Delay in seconds corresponding to Delayed Service Parameter con
+ figuration, as defined in  DHC Load Balancing Algorithm [RFC 3074]. ' EQUAL
+ ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.37 NAME 'dhcpMaxClientLeadTime' 
+ DESC 'Maximum Client Lead Time configuration in seconds, as defined in DHCP
+  Failover Protocol [FAILOVR]' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.38 NAME 'dhcpFailOverEndpointSta
+ te' DESC 'Server (Failover Endpoint) state, as defined in DHCP Failover Pro
+ tocol [FAILOVR]' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.39 NAME 'dhcpErrorLog' DESC 'Gen
+ eric error log attribute that allows logging error conditions within a dhcp
+ Service or a dhcpSubnet, like no IP addresses available for lease.' EQUALIT
+ Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.40 NAME 'dhcpLocatorDN' DESC 'Th
+ e DN of dhcpLocator object which contain the DNs of all DHCP configuration 
+ objects. There will be a single dhcpLocator object in the tree with links t
+ o all the DHCP objects in the tree' EQUALITY distinguishedNameMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.41 NAME 'dhcpKeyAlgorithm' DESC 
+ 'Algorithm to generate TSIG Key' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.42 NAME 'dhcpKeySecret' DESC 'Se
+ cret to generate TSIG Key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.43 NAME 'dhcpDnsZoneServer' DESC
+  'Master server of the DNS Zone' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.44 NAME 'dhcpKeyDN' DESC 'The DN
+ s of TSIG Key to use in secure dynamic updates. In case of locator object, 
+ this will be list of TSIG keys.  In case of DHCP Service, Shared Network, S
+ ubnet and DNS Zone, it will be a single key.' EQUALITY distinguishedNameMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.45 NAME 'dhcpZoneDN' DESC 'The D
+ Ns of DNS Zone. In case of locator object, this will be list of DNS Zones i
+ n the tree. In case of DHCP Service, Shared Network and Subnet, it will be 
+ a single DNS Zone.' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.46 NAME 'dhcpFailOverPrimaryServ
+ er' DESC 'IP address or DNS name of the server playing primary role in DHC 
+ Load Balancing and Fail over.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.47 NAME 'dhcpFailOverSecondarySe
+ rver' DESC 'IP address or DNS name of the server playing secondary role in 
+ DHC Load Balancing and Fail over.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.48 NAME 'dhcpFailOverPrimaryPort
+ ' DESC 'Port on which primary server listens for connections from its fail 
+ over peer (secondary server)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.49 NAME 'dhcpFailOverSecondaryPo
+ rt' DESC 'Port on which secondary server listens for connections from its f
+ ail over peer (primary server)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.50 NAME 'dhcpFailOverResponseDel
+ ay' DESC 'Maximum response time in seconds, before Server assumes that conn
+ ection to fail over peer has failed' EQUALITY integerMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.27 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.51 NAME 'dhcpFailOverUnackedUpda
+ tes' DESC 'Number of BNDUPD messages that server can send before it receive
+ s BNDACK from its fail over peer' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.52 NAME 'dhcpFailOverSplit' DESC
+  'Split between the primary and secondary servers for fail over purpose' EQ
+ UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.53 NAME 'dhcpFailOverLoadBalance
+ Time' DESC 'Cutoff time in seconds, after which load balance is disabled' E
+ QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.54 NAME 'dhcpFailOverPeerDN' DES
+ C 'The DNs of Fail over peers. In case of locator object, this will be list
+  of fail over peers in the tree. In case of Subnet and pool, it will be a s
+ ingle Fail Over Peer' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.55 NAME 'dhcpServerDN' DESC 'Lis
+ t of all  DHCP Servers in the tree. Used by dhcpLocatorObject' EQUALITY dis
+ tinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 2.16.840.1.113719.1.203.4.56 NAME 'dhcpComments' DESC 'Gen
+ eric attribute that allows coments  within any DHCP object' EQUALITY caseIg
+ noreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.10 NAME 'dlzZoneName' DESC 'DNS zone
+  name - domain name not including host name' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.20 NAME 'dlzHostName' DESC 'Host por
+ tion of a domain name' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.30 NAME 'dlzData' DESC 'Data for the
+  resource record' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.40 NAME 'dlzType' DESC 'DNS record t
+ ype - A, SOA, NS, MX, etc...' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.50 NAME 'dlzSerial' DESC 'SOA record
+  serial number' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.60 NAME 'dlzRefresh' DESC 'SOA recor
+ d refresh time in seconds' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.70 NAME 'dlzRetry' DESC 'SOA retry t
+ ime in seconds' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.80 NAME 'dlzExpire' DESC 'SOA expire
+  time in seconds' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.90 NAME 'dlzMinimum' DESC 'SOA minim
+ um time in seconds' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.100 NAME 'dlzAdminEmail' DESC 'E-mai
+ l address of person responsible for this zone - @ should be replaced with .
+  (period)' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.110 NAME 'dlzPrimaryNS' DESC 'Primar
+ y name server for this zone - should be host name not IP address' SUP name 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.120 NAME 'dlzIPAddr' DESC 'IP addres
+ s - IPV4 should be in dot notation xxx.xxx.xxx.xxx IPV6 should be in colon 
+ notation xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx' EQUALITY caseExactIA5Matc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{40} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.130 NAME 'dlzCName' DESC 'DNS cname'
+  SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.140 NAME 'dlzPreference' DESC 'DNS M
+ X record preference.  Lower numbers have higher preference' EQUALITY intege
+ rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.150 NAME 'dlzTTL' DESC 'DNS time to 
+ live - how long this record can be cached by caching DNS servers' EQUALITY 
+ integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.18420.1.1.160 NAME 'dlzRecordID' DESC 'Unique 
+ ID for each DLZ resource record' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount M
+ ap Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key v
+ alue' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Automou
+ nt information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.37 NAME 'x509CRLThisUpdate' DESC '
+ Date at which this revocation list was issued - see RFC3280 5.1.2.4' EQUALI
+ TY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.38 NAME 'x509CRLNextUpdate' DESC '
+ Date by which the next revocation list in this series 	will be issued, see 
+ - RFC3280 5.1.2.5' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr
+ deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.102 NAME 'x509CRLNumber' DESC 'seq
+ uence number of issued CRL - see RFC3280 5.2.3' EQUALITY integerMatch ORDER
+ ING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE 
+ )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.48 NAME 'x509CRLDPRfc822Name' DESC
+  'Internet electronic mail address of the issuing   	distribution point, se
+ e RFC3280 5.2.5' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.49 NAME 'x509CRLDPDnsName' DESC 'I
+ nternet domain name of the issuing distribution point, see 	RFC3280 5.2.5' 
+ EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.50 NAME 'x509CRLDPDN' DESC 'Distin
+ guished name of the issuing distribution point, see 	RFC3280 5.2.5' EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.51 NAME 'x509CRLDPURI' DESC 'Unifo
+ rm Resource Identifier of the issuing distribution  	point, see RFC3280 5.2
+ .5' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.52 NAME 'x509CRLDPIpAddress' DESC 
+ 'Internet Protocol address, of the issuing distribution point, see 	RFC3280
+  5.2.5' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.53 NAME 'x509CRLDPRegisteredID' DE
+ SC 'Any registered OID of the certificate issuer, see 	RFC3280 5.2.5' EQUAL
+ ITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.54 NAME 'x509CRLDPOnlyUserCerts' D
+ ESC 'If true, the CRL only contains revocations for end-entity certs, see 	
+ RFC3280 5.2.5' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.55 NAME 'x509CRLDPOnlyCACerts' DES
+ C 'If true, the CRL only contains revocations for CA certs, see 	RFC3280 5.
+ 2.5' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.56 NAME 'x509CRLDPOnlySomeReasons'
+  DESC 'If true, the CRL only contains some revocation reason codes, see 	RF
+ C3280 5.2.5' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.57 NAME 'x509CRLDPOnlyAttCerts' DE
+ SC 'If true, the CRL only contains revocations for attribute certs, see 	RF
+ C3280 5.2.5' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.58 NAME 'x509CRLDPindirect' DESC '
+ If true, the CRL is an indirect CRL, see 	RFC3280 5.2.5' EQUALITY booleanMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.59 NAME 'x509CRLDeltaIndicator' DE
+ SC 'Indicates this is a delta CRL, and the value points to the 	sequence nu
+ mber of the issued base CRL to which this is a delta  	- see RFC3280 5.2.4'
+  EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.27 SINGLE-VALUE )
+attributeTypes:: KCAxLjIuODI2LjAuMS4zMzQ0ODEwLjEuMS4zOSBOQU1FICd4NTA5Q1JMQ2V
+ ydFJldm9jYXRpb25EYXRlJyBERVNDICdEYXRlL3RpbWUgdGhlIENBIGFjdHVhbGx5IHJldm9rZW
+ QgdGhlIGNlcnRpZmljYXRlLCBzZWUg4oCTICAJUkZDMzI4MCA1LjEuMi42JyBFUVVBTElUWSBnZ
+ W5lcmFsaXplZFRpbWVNYXRjaCBPUkRFUklORyBnZW5lcmFsaXplZFRpbWVPcmRlcmluZ01hdGNo
+ IFNZTlRBWCAxLjMuNi4xLjQuMS4xNDY2LjExNS4xMjEuMS4yNCBTSU5HTEUtVkFMVUUgKQ==
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.40 NAME 'x509CRLCertInvalidityDate
+ ' DESC 'date at which it is known or suspected that the private 	key was co
+ mpromised, see RFC3280 5.3.3' EQUALITY generalizedTimeMatch ORDERING genera
+ lizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.41 NAME 'x509CRLCertIssuerRfc822Na
+ me' DESC 'Internet electronic mail address of the certificate issuer, see 	
+ RFC3280 5.3.4' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.42 NAME 'x509CRLCertIssuerDnsName'
+  DESC 'Internet domain name of the certificate issuer, see 	RFC3280 5.3.4' 
+ EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.43 NAME 'x509CRLCertIssuerDN' DESC
+  'Distinguished name of the certificate issuer, see 	RFC3280 5.3.4' EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.44 NAME 'x509CRLCertIssuerURI' DES
+ C 'Uniform Resource Identifier of the certificate issuer, see 	RFC3280 5.3.
+ 4' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.45 NAME 'x509CRLCertIssuerIpAddres
+ s' DESC 'Internet Protocol address, of the certificate issuer, see 	RFC3280
+  5.3.4' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.46 NAME 'x509CRLCertIssuerRegister
+ edID' DESC 'Any registered OID of the certificate issuer, see 	RFC3280 5.3.
+ 4' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.47 NAME 'x509CRLCertReasonCode' DE
+ SC 'An integer code indicating the reason for the revocation, see 	RFC3280 
+ 5.3.1' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.27 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.103 NAME 'x509CRLCertHoldInstructi
+ onCode' DESC 'Any registered OID indicating a hold instruction, see 	RFC328
+ 0 5.3.2' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3
+ 8 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.1 NAME 'x509version' DESC 'X.509 V
+ ersion of the certificate, or of the CRL' EQUALITY integerMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.2 NAME 'x509serialNumber' DESC 'Un
+ ique integer for each certificate issued by a 	particular CA' EQUALITY inte
+ gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.3 NAME 'x509signatureAlgorithm' DE
+ SC 'OID of the algorithm used by the CA in 	signing the CRL or the certific
+ ate' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SI
+ NGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.4 NAME 'x509issuer' DESC 'Distingu
+ ished name of the entity who has signed and 	issued the certificate' EQUALI
+ TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.5 NAME 'x509validityNotBefore' DES
+ C 'Date on which the certificate validity period begins' EQUALITY generaliz
+ edTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.6 NAME 'x509validityNotAfter' DESC
+  'Date on which the certificate validity period ends' EQUALITY generalizedT
+ imeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.7 NAME 'x509subject' DESC 'Disting
+ uished name of the entity associated with this 	public-key' EQUALITY distin
+ guishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.8 NAME 'x509subjectPublicKeyInfoAl
+ gorithm' DESC 'OID identifying the algorithm associated with the certified 
+ 	public key' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.38 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.11 NAME 'x509authorityKeyIdentifie
+ r' DESC 'Key Identifier field of the Authority Key Identifier 	extension' E
+ QUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.12 NAME 'x509authorityCertIssuer' 
+ DESC 'Authority Cert Issuer field of the Authority Key Identifier 	extensio
+ n' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.13 NAME 'x509authorityCertSerialNu
+ mber' DESC 'Authority Cert Serial Number field of the 	Authority Key Identi
+ fier extension' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.14 NAME 'x509subjectKeyIdentifier'
+  DESC 'Key identifier which must be unique with respect to all 	key identif
+ iers for the subject' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.15 NAME 'x509keyUsage' DESC 'Purpo
+ se for which the certified public key is used' EQUALITY caseIgnoreMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.16 NAME 'x509policyInformationIden
+ tifier' DESC 'OID which indicates the policy under which the 	certificate h
+ as been issued and the purposes for which 	the certificate may be used' EQU
+ ALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VAL
+ UE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.17 NAME 'x509subjectRfc822Name' DE
+ SC 'Internet electronic mail address of the entity 	associated with this pu
+ blic-key' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.18 NAME 'x509subjectDnsName' DESC 
+ 'Internet domain name of the entity 	associated with this public-key' EQUAL
+ ITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.19 NAME 'x509subjectDirectoryName'
+  DESC 'Distinguished name of the entity 	associated with this public-key' E
+ QUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.20 NAME 'x509subjectUniformResourc
+ eIdentifier' DESC 'Uniform Resource Identifier for the World-Wide Web 	of t
+ he entity associated with this public-key' EQUALITY caseExactIA5Match SUBST
+ R caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.21 NAME 'x509subjectIpAddress' DES
+ C 'Internet Protocol address of the entity 	associated with this public-key
+ ' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.22 NAME 'x509subjectRegisteredID' 
+ DESC 'OID of any registered object identifying the entity 	associated with 
+ this public-key' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.38 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.23 NAME 'x509issuerRfc822Name' DES
+ C 'Internet electronic mail address of the entity who has 	signed and issue
+ d the certificate' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.24 NAME 'x509issuerDnsName' DESC '
+ Internet domain name of the entity who has 	signed and issued the certifica
+ te' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.25 NAME 'x509issuerDirectoryName' 
+ DESC 'Distinguished name of the entity who has 	signed and issued the certi
+ ficate' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 2 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.26 NAME 'x509issuerUniformResource
+ Identifier' DESC 'Uniform Resource Identifier for the World-Wide Web 	of th
+ e entity who has signed and issued the certificate' EQUALITY caseExactIA5Ma
+ tch SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+  )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.27 NAME 'x509issuerIpAddress' DESC
+  'Internet Protocol address of the entity who has 	signed and issued the ce
+ rtificate' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.28 NAME 'x509issuerRegisteredID' D
+ ESC 'OID of any registered object identifying the entity who has 	signed an
+ d issued the certificate' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.38 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.29 NAME 'x509basicConstraintsCa' D
+ ESC 'Identifies whether the subject of the certificate is a 	CA' EQUALITY b
+ ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.30 NAME 'x509extKeyUsage' DESC 'Pu
+ rposes for which the certified public key may be used, 	identified by an OI
+ D' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.3.32 NAME 'x509fullCRLDistributionPo
+ intURI' DESC 'URI type of DistributionPointName for the full CRL' EQUALITY 
+ caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.4.74 NAME 'x509certLocation' DESC 'P
+ ointer to a x509certificate Entry' EQUALITY distinguishedNameMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.4.75 NAME 'x509certHolder' DESC 'Poi
+ nter to the directory entry of the end entity to which this 	certificate wa
+ s issued' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .12 )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.4.76 NAME 'x509userCert' DESC 'Compl
+ ete x.509 user certificate' SUP userCertificate SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.1.5.4.77 NAME 'x509caCert' DESC 'Complet
+ e x.509 CA certificate' SUP caCertificate SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.60 NAME 'x509issuerSerial' DESC 'U
+ sed to hold the RDN of a certificate entry, formed by 	concatenating the AC
+  serial number and issuer fields ' EQUALITY distinguishedNameMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.61 NAME 'x509ACHolderPKCSerialNumb
+ er' DESC 'The serial number of the PKC of the AC holder 	- see RFC3281 4.2.
+ 2' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.62 NAME 'x509ACHolderPKCissuerDN' 
+ DESC 'Distinguished name of the issuer of the PKC belonging to the 	AC hold
+ er - see  RFC3281 4.2.2' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.63 NAME 'x509ACHolderRfc822Name' D
+ ESC 'Internet electronic mail address of the AC holder  	- see RFC3281 4.2.
+ 2' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.64 NAME 'x509ACHolderDNSName' DESC
+  'Internet domain name of the AC Holder, see 	RFC3281 4.2.2' EQUALITY caseI
+ gnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.65 NAME 'x509ACHolderDN' DESC 'Dis
+ tinguished name of the AC Holder, see 	RFC3281 4.2.2' EQUALITY distinguishe
+ dNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.66 NAME 'x509ACHolderURI' DESC 'Un
+ iform Resource Identifier of the AC Holder  	- see RFC3281 4.2.2' EQUALITY 
+ caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.67 NAME 'x509ACHolderIPAddress' DE
+ SC 'Internet Protocol address of the AC Holder, see 	RFC3281 4.2.2' EQUALIT
+ Y caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.68 NAME 'x509ACHolderRegisteredID'
+  DESC 'Any registered OID of the AC holder, see 	RFC3281 4.2.2' EQUALITY ob
+ jectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes:: KCAxLjIuODI2LjAuMS4zMzQ0ODEwLjEuMS42OSBOQU1FICd4NTA5QUNPYmp
+ lY3REaWdlc3QnIERFU0MgJ0hvbGRzIHRoZSBoYXNoIHZhbHVlIG9mIHRoZSBvYmplY3QgaWRlbn
+ RpZmllZCBieSAJeDUwOUFDRGlnZXN0ZWRPYmplY3RUeXBlIOKAkyBzZWUgUkZDIDMyODEsIHNlY
+ 3Rpb24gNy4zJyBFUVVBTElUWSBiaXRTdHJpbmdNYXRjaCBTWU5UQVggMS4zLjYuMS40LjEuMTQ2
+ Ni4xMTUuMTIxLjEuNiBTSU5HTEUtVkFMVUUgKQ==
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.70 NAME 'x509ACDigestAlgorithm' DE
+ SC 'OID of the hashing algorithm used to create the 	Object digest, see RFC
+ 3281, section 7.3' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.38 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.71 NAME 'x509ACDigestedObjectType'
+  DESC 'Type of object being digested - see RFC3281, section 7.3' EQUALITY i
+ ntegerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.72 NAME 'x509ACAuditID' DESC 'Iden
+ tity of holder used in audit trails - see RFC3281 4.3.1' EQUALITY octetStri
+ ngMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.73 NAME 'x509ACTargetRfc822Name' D
+ ESC 'Internet electronic mail address of the ACs Target  	- see RFC3281 4.3
+ .2' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.74 NAME 'x509ACTargetDNSName' DESC
+  'Internet domain name of the ACs Target, see 	RFC3281 4.3.2' EQUALITY case
+ IgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.75 NAME 'x509ACTargetDN' DESC 'Dis
+ tinguished name of the ACs Target, see RFC3281 4.3.2' EQUALITY distinguishe
+ dNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.76 NAME 'x509ACTargetURI' DESC 'Un
+ iform Resource Identifier of the ACs Target  	- see RFC3281 4.3.2' EQUALITY
+  caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.77 NAME 'x509ACTargetIPAddress' DE
+ SC 'Internet Protocol address of the ACs Target, see 	RFC3281 4.3.2' EQUALI
+ TY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.78 NAME 'x509ACTargetRegisteredID'
+  DESC 'Any registered OID of the ACs Target, see 	RFC3281 4.3.2' EQUALITY o
+ bjectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.79 NAME 'x509ACTargetGroupRfc822Na
+ me' DESC 'Internet electronic mail address of the ACs Target group  	- see 
+ RFC3281 4.3.2' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.80 NAME 'x509ACTargetGroupDNSName'
+  DESC 'Internet domain name of the ACs Target group, see 	RFC3281 4.3.2' EQ
+ UALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 )
+attributeTypes:: KCAxLjIuODI2LjAuMS4zMzQ0ODEwLjEuMS44MSBOQU1FICd4NTA5QUNUYXJ
+ nZXRHcm91cEROJyBERVNDICdEaXN0aW5ndWlzaGVkIG5hbWUgb2YgdGhlIEFD4oCZcyBUYXJnZX
+ QgZ3JvdXAsIHNlZSAJUkZDMzI4MSA0LjMuMicgRVFVQUxJVFkgZGlzdGluZ3Vpc2hlZE5hbWVNY
+ XRjaCBTWU5UQVggMS4zLjYuMS40LjEuMTQ2Ni4xMTUuMTIxLjEuMTIgKQ==
+attributeTypes:: KCAxLjIuODI2LjAuMS4zMzQ0ODEwLjEuMS44MiBOQU1FICd4NTA5QUNUYXJ
+ nZXRHcm91cFVSSScgREVTQyAnVW5pZm9ybSBSZXNvdXJjZSBJZGVudGlmaWVyIG9mIHRoZSBBQ+
+ KAmXMgVGFyZ2V0IGdyb3VwICAJLSBzZWUgUkZDMzI4MSA0LjMuMicgRVFVQUxJVFkgY2FzZUV4Y
+ WN0SUE1TWF0Y2ggU1VCU1RSIGNhc2VFeGFjdElBNVN1YnN0cmluZ3NNYXRjaCBTWU5UQVggMS4z
+ LjYuMS40LjEuMTQ2Ni4xMTUuMTIxLjEuMjYgKQ==
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.83 NAME 'x509ACTargetGroupIPAddres
+ s' DESC 'Internet Protocol address of the ACs Target group, see 	RFC3281 4.
+ 3.2' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.84 NAME 'x509ACTargetGroupRegister
+ edID' DESC 'Any registered OID of the ACs Target group, see 	RFC3281 4.3.2'
+  EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.85 NAME 'x509ACNoRevocation' DESC 
+ 'If true, the AC will never be revoked, see 	RFC3281 section 4.3.6' EQUALIT
+ Y booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.86 NAME 'x509DPRfc822Name' DESC 'I
+ nternet electronic mail address of the    	distribution point, see RFC3280 
+ section 4.2.1.14' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.87 NAME 'x509DPDNSName' DESC 'Inte
+ rnet domain name of the distribution point, see 	RFC3280 section 4.2.1.14' 
+ EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.88 NAME 'x509DPDN' DESC 'Distingui
+ shed name of the distribution point, see 	RFC3280 section 4.2.1.14' EQUALIT
+ Y distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.89 NAME 'x509DPURI' DESC 'Uniform 
+ Resource Identifier of the distribution  	point, see RFC3280 section 4.2.1.
+ 14' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.90 NAME 'x509DPIPAddress' DESC 'In
+ ternet Protocol address of the distribution point, see 	RFC3280 section 4.2
+ .1.14' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.91 NAME 'x509DPRegisteredID' DESC 
+ 'Any registered OID of the distribution point, see 	RFC3280 section 4.2.1.1
+ 4' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.92 NAME 'x509DPrelativeToIssuer' D
+ ESC 'RDN of the  distribution point, relative to the issuer, see 	RFC3280 s
+ ection 4.2.1.14' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.93 NAME 'x509DPissuerRfc822Name' D
+ ESC 'Internet electronic mail address of the    	distribution point CRL iss
+ uer, see RFC3280 section 4.2.1.14' EQUALITY caseIgnoreIA5Match SUBSTR caseI
+ gnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.94 NAME 'x509DPissuerDNSName' DESC
+  'Internet domain name of the distribution point CRL issuer, 	see RFC3280 s
+ ection 4.2.1.14' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.95 NAME 'x509DPissuerDN' DESC 'Dis
+ tinguished name of the distribution point CRL issuer,  	see RFC3280 section
+  4.2.1.14' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.12 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.96 NAME 'x509DPissuerURI' DESC 'Un
+ iform Resource Identifier of the distribution  	point CRL issuer, see RFC32
+ 80 section 4.2.1.14' EQUALITY caseExactIA5Match SUBSTR caseExactIA5Substrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.97 NAME 'x509DPissuerIPAddress' DE
+ SC 'Internet Protocol address of the distribution point CRL 	issuer, see RF
+ C3280 section 4.2.1.14' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Sub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.98 NAME 'x509DPissuerRegisteredID'
+  DESC 'Any registered OID of the distribution point CRL issuer, 	see  RFC32
+ 80 section 4.2.1.14' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.38 )
+attributeTypes: ( 1.2.826.0.1.3344810.1.1.99 NAME 'x509DPReasonCodes' DESC '
+ The reason codes used by a DP, see 	RFC3280 section 4.2.1.14' EQUALITY bitS
+ tringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )
+attributeTypes: ( 1.3.6.1.1.11.1.2.1 NAME 'vPIMTelephoneNumber' DESC 'draft-
+ ietf-vpim-vpimdir: The full E.164 form of the telephone number, including a
+ ny sub-addressing portion' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.44{20} )
+attributeTypes: ( 1.3.6.1.1.11.1.2.2 NAME 'vPIMRfc822Mailbox' DESC 'draft-ie
+ tf-vpim-vpimdir: stores the inter-domain SMTP address of the voice mailbox 
+ associated with a given telephone number' EQUALITY caseIgnoreIA5Match SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.1.11.1.2.3 NAME 'vPIMSpokenName' DESC 'draft-ietf-
+ vpim-vpimdir: the spoken name of the user in the voice of the user' EQUALIT
+ Y octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{20000} SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.1.11.1.2.4 NAME 'vPIMTextName' DESC 'draft-ietf-vp
+ im-vpimdir: consistent with the unstructured text name databases used for c
+ alling name delivery service of caller ID' EQUALITY caseIgnoreMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.11.1.2.5 NAME 'vPIMSupportedAudioMediaTypes' DES
+ C 'draft-ietf-vpim-vpimdir: MIME audio subtype(s) of encodings that can be 
+ received at the address specified in vPIMRfc822Mailbox' EQUALITY caseIgnore
+ IA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.11.1.2.6 NAME 'vPIMSupportedMessageContext' DESC
+  'draft-ietf-vpim-vpimdir: provides guidance to the sender about the messag
+ e contexts the recipient is likely to accept' EQUALITY caseIgnoreIA5Match S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.11.1.2.7 NAME 'vPIMExtendedAbsenceStatus' DESC '
+ draft-ietf-vpim-vpimdir: indicates to the subscriber whether the recipient 
+ is accepting messages during his absence' EQUALITY caseIgnoreIA5Match SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.11.1.2.8 NAME 'vPIMSupportedUABehaviors' DESC 'd
+ raft-ietf-vpim-vpimdir: list of the attributes considered optional by VPIM 
+ and other vendor-specific attributes maybe supported by the recipient' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.1.11.1.2.9 NAME 'vPIMMaxMessageSize' DESC 'draft-i
+ etf-vpim-vpimdir: maximum message length in seconds the receiving mailbox a
+ ccepts' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.1.11.1.2.10 NAME 'vPIMSubMailboxes' DESC 'draft-ie
+ tf-vpim-vpimdir: indicates the presence of sub-mailboxes' EQUALITY numericS
+ tringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{4} )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.1 NAME 'AstContext' DESC 'Asterisk C
+ ontext' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.2 NAME 'AstExtension' DESC 'Asterisk
+  Extension' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.3 NAME 'AstPriority' DESC 'Asterisk 
+ Priority' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.4 NAME 'AstApplication' DESC 'Asteri
+ sk Application' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.5 NAME 'AstApplicationData' DESC 'As
+ terisk Application Data' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.6 NAME 'AstAccountAMAFlags' DESC 'As
+ terisk Account AMA Flags' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri
+ ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.7 NAME 'AstAccountCallerID' DESC 'As
+ terisk Account CallerID' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.8 NAME 'AstAccountContext' DESC 'Ast
+ erisk Account Context' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.9 NAME 'AstAccountMailbox' DESC 'Ast
+ erisk Account Mailbox' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.10 NAME 'AstMD5secret' DESC 'Asteris
+ k Account MD5 Secret' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.11 NAME 'AstAccountDeny' DESC 'Aster
+ isk Account Deny' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.12 NAME 'AstAccountPermit' DESC 'Ast
+ erisk Account Permit' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.13 NAME 'AstAccountQualify' DESC 'As
+ terisk Account Qualify' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.14 NAME 'AstAccountType' DESC 'Aster
+ isk Account Type' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.15 NAME 'AstAccountDisallowedCodec' 
+ DESC 'Asterisk Account Disallowed Codec' EQUALITY caseIgnoreMatch SUBSTR ca
+ seIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.16 NAME 'AstAccountExpirationTimesta
+ mp' DESC 'Asterisk Account Expiration Timestamp' EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.17 NAME 'AstAccountRegistrationConte
+ xt' DESC 'Asterisk Account Registration Context' EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.18 NAME 'AstAccountRegistrationExten
+ ' DESC 'Asterisk Account Registration Extension' EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.19 NAME 'AstAccountNoTransfer' DESC 
+ 'Asterisk Account No Transfer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.20 NAME 'AstAccountCallGroup' DESC '
+ Asterisk Account Call Group' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.21 NAME 'AstAccountCanReinvite' DESC
+  'Asterisk Account Can Reinvite' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.22 NAME 'AstAccountDTMFMode' DESC 'A
+ sterisk Account DTMF Flags' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.23 NAME 'AstAccountFromUser' DESC 'A
+ sterisk Account From User' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.24 NAME 'AstAccountFromDomain' DESC 
+ 'Asterisk Account From Domain' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.25 NAME 'AstAccountFullContact' DESC
+  'Asterisk Account Full Contact' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.26 NAME 'AstAccountHost' DESC 'Aster
+ isk Account Host' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.27 NAME 'AstAccountInsecure' DESC 'A
+ sterisk Account Insecure' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri
+ ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.28 NAME 'AstAccountNAT' DESC 'Asteri
+ sk Account NAT' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.29 NAME 'AstAccountPickupGroup' DESC
+  'Asterisk Account PickupGroup' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.30 NAME 'AstAccountPort' DESC 'Aster
+ isk Account Port' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.31 NAME 'AstAccountRestrictCID' DESC
+  'Asterisk Account Restrict CallerID' EQUALITY caseIgnoreMatch SUBSTR caseI
+ gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.32 NAME 'AstAccountRTPTimeout' DESC 
+ 'Asterisk Account RTP Timeout' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.33 NAME 'AstAccountRTPHoldTimeout' D
+ ESC 'Asterisk Account RTP Hold Timeout' EQUALITY caseIgnoreMatch SUBSTR cas
+ eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.34 NAME 'AstAccountRealmedPassword' 
+ DESC 'Asterisk Account Realmed Password' EQUALITY caseIgnoreMatch SUBSTR ca
+ seIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.35 NAME 'AstAccountAllowedCodec' DES
+ C 'Asterisk Account Allowed Codec' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.36 NAME 'AstAccountMusicOnHold' DESC
+  'Asterisk Account Music On Hold' EQUALITY caseIgnoreMatch SUBSTR caseIgnor
+ eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.37 NAME 'AstAccountCanCallForward' D
+ ESC 'Asterisk Account Can Call Forward' EQUALITY caseIgnoreMatch SUBSTR cas
+ eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.38 NAME 'AstAccountSecret' DESC 'Ast
+ erisk Account Secret' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.39 NAME 'AstAccountName' DESC 'Aster
+ isk Account Username' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.40 NAME 'AstConfigFilename' DESC 'As
+ terisk LDAP Configuration Filename' EQUALITY caseIgnoreMatch SUBSTR caseIgn
+ oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.41 NAME 'AstConfigCategory' DESC 'As
+ terisk LDAP Configuration Category' EQUALITY caseIgnoreMatch SUBSTR caseIgn
+ oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.42 NAME 'AstConfigCategoryMetric' DE
+ SC 'Asterisk LDAP Configuration Category Metric' EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.43 NAME 'AstConfigVariableName' DESC
+  'Asterisk LDAP Configuration Variable Name' EQUALITY caseIgnoreMatch SUBST
+ R caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.44 NAME 'AstConfigVariableValue' DES
+ C 'Asterisk LDAP Configuration Variable Value' EQUALITY caseIgnoreMatch SUB
+ STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.45 NAME 'AstConfigCommented' DESC 'A
+ sterisk LDAP Configuration Commented' EQUALITY caseIgnoreMatch SUBSTR caseI
+ gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.46 NAME 'AstAccountIPAddress' DESC '
+ Asterisk Account IP Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.47 NAME 'AstAccountDefaultUser' DESC
+  'Asterisk Account Default User' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.48 NAME 'AstAccountRegistrationServe
+ r' DESC 'Asterisk Account Registration Server' EQUALITY caseIgnoreMatch SUB
+ STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.49 NAME 'AstAccountLastQualifyMillis
+ econds' DESC 'Asterisk Account Last Qualify Milliseconds' EQUALITY caseIgno
+ reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.50 NAME 'AstAccountCallLimit' DESC '
+ Asterisk Account Call Limit' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.51 NAME 'AstVoicemailMailbox' DESC '
+ Asterisk voicemail mailbox' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.52 NAME 'AstVoicemailPassword' DESC 
+ 'Asterisk voicemail password' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.53 NAME 'AstVoicemailFullname' DESC 
+ 'Asterisk voicemail fullname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.54 NAME 'AstVoicemailEmail' DESC 'As
+ terisk voicemail email' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.55 NAME 'AstVoicemailPager' DESC 'As
+ terisk voicemail pager' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.56 NAME 'AstVoicemailOptions' DESC '
+ Asterisk voicemail options' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.57 NAME 'AstVoicemailTimestamp' DESC
+  'Asterisk voicemail timestamp' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS
+ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.58 NAME 'AstVoicemailContext' DESC '
+ Asterisk voicemail context' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.59 NAME 'AstAccountSubscribeContext'
+  DESC 'Asterisk subscribe context' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.61 NAME 'AstAccountUserAgent' DESC '
+ Asterisk account user context' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.62 NAME 'AstAccountLanguage' DESC 'A
+ sterisk account user language' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu
+ bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.63 NAME 'AstAccountTransport' DESC '
+ Asterisk account transport type' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.64 NAME 'AstAccountPromiscRedir' DES
+ C 'Asterisk account promiscous redirects' EQUALITY caseIgnoreMatch SUBSTR c
+ aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.65 NAME 'AstAccountAccountCode' DESC
+  'Asterisk account billing code' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.66 NAME 'AstAccountSetVar' DESC 'Ast
+ erisk account setvar' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.67 NAME 'AstAccountAllowOverlap' DES
+ C 'Asterisk account allow overlap dialing' EQUALITY caseIgnoreMatch SUBSTR 
+ caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.68 NAME 'AstAccountVideoSupport' DES
+ C 'Asterisk account video support' EQUALITY caseIgnoreMatch SUBSTR caseIgno
+ reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.69 NAME 'AstAccountIgnoreSDPVersion'
+  DESC 'Asterisk account ignore SDP version' EQUALITY caseIgnoreMatch SUBSTR
+  caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.22736.5.4.70 NAME 'AstAccountPathSupport' DESC
+  'Asterisk account support Path RFC 3327' EQUALITY caseIgnoreMatch SUBSTR c
+ aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.8 NAME 'pgpBaseKeySpaceDN' DESC 'Poin
+ ts to DN of the object that will store the PGP keys.' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.12 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.9 NAME 'pgpSoftware' DESC 'pgpSoftwar
+ e attribute for PGP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-OR
+ IGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.10 NAME 'pgpVersion' DESC 'pgpVersion
+  attribute for PGP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORI
+ GIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.11 NAME 'pgpKey' DESC 'pgpKey attribu
+ te for PGP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Pre
+ tty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.12 NAME 'pgpCertID' DESC 'pgpCertID a
+ ttribute for PGP' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good Pr
+ ivacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.13 NAME 'pgpDisabled' DESC 'pgpDisabl
+ ed attribute for PGP' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.14 NAME 'pgpKeyID' DESC 'pgpKeyID att
+ ribute for PGP' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good Priv
+ acy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.15 NAME 'pgpKeyType' DESC 'pgpKeyType
+  attribute for PGP' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good 
+ Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.16 NAME 'pgpUserID' DESC 'User ID(s) 
+ associated with the PGP key.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub
+ stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Pretty Good Pri
+ vacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.17 NAME 'pgpKeyCreateTime' DESC 'pgpK
+ eyCreateTime attribute for PGP' EQUALITY caseIgnoreMatch ORDERING caseIgnor
+ eOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.18 NAME 'pgpSignerID' DESC 'pgpSigner
+ ID attribute for PGP' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Pretty Good Privacy (PG
+ P)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.19 NAME 'pgpRevoked' DESC 'pgpRevoked
+  attribute for PGP' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.20 NAME 'pgpSubKeyID' DESC 'Sub-key I
+ D(s) of the PGP key.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Pretty Good Privacy (PG
+ P)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.21 NAME 'pgpKeySize' DESC 'pgpKeySize
+  attribute for PGP' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMat
+ ch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-
+ ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.22 NAME 'pgpKeyExpireTime' DESC 'pgpK
+ eyExpireTime attribute for PGP' EQUALITY caseIgnoreMatch ORDERING caseIgnor
+ eOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.6 NAME 'pgpReconData' DESC 'PGP defin
+ ed attributed containing reconstruction data' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.40 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.7 NAME 'pgpReconCertID' DESC 'PGP def
+ ined attribute containing the certID of the key' EQUALITY caseIgnoreMatch S
+ UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE
+ -VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.2 NAME 'pgpElementType' DESC 'PGP def
+ ined attribute containing the type of the pref object' EQUALITY caseIgnoreM
+ atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
+ SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.3.6.1.4.1.3401.8.2.3 NAME 'pgpData' DESC 'PGP defined at
+ tribute containing the admin pref data' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4
+ 0 SINGLE-VALUE X-ORIGIN 'Pretty Good Privacy (PGP)' )
+attributeTypes: ( 1.2.840.113556.1.4.478 NAME 'calCalURI' DESC 'URI to a sna
+ pshot of the users entire default calendar' EQUALITY caseIgnoreMatch SUBSTR
+  caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALU
+ E )
+attributeTypes: ( 1.2.840.113556.1.4.479 NAME 'calFBURL' DESC 'URI to the us
+ ers default free/busy time data' EQUALITY caseIgnoreMatch SUBSTR caseIgnore
+ SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.480 NAME 'calCAPURI' DESC 'URI used to 
+ communicate with the users calendar' EQUALITY caseIgnoreMatch SUBSTR caseIg
+ noreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.481 NAME 'calCalAdrURI' DESC 'URI to wh
+ ich event requests should be sent for the user' EQUALITY caseIgnoreMatch SU
+ BSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-
+ VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.482 NAME 'calOtherCalURIs' DESC 'URIs t
+ o snapshots of non-default calendars belonging to the user' EQUALITY caseIg
+ noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.15 )
+attributeTypes: ( 1.2.840.113556.1.4.483 NAME 'calOtherFBURLs' DESC 'URIs to
+  non-default free/busy data belonging to the user' EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.2.840.113556.1.4.484 NAME 'calOtherCAPURIs' DESC 'URIs t
+ o non-default calendars belonging to the user' EQUALITY caseIgnoreMatch SUB
+ STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.2.840.113556.1.4.485 NAME 'calOtherCalAdrURIs' DESC 'URI
+ s of destinations for event requests to non-default calendars' EQUALITY cas
+ eIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.13040.2.1.1 NAME 'hordePrefs' DESC 'Horde Pref
+ erences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1
+ 024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.3.1.1 NAME 'impPrefs' DESC 'IMP Preferen
+ ces' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1024}
+  )
+attributeTypes: ( 1.3.6.1.4.1.13040.4.1.1 NAME 'turbaPrefs' DESC 'Turba Pref
+ erences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1
+ 024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.4.1.2 NAME 'turbaType' DESC 'Turba Objec
+ t Type: Contact/List' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{8} )
+attributeTypes: ( 1.3.6.1.4.1.13040.4.1.3 NAME 'turbaMembers' DESC 'Encoded 
+ members of a Turba list' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.13040.4.1.4 NAME 'turbaPGPPublicKey' DESC 'PGP
+ /GPG Public Key' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.26{4000} )
+attributeTypes: ( 1.3.6.1.4.1.13040.5.1.1 NAME 'kronolithPrefs' DESC 'Kronol
+ ith Preferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.26{1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.6.1.1 NAME 'nagPrefs' DESC 'Nag Preferen
+ ces' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1024}
+  )
+attributeTypes: ( 1.3.6.1.4.1.13040.7.1.1 NAME 'gollemPrefs' DESC 'Gollem Pr
+ eferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+ {1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.8.1.1 NAME 'choraPrefs' DESC 'Chora Pref
+ erences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1
+ 024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.9.1.1 NAME 'mnemoPrefs' DESC 'Mnemo Pref
+ erences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1
+ 024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.10.1.1 NAME 'trollPrefs' DESC 'Troll Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.11.1.1 NAME 'klutzPrefs' DESC 'Klutz Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.12.1.1 NAME 'jonahPrefs' DESC 'Jonah Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.13.1.1 NAME 'hermesPrefs' DESC 'Hermes P
+ references' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6{1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.14.1.1 NAME 'junoPrefs' DESC 'Juno Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.15.1.1 NAME 'treanPrefs' DESC 'Trean Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.16.1.1 NAME 'whupsPrefs' DESC 'Whups Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.17.1.1 NAME 'ingoPrefs' DESC 'Ingo Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.18.1.1 NAME 'anselPrefs' DESC 'Ansel Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.19.1.1 NAME 'geniePrefs' DESC 'Genie Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.20.1.1 NAME 'scryPrefs' DESC 'Scry Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.21.1.1 NAME 'wickedPrefs' DESC 'Wicked P
+ references' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6{1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.22.1.1 NAME 'agoraPrefs' DESC 'Agora Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.24.1.1 NAME 'goopsPrefs' DESC 'Goops Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.25.1.1 NAME 'merkPrefs' DESC 'Merk Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.26.1.1 NAME 'mimpPrefs' DESC 'MIMP Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.27.1.1 NAME 'mottlePrefs' DESC 'Mottle P
+ references' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6{1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.28.1.1 NAME 'nicPrefs' DESC 'NIC Prefere
+ nces' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1024
+ } )
+attributeTypes: ( 1.3.6.1.4.1.13040.29.1.1 NAME 'occamPrefs' DESC 'Occam Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.30.1.1 NAME 'odinPrefs' DESC 'Odin Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.31.1.1 NAME 'rakimPrefs' DESC 'Rakim Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.32.1.1 NAME 'seshaPrefs' DESC 'Sesha Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.33.1.1 NAME 'swooshPrefs' DESC 'Swoosh P
+ references' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6{1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.34.1.1 NAME 'thorPrefs' DESC 'Thor Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.13040.35.1.1 NAME 'ulaformPrefs' DESC 'Ulaform
+  Preferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .26{1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.36.1.1 NAME 'volosPrefs' DESC 'Volos Pre
+ ferences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{
+ 1024} )
+attributeTypes: ( 1.3.6.1.4.1.13040.37.1.1 NAME 'jetaPrefs' DESC 'Jeta Prefe
+ rences' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10
+ 24} )
+attributeTypes: ( 1.3.6.1.4.1.412.100.1.2.5 NAME 'arrayIndex' DESC 'the inde
+ x of this child' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .15 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.101 NAME 'dlmIdentifyingDescriptio
+ n' DESC 'A free-form string providing explanation and            details be
+ hind the entries in the dlmOtherIdentifyingInfo            attribute.' EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.112 NAME 'dlmOtherIdentifyingInfo'
+  DESC 'OtherIdentifyingInfo captures additional data,            beyond tha
+ t of Tag information, that could be used to            identify a Physical 
+ Element. One example is bar code            data associated with an Element
+  that also has an asset             tag. Note that if only bar code data is
+  available and            is unique/able to be used as an Element key, this
+             property would be NULL and the bar code data used as           
+  the class key, in the Tag property.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.1.2.1 NAME 'orderedCimKeys' DESC 'The 
+ model path for the instance (without propagated            keys). May be us
+ ed as an RDN' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+  SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.1.2.2 NAME 'orderedCimModelPath' DESC 
+ 'The model path for the instance (with propagated keys). May            be 
+ used as an RDN' OBSOLETE EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.103 NAME 'dlmCaption' DESC 'The Ca
+ ption property is a short textual            description (oneline string) o
+ f the object.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
+ 5{64} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.104 NAME 'dlmDescription' DESC 'Th
+ e Description property provides a textual           description of the obje
+ ct.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.105 NAME 'dlmInstallDate' DESC 'A 
+ datetime value indicating when the object was            installed. A lack 
+ of a value does not indicate that            the object is not installed.' 
+ EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.106 NAME 'dlmName' DESC 'The Name 
+ property defines the label by which the            object is known. When su
+ bclassed, the Name property            can be overridden to be a Key proper
+ ty.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.107 NAME 'dlmStatus' DESC 'A strin
+ g indicating the current status of the            object. Various operation
+ al and non-operational            statuses are defined. Operational statuse
+ s are "OK",            "Degraded", "Stressed" and "Pred Fail". "Stressed"  
+           indicates that the Element is functioning, but needs            a
+ ttention. Examples of "Stressed" states are overload,             overheate
+ d, etc. The condition "Pred Fail" (failure            predicted) indicates 
+ that an Element is functioning            properly but predicting a failure
+  in the near future.            An example is a SMART-enabled hard drive.  
+              [...]' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.15{10} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.108 NAME 'dlmCreationClassName' DE
+ SC 'CreationClassName indicates the name of the class             or the su
+ bclass used in the creation of an instance.            When used with the o
+ ther key properties of this class,             this property allows all ins
+ tances of this class and            its subclasses to be uniquely identifie
+ d.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.119 NAME 'dlmNameFormat' DESC 'The
+  System object and its derivatives are Top            Level Objects of CIM.
+  They provide the scope for            numerous components. Having unique S
+ ystem keys is            required. A heuristic can be defined in individual
+             System subclasses to attempt to always generate the            
+ same System Name Key. The NameFormat property            identifies how the
+  System name was generated, using            the subclass" heuristic.' EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.120 NAME 'dlmPrimaryOwnerContact' 
+ DESC 'A string that provides information on how the            primary syst
+ em owner can be reached (e.g. phone            number, email address, ...).
+ ' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE
+ -VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.121 NAME 'dlmPrimaryOwnerName' DES
+ C 'The name of the primary system owner.' EQUALITY caseIgnoreMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.15{64} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.122 NAME 'dlmRoles' DESC 'An array
+  (bag) of strings that specify the roles            this System plays in th
+ e IT-environment. Subclasses of             System may override this proper
+ ty to define explicit            Roles values. Alternately, a Working Group
+  may            describe the heuristics, conventions and guidelines        
+     for specifying Roles. For example, for an instance of            a netw
+ orking system, the Roles property might contain            the string, "Swi
+ tch" or "Bridge".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.123 NAME 'dlmDedicated' DESC 'Enum
+ eration indicating whether the ComputerSystem             is a special-purp
+ ose System (ie, dedicated to a            particular use), versus being "ge
+ neral purpose". For            example, one could specify that the System i
+ s            dedicated to "Print" (value=11) or acts as a "Hub"            
+ (value=8).  Values are 0="Not Dedicated",            1="Unknown", 2="Other"
+ , 3="Storage", 4="Router",            5="Switch", 6="Layer 3 Switch", 7="Ce
+ ntral Office            Switch", 8="Hub", 9="Access Server", 10="Firewall",
+             11="Print", 12="I/O", 13="Web Caching",            14="Manageme
+ nt"' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.136 NAME 'dlmStartMode' DESC 'Star
+ tMode is a string value indicating whether            the Service is automa
+ tically started by a System,            Operating System, etc. or only star
+ ted upon request.             Value Mapping are "Automatic", "Manual"' EQUA
+ LITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{10} SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.137 NAME 'dlmStarted' DESC 'Starte
+ d is a boolean indicating whether the            Service has been started (
+ TRUE), or stopped (FALSE).' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU
+ E )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.139 NAME 'dlmSettingID' DESC 'The 
+ identifier by which the Setting object is            known.' EQUALITY caseI
+ gnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.159 NAME 'dlmElementSettingElement
+ Ref' DESC 'The ManagedSystemElement. Values of this            attribute po
+ int to entries of class            dlmManagedSystemElement.' EQUALITY disti
+ nguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.160 NAME 'dlmElementSettingSetting
+ Ref' DESC 'The Setting object associated with the            ManagedSystem 
+ Element. Values of this attribute point            to entries of class dlmS
+ etting.' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 12 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.186 NAME 'dlmMemberOfCollectionCol
+ lectionRef' DESC 'The Collection that aggregates members. Values of        
+      this attribute point to entries of class dlmCollection.' EQUALITY dist
+ inguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.2.2.187 NAME 'dlmMemberOfCollectionMem
+ berRef' DESC 'The aggregated member of the collection. Values            of
+  this attribute point to entries of class            dlmManagedElement.' EQ
+ UALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.8 NAME 'dlm1FilterListDirection'
+  DESC 'This defines whether the FilterList is used          for input, outp
+ ut, or both input and output          filtering. All values are used with r
+ espect to          the interface for which the FilterList applies.         
+  "Not Applicable" (0) is used when there is no          direction applicabl
+ e to the FilterList.          "Input" (1) is used when the FilterList appli
+ es          to packets that are inbound on the related          interface. 
+          "Output" (2) is used when the FilterList applies          to packe
+ ts that are outbound on the related          interface.          "Both" (3)
+  is used to indicate that          the direction is immaterial, e.g., to fi
+ lter on          a source subnet regardless of whether the flow is         
+  inbound or outbound.          "Mirrored" (4) is also applicable to        
+   both inbound and outbound flow processing, but          indicates that th
+ e filter criteria are applied          asymmetrically to traffic in both di
+ rections          and, thus, specifies the reversal of source and          
+ destination criteria (as opposed to the equality          of these criteria
+  as indicated by "Both").          The match conditions in the aggregated  
+         FilterEntryBase subclass instances are defined          from the pe
+ rspective of outbound flows and applied          to inbound flows as well b
+ y reversing the source          and destination criteria. So, for example, 
+          consider a FilterList with 3 FilterEntries          indicating des
+ tination port = 80, and source and          destination addresses of a and 
+ b, respectively.          Then, for the outbound direction, the filter     
+      entries match as specified and the mirror (for          the inbound di
+ rection) matches on source          port = 80 and source and destination ad
+ dresses          of b and a, respectively.),          Values are "Not Appli
+ cable", "Input", "Output",          "Both", "Mirrored"' EQUALITY caseIgnore
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.1 NAME 'dlm1FilterEntryBaseIsNeg
+ ated' DESC 'Boolean indicating that the match condition described          
+ in the properties of the FilterEntryBase subclass          should be negate
+ d.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.2 NAME 'dlmProtocolType' DESC 'P
+ rotocolType is an enumeration that provides additional          information
+  that can be used to help categorize and          classify different instan
+ ces of this class.          Values are "Unknown", "Other", "IPv4", "IPv6", 
+ "IPX",          "AppleTalk", "DECnet", "SNA", "CONP", "CLNP", "VINES",     
+      "XNS", "ATM", "Frame Relay", "Ethernet", "TokenRing",          "FDDI",
+  "Infiniband", "Fibre Channel", "ISDN BRI Endpoint",          "ISDN B Chann
+ el Endpoint", "ISDN D Channel Endpoint"' EQUALITY caseIgnoreMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.3 NAME 'dlmOtherTypeDescription'
+  DESC 'A string describing the type of ProtocolEndpoint that this          
+ instance is when the Type property of this class (or any of          its  s
+ ubclasses) is set to "Other". The format of          the string inserted in
+  this property should be similar in          format to the values defined f
+ or the Type property. This          property should be set to NULL when the
+  Type property is          any value other than "Other".' EQUALITY caseIgno
+ reMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.4 NAME 'dlmIPAddress' DESC 'The 
+ IP address that this ProtocolEndpoint represents,          formatted accord
+ ing to the appropriate convention as          defined in the AddressType pr
+ operty of this class          (e.g., 171.79.6.40).' EQUALITY caseIgnoreMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.5 NAME 'dlmIPSubnetMask' DESC 'T
+ he mask for the IP address of this ProtocolEndpoint,          formatted acc
+ ording to the appropriate convention as          defined in the AddressType
+  property of this class          (e.g., 255.255.252.0).' EQUALITY caseIgnor
+ eMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.6 NAME 'dlmIPAddressType' DESC '
+ An enumeration that describes the format of the address          property. 
+ Whenever possible, IPv4-compatible addresses          should be used instea
+ d of native IPv6 addresses (see          RFC 2373, section 2.5.4). In order
+  to have a consistent          format for IPv4 addresses in a mixed IPv4/v6
+  environment,          all IPv4 addresses and both IPv4-compatible IPv6 add
+ resses          and IPv4-mapped IPv6 addresses, per RFC 2373, section      
+     2.5.4, should be formatted in standard IPv4 format.          However, t
+ his (the 2.2) version of the Network Common          Model will not explici
+ tly support mixed IPv4/IPv6          environments. This will be added in a 
+ future release.          Values are "Unknown", "IPv4", "IPv6".' EQUALITY ca
+ seIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.10126.7.1.3.1.7 NAME 'dlmIPVersionSupport' DES
+ C 'It is not possible to tell from the address alone if a          given IP
+ ProtocolEndpoint can support IPv4 and IPv6, or          just one of these. 
+ This property explicitly defines the          support for different version
+ s of IP that this          IPProtocolEndpoint has.          More implementa
+ tion experience is needed in order to          correctly model mixed IPv4/I
+ Pv6 networks; therefore, this          version (2.2) of the Network Common 
+ Model will not support          mixed IPv4/IPv6 environments. This will be 
+ looked at          further in a future version.          Values are "Unknow
+ n", "IPv4 Only", "IPv6 Only".' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.18 NAME 'dlmBiometric' DESC 'Biome
+ tric information used to identify a person.              The property value
+  is left null or set to "N/A" for            non-human user or a user not u
+ sing biometric            information for authentication.  Values are 0="N/
+ A",            1="Other", 2="Facial", 3="Retina", 4="Mark",            5="F
+ inger", 6="Voice", 7="DNA-RNA", 8="EEG".' EQUALITY integerMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.19 NAME 'dlmElementID' DESC 'The E
+ lementID property uniquely specifies the            ManagedElement object i
+ nstance that is the user            represented by the UsersAccess object i
+ nstance.  The            ElementID is formatted similarly to a model path  
+           except that the property-value pairs are ordered in            al
+ phabetical order (US ASCII lexical order).' EQUALITY caseIgnoreMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.41 NAME 'dlmElementAsUserAnteceden
+ tRef' DESC 'The ManagedElement that has UsersAccess. The value             
+ of this attribute points to an entry of class            dlm1ManagedElement
+ .' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.42 NAME 'dlmElementAsUserDependent
+ Ref' DESC 'The "owned" UsersAccess. Values of this            attribute poi
+ nt to entries of class dlm1UsersAccess.' EQUALITY distinguishedNameMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.57 NAME 'dlmUsersCredentialAnteced
+ entRef' DESC 'The issued credential that may be used. Values            of 
+ this attribute point to entries of class            dlm1Credential.' EQUALI
+ TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.58 NAME 'dlmUsersCredentialDepende
+ ntRef' DESC 'The UsersAccess that has use of a credential.            Value
+ s of this attribute point to entries of class             dlm1UsersAccess.'
+  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.26 NAME 'dlmRemoteID' DESC 'Remote
+ ID is the name by which the user is known           at the KDC security ser
+ vice.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} S
+ INGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.28 NAME 'dlmAlgorithm' DESC 'algor
+ ithm names the transformation algorithm, if           any, used to protect 
+ passwords before use in the           protocol.  For instance, Kerberos doe
+ sn"t store           passwords as the shared secret, but rather, a hash of 
+           the password.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.29 NAME 'dlmProtocol' DESC 'protoc
+ ol names the protocol with which the           SharedSecret is used.' EQUAL
+ ITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.412.100.4.2.30 NAME 'dlmSecret' DESC 'secret i
+ s the secret known by the Users Access.' EQUALITY caseIgnoreMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.15 NAME 'pcimRoles' DESC 'RFC 3703: Each val
+ ue of this attribute represents a role-combination.' EQUALITY caseIgnoreMat
+ ch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.6.2.3 NAME 'pcimKeywords' DESC 'RFC 3703: A set 
+ of keywords to assist directory clients in locating the policy objects appl
+ icable to them.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch 
+ SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.6.2.4 NAME 'pcimGroupName' DESC 'RFC 3703: The u
+ ser-friendly name of this policy group.' EQUALITY caseIgnoreMatch ORDERING 
+ caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.5 NAME 'pcimRuleName' DESC 'RFC 3703: The us
+ er-friendly name of this policy rule.' EQUALITY caseIgnoreMatch ORDERING ca
+ seIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.6 NAME 'pcimRuleEnabled' DESC 'RFC 3703: An 
+ integer indicating whether a policy rule is administratively enabled (value
+ =1), disabled (value=2), or enabled for debug (value=3).' EQUALITY integerM
+ atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.11 NAME 'pcimRuleUsage' DESC 'RFC 3703: This
+  attribute is a free-form sting providing guidelines on how this policy sho
+ uld be used.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUB
+ STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V
+ ALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.13 NAME 'pcimRuleMandatory' DESC 'RFC 3703: 
+ If TRUE, indicates that for this policy rule, the evaluation of its conditi
+ ons and execution of its actions (if the condition is satisfied) is require
+ d.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.1.6.2.16 NAME 'pcimConditionGroupNumber' DESC 'RFC
+  3703: The number of the group to which a policy condition belongs.  This i
+ s used to form the DNF or CNF expression associated with a policy rule.' EQ
+ UALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.17 NAME 'pcimConditionNegated' DESC 'RFC 370
+ 3: If TRUE (FALSE), it indicates that a policy condition IS (IS NOT) negate
+ d in the DNF or CNF expression associated with a policy rule.' EQUALITY boo
+ leanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.18 NAME 'pcimConditionName' DESC 'RFC 3703: 
+ A user-friendly name for a policy condition.' EQUALITY caseIgnoreMatch ORDE
+ RING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.19 NAME 'pcimConditionDN' DESC 'RFC 3703: A 
+ DN that references an instance of a reusable policy condition.' EQUALITY di
+ stinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.23 NAME 'pcimActionOrder' DESC 'RFC 3703: An
+  integer indicating the relative order of an action in the context of a pol
+ icy rule.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.22 NAME 'pcimActionName' DESC 'RFC 3703: A u
+ ser-friendly name for a policy action.' EQUALITY caseIgnoreMatch ORDERING c
+ aseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.24 NAME 'pcimActionDN' DESC 'RFC 3703: A DN 
+ that references a reusable policy action.' EQUALITY distinguishedNameMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.6.2.36 NAME 'pcimRepositoryName' DESC 'RFC 3703:
+  The user-friendly name of this policy repository.' EQUALITY caseIgnoreMatc
+ h ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.1 NAME 'pcelsPolicySetName' DESC 'RFC 4104: 
+ User-friendly name of a policy set' EQUALITY caseIgnoreMatch ORDERING caseI
+ gnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.2 NAME 'pcelsDecisionStrategy' DESC 'RFC 410
+ 4: Evaluation method for the components of a pcelsPolicySet' EQUALITY integ
+ erMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 
+ SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.3 NAME 'pcelsPolicySetList' DESC 'RFC 4104: 
+ Unordered set of DNs of pcelsPolicySetAssociation entries' EQUALITY disting
+ uishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.4 NAME 'pcelsPriority' DESC 'RFC 4104: Prior
+ ity of a component' EQUALITY integerMatch ORDERING integerOrderingMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.5 NAME 'pcelsPolicySetDN' DESC 'RFC 4104: DN
+  of a pcelsPolicySet entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.62 NAME 'pcelsRuleValidityPeriodList' DESC '
+ RFC 4104: Unordered set of DNs of pcimRuleValidityAssociation entries' EQUA
+ LITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.6 NAME 'pcelsConditionListType' DESC 'RFC 41
+ 04: Indicates the type of condition aggregation' EQUALITY integerMatch ORDE
+ RING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.1.9.2.7 NAME 'pcelsConditionList' DESC 'RFC 4104: 
+ Unordered set of DNs of pcelsConditionAssociation entries' EQUALITY disting
+ uishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.8 NAME 'pcelsActionList' DESC 'RFC 4104: Uno
+ rdered set of DNs of pcelsActionAssociation entries' EQUALITY distinguished
+ NameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.9 NAME 'pcelsSequencedActions' DESC 'RFC 410
+ 4: Indicates the importance of action sequencing' EQUALITY integerMatch ORD
+ ERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALU
+ E )
+attributeTypes: ( 1.3.6.1.1.9.2.10 NAME 'pcelsExecutionStrategy' DESC 'RFC 4
+ 104: Indicates the action execution strategy' EQUALITY integerMatch ORDERIN
+ G integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.11 NAME 'pcelsVariableDN' DESC 'RFC 4104: DN
+  of a pcelsVariable entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.12 NAME 'pcelsValueDN' DESC 'RFC 4104: DN of
+  a pcelsValueAuxClass entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.13 NAME 'pcelsIsMirrored' DESC 'RFC 4104: In
+ dicates whether the mirrored traffic matches' EQUALITY booleanMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.14 NAME 'pcelsVariableName' DESC 'RFC 4104: 
+ The user-friendly name of a variable.' EQUALITY caseIgnoreMatch ORDERING ca
+ seIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.15 NAME 'pcelsExpectedValueList' DESC 'RFC 4
+ 104: Unordered set of DNs of pcelsValueAuxClass entries        representing
+  expected values for a policy variable' EQUALITY distinguishedNameMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.16 NAME 'pcelsVariableModelClass' DESC 'RFC 
+ 4104: Identifies a CIM class' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.17 NAME 'pcelsVariableModelProperty' DESC 'R
+ FC 4104: Identifies the property of a CIM class.' EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.18 NAME 'pcelsExpectedValueTypes' DESC 'RFC 
+ 4104: Identifies subclasses of pcelsValueAuxClass by name' EQUALITY caseIgn
+ oreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.19 NAME 'pcelsValueName' DESC 'RFC 4104: The
+  user-friendly name of a value' EQUALITY caseIgnoreMatch ORDERING caseIgnor
+ eOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.20 NAME 'pcelsIPv4AddrList' DESC 'RFC 4104: 
+ Unordered set of IPv4 addresses, IPv4 address ranges or        hosts' EQUAL
+ ITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.21 NAME 'pcelsIPv6AddrList' DESC 'RFC 4104: 
+ Unordered set of IPv6 addresses, IPv6 address ranges or        hosts' EQUAL
+ ITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubst
+ ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.22 NAME 'pcelsMACAddrList' DESC 'RFC 4104: U
+ nordered set of MAC addresses or MAC address ranges' EQUALITY caseIgnoreMat
+ ch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.23 NAME 'pcelsStringList' DESC 'RFC 4104: Un
+ ordered set of strings with wildcards' EQUALITY caseIgnoreMatch ORDERING ca
+ seIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.24 NAME 'pcelsBitStringList' DESC 'RFC 4104:
+  Unordered set of bit strings or bit string ranges' EQUALITY caseIgnoreMatc
+ h ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.25 NAME 'pcelsIntegerList' DESC 'RFC 4104: U
+ nordered set of integers or integer ranges' EQUALITY caseIgnoreMatch ORDERI
+ NG caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.1.9.2.26 NAME 'pcelsBoolean' DESC 'RFC 4104: Boole
+ an value' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-
+ VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.27 NAME 'pcelsReusableContainerName' DESC 'R
+ FC 4104: User-friendly name of a reusable policy container' EQUALITY caseIg
+ noreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.28 NAME 'pcelsReusableContainerList' DESC 'R
+ FC 4104: Unordered set of DNs of pcelsReusableContainer entries' EQUALITY d
+ istinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.29 NAME 'pcelsRole' DESC 'RFC 4104: String r
+ epresenting a role.' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMa
+ tch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 S
+ INGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.30 NAME 'pcelsRoleCollectionName' DESC 'RFC 
+ 4104: User-friendly name of a role collection' EQUALITY caseIgnoreMatch ORD
+ ERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.31 NAME 'pcelsElementList' DESC 'RFC 4104: U
+ nordered set of managed elements' EQUALITY distinguishedNameMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.32 NAME 'pcelsFilterName' DESC 'RFC 4104: Us
+ er-friendly name of a filter entry' EQUALITY caseIgnoreMatch ORDERING caseI
+ gnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.33 NAME 'pcelsFilterIsNegated' DESC 'RFC 410
+ 4: Indicates whether the filter is negated' EQUALITY booleanMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.34 NAME 'pcelsIPHdrVersion' DESC 'RFC 4104: 
+ IP version' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.35 NAME 'pcelsIPHdrSourceAddress' DESC 'RFC 
+ 4104: Source IP address' EQUALITY octetStringMatch ORDERING octetStringOrde
+ ringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.36 NAME 'pcelsIPHdrSourceAddressEndOfRange' 
+ DESC 'RFC 4104: End of a range of source IP addresses' EQUALITY octetString
+ Match ORDERING octetStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.4
+ 0 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.37 NAME 'pcelsIPHdrSourceMask' DESC 'RFC 410
+ 4: Mask to be used in comparing the source IP address' EQUALITY octetString
+ Match ORDERING octetStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.4
+ 0 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.38 NAME 'pcelsIPHdrDestAddress' DESC 'RFC 41
+ 04: Destination IP address' EQUALITY octetStringMatch ORDERING octetStringO
+ rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.39 NAME 'pcelsIPHdrDestAddressEndOfRange' DE
+ SC 'RFC 4104: End of a range of destination IP addresses' EQUALITY octetStr
+ ingMatch ORDERING octetStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.40 NAME 'pcelsIPHdrDestMask' DESC 'RFC 4104:
+  Mask to be used in comparing the destination IP address' EQUALITY octetStr
+ ingMatch ORDERING octetStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.41 NAME 'pcelsIPHdrProtocolID' DESC 'RFC 410
+ 4: IP protocol type' EQUALITY integerMatch ORDERING integerOrderingMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.42 NAME 'pcelsIPHdrSourcePortStart' DESC 'RF
+ C 4104: Lower end of a range of UDP or TCP source ports' EQUALITY integerMa
+ tch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.43 NAME 'pcelsIPHdrSourcePortEnd' DESC 'RFC 
+ 4104: Upper end of a range of UDP or TCP source ports' EQUALITY integerMatc
+ h ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE
+ -VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.44 NAME 'pcelsIPHdrDestPortStart' DESC 'RFC 
+ 4104: Lower end of a range of UDP or TCP destination ports' EQUALITY intege
+ rMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 S
+ INGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.45 NAME 'pcelsIPHdrDestPortEnd' DESC 'RFC 41
+ 04: Upper end of a range of UDP or TCP destination ports' EQUALITY integerM
+ atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.46 NAME 'pcelsIPHdrDSCPList' DESC 'RFC 4104:
+  DSCP values' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.
+ 3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.1.9.2.47 NAME 'pcelsIPHdrFlowLabel' DESC 'RFC 4104
+ : IP flow label' EQUALITY octetStringMatch ORDERING octetStringOrderingMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.48 NAME 'pcels8021HdrSourceMACAddress' DESC 
+ 'RFC 4104: Source MAC address' EQUALITY octetStringMatch ORDERING octetStri
+ ngOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.49 NAME 'pcels8021HdrSourceMACMask' DESC 'RF
+ C 4104: Source MAC address mask' EQUALITY octetStringMatch ORDERING octetSt
+ ringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.50 NAME 'pcels8021HdrDestMACAddress' DESC 'R
+ FC 4104: Destination MAC address' EQUALITY octetStringMatch ORDERING octetS
+ tringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.51 NAME 'pcels8021HdrDestMACMask' DESC 'RFC 
+ 4104: Destination MAC address mask' EQUALITY octetStringMatch ORDERING octe
+ tStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.52 NAME 'pcels8021HdrProtocolID' DESC 'RFC 4
+ 104: Ethernet protocol ID' EQUALITY integerMatch ORDERING integerOrderingMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.1.9.2.53 NAME 'pcels8021HdrPriority' DESC 'RFC 410
+ 4: 802.1Q priority' EQUALITY integerMatch ORDERING integerOrderingMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.1.9.2.54 NAME 'pcels8021HdrVLANID' DESC 'RFC 4104:
+  802.1Q VLAN ID' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.1.9.2.55 NAME 'pcelsFilterListName' DESC 'RFC 4104
+ : User-friendly name of a FilterList' EQUALITY caseIgnoreMatch ORDERING cas
+ eIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.56 NAME 'pcelsFilterDirection' DESC 'RFC 410
+ 4: Direction to which this filter is applied' EQUALITY integerMatch ORDERIN
+ G integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.57 NAME 'pcelsFilterEntryList' DESC 'RFC 410
+ 4: Unordered set of DNs of pcelsFilterEntryBase entries' EQUALITY distingui
+ shedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.1.9.2.58 NAME 'pcelsVendorVariableData' DESC 'RFC 
+ 4104: Mechanism for representing variables that have not        been specif
+ ically modeled' EQUALITY octetStringMatch ORDERING octetStringOrderingMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.1.9.2.59 NAME 'pcelsVendorVariableEncoding' DESC '
+ RFC 4104: Identifies the format and semantics for policy variables' EQUALIT
+ Y objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.1.9.2.60 NAME 'pcelsVendorValueData' DESC 'RFC 410
+ 4: Mechanism for representing values that have not been        specifically
+  modeled' EQUALITY octetStringMatch ORDERING octetStringOrderingMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.1.9.2.61 NAME 'pcelsVendorValueEncoding' DESC 'RFC
+  4104: Identifies the format and semantics for policy values' EQUALITY obje
+ ctIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.7924.2.1.1.1 NAME 'demailMaxAuthLevel' DESC 'd
+ escribes the maximum authentification the person is capable of (NORMAL/HIGH
+ /VERY HIGH)' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who 
+ may  run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who 
+ may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s
+ ) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) imp
+ ersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s)
+  followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s)
+  impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(
+ s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Start o
+ f time interval for which the entry is valid' EQUALITY generalizedTimeMatch
+  ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of t
+ ime interval for which the entry is valid' EQUALITY generalizedTimeMatch OR
+ DERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
+attributeTypes: ( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an integer
+  to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrder
+ ingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' DESC 'M
+ ANDATORY: OpenSSH Public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.34380.1.1.3.10 NAME 'puppetClass' DESC 'Puppet
+  Node Class' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 26 )
+attributeTypes: ( 1.3.6.1.4.1.34380.1.1.3.9 NAME 'parentNode' DESC 'Puppet P
+ arent Node' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
+ 6 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.34380.1.1.3.11 NAME 'environment' DESC 'Puppet
+  Node Environment' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.34380.1.1.3.12 NAME 'puppetVar' DESC 'A variab
+ le setting for puppet' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.29426.2.2.1.1 NAME 'DKIMSelector' DESC 'Select
+ or name associated with DKIM signing key' EQUALITY caseExactIA5Match SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.29426.2.2.1.2 NAME 'DKIMKey' DESC 'DKIM signin
+ g key' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.29426.2.2.1.3 NAME 'DKIMIdentity' DESC 'The Ag
+ ent or User Identifier (AUID)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.29426.2.2.1.4 NAME 'DKIMDomain' DESC 'DKIM sen
+ der domain' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+  SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.19937.1.1.1 NAME 'quota' DESC 'Quotas (FileSys
+ tem:BlocksSoft,BlocksHard,InodesSoft,InodesHard)' EQUALITY caseIgnoreIA5Mat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} )
+attributeTypes: ( 1.3.6.1.3.1.1.1.1.2.1 NAME 'tacacsClient' DESC 'Valid clie
+ nt address range for this user, in CIDR notation' EQUALITY caseExactIA5Matc
+ h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{20} )
+attributeTypes: ( 1.3.6.1.3.1.1.1.1.2.2 NAME 'tacacsMember' DESC 'Tacacs gro
+ up membership' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .26{40} )
+attributeTypes: ( 1.3.6.1.3.1.1.1.1.2.3 NAME 'tacacsProfile' DESC 'Tacacs us
+ er profile' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+ {1024} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.3.1.1.1.1.2.8 NAME 'tacacsFlag' DESC 'Arbitrary te
+ xt, may be used by LDAP filters' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.26{40} )
+attributeTypes: ( 1.3.6.1.4.1.3.8.1.1.1 NAME 'cmusaslsecretCRAM-MD5' DESC 'P
+ rehashed password as described in CRAM-MD5' EQUALITY octetStringMatch SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.40{32} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.3.8.1.1.2 NAME 'cmusaslsecretDIGEST-MD5' DESC 
+ 'Shared secret for DIGEST-MD5' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.40{16} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.3.8.1.1.3 NAME 'cmusaslsecretOTP' DESC 'OTP se
+ cret' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.3.8.1.1.4 NAME 'cmusaslsecretSRP' DESC 'base64
+  encoded SRP secret' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.3.8.1.1.5 NAME 'cmusaslsecretPLAIN' DESC 'PLAI
+ N secret' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.1 NAME 'fedfsUuid' DESC 'A UUID used b
+ y NSDB' EQUALITY uuidMatch ORDERING uuidOrderingMatch SYNTAX 1.3.6.1.1.16.1
+  SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.4 NAME 'fedfsFsnUuid' DESC 'The FSN UU
+ ID component of an FSN' SUP fedfsUuid SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.11 NAME 'fedfsFsnTTL' DESC 'Time to li
+ ve of an FSN tree' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.14 NAME 'fedfsNceDN' DESC 'NCE Disting
+ uished Name' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.12 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.8 NAME 'fedfsFslUuid' DESC 'UUID of an
+  FSL' SUP fedfsUuid SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.12 NAME 'fedfsAnnotation' DESC 'Annota
+ tion of an object' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.13 NAME 'fedfsDescr' DESC 'Description
+  of an object' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.120 NAME 'fedfsNfsURI' DESC 'Location 
+ of fileset' SUP labeledURI SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.103 NAME 'fedfsNfsCurrency' DESC 'up-t
+ o-date measure of the data' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.104 NAME 'fedfsNfsGenFlagWritable' DES
+ C 'Indicates if the file system is writable' EQUALITY booleanMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.105 NAME 'fedfsNfsGenFlagGoing' DESC '
+ Indicates if the file system is going' EQUALITY booleanMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.106 NAME 'fedfsNfsGenFlagSplit' DESC '
+ Indicates if there are multiple file systems' EQUALITY booleanMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.107 NAME 'fedfsNfsTransFlagRdma' DESC 
+ 'Indicates if the transport supports RDMA' EQUALITY booleanMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.108 NAME 'fedfsNfsClassSimul' DESC 'Th
+ e simultaneous-use class of the file system' EQUALITY integerMatch SYNTAX 1
+ .3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.109 NAME 'fedfsNfsClassHandle' DESC 'T
+ he handle class of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.110 NAME 'fedfsNfsClassFileid' DESC 'T
+ he fileid class of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.111 NAME 'fedfsNfsClassWritever' DESC 
+ 'The write-verifier class of the file system' EQUALITY integerMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.112 NAME 'fedfsNfsClassChange' DESC 'T
+ he change class of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.113 NAME 'fedfsNfsClassReaddir' DESC '
+ The readdir class of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.114 NAME 'fedfsNfsReadRank' DESC 'The 
+ read rank of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.115 NAME 'fedfsNfsReadOrder' DESC 'The
+  read order of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.116 NAME 'fedfsNfsWriteRank' DESC 'The
+  write rank of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.117 NAME 'fedfsNfsWriteOrder' DESC 'Th
+ e write order of the file system' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.118 NAME 'fedfsNfsVarSub' DESC 'Indica
+ tes if variable substitution is present' EQUALITY booleanMatch SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.31103.1.19 NAME 'fedfsNfsValidFor' DESC 'Valid
+  for time' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL
+ E-VALUE )
+attributeTypes: ( 0.0.8.350.1.1.1.1.1 NAME 'commURI' DESC 'Labeled URI forma
+ t to point to the distinguished name of the commUniqueId' EQUALITY caseExac
+ tMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 0.0.8.350.1.1.2.1.1 NAME 'commUniqueId' DESC 'To hold the 
+ endpoints unique Id' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr
+ ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.0.8.350.1.1.2.1.2 NAME 'commOwner' DESC 'Labeled URI to 
+ point back to the original owner' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.15 )
+attributeTypes: ( 0.0.8.350.1.1.2.1.3 NAME 'commPrivate' DESC 'To decide whe
+ ther the entry is visible to world or not' SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.26 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.1 NAME 'SIPIdentitySIPURI' DESC 'Univers
+ al Resource Indicator of the SIP UA' EQUALITY caseExactMatch SUBSTR caseExa
+ ctSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.2 NAME 'SIPIdentityRegistrarAddress' DES
+ C 'specifies the location of the registrar' EQUALITY caseIgnoreIA5Match SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.3 NAME 'SIPIdentityProxyAddress' DESC 'S
+ pecifies the location of the SIP Proxy' EQUALITY caseIgnoreIA5Match SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.4 NAME 'SIPIdentityAddress' DESC 'IP add
+ ress of the UA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.26 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.5 NAME 'SIPIdentityPassword' DESC 'The u
+ ser agent SIP password ' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.40 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.6 NAME 'SIPIdentityUserName' DESC 'The u
+ ser agent user name.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM
+ atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 0.0.8.350.1.1.6.1.7 NAME 'SIPIdentityServiceLevel' DESC 'T
+ o define services that a user can belong to.' EQUALITY caseIgnoreIA5Match S
+ UBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.1 NAME 'radiusArapFeatures' EQUALI
+ TY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.2 NAME 'radiusArapSecurity' EQUALI
+ TY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.3 NAME 'radiusArapZoneAccess' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.44 NAME 'radiusAuthType' DESC 'con
+ trolItem: Auth-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.4 NAME 'radiusCallbackId' DESC 're
+ plyItem: Callback-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.5 NAME 'radiusCallbackNumber' DESC
+  'replyItem: Callback-Number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.6 NAME 'radiusCalledStationId' DES
+ C 'controlItem: Called-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.7 NAME 'radiusCallingStationId' DE
+ SC 'controlItem: Calling-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.8 NAME 'radiusClass' DESC 'replyIt
+ em: Class' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+  )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.45 NAME 'radiusClientIPAddress' EQ
+ UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE
+  )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.9 NAME 'radiusFilterId' DESC 'repl
+ yItem: Filter-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.10 NAME 'radiusFramedAppleTalkLink
+ ' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreIA5Match SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.11 NAME 'radiusFramedAppleTalkNetw
+ ork' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreIA5Match
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.12 NAME 'radiusFramedAppleTalkZone
+ ' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreIA5Match SYNTA
+ X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.13 NAME 'radiusFramedCompression' 
+ DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.14 NAME 'radiusFramedIPAddress' DE
+ SC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.15 NAME 'radiusFramedIPNetmask' DE
+ SC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.16 NAME 'radiusFramedIPXNetwork' D
+ ESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.17 NAME 'radiusFramedMTU' DESC 're
+ plyItem: Framed-MTU' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.18 NAME 'radiusFramedProtocol' DES
+ C 'replyItem: Framed-Protocol' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.19 NAME 'radiusFramedRoute' DESC '
+ replyItem: Framed-Route' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.20 NAME 'radiusFramedRouting' DESC
+  'replyItem: Framed-Routing' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.46 NAME 'radiusGroupName' EQUALITY
+  caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.47 NAME 'radiusHint' EQUALITY case
+ IgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.48 NAME 'radiusHuntgroupName' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.21 NAME 'radiusIdleTimeout' DESC '
+ replyItem: Idle-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.22 NAME 'radiusLoginIPHost' DESC '
+ replyItem: Login-IP-Host' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.23 NAME 'radiusLoginLATGroup' DESC
+  'replyItem: Login-LAT-Group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.24 NAME 'radiusLoginLATNode' DESC 
+ 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.25 NAME 'radiusLoginLATPort' DESC 
+ 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.26 NAME 'radiusLoginLATService' DE
+ SC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.27 NAME 'radiusLoginService' DESC 
+ 'replyItem: Login-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.28 NAME 'radiusLoginTCPPort' DESC 
+ 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.29 NAME 'radiusPasswordRetry' EQUA
+ LITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.30 NAME 'radiusPortLimit' DESC 're
+ plyItem: Port-Limit' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.49 NAME 'radiusProfileDN' EQUALITY
+  distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.31 NAME 'radiusPrompt' EQUALITY ca
+ seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.50 NAME 'radiusProxyToRealm' EQUAL
+ ITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.51 NAME 'radiusReplicateToRealm' D
+ ESC 'control:Replicate-To-Realm' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.52 NAME 'radiusRealm' EQUALITY cas
+ eIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.32 NAME 'radiusServiceType' DESC '
+ replyItem: Service-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.33 NAME 'radiusSessionTimeout' DES
+ C 'replyItem: Session-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.34 NAME 'radiusTerminationAction' 
+ DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.35 NAME 'radiusTunnelAssignmentId'
+  EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.36 NAME 'radiusTunnelMediumType' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.37 NAME 'radiusTunnelPassword' EQU
+ ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE 
+ )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.38 NAME 'radiusTunnelPreference' E
+ QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.39 NAME 'radiusTunnelPrivateGroupI
+ d' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.40 NAME 'radiusTunnelServerEndpoin
+ t' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.41 NAME 'radiusTunnelType' EQUALIT
+ Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.42 NAME 'radiusVSA' EQUALITY caseI
+ gnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.43 NAME 'radiusTunnelClientEndpoin
+ t' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.53 NAME 'radiusSimultaneousUse' DE
+ SC 'controlItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN
+ GLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.54 NAME 'radiusLoginTime' EQUALITY
+  caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.55 NAME 'radiusUserCategory' EQUAL
+ ITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.56 NAME 'radiusStripUserName' SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.57 NAME 'dialupAccess' EQUALITY ca
+ seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.58 NAME 'radiusExpiration' DESC 'c
+ ontrolItem: Expiration' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.59 NAME 'radiusAttribute' DESC 'co
+ ntrolItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.61 NAME 'radiusNASIpAddress' EQUAL
+ ITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.62 NAME 'radiusReplyMessage' DESC 
+ 'replyItem: Reply-Message' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.63 NAME 'radiusControlAttribute' D
+ ESC 'controlItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.64 NAME 'radiusReplyAttribute' DES
+ C 'replyItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.4.3.1.65 NAME 'radiusRequestAttribute' D
+ ESC 'requestItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.26 )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.1 NAME 'radiusClientIdentifier' 
+ DESC 'Client Identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin
+ gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.2 NAME 'radiusClientSecret' DESC
+  'Client Secret' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.3 NAME 'radiusClientShortname' D
+ ESC 'Client Shortname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings
+ Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.4 NAME 'radiusClientVirtualServe
+ r' DESC 'VirtualServer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring
+ sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.5 NAME 'radiusClientType' DESC '
+ Client Type' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNT
+ AX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.6 NAME 'radiusClientRequireMa' D
+ ESC 'Require Message Authenticator' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.7 NAME 'radiusClientComment' DES
+ C 'Client comment' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.15 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.2 NAME 'dateOfBirth' DESC 'Date o
+ f birth (format YYYY-MM-DD, see ISO 8601)' EQUALITY caseExactIA5Match SUBST
+ R caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{10} SING
+ LE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.12 NAME 'birthPlace' DESC 'Place 
+ of birth' SUP l SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.14 NAME 'birthName' DESC 'Last na
+ me at time of birth, e.g. maiden name' SUP sn SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.7 NAME 'gender' DESC 'Representat
+ ion of human sex (see ISO 5218)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.27{1} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.9 NAME 'businessTitle' DESC 'Busi
+ ness title describing the kind of job a person does' SUP title )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.15 NAME 'academicTitle' DESC 'Aca
+ demic title a person is allowed to use' SUP title )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.10 NAME 'nickName' DESC 'A nick n
+ ame of a person' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.11 NAME 'euVATId' DESC 'value add
+ ed tax ID of company within EU' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.26{20} )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.13 NAME 'labeledBICandIBAN' DESC 
+ 'international bank arrangement consisting of BIC, IBAN and optional label 
+ (format: "BIC:<BIC>,IBAN:<IBAN>#<Label>")' EQUALITY caseIgnoreMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.15{100} )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.17 NAME 'delegatesTo' DESC 'DN of
+  entity to which tasks are delegated' SUP distinguishedName )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.19 NAME 'germanTaxNr' DESC 'tax I
+ D of person or company within Germany' SUP uniqueIdentifier EQUALITY caseIg
+ noreMatch )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.20 NAME 'germanUniqueTaxIDNr' DES
+ C 'tax ID of person or company within Germany' EQUALITY caseIgnoreMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15{20} )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.3 NAME 'musicalInstrument' DESC '
+ Commonly used name of a musical instrument.' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.4 NAME 'musicalOrchestra' DESC 'C
+ ommonly used name of a musical orchestra or band.' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.5 NAME 'musicalArtistName' DESC '
+ Commonly used artist name of this individual.' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.661 NAME 'germanBankAccountNumber
+ ' DESC 'The 8-digits number of a german bank account without spaces' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.36{10} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.662 NAME 'germanBankCode' DESC 'T
+ he 8-digits number of a german bank code (BLZ) without spaces' SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.36{8} SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.663 NAME 'germanBankName' DESC 'T
+ he name of a german bank registered in the BLZ table published by Deutsche 
+ Bundesbank.' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.664 NAME 'germanBankAccountInfo' 
+ DESC 'Composed field containing a one-line human-readable representation of
+  all necessary information.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.665 NAME 'germanBankAccountHolder
+ ' DESC 'The name of the holder of a german bank account commonly used as re
+ cipient name.' SUP name SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.18 NAME 'intlMailAddr' DESC 'Inte
+ rnationalized Email Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs
+ tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.1 NAME 'oathSecret' DESC 'OA
+ TH-LDAP: Shared Secret (possibly encrypted with public key in oathEncCert)'
+  EQUALITY octetStringMatch SUBSTR octetStringSubstringsMatch SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.40{2000} SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.2 NAME 'oathTokenSerialNumbe
+ r' DESC 'OATH-LDAP: Proprietary hardware token serial number assigned by ve
+ ndor' SUP serialNumber SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.3 NAME 'oathTokenIdentifier'
+  DESC 'OATH-LDAP: Globally unique OATH token identifier' SUP uniqueIdentifi
+ er SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.4 NAME 'oathParamsEntry' DES
+ C 'OATH-LDAP: DN pointing to OATH parameter/policy object' SUP distinguishe
+ dName SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.5 NAME 'oathOTPLength' DESC 
+ 'OATH-LDAP: Length of OTP (number of digits)' EQUALITY integerMatch ORDERIN
+ G integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-
+ ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.6 NAME 'oathHMACAlgorithm' D
+ ESC 'OATH-LDAP: HMAC algorithm used for generating OTP values' EQUALITY obj
+ ectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE X-ORIG
+ IN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.7 NAME 'oathTimestamp' DESC 
+ 'OATH-LDAP: Timestamp (not directly used).' EQUALITY generalizedTimeMatch O
+ RDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 S
+ INGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.7.1 NAME 'oathLastFailure' D
+ ESC 'OATH-LDAP: Timestamp of last failed OATH validation' SUP oathTimestamp
+  SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.7.2 NAME 'oathLastLogin' DES
+ C 'OATH-LDAP: Timestamp of last successful OATH validation' SUP oathTimesta
+ mp SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.7.3 NAME 'oathSecretTime' DE
+ SC 'OATH-LDAP: Timestamp of generation of oathSecret attribute.' SUP oathTi
+ mestamp SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.8 NAME 'oathSecretMaxAge' DE
+ SC 'OATH-LDAP: Time in seconds for which the shared secret (oathSecret) wil
+ l be valid from oathSecretTime value.' EQUALITY integerMatch ORDERING integ
+ erOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 
+ 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.11 NAME 'oathSecretLength' D
+ ESC 'OATH-LDAP: Length of plain-text shared secret (number of bytes)' EQUAL
+ ITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.9 NAME 'oathToken' DESC 'OAT
+ H-LDAP: DN pointing to OATH token object' SUP distinguishedName SINGLE-VALU
+ E X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10 NAME 'oathCounter' DESC '
+ OATH-LDAP: Counter for OATH data (not directly used)' EQUALITY integerMatch
+  ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-
+ VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10.1 NAME 'oathFailureCount'
+  DESC 'OATH-LDAP: OATH failure counter' SUP oathCounter SINGLE-VALUE X-ORIG
+ IN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10.7 NAME 'oathMaxUsageCount
+ ' DESC 'OATH-LDAP: Maximum number of times a token can be used' SUP oathCou
+ nter SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10.5 NAME 'oathThrottleLimit
+ ' DESC 'OATH-LDAP: Failure throttle limit' SUP oathCounter SINGLE-VALUE X-O
+ RIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.12 NAME 'oathEncCert' DESC '
+ OATH-LDAP: X.509 public key certificate to be used for encrypting new share
+ d secrets' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .8 SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.14 NAME 'oathTokenPIN' DESC 
+ 'OATH-LDAP: Configuration PIN (possibly encrypted with oathEncCert)' EQUALI
+ TY octetStringMatch SUBSTR octetStringSubstringsMatch SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.40{2000} SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.13 NAME 'oathResultCode' DES
+ C 'OATH-LDAP: LDAP resultCode to use in response' EQUALITY integerMatch ORD
+ ERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALU
+ E X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.13.1 NAME 'oathSuccessResult
+ Code' DESC 'OATH-LDAP: success resultCode to use in bind/compare response' 
+ SUP oathResultCode X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.13.2 NAME 'oathFailureResult
+ Code' DESC 'OATH-LDAP: failure resultCode to use in bind/compare response' 
+ SUP oathResultCode X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.15 NAME 'oathMessage' DESC '
+ OATH-LDAP: success diagnosticMessage to use in bind/compare response' EQUAL
+ ITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.15{1024} SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.15.1 NAME 'oathSuccessMessag
+ e' DESC 'OATH-LDAP: success diagnosticMessage to use in bind/compare respon
+ se' SUP oathMessage X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.15.2 NAME 'oathFailureMessag
+ e' DESC 'OATH-LDAP: failure diagnosticMessage to use in bind/compare respon
+ se' SUP oathMessage X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.9.1 NAME 'oathHOTPToken' DES
+ C 'OATH-LDAP: DN pointing to OATH/HOTP token object' SUP oathToken SINGLE-V
+ ALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10.2 NAME 'oathHOTPCounter' 
+ DESC 'OATH-LDAP: Counter for HOTP' SUP oathCounter SINGLE-VALUE X-ORIGIN 'O
+ ATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10.3 NAME 'oathHOTPLookAhead
+ ' DESC 'OATH-LDAP: Look-ahead window for HOTP' SUP oathCounter SINGLE-VALUE
+  X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.5.1 NAME 'oathHOTPParams' DE
+ SC 'OATH-LDAP: DN pointing to HOTP parameter object' SUP oathParamsEntry SI
+ NGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.5.2 NAME 'oathTOTPParams' DE
+ SC 'OATH-LDAP: DN pointing to TOTP parameter object' SUP oathParamsEntry SI
+ NGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.9.2 NAME 'oathTOTPToken' DES
+ C 'OATH-LDAP: DN pointing to OATH/TOTP token object' SUP oathToken SINGLE-V
+ ALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.4.1 NAME 'oathTOTPTimeStepPe
+ riod' DESC 'OATH-LDAP: Time window for TOTP (seconds)' EQUALITY integerMatc
+ h ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE
+ -VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4226.4.10.6 NAME 'oathTOTPLastTimeS
+ tep' DESC 'OATH-LDAP: Last time step seen for TOTP (time/period)' SUP oathC
+ ounter SINGLE-VALUE X-ORIGIN 'OATH-LDAP' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.42.1 DESC 'Test attribute type with
+ out NAME' SUP name )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.42.2 NAME 'X-experimentalFlag' DESC
+  'Test attribute type with Boolean syntax' EQUALITY booleanMatch SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.42.3 DESC 'Test attribute type with
+  "double quotes" in DESC' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.330 NAME 'msPwdResetPasswordHash'
+  DESC 'Non-salted hash of temporary reset password (hex-bytes)' EQUALITY ca
+ seIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.331 NAME 'msPwdResetTimestamp' DE
+ SC 'Time at which the temporary password was set.' EQUALITY generalizedTime
+ Match ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121
+ .1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.332 NAME 'msPwdResetExpirationTim
+ e' DESC 'Time until the temporary password will be valid.' EQUALITY general
+ izedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.24 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.333 NAME 'msPwdResetEnabled' DESC
+  'Flag which finally enables password reset.' EQUALITY booleanMatch SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.334 NAME 'msPwdResetAdminPw' DESC
+  'Clear-text part of temporary password to be read by admin' EQUALITY caseI
+ gnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.335 NAME 'msPwdResetMaxAge' DESC 
+ 'Time span (secs) after which the temporary password will be invalid.' EQUA
+ LITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.336 NAME 'msPwdResetHashAlgorithm
+ ' DESC 'Hash algorithm used for the temporary passwords' EQUALITY objectIde
+ ntifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.337 NAME 'msPwdResetPwLen' DESC '
+ Length of generated reset password' EQUALITY integerMatch ORDERING integerO
+ rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.4.338 NAME 'msPwdResetAdminPwLen' D
+ ESC 'Length of admin password part of generated reset password (must be les
+ ser than msPwdResetPwLen)' EQUALITY integerMatch ORDERING integerOrderingMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.42 NAME 'aeRoot' DESC 'AE-DIR
+ : DN of aeRoot entry (to be placed in rootDSE)' SUP distinguishedName SINGL
+ E-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.43 NAME 'defaultNamingContext
+ ' DESC 'DN of default search base (to be placed in rootDSE)' SUP distinguis
+ hedName SINGLE-VALUE )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.1 NAME 'aeOwnerGroup' DESC 'A
+ E-DIR: DN of owner group entry' SUP owner X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.3 NAME 'aeTicketId' DESC 'AE-
+ DIR: Tracker ticket related to last change' EQUALITY caseIgnoreIA5Match SUB
+ STR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{20} S
+ INGLE-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.5 NAME 'aeStatus' DESC 'AE-DI
+ R: Status of an entry (-1, 0, 1, 2)' EQUALITY integerMatch ORDERING integer
+ OrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'A
+ E-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.16 NAME 'aePerson' DESC 'AE-D
+ IR: DN of referenced person entry' SUP distinguishedName SINGLE-VALUE X-ORI
+ GIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.20 NAME 'aeVisibleGroups' DES
+ C 'AE-DIR: DN(s) of group entries usable with a certain server group, serve
+ r, or service' SUP distinguishedName X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.30 NAME 'aeDisplayNameGroups'
+  DESC 'AE-DIR: DN(s) of group entries for which member personalnames are di
+ splayed' SUP distinguishedName X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.21 NAME 'aeVisibleSudoers' DE
+ SC 'AE-DIR: DN(s) of sudoer entries usable with a certain server group or s
+ erver' SUP distinguishedName X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.22 NAME 'aeNotBefore' DESC 'A
+ E-DIR: Begin of time interval for which the entry is valid' EQUALITY genera
+ lizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.24 SINGLE-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.23 NAME 'aeNotAfter' DESC 'AE
+ -DIR: End of time interval for which the entry is valid' EQUALITY generaliz
+ edTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.24 SINGLE-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.8 NAME 'aeRemoteHost' DESC 'A
+ E-DIR: Remote host (client IP or FQDN) used during login' EQUALITY caseIgno
+ reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.
+ 15{256} X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.9 NAME 'aeSourceUri' DESC 'AE
+ -DIR: URI of data source for synced person entry' SUP labeledURI X-ORIGIN '
+ AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.24 NAME 'aeTag' DESC 'AE-DIR:
+  cn of referenced aeTag entry' SUP name X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17 NAME 'aePosixId' DESC 'AE-
+ DIR: POSIX id value' EQUALITY integerMatch ORDERING integerOrderingMatch SY
+ NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17.1 NAME 'aeUidNumberMin' DE
+ SC 'AE-DIR: minimum uidNumber value' SUP aePosixId SINGLE-VALUE X-ORIGIN 'A
+ E-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17.2 NAME 'aeUidNumberMax' DE
+ SC 'AE-DIR: maximum uidNumber value' SUP aePosixId SINGLE-VALUE X-ORIGIN 'A
+ E-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17.3 NAME 'aeUidNumberNext' D
+ ESC 'AE-DIR: next uidNumber value' OBSOLETE SUP aePosixId SINGLE-VALUE X-OR
+ IGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17.4 NAME 'aeGidNumberMin' DE
+ SC 'AE-DIR: minimum gidNumber value' SUP aePosixId SINGLE-VALUE X-ORIGIN 'A
+ E-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17.5 NAME 'aeGidNumberMax' DE
+ SC 'AE-DIR: maximum gidNumber value' SUP aePosixId SINGLE-VALUE X-ORIGIN 'A
+ E-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.17.6 NAME 'aeGidNumberNext' D
+ ESC 'AE-DIR: next gidNumber value' OBSOLETE SUP aePosixId SINGLE-VALUE X-OR
+ IGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.29 NAME 'aeDept' DESC 'AE-DIR
+ : Associated department of aePerson, aeZone, etc.' SUP distinguishedName X-
+ ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.31 NAME 'aeZoneAdmins' DESC '
+ AE-DIR: DN of groups of users entitled zone admin' SUP distinguishedName X-
+ ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.32 NAME 'aeZoneAuditors' DESC
+  'AE-DIR: DN of groups of users entitled zone auditor' SUP distinguishedNam
+ e X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.33 NAME 'aePasswordAdmins' DE
+ SC 'AE-DIR: DN of groups of users allowed to set personal user account pass
+ words' SUP distinguishedName X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.4 NAME 'aeLoginGroups' DESC '
+ AE-DIR: DN of groups of users allowed to do SSH login' SUP distinguishedNam
+ e X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.6 NAME 'aeSetupGroups' DESC '
+ AE-DIR: DN of groups of users allowed to deploy machine' SUP distinguishedN
+ ame X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.7 NAME 'aeLogStoreGroups' DES
+ C 'AE-DIR: DN of groups of users allowed to deploy machine' SUP distinguish
+ edName X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.15 NAME 'aeLogStorePeriod' DE
+ SC 'AE-DIR: Retention period for log files (seconds, -1=unlimited)' EQUALIT
+ Y integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.25 NAME 'aeProxyFor' DESC 'AE
+ -DIR: DN of server groups this server group is proxy for' SUP distinguished
+ Name X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.26 NAME 'aeSSHProxyCommand' D
+ ESC 'AE-DIR: SSH proxy command to be used to connect to server within this 
+ server group' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN
+ TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.27 NAME 'aeSrvGroup' DESC 'AE
+ -DIR: DN of server group this server also is member of' SUP distinguishedNa
+ me X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.28 NAME 'aeHost' DESC 'AE-DIR
+ : DN of aeHost entry' SUP distinguishedName X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.10 NAME 'aeFqdn' DESC 'AE-DIR
+ : Arbitrary fully-qualified domain name (IDNA)' SUP associatedDomain SINGLE
+ -VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.11 NAME 'aeStockId' DESC 'AE-
+ DIR: inventory number' SUP uniqueIdentifier SINGLE-VALUE X-ORIGIN 'AE-DIR' 
+ )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.12 NAME 'aeHwSerialNumber' DE
+ SC 'AE-DIR: Serial number of manufacturer' SUP serialNumber SINGLE-VALUE X-
+ ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.13 NAME 'aeDeviceSlot' DESC '
+ AE-DIR: Slot for adaptor card' SUP name SINGLE-VALUE X-ORIGIN 'AE-DIR' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.14 NAME 'aeDevicePort' DESC '
+ AE-DIR: Port label for adaptor card' SUP name SINGLE-VALUE X-ORIGIN 'AE-DIR
+ ' )
+attributeTypes: ( 1.3.6.1.4.1.5427.1.389.100.4.34 NAME 'aeNwDevice' DESC 'AE
+ -DIR: (Physical) device(s) for e.g. bridge interfaces' SUP distinguishedNam
+ e X-ORIGIN 'AE-DIR' )
+cn: Subschema
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.24 NAME 'aeTag-dcr' NOT uniq
+ ueIdentifier )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.26 NAME 'aePolicy-dcr' AUX (
+  pwdPolicy $ oathHOTPParams $ oathTOTPParams $ msPwdResetPolicy ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.22 NAME 'aeRoot-dcr' AUX aeP
+ osixIdRanges NOT ( businessCategory $ destinationIndicator $ facsimileTelep
+ honeNumber $ internationaliSDNNumber $ l $ physicalDeliveryOfficeName $ pos
+ talAddress $ postalCode $ postOfficeBox $ preferredDeliveryMethod $ registe
+ redAddress $ searchGuide $ seeAlso $ st $ street $ teletexTerminalIdentifie
+ r $ telexNumber $ userPassword $ x121Address ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.29 NAME 'aeDept-dcr' AUX lab
+ eledURIObject NOT ( businessCategory $ destinationIndicator $ international
+ iSDNNumber $ postOfficeBox $ preferredDeliveryMethod $ registeredAddress $ 
+ searchGuide $ seeAlso $ st $ teletexTerminalIdentifier $ telexNumber $ user
+ Password $ x121Address ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.20 NAME 'aeZone-dcr' AUX aeP
+ osixIdRanges NOT uniqueIdentifier )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.1 NAME 'aeGroup-dcr' AUX mai
+ lboxRelatedObject NOT ( businessCategory $ o $ ou $ owner $ seeAlso $ userP
+ assword ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.7 NAME 'aeSudoRule-dcr' NOT 
+ sudoOrder )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.2 NAME 'aeUser-dcr' AUX ( po
+ sixAccount $ inetLocalMailRecipient $ pkiUser $ ldapPublicKey $ msPwdResetO
+ bject $ oathHOTPUser $ oathTOTPUser ) NOT ( audio $ businessCategory $ carL
+ icense $ destinationIndicator $ facsimileTelephoneNumber $ homePhone $ home
+ PostalAddress $ host $ l $ labeledURI $ manager $ o $ ou $ telephoneNumber 
+ $ initials $ internationaliSDNNumber $ jpegPhoto $ pager $ photo $ physical
+ DeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox $ preferred
+ DeliveryMethod $ preferredLanguage $ registeredAddress $ roomNumber $ secre
+ tary $ st $ street $ teletexTerminalIdentifier $ telexNumber $ title $ user
+ PKCS12 $ userSMIMECertificate $ x121Address $ x500UniqueIdentifier $ depart
+ mentNumber $ employeeNumber $ employeeType $ seeAlso $ mobile ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.5 NAME 'aeMailbox-dcr' AUX (
+  inetLocalMailRecipient $ mailboxRelatedObject ) NOT ( l $ ou $ seeAlso ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.6.1 NAME 'aeHost-dcr' AUX ( 
+ posixAccount $ ldapPublicKey $ pkiUser $ ipHost ) NOT ( o $ ou $ owner $ se
+ eAlso ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.6.2 NAME 'aeNwDevice-dcr' AU
+ X ( ipHost $ ieee802Device $ bootableDevice ) NOT ( l $ o $ ou ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.8 NAME 'aePerson-dcr' AUX ms
+ Person NOT ( audio $ carLicense $ destinationIndicator $ homePostalAddress 
+ $ host $ initials $ internationaliSDNNumber $ pager $ photo $ preferredDeli
+ veryMethod $ registeredAddress $ secretary $ teletexTerminalIdentifier $ te
+ lexNumber $ uid $ userSMIMECertificate $ x121Address $ x500UniqueIdentifier
+  $ seeAlso $ userPassword ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.4 NAME 'aeService-dcr' AUX (
+  posixAccount $ inetLocalMailRecipient $ pkiUser $ ldapPublicKey $ oathHOTP
+ User $ oathTOTPUser ) NOT ( host $ l $ o $ ou ) )
+dITContentRules: ( 1.3.6.1.4.1.5427.1.389.100.6.25 NAME 'aeAuthcToken-dcr' A
+ UX ( oathHOTPToken $ oathTOTPToken $ ldapPublicKey $ pkiUser ) NOT ( l $ o 
+ $ ou $ owner $ seeAlso ) )
+dITContentRules: ( 0.9.2342.19200300.100.4.5 NAME 'account-dcr' AUX ( posixA
+ ccount $ sambaSamAccount $ vPIMUser $ inetLocalMailRecipient $ pkiUser $ sh
+ adowAccount $ simpleSecurityObject $ pwdPolicy $ ldapPublicKey $ msPwdReset
+ Object $ dynamicObject $ labeledURIObject $ dynamicObject $ oathHOTPUser $ 
+ oathTOTPUser ) )
+dITContentRules: ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson-dcr' AUX ( ms
+ Person $ musician $ germanBankArrangement $ pkiUser $ cmuSaslUser $ posixAc
+ count $ sambaSamAccount $ vPIMUser $ inetLocalMailRecipient $ shadowAccount
+  $ simpleSecurityObject $ pwdPolicy $ msPwdResetObject $ eduPerson $ schacP
+ ersonalCharacteristics $ ldapPublicKey $ schacExperimentalOC $ dynamicObjec
+ t $ oathHOTPUser $ oathTOTPUser $ DKIM ) NOT x121Address )
+dITContentRules: ( 0.9.2342.19200300.100.4.13 NAME 'domain-dcr' AUX ( dcObje
+ ct $ domainRelatedObject $ labeledURIObject $ DKIM ) )
+dITContentRules: ( 2.5.6.4 NAME 'organization-dcr' AUX ( msOrganization $ do
+ mainRelatedObject $ labeledURIObject $ germanBankArrangement ) )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-READAB
+ LE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-READA
+ BLE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' X-BINARY-TRA
+ NSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' X-BINAR
+ Y-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' X-BINA
+ RY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.1 DESC 'X.509 AttributeCertific
+ ate' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )
+ldapSyntaxes: ( 1.2.36.79672281.1.5.0 DESC 'RDN' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Numb
+ er' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-READAB
+ LE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' X-B
+ INARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )
+ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )
+ldapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' )
+ldapSyntaxes: ( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )
+ldapSyntaxes: ( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' )
+ldapSyntaxes: ( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.2 DESC 'AttributeCertificate Ex
+ act Assertion' )
+ldapSyntaxes: ( 1.3.6.1.1.16.1 DESC 'UUID' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.4 DESC 'X.509 PMI attribute car
+ tificate path: SEQUENCE OF AttributeCertificate' X-SUBST '1.3.6.1.4.1.1466.
+ 115.121.1.15' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.5 DESC 'X.509 PMI policy syntax
+ ' X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.6 DESC 'X.509 PMI role syntax' 
+ X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )
+ldapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.5.3.1 DESC 'Control' )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.11.2.5 NAME 'CSNSIDMatch' APPLIES ( 
+ entryCSN $ namingCSN $ contextCSN ) )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.11.2.3 NAME 'CSNOrderingMatch' APPLI
+ ES ( entryCSN $ namingCSN $ contextCSN ) )
+matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES (
+  supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $
+  olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubst
+ rIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrA
+ nyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDep
+ th $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncoming
+ Auth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbMaxReaders $ ol
+ cDbMaxSize $ olcDbRtxnSize $ olcDbSearchStack $ olcDbCacheFree $ olcDbCache
+ Size $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbShmKey $ olcDbProtocolVe
+ rsion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ monitorCounter 
+ $ monitorOpCompleted $ monitorOpInitiated $ monitorConnectionNumber $ monit
+ orConnectionOpsReceived $ monitorConnectionOpsExecuting $ monitorConnection
+ OpsPending $ monitorConnectionOpsCompleted $ monitorConnectionGet $ monitor
+ ConnectionRead $ monitorConnectionWrite $ reqResult $ reqId $ reqVersion $ 
+ reqSizeLimit $ reqTimeLimit $ reqEntries $ olcSpSessionlog $ olcSssVlvMax $
+  olcSssVlvMaxKeys $ olcSssVlvMaxPerConn $ olcDDSmaxDynamicObjects $ olcLast
+ BindPrecision $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shado
+ wMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServi
+ cePort $ ipProtocolNumber $ oncRpcNumber $ pwdMinAge $ pwdMaxAge $ pwdInHis
+ tory $ pwdCheckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLim
+ it $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMaxR
+ ecordedFailure $ searchTimeLimit $ bindTimeLimit $ profileTTL $ schacGender
+  $ dNSTTL $ SolarisCacheTTL $ SolarisSearchTimeLimit $ sambaPwdLastSet $ sa
+ mbaPwdCanChange $ sambaPwdMustChange $ sambaLogonTime $ sambaLogoffTime $ s
+ ambaKickoffTime $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaGroup
+ Type $ sambaNextUserRid $ sambaNextGroupRid $ sambaNextRid $ sambaAlgorithm
+ icRidBase $ sambaIntegerOption $ sambaMinPwdLength $ sambaPwdHistoryLength 
+ $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDurati
+ on $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLogo
+ ff $ sambaRefuseMachinePwdChange $ sambaTrustType $ sambaTrustAttributes $ 
+ sambaTrustDirection $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes
+  $ krb5KeyVersionNumber $ krb5MaxLife $ krb5MaxRenew $ krb5KDCFlags $ krb5E
+ ncryptionType $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbM
+ axRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMin
+ DiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbP
+ wdFailureCountInterval $ krbPwdLockoutDuration $ krbPwdAttributes $ krbPwdM
+ axLife $ krbPwdMaxRenewableLife $ krbLoginFailedCount $ dhcpNetMask $ dhcpD
+ nsStatus $ dhcpDelayedServiceParameter $ dhcpMaxClientLeadTime $ dhcpFailOv
+ erPrimaryPort $ dhcpFailOverSecondaryPort $ dhcpFailOverResponseDelay $ dhc
+ pFailOverUnackedUpdates $ dhcpFailOverSplit $ dhcpFailOverLoadBalanceTime $
+  dlzSerial $ dlzRefresh $ dlzRetry $ dlzExpire $ dlzMinimum $ dlzPreference
+  $ dlzTTL $ x509CRLNumber $ x509CRLDeltaIndicator $ x509CRLCertReasonCode $
+  x509version $ x509serialNumber $ x509authorityCertSerialNumber $ x509ACHol
+ derPKCSerialNumber $ x509ACDigestedObjectType $ vPIMMaxMessageSize $ dlmDed
+ icated $ dlmBiometric $ pcimRuleEnabled $ pcimConditionGroupNumber $ pcimAc
+ tionOrder $ pcelsDecisionStrategy $ pcelsPriority $ pcelsConditionListType 
+ $ pcelsSequencedActions $ pcelsExecutionStrategy $ pcelsIPHdrVersion $ pcel
+ sIPHdrProtocolID $ pcelsIPHdrSourcePortStart $ pcelsIPHdrSourcePortEnd $ pc
+ elsIPHdrDestPortStart $ pcelsIPHdrDestPortEnd $ pcelsIPHdrDSCPList $ pcels8
+ 021HdrProtocolID $ pcels8021HdrPriority $ pcels8021HdrVLANID $ pcelsFilterD
+ irection $ sudoOrder $ fedfsFsnTTL $ fedfsNfsCurrency $ fedfsNfsClassSimul 
+ $ fedfsNfsClassHandle $ fedfsNfsClassFileid $ fedfsNfsClassWritever $ fedfs
+ NfsClassChange $ fedfsNfsClassReaddir $ fedfsNfsReadRank $ fedfsNfsReadOrde
+ r $ fedfsNfsWriteRank $ fedfsNfsWriteOrder $ fedfsNfsValidFor $ radiusSimul
+ taneousUse $ gender $ oathOTPLength $ oathSecretMaxAge $ oathSecretLength $
+  oathCounter $ oathFailureCount $ oathMaxUsageCount $ oathThrottleLimit $ o
+ athResultCode $ oathSuccessResultCode $ oathFailureResultCode $ oathHOTPCou
+ nter $ oathHOTPLookAhead $ oathTOTPTimeStepPeriod $ oathTOTPLastTimeStep $ 
+ msPwdResetMaxAge $ msPwdResetPwLen $ msPwdResetAdminPwLen $ aeStatus $ aePo
+ sixId $ aeUidNumberMin $ aeUidNumberMax $ aeUidNumberNext $ aeGidNumberMin 
+ $ aeGidNumberMax $ aeGidNumberNext $ aeLogStorePeriod ) )
+matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES 
+ ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency 
+ $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubs
+ trIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstr
+ AnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDe
+ pth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomin
+ gAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbMaxReaders $ o
+ lcDbMaxSize $ olcDbRtxnSize $ olcDbSearchStack $ olcDbCacheFree $ olcDbCach
+ eSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbShmKey $ olcDbProtocolV
+ ersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ monitorCounter
+  $ monitorOpCompleted $ monitorOpInitiated $ monitorConnectionNumber $ moni
+ torConnectionOpsReceived $ monitorConnectionOpsExecuting $ monitorConnectio
+ nOpsPending $ monitorConnectionOpsCompleted $ monitorConnectionGet $ monito
+ rConnectionRead $ monitorConnectionWrite $ reqResult $ reqId $ reqVersion $
+  reqSizeLimit $ reqTimeLimit $ reqEntries $ olcSpSessionlog $ olcSssVlvMax 
+ $ olcSssVlvMaxKeys $ olcSssVlvMaxPerConn $ olcDDSmaxDynamicObjects $ olcLas
+ tBindPrecision $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shad
+ owMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServ
+ icePort $ ipProtocolNumber $ oncRpcNumber $ pwdMinAge $ pwdMaxAge $ pwdInHi
+ story $ pwdCheckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLi
+ mit $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMax
+ RecordedFailure $ searchTimeLimit $ bindTimeLimit $ profileTTL $ schacGende
+ r $ dNSTTL $ SolarisCacheTTL $ SolarisSearchTimeLimit $ sambaPwdLastSet $ s
+ ambaPwdCanChange $ sambaPwdMustChange $ sambaLogonTime $ sambaLogoffTime $ 
+ sambaKickoffTime $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaGrou
+ pType $ sambaNextUserRid $ sambaNextGroupRid $ sambaNextRid $ sambaAlgorith
+ micRidBase $ sambaIntegerOption $ sambaMinPwdLength $ sambaPwdHistoryLength
+  $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDurat
+ ion $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLog
+ off $ sambaRefuseMachinePwdChange $ sambaTrustType $ sambaTrustAttributes $
+  sambaTrustDirection $ sambaTrustPosixOffset $ sambaSupportedEncryptionType
+ s $ krb5KeyVersionNumber $ krb5MaxLife $ krb5MaxRenew $ krb5KDCFlags $ krb5
+ EncryptionType $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krb
+ MaxRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMi
+ nDiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krb
+ PwdFailureCountInterval $ krbPwdLockoutDuration $ krbPwdAttributes $ krbPwd
+ MaxLife $ krbPwdMaxRenewableLife $ krbLoginFailedCount $ dhcpNetMask $ dhcp
+ DnsStatus $ dhcpDelayedServiceParameter $ dhcpMaxClientLeadTime $ dhcpFailO
+ verPrimaryPort $ dhcpFailOverSecondaryPort $ dhcpFailOverResponseDelay $ dh
+ cpFailOverUnackedUpdates $ dhcpFailOverSplit $ dhcpFailOverLoadBalanceTime 
+ $ dlzSerial $ dlzRefresh $ dlzRetry $ dlzExpire $ dlzMinimum $ dlzPreferenc
+ e $ dlzTTL $ x509CRLNumber $ x509CRLDeltaIndicator $ x509CRLCertReasonCode 
+ $ x509version $ x509serialNumber $ x509authorityCertSerialNumber $ x509ACHo
+ lderPKCSerialNumber $ x509ACDigestedObjectType $ vPIMMaxMessageSize $ dlmDe
+ dicated $ dlmBiometric $ pcimRuleEnabled $ pcimConditionGroupNumber $ pcimA
+ ctionOrder $ pcelsDecisionStrategy $ pcelsPriority $ pcelsConditionListType
+  $ pcelsSequencedActions $ pcelsExecutionStrategy $ pcelsIPHdrVersion $ pce
+ lsIPHdrProtocolID $ pcelsIPHdrSourcePortStart $ pcelsIPHdrSourcePortEnd $ p
+ celsIPHdrDestPortStart $ pcelsIPHdrDestPortEnd $ pcelsIPHdrDSCPList $ pcels
+ 8021HdrProtocolID $ pcels8021HdrPriority $ pcels8021HdrVLANID $ pcelsFilter
+ Direction $ sudoOrder $ fedfsFsnTTL $ fedfsNfsCurrency $ fedfsNfsClassSimul
+  $ fedfsNfsClassHandle $ fedfsNfsClassFileid $ fedfsNfsClassWritever $ fedf
+ sNfsClassChange $ fedfsNfsClassReaddir $ fedfsNfsReadRank $ fedfsNfsReadOrd
+ er $ fedfsNfsWriteRank $ fedfsNfsWriteOrder $ fedfsNfsValidFor $ radiusSimu
+ ltaneousUse $ gender $ oathOTPLength $ oathSecretMaxAge $ oathSecretLength 
+ $ oathCounter $ oathFailureCount $ oathMaxUsageCount $ oathThrottleLimit $ 
+ oathResultCode $ oathSuccessResultCode $ oathFailureResultCode $ oathHOTPCo
+ unter $ oathHOTPLookAhead $ oathTOTPTimeStepPeriod $ oathTOTPLastTimeStep $
+  msPwdResetMaxAge $ msPwdResetPwLen $ msPwdResetAdminPwLen $ aeStatus $ aeP
+ osixId $ aeUidNumberMin $ aeUidNumberMax $ aeUidNumberNext $ aeGidNumberMin
+  $ aeGidNumberMax $ aeGidNumberNext $ aeLogStorePeriod ) )
+matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPL
+ IES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ 
+ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetM
+ ailbox $ mailLocalAddress $ mailHost $ mailRoutingAddress $ rfc822MailMembe
+ r $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ip
+ HostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ ni
+ sMapEntry $ javaCodebase $ javaDoc $ corbaIor $ pwdCheckModule $ attributeM
+ ap $ credentialLevel $ objectclassMap $ defaultSearchScope $ serviceCredent
+ ialLevel $ eduOrgHomePageURI $ eduOrgIdentityAuthNPolicyURI $ eduOrgSuperio
+ rURI $ eduOrgWhitePagesURI $ schacUserPrivateAttribute $ dNSClass $ wKSReco
+ rd $ pTRRecord $ hInfoRecord $ mInfoRecord $ tXTRecord $ rPRecord $ aFSDBRe
+ cord $ SigRecord $ KeyRecord $ gPosRecord $ aAAARecord $ LocRecord $ nXTRec
+ ord $ sRVRecord $ nAPTRRecord $ kXRecord $ certRecord $ a6Record $ dNameRec
+ ord $ aPLRecord $ dSRecord $ sSHFPRecord $ iPSecKeyRecord $ rRSIGRecord $ n
+ SECRecord $ dNSKeyRecord $ dHCIDRecord $ nSec3ParamRecord $ TLSARecord $ sP
+ FRecord $ CAARecord $ DLVRecord $ nisPublickey $ nisSecretkey $ mgrpRFC822M
+ ailMember $ nisNetIdUser $ nisNetIdGroup $ nisNetIdHost $ mozillaSecondEmai
+ l $ homeurl $ workurl $ custom1 $ custom2 $ custom3 $ custom4 $ sambaLMPass
+ word $ sambaNTPassword $ sambaAcctFlags $ sambaLogonHours $ sambaHomeDrive 
+ $ sambaPasswordHistory $ sambaSID $ sambaPrimaryGroupSID $ sambaSIDList $ s
+ ambaStringOption $ sambaTrustFlags $ sambaSecurityIdentifier $ krb5Principa
+ lName $ krbPrincipalName $ krbCanonicalName $ krbHostServer $ krbPwdAllowed
+ Keysalts $ krbPrincipalAliases $ krbAllowedToDelegateTo $ esgContactMail $ 
+ dhcpStatements $ dhcpRange $ dhcpPermitList $ dhcpOption $ dhcpClassData $ 
+ dhcpVersion $ dhcpImplementation $ dhcpAddressState $ dhcpDomainName $ dhcp
+ RequestedHostName $ dhcpAssignedHostName $ dhcpHWAddress $ dhcpFailOverEndp
+ ointState $ dhcpErrorLog $ dhcpKeyAlgorithm $ dhcpDnsZoneServer $ dhcpFailO
+ verPrimaryServer $ dhcpFailOverSecondaryServer $ dhcpComments $ dlzIPAddr $
+  automountMapName $ automountKey $ automountInformation $ x509CRLDPRfc822Na
+ me $ x509CRLDPDnsName $ x509CRLDPURI $ x509CRLDPIpAddress $ x509CRLCertIssu
+ erRfc822Name $ x509CRLCertIssuerDnsName $ x509CRLCertIssuerURI $ x509CRLCer
+ tIssuerIpAddress $ x509subjectRfc822Name $ x509subjectDnsName $ x509subject
+ UniformResourceIdentifier $ x509subjectIpAddress $ x509issuerRfc822Name $ x
+ 509issuerDnsName $ x509issuerUniformResourceIdentifier $ x509issuerIpAddres
+ s $ x509fullCRLDistributionPointURI $ x509ACHolderRfc822Name $ x509ACHolder
+ DNSName $ x509ACHolderURI $ x509ACHolderIPAddress $ x509ACTargetRfc822Name 
+ $ x509ACTargetDNSName $ x509ACTargetURI $ x509ACTargetIPAddress $ x509ACTar
+ getGroupRfc822Name $ x509ACTargetGroupDNSName $ x509ACTargetGroupURI $ x509
+ ACTargetGroupIPAddress $ x509DPRfc822Name $ x509DPDNSName $ x509DPURI $ x50
+ 9DPIPAddress $ x509DPissuerRfc822Name $ x509DPissuerDNSName $ x509DPissuerU
+ RI $ x509DPissuerIPAddress $ vPIMRfc822Mailbox $ vPIMSupportedAudioMediaTyp
+ es $ vPIMSupportedMessageContext $ vPIMExtendedAbsenceStatus $ vPIMSupporte
+ dUABehaviors $ pgpKey $ hordePrefs $ impPrefs $ turbaPrefs $ turbaType $ tu
+ rbaPGPPublicKey $ kronolithPrefs $ nagPrefs $ gollemPrefs $ choraPrefs $ mn
+ emoPrefs $ trollPrefs $ klutzPrefs $ jonahPrefs $ hermesPrefs $ junoPrefs $
+  treanPrefs $ whupsPrefs $ ingoPrefs $ anselPrefs $ geniePrefs $ scryPrefs 
+ $ wickedPrefs $ agoraPrefs $ goopsPrefs $ merkPrefs $ mimpPrefs $ mottlePre
+ fs $ nicPrefs $ occamPrefs $ odinPrefs $ rakimPrefs $ seshaPrefs $ swooshPr
+ efs $ thorPrefs $ ulaformPrefs $ volosPrefs $ jetaPrefs $ sudoUser $ sudoHo
+ st $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup 
+ $ puppetClass $ parentNode $ environment $ puppetVar $ DKIMSelector $ DKIMK
+ ey $ DKIMIdentity $ DKIMDomain $ quota $ tacacsClient $ tacacsMember $ taca
+ csProfile $ tacacsFlag $ commUniqueId $ commPrivate $ SIPIdentityRegistrarA
+ ddress $ SIPIdentityProxyAddress $ SIPIdentityAddress $ SIPIdentityServiceL
+ evel $ radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ rad
+ iusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStation
+ Id $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusF
+ ilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radius
+ FramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ rad
+ iusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFrame
+ dProtocol $ radiusFramedRoute $ radiusFramedRouting $ radiusGroupName $ rad
+ iusHint $ radiusHuntgroupName $ radiusIdleTimeout $ radiusLoginIPHost $ rad
+ iusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLAT
+ Service $ radiusLoginService $ radiusLoginTCPPort $ radiusPasswordRetry $ r
+ adiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusReplicateToRealm
+  $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusTerminati
+ onAction $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnel
+ Password $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunn
+ elServerEndpoint $ radiusTunnelType $ radiusVSA $ radiusTunnelClientEndpoin
+ t $ radiusLoginTime $ radiusUserCategory $ dialupAccess $ radiusExpiration 
+ $ radiusAttribute $ radiusNASIpAddress $ radiusReplyMessage $ radiusControl
+ Attribute $ radiusReplyAttribute $ radiusRequestAttribute $ dateOfBirth $ e
+ uVATId $ msPwdResetPasswordHash $ msPwdResetAdminPw $ aeTicketId $ aeFqdn )
+  )
+matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLI
+ ES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ a
+ Record $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMa
+ ilbox $ mailLocalAddress $ mailHost $ mailRoutingAddress $ rfc822MailMember
+  $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipH
+ ostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nis
+ MapEntry $ javaCodebase $ javaDoc $ corbaIor $ pwdCheckModule $ attributeMa
+ p $ credentialLevel $ objectclassMap $ defaultSearchScope $ serviceCredenti
+ alLevel $ eduOrgHomePageURI $ eduOrgIdentityAuthNPolicyURI $ eduOrgSuperior
+ URI $ eduOrgWhitePagesURI $ schacUserPrivateAttribute $ dNSClass $ wKSRecor
+ d $ pTRRecord $ hInfoRecord $ mInfoRecord $ tXTRecord $ rPRecord $ aFSDBRec
+ ord $ SigRecord $ KeyRecord $ gPosRecord $ aAAARecord $ LocRecord $ nXTReco
+ rd $ sRVRecord $ nAPTRRecord $ kXRecord $ certRecord $ a6Record $ dNameReco
+ rd $ aPLRecord $ dSRecord $ sSHFPRecord $ iPSecKeyRecord $ rRSIGRecord $ nS
+ ECRecord $ dNSKeyRecord $ dHCIDRecord $ nSec3ParamRecord $ TLSARecord $ sPF
+ Record $ CAARecord $ DLVRecord $ nisPublickey $ nisSecretkey $ mgrpRFC822Ma
+ ilMember $ nisNetIdUser $ nisNetIdGroup $ nisNetIdHost $ mozillaSecondEmail
+  $ homeurl $ workurl $ custom1 $ custom2 $ custom3 $ custom4 $ sambaLMPassw
+ ord $ sambaNTPassword $ sambaAcctFlags $ sambaLogonHours $ sambaHomeDrive $
+  sambaPasswordHistory $ sambaSID $ sambaPrimaryGroupSID $ sambaSIDList $ sa
+ mbaStringOption $ sambaTrustFlags $ sambaSecurityIdentifier $ krb5Principal
+ Name $ krbPrincipalName $ krbCanonicalName $ krbHostServer $ krbPwdAllowedK
+ eysalts $ krbPrincipalAliases $ krbAllowedToDelegateTo $ esgContactMail $ d
+ hcpStatements $ dhcpRange $ dhcpPermitList $ dhcpOption $ dhcpClassData $ d
+ hcpVersion $ dhcpImplementation $ dhcpAddressState $ dhcpDomainName $ dhcpR
+ equestedHostName $ dhcpAssignedHostName $ dhcpHWAddress $ dhcpFailOverEndpo
+ intState $ dhcpErrorLog $ dhcpKeyAlgorithm $ dhcpDnsZoneServer $ dhcpFailOv
+ erPrimaryServer $ dhcpFailOverSecondaryServer $ dhcpComments $ dlzIPAddr $ 
+ automountMapName $ automountKey $ automountInformation $ x509CRLDPRfc822Nam
+ e $ x509CRLDPDnsName $ x509CRLDPURI $ x509CRLDPIpAddress $ x509CRLCertIssue
+ rRfc822Name $ x509CRLCertIssuerDnsName $ x509CRLCertIssuerURI $ x509CRLCert
+ IssuerIpAddress $ x509subjectRfc822Name $ x509subjectDnsName $ x509subjectU
+ niformResourceIdentifier $ x509subjectIpAddress $ x509issuerRfc822Name $ x5
+ 09issuerDnsName $ x509issuerUniformResourceIdentifier $ x509issuerIpAddress
+  $ x509fullCRLDistributionPointURI $ x509ACHolderRfc822Name $ x509ACHolderD
+ NSName $ x509ACHolderURI $ x509ACHolderIPAddress $ x509ACTargetRfc822Name $
+  x509ACTargetDNSName $ x509ACTargetURI $ x509ACTargetIPAddress $ x509ACTarg
+ etGroupRfc822Name $ x509ACTargetGroupDNSName $ x509ACTargetGroupURI $ x509A
+ CTargetGroupIPAddress $ x509DPRfc822Name $ x509DPDNSName $ x509DPURI $ x509
+ DPIPAddress $ x509DPissuerRfc822Name $ x509DPissuerDNSName $ x509DPissuerUR
+ I $ x509DPissuerIPAddress $ vPIMRfc822Mailbox $ vPIMSupportedAudioMediaType
+ s $ vPIMSupportedMessageContext $ vPIMExtendedAbsenceStatus $ vPIMSupported
+ UABehaviors $ pgpKey $ hordePrefs $ impPrefs $ turbaPrefs $ turbaType $ tur
+ baPGPPublicKey $ kronolithPrefs $ nagPrefs $ gollemPrefs $ choraPrefs $ mne
+ moPrefs $ trollPrefs $ klutzPrefs $ jonahPrefs $ hermesPrefs $ junoPrefs $ 
+ treanPrefs $ whupsPrefs $ ingoPrefs $ anselPrefs $ geniePrefs $ scryPrefs $
+  wickedPrefs $ agoraPrefs $ goopsPrefs $ merkPrefs $ mimpPrefs $ mottlePref
+ s $ nicPrefs $ occamPrefs $ odinPrefs $ rakimPrefs $ seshaPrefs $ swooshPre
+ fs $ thorPrefs $ ulaformPrefs $ volosPrefs $ jetaPrefs $ sudoUser $ sudoHos
+ t $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup $
+  puppetClass $ parentNode $ environment $ puppetVar $ DKIMSelector $ DKIMKe
+ y $ DKIMIdentity $ DKIMDomain $ quota $ tacacsClient $ tacacsMember $ tacac
+ sProfile $ tacacsFlag $ commUniqueId $ commPrivate $ SIPIdentityRegistrarAd
+ dress $ SIPIdentityProxyAddress $ SIPIdentityAddress $ SIPIdentityServiceLe
+ vel $ radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radi
+ usAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStationI
+ d $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusFi
+ lterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radiusF
+ ramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ radi
+ usFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFramed
+ Protocol $ radiusFramedRoute $ radiusFramedRouting $ radiusGroupName $ radi
+ usHint $ radiusHuntgroupName $ radiusIdleTimeout $ radiusLoginIPHost $ radi
+ usLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATS
+ ervice $ radiusLoginService $ radiusLoginTCPPort $ radiusPasswordRetry $ ra
+ diusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusReplicateToRealm 
+ $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusTerminatio
+ nAction $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelP
+ assword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunne
+ lServerEndpoint $ radiusTunnelType $ radiusVSA $ radiusTunnelClientEndpoint
+  $ radiusLoginTime $ radiusUserCategory $ dialupAccess $ radiusExpiration $
+  radiusAttribute $ radiusNASIpAddress $ radiusReplyMessage $ radiusControlA
+ ttribute $ radiusReplyAttribute $ radiusRequestAttribute $ dateOfBirth $ eu
+ VATId $ msPwdResetPasswordHash $ msPwdResetAdminPw $ aeTicketId $ aeFqdn ) 
+ )
+matchingRuleUse: ( 2.5.13.45 NAME 'attributeCertificateExactMatch' APPLIES (
+  attributeCertificateAttribute $ aACertificate $ attributeDescriptorCertifi
+ cate $ protPrivPolicy ) )
+matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( auth
+ orityRevocationList $ certificateRevocationList $ deltaRevocationList $ att
+ ributeCertificateRevocationList $ attributeAuthorityRevocationList ) )
+matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCert
+ ificate $ cACertificate $ x509userCert $ x509caCert $ oathEncCert ) )
+matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPL
+ IES ( collectiveExclusions $ supportedControl $ supportedExtension $ suppor
+ tedFeatures $ administrativeRole $ nameForms $ ldapSyntaxes $ reqControls $
+  reqRespControls $ supportedApplicationContext $ x509CRLDPRegisteredID $ x5
+ 09CRLCertIssuerRegisteredID $ x509CRLCertHoldInstructionCode $ x509signatur
+ eAlgorithm $ x509subjectPublicKeyInfoAlgorithm $ x509policyInformationIdent
+ ifier $ x509subjectRegisteredID $ x509issuerRegisteredID $ x509extKeyUsage 
+ $ x509ACHolderRegisteredID $ x509ACDigestAlgorithm $ x509ACTargetRegistered
+ ID $ x509ACTargetGroupRegisteredID $ x509DPRegisteredID $ x509DPissuerRegis
+ teredID $ pcelsVendorVariableEncoding $ pcelsVendorValueEncoding $ oathHMAC
+ Algorithm $ msPwdResetHashAlgorithm ) )
+matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( sup
+ portedLDAPVersion $ dITStructureRules $ entryTtl $ uidNumber $ gidNumber $ 
+ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout
+  $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $
+  olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF 
+ $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSo
+ ckbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcD
+ bMaxReaders $ olcDbMaxSize $ olcDbRtxnSize $ olcDbSearchStack $ olcDbCacheF
+ ree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbShmKey $
+  olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $
+  monitorCounter $ monitorOpCompleted $ monitorOpInitiated $ monitorConnecti
+ onNumber $ monitorConnectionOpsReceived $ monitorConnectionOpsExecuting $ m
+ onitorConnectionOpsPending $ monitorConnectionOpsCompleted $ monitorConnect
+ ionGet $ monitorConnectionRead $ monitorConnectionWrite $ reqResult $ reqId
+  $ reqVersion $ reqSizeLimit $ reqTimeLimit $ reqEntries $ olcSpSessionlog 
+ $ olcSssVlvMax $ olcSssVlvMaxKeys $ olcSssVlvMaxPerConn $ olcDDSmaxDynamicO
+ bjects $ olcLastBindPrecision $ mailPreferenceOption $ shadowLastChange $ s
+ hadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shad
+ owFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ pwdMinAge $ pwdM
+ axAge $ pwdInHistory $ pwdCheckQuality $ pwdMinLength $ pwdExpireWarning $ 
+ pwdGraceAuthNLimit $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountIn
+ terval $ pwdMaxRecordedFailure $ searchTimeLimit $ bindTimeLimit $ profileT
+ TL $ schacGender $ dNSTTL $ SolarisCacheTTL $ SolarisSearchTimeLimit $ samb
+ aPwdLastSet $ sambaPwdCanChange $ sambaPwdMustChange $ sambaLogonTime $ sam
+ baLogoffTime $ sambaKickoffTime $ sambaBadPasswordCount $ sambaBadPasswordT
+ ime $ sambaGroupType $ sambaNextUserRid $ sambaNextGroupRid $ sambaNextRid 
+ $ sambaAlgorithmicRidBase $ sambaIntegerOption $ sambaMinPwdLength $ sambaP
+ wdHistoryLength $ sambaLogonToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sa
+ mbaLockoutDuration $ sambaLockoutObservationWindow $ sambaLockoutThreshold 
+ $ sambaForceLogoff $ sambaRefuseMachinePwdChange $ sambaTrustType $ sambaTr
+ ustAttributes $ sambaTrustDirection $ sambaTrustPosixOffset $ sambaSupporte
+ dEncryptionTypes $ krb5KeyVersionNumber $ krb5MaxLife $ krb5MaxRenew $ krb5
+ KDCFlags $ krb5EncryptionType $ krbPrincipalType $ krbTicketFlags $ krbMaxT
+ icketLife $ krbMaxRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwd
+ Life $ krbPwdMinDiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdM
+ axFailure $ krbPwdFailureCountInterval $ krbPwdLockoutDuration $ krbPwdAttr
+ ibutes $ krbPwdMaxLife $ krbPwdMaxRenewableLife $ krbLoginFailedCount $ dhc
+ pNetMask $ dhcpDnsStatus $ dhcpDelayedServiceParameter $ dhcpMaxClientLeadT
+ ime $ dhcpFailOverPrimaryPort $ dhcpFailOverSecondaryPort $ dhcpFailOverRes
+ ponseDelay $ dhcpFailOverUnackedUpdates $ dhcpFailOverSplit $ dhcpFailOverL
+ oadBalanceTime $ dlzSerial $ dlzRefresh $ dlzRetry $ dlzExpire $ dlzMinimum
+  $ dlzPreference $ dlzTTL $ x509CRLNumber $ x509CRLDeltaIndicator $ x509CRL
+ CertReasonCode $ x509version $ x509serialNumber $ x509authorityCertSerialNu
+ mber $ x509ACHolderPKCSerialNumber $ x509ACDigestedObjectType $ vPIMMaxMess
+ ageSize $ dlmDedicated $ dlmBiometric $ pcimRuleEnabled $ pcimConditionGrou
+ pNumber $ pcimActionOrder $ pcelsDecisionStrategy $ pcelsPriority $ pcelsCo
+ nditionListType $ pcelsSequencedActions $ pcelsExecutionStrategy $ pcelsIPH
+ drVersion $ pcelsIPHdrProtocolID $ pcelsIPHdrSourcePortStart $ pcelsIPHdrSo
+ urcePortEnd $ pcelsIPHdrDestPortStart $ pcelsIPHdrDestPortEnd $ pcelsIPHdrD
+ SCPList $ pcels8021HdrProtocolID $ pcels8021HdrPriority $ pcels8021HdrVLANI
+ D $ pcelsFilterDirection $ sudoOrder $ fedfsFsnTTL $ fedfsNfsCurrency $ fed
+ fsNfsClassSimul $ fedfsNfsClassHandle $ fedfsNfsClassFileid $ fedfsNfsClass
+ Writever $ fedfsNfsClassChange $ fedfsNfsClassReaddir $ fedfsNfsReadRank $ 
+ fedfsNfsReadOrder $ fedfsNfsWriteRank $ fedfsNfsWriteOrder $ fedfsNfsValidF
+ or $ radiusSimultaneousUse $ gender $ oathOTPLength $ oathSecretMaxAge $ oa
+ thSecretLength $ oathCounter $ oathFailureCount $ oathMaxUsageCount $ oathT
+ hrottleLimit $ oathResultCode $ oathSuccessResultCode $ oathFailureResultCo
+ de $ oathHOTPCounter $ oathHOTPLookAhead $ oathTOTPTimeStepPeriod $ oathTOT
+ PLastTimeStep $ msPwdResetMaxAge $ msPwdResetPwLen $ msPwdResetAdminPwLen $
+  aeStatus $ aePosixId $ aeUidNumberMin $ aeUidNumberMax $ aeUidNumberNext $
+  aeGidNumberMin $ aeGidNumberMax $ aeGidNumberNext $ aeLogStorePeriod ) )
+matchingRuleUse: ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' APPLIES ( c
+ reateTimestamp $ modifyTimestamp $ monitorTimestamp $ monitorConnectionStar
+ tTime $ monitorConnectionActivityTime $ reqStart $ reqEnd $ pwdChangedTime 
+ $ pwdAccountLockedTime $ pwdFailureTime $ pwdGraceUseTime $ entryExpireTime
+ stamp $ authTimestamp $ schacExpiryDate $ krb5ValidStart $ krb5ValidEnd $ k
+ rb5PasswordEnd $ krbPrincipalExpiration $ krbPasswordExpiration $ krbLastPw
+ dChange $ krbLastAdminUnlock $ krbLastSuccessfulAuth $ krbLastFailedAuth $ 
+ esgFirstShown $ esgFinalEnd $ dhcpExpirationTime $ dhcpStartTimeOfState $ d
+ hcpLastTransactionTime $ x509CRLThisUpdate $ x509CRLNextUpdate $ x509CRLCer
+ tRevocationDate $ x509CRLCertInvalidityDate $ x509validityNotBefore $ x509v
+ alidityNotAfter $ dlmInstallDate $ sudoNotBefore $ sudoNotAfter $ oathTimes
+ tamp $ oathLastFailure $ oathLastLogin $ oathSecretTime $ msPwdResetTimesta
+ mp $ msPwdResetExpirationTime $ aeNotBefore $ aeNotAfter ) )
+matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTim
+ estamp $ modifyTimestamp $ monitorTimestamp $ monitorConnectionStartTime $ 
+ monitorConnectionActivityTime $ reqStart $ reqEnd $ pwdChangedTime $ pwdAcc
+ ountLockedTime $ pwdFailureTime $ pwdGraceUseTime $ entryExpireTimestamp $ 
+ authTimestamp $ schacExpiryDate $ krb5ValidStart $ krb5ValidEnd $ krb5Passw
+ ordEnd $ krbPrincipalExpiration $ krbPasswordExpiration $ krbLastPwdChange 
+ $ krbLastAdminUnlock $ krbLastSuccessfulAuth $ krbLastFailedAuth $ esgFirst
+ Shown $ esgFinalEnd $ dhcpExpirationTime $ dhcpStartTimeOfState $ dhcpLastT
+ ransactionTime $ x509CRLThisUpdate $ x509CRLNextUpdate $ x509CRLCertRevocat
+ ionDate $ x509CRLCertInvalidityDate $ x509validityNotBefore $ x509validityN
+ otAfter $ dlmInstallDate $ sudoNotBefore $ sudoNotAfter $ oathTimestamp $ o
+ athLastFailure $ oathLastLogin $ oathSecretTime $ msPwdResetTimestamp $ msP
+ wdResetExpirationTime $ aeNotBefore $ aeNotAfter ) )
+matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protoco
+ lInformation )
+matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember )
+matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES present
+ ationAddress )
+matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephone
+ Number $ homePhone $ mobile $ pager $ c-TelephoneNumber $ nsAIMid $ esgCont
+ actPhone ) )
+matchingRuleUse: ( 2.5.13.18 NAME 'octetStringOrderingMatch' APPLIES ( syncr
+ eplCookie $ userPassword $ olcDbCryptKey $ reqMod $ reqOld $ reqData $ pwdH
+ istory $ javaSerializedData $ entrustPolicyCertificate $ entrustRoamFileEnc
+ Info $ entrustRoamingCAPAB $ entrustRoamingEOP $ entrustRoamingPAB $ entrus
+ tRoamingPRV $ entrustRoamingProfile $ entrustRoamingRecipList $ entrustRoam
+ ingSLA $ entrustAttributeCertificate $ sambaClearTextPassword $ sambaPrevio
+ usClearTextPassword $ krb5RealmName $ krbPrincipalKey $ krbPwdHistory $ krb
+ MKey $ krbExtraData $ dhcpRelayAgentInfo $ dhcpHashBucketAssignment $ dhcpK
+ eySecret $ x509authorityKeyIdentifier $ x509subjectKeyIdentifier $ x509ACAu
+ ditID $ vPIMSpokenName $ pgpReconData $ pgpData $ pcelsIPHdrSourceAddress $
+  pcelsIPHdrSourceAddressEndOfRange $ pcelsIPHdrSourceMask $ pcelsIPHdrDestA
+ ddress $ pcelsIPHdrDestAddressEndOfRange $ pcelsIPHdrDestMask $ pcelsIPHdrF
+ lowLabel $ pcels8021HdrSourceMACAddress $ pcels8021HdrSourceMACMask $ pcels
+ 8021HdrDestMACAddress $ pcels8021HdrDestMACMask $ pcelsVendorVariableData $
+  pcelsVendorValueData $ sshPublicKey $ cmusaslsecretCRAM-MD5 $ cmusaslsecre
+ tDIGEST-MD5 $ cmusaslsecretOTP $ cmusaslsecretSRP $ cmusaslsecretPLAIN $ SI
+ PIdentityPassword $ oathSecret $ oathTokenPIN ) )
+matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( syncreplCooki
+ e $ userPassword $ olcDbCryptKey $ reqMod $ reqOld $ reqData $ pwdHistory $
+  javaSerializedData $ entrustPolicyCertificate $ entrustRoamFileEncInfo $ e
+ ntrustRoamingCAPAB $ entrustRoamingEOP $ entrustRoamingPAB $ entrustRoaming
+ PRV $ entrustRoamingProfile $ entrustRoamingRecipList $ entrustRoamingSLA $
+  entrustAttributeCertificate $ sambaClearTextPassword $ sambaPreviousClearT
+ extPassword $ krb5RealmName $ krbPrincipalKey $ krbPwdHistory $ krbMKey $ k
+ rbExtraData $ dhcpRelayAgentInfo $ dhcpHashBucketAssignment $ dhcpKeySecret
+  $ x509authorityKeyIdentifier $ x509subjectKeyIdentifier $ x509ACAuditID $ 
+ vPIMSpokenName $ pgpReconData $ pgpData $ pcelsIPHdrSourceAddress $ pcelsIP
+ HdrSourceAddressEndOfRange $ pcelsIPHdrSourceMask $ pcelsIPHdrDestAddress $
+  pcelsIPHdrDestAddressEndOfRange $ pcelsIPHdrDestMask $ pcelsIPHdrFlowLabel
+  $ pcels8021HdrSourceMACAddress $ pcels8021HdrSourceMACMask $ pcels8021HdrD
+ estMACAddress $ pcels8021HdrDestMACMask $ pcelsVendorVariableData $ pcelsVe
+ ndorValueData $ sshPublicKey $ cmusaslsecretCRAM-MD5 $ cmusaslsecretDIGEST-
+ MD5 $ cmusaslsecretOTP $ cmusaslsecretSRP $ cmusaslsecretPLAIN $ SIPIdentit
+ yPassword $ oathSecret $ oathTokenPIN ) )
+matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES ( x500UniqueIdent
+ ifier $ x509CRLDPOnlySomeReasons $ x509ACObjectDigest $ x509DPReasonCodes )
+  )
+matchingRuleUse: ( 2.5.13.15 NAME 'integerOrderingMatch' APPLIES ( supported
+ LDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMa
+ xPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen 
+ $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ o
+ lcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcRe
+ plicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olc
+ Threads $ olcToolThreads $ olcWriteTimeout $ olcDbMaxReaders $ olcDbMaxSize
+  $ olcDbRtxnSize $ olcDbSearchStack $ olcDbCacheFree $ olcDbCacheSize $ olc
+ DbDNcacheSize $ olcDbIDLcacheSize $ olcDbShmKey $ olcDbProtocolVersion $ ol
+ cDbConnectionPoolMax $ olcChainMaxReferralDepth $ monitorCounter $ monitorO
+ pCompleted $ monitorOpInitiated $ monitorConnectionNumber $ monitorConnecti
+ onOpsReceived $ monitorConnectionOpsExecuting $ monitorConnectionOpsPending
+  $ monitorConnectionOpsCompleted $ monitorConnectionGet $ monitorConnection
+ Read $ monitorConnectionWrite $ reqResult $ reqId $ reqVersion $ reqSizeLim
+ it $ reqTimeLimit $ reqEntries $ olcSpSessionlog $ olcSssVlvMax $ olcSssVlv
+ MaxKeys $ olcSssVlvMaxPerConn $ olcDDSmaxDynamicObjects $ olcLastBindPrecis
+ ion $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ sha
+ dowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ i
+ pProtocolNumber $ oncRpcNumber $ pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwd
+ CheckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLo
+ ckoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMaxRecordedFai
+ lure $ searchTimeLimit $ bindTimeLimit $ profileTTL $ schacGender $ dNSTTL 
+ $ SolarisCacheTTL $ SolarisSearchTimeLimit $ sambaPwdLastSet $ sambaPwdCanC
+ hange $ sambaPwdMustChange $ sambaLogonTime $ sambaLogoffTime $ sambaKickof
+ fTime $ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaGroupType $ sam
+ baNextUserRid $ sambaNextGroupRid $ sambaNextRid $ sambaAlgorithmicRidBase 
+ $ sambaIntegerOption $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLog
+ onToChgPwd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ samba
+ LockoutObservationWindow $ sambaLockoutThreshold $ sambaForceLogoff $ samba
+ RefuseMachinePwdChange $ sambaTrustType $ sambaTrustAttributes $ sambaTrust
+ Direction $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes $ krb5Key
+ VersionNumber $ krb5MaxLife $ krb5MaxRenew $ krb5KDCFlags $ krb5EncryptionT
+ ype $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewabl
+ eAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars 
+ $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailureC
+ ountInterval $ krbPwdLockoutDuration $ krbPwdAttributes $ krbPwdMaxLife $ k
+ rbPwdMaxRenewableLife $ krbLoginFailedCount $ dhcpNetMask $ dhcpDnsStatus $
+  dhcpDelayedServiceParameter $ dhcpMaxClientLeadTime $ dhcpFailOverPrimaryP
+ ort $ dhcpFailOverSecondaryPort $ dhcpFailOverResponseDelay $ dhcpFailOverU
+ nackedUpdates $ dhcpFailOverSplit $ dhcpFailOverLoadBalanceTime $ dlzSerial
+  $ dlzRefresh $ dlzRetry $ dlzExpire $ dlzMinimum $ dlzPreference $ dlzTTL 
+ $ x509CRLNumber $ x509CRLDeltaIndicator $ x509CRLCertReasonCode $ x509versi
+ on $ x509serialNumber $ x509authorityCertSerialNumber $ x509ACHolderPKCSeri
+ alNumber $ x509ACDigestedObjectType $ vPIMMaxMessageSize $ dlmDedicated $ d
+ lmBiometric $ pcimRuleEnabled $ pcimConditionGroupNumber $ pcimActionOrder 
+ $ pcelsDecisionStrategy $ pcelsPriority $ pcelsConditionListType $ pcelsSeq
+ uencedActions $ pcelsExecutionStrategy $ pcelsIPHdrVersion $ pcelsIPHdrProt
+ ocolID $ pcelsIPHdrSourcePortStart $ pcelsIPHdrSourcePortEnd $ pcelsIPHdrDe
+ stPortStart $ pcelsIPHdrDestPortEnd $ pcelsIPHdrDSCPList $ pcels8021HdrProt
+ ocolID $ pcels8021HdrPriority $ pcels8021HdrVLANID $ pcelsFilterDirection $
+  sudoOrder $ fedfsFsnTTL $ fedfsNfsCurrency $ fedfsNfsClassSimul $ fedfsNfs
+ ClassHandle $ fedfsNfsClassFileid $ fedfsNfsClassWritever $ fedfsNfsClassCh
+ ange $ fedfsNfsClassReaddir $ fedfsNfsReadRank $ fedfsNfsReadOrder $ fedfsN
+ fsWriteRank $ fedfsNfsWriteOrder $ fedfsNfsValidFor $ radiusSimultaneousUse
+  $ gender $ oathOTPLength $ oathSecretMaxAge $ oathSecretLength $ oathCount
+ er $ oathFailureCount $ oathMaxUsageCount $ oathThrottleLimit $ oathResultC
+ ode $ oathSuccessResultCode $ oathFailureResultCode $ oathHOTPCounter $ oat
+ hHOTPLookAhead $ oathTOTPTimeStepPeriod $ oathTOTPLastTimeStep $ msPwdReset
+ MaxAge $ msPwdResetPwLen $ msPwdResetAdminPwLen $ aeStatus $ aePosixId $ ae
+ UidNumberMin $ aeUidNumberMax $ aeUidNumberNext $ aeGidNumberMin $ aeGidNum
+ berMax $ aeGidNumberNext $ aeLogStorePeriod ) )
+matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVers
+ ion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending
+  $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcInd
+ exSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexI
+ ntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicatio
+ nInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads 
+ $ olcToolThreads $ olcWriteTimeout $ olcDbMaxReaders $ olcDbMaxSize $ olcDb
+ RtxnSize $ olcDbSearchStack $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcach
+ eSize $ olcDbIDLcacheSize $ olcDbShmKey $ olcDbProtocolVersion $ olcDbConne
+ ctionPoolMax $ olcChainMaxReferralDepth $ monitorCounter $ monitorOpComplet
+ ed $ monitorOpInitiated $ monitorConnectionNumber $ monitorConnectionOpsRec
+ eived $ monitorConnectionOpsExecuting $ monitorConnectionOpsPending $ monit
+ orConnectionOpsCompleted $ monitorConnectionGet $ monitorConnectionRead $ m
+ onitorConnectionWrite $ reqResult $ reqId $ reqVersion $ reqSizeLimit $ req
+ TimeLimit $ reqEntries $ olcSpSessionlog $ olcSssVlvMax $ olcSssVlvMaxKeys 
+ $ olcSssVlvMaxPerConn $ olcDDSmaxDynamicObjects $ olcLastBindPrecision $ ma
+ ilPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarni
+ ng $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtoco
+ lNumber $ oncRpcNumber $ pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckQua
+ lity $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockoutDur
+ ation $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMaxRecordedFailure $ s
+ earchTimeLimit $ bindTimeLimit $ profileTTL $ schacGender $ dNSTTL $ Solari
+ sCacheTTL $ SolarisSearchTimeLimit $ sambaPwdLastSet $ sambaPwdCanChange $ 
+ sambaPwdMustChange $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ 
+ sambaBadPasswordCount $ sambaBadPasswordTime $ sambaGroupType $ sambaNextUs
+ erRid $ sambaNextGroupRid $ sambaNextRid $ sambaAlgorithmicRidBase $ sambaI
+ ntegerOption $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgP
+ wd $ sambaMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutO
+ bservationWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMa
+ chinePwdChange $ sambaTrustType $ sambaTrustAttributes $ sambaTrustDirectio
+ n $ sambaTrustPosixOffset $ sambaSupportedEncryptionTypes $ krb5KeyVersionN
+ umber $ krb5MaxLife $ krb5MaxRenew $ krb5KDCFlags $ krb5EncryptionType $ kr
+ bPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge $ k
+ rbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $ krbPwd
+ MinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailureCountInte
+ rval $ krbPwdLockoutDuration $ krbPwdAttributes $ krbPwdMaxLife $ krbPwdMax
+ RenewableLife $ krbLoginFailedCount $ dhcpNetMask $ dhcpDnsStatus $ dhcpDel
+ ayedServiceParameter $ dhcpMaxClientLeadTime $ dhcpFailOverPrimaryPort $ dh
+ cpFailOverSecondaryPort $ dhcpFailOverResponseDelay $ dhcpFailOverUnackedUp
+ dates $ dhcpFailOverSplit $ dhcpFailOverLoadBalanceTime $ dlzSerial $ dlzRe
+ fresh $ dlzRetry $ dlzExpire $ dlzMinimum $ dlzPreference $ dlzTTL $ x509CR
+ LNumber $ x509CRLDeltaIndicator $ x509CRLCertReasonCode $ x509version $ x50
+ 9serialNumber $ x509authorityCertSerialNumber $ x509ACHolderPKCSerialNumber
+  $ x509ACDigestedObjectType $ vPIMMaxMessageSize $ dlmDedicated $ dlmBiomet
+ ric $ pcimRuleEnabled $ pcimConditionGroupNumber $ pcimActionOrder $ pcelsD
+ ecisionStrategy $ pcelsPriority $ pcelsConditionListType $ pcelsSequencedAc
+ tions $ pcelsExecutionStrategy $ pcelsIPHdrVersion $ pcelsIPHdrProtocolID $
+  pcelsIPHdrSourcePortStart $ pcelsIPHdrSourcePortEnd $ pcelsIPHdrDestPortSt
+ art $ pcelsIPHdrDestPortEnd $ pcelsIPHdrDSCPList $ pcels8021HdrProtocolID $
+  pcels8021HdrPriority $ pcels8021HdrVLANID $ pcelsFilterDirection $ sudoOrd
+ er $ fedfsFsnTTL $ fedfsNfsCurrency $ fedfsNfsClassSimul $ fedfsNfsClassHan
+ dle $ fedfsNfsClassFileid $ fedfsNfsClassWritever $ fedfsNfsClassChange $ f
+ edfsNfsClassReaddir $ fedfsNfsReadRank $ fedfsNfsReadOrder $ fedfsNfsWriteR
+ ank $ fedfsNfsWriteOrder $ fedfsNfsValidFor $ radiusSimultaneousUse $ gende
+ r $ oathOTPLength $ oathSecretMaxAge $ oathSecretLength $ oathCounter $ oat
+ hFailureCount $ oathMaxUsageCount $ oathThrottleLimit $ oathResultCode $ oa
+ thSuccessResultCode $ oathFailureResultCode $ oathHOTPCounter $ oathHOTPLoo
+ kAhead $ oathTOTPTimeStepPeriod $ oathTOTPLastTimeStep $ msPwdResetMaxAge $
+  msPwdResetPwLen $ msPwdResetAdminPwLen $ aeStatus $ aePosixId $ aeUidNumbe
+ rMin $ aeUidNumberMax $ aeUidNumberNext $ aeGidNumberMin $ aeGidNumberMax $
+  aeGidNumberNext $ aeLogStorePeriod ) )
+matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $
+  olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $
+  olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcD
+ bNoSync $ olcDbChecksum $ olcDbDirtyRead $ olcDbLinearIndex $ olcDbRebindAs
+ User $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseT
+ emporaryConn $ olcDbSessionTrackingRequest $ olcDbNoRefs $ olcDbNoUndefFilt
+ er $ olcChainCacheURI $ olcChainReturnError $ olcDbPseudoRootBindDefer $ re
+ adOnly $ monitorIsShadow $ monitorRuntimeConfig $ olcAccessLogSuccess $ req
+ DeleteOldRDN $ reqAttrsOnly $ olcMemberOfRefInt $ olcSpNoPresent $ olcSpRel
+ oadHint $ olcTranslucentStrict $ olcTranslucentNoGlue $ olcTranslucentBindL
+ ocal $ olcTranslucentPwModLocal $ olcUniqueStrict $ pwdReset $ olcPPolicyHa
+ shCleartext $ olcPPolicyForwardUpdates $ olcPPolicyUseLockout $ olcDDSstate
+  $ pwdLockout $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify $ follow
+ Referrals $ dereferenceAliases $ xmozillausehtmlmail $ sambaBoolOption $ kr
+ bUPEnabled $ esgAlwaysOn $ dhcpBootpFlag $ x509CRLDPOnlyUserCerts $ x509CRL
+ DPOnlyCACerts $ x509CRLDPOnlyAttCerts $ x509CRLDPindirect $ x509basicConstr
+ aintsCa $ x509ACNoRevocation $ dlmStarted $ dlm1FilterEntryBaseIsNegated $ 
+ pcimRuleMandatory $ pcimConditionNegated $ pcelsIsMirrored $ pcelsBoolean $
+  pcelsFilterIsNegated $ fedfsNfsGenFlagWritable $ fedfsNfsGenFlagGoing $ fe
+ dfsNfsGenFlagSplit $ fedfsNfsTransFlagRdma $ fedfsNfsVarSub $ radiusStripUs
+ erName $ radiusClientRequireMa $ X-experimentalFlag $ 1.3.6.1.4.1.5427.1.38
+ 9.42.3 $ msPwdResetEnabled ) )
+matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddr
+ ess $ registeredAddress $ homePostalAddress $ c-PostalAddress $ mozillaPost
+ alAddress2 $ mozillaHomePostalAddress2 ) )
+matchingRuleUse: ( 2.5.13.9 NAME 'numericStringOrderingMatch' APPLIES ( x121
+ Address $ internationaliSDNNumber $ c-InternationalISDNNumber $ schacDateOf
+ Birth $ schacYearOfBirth $ esgDuration $ esgRepeatInterval $ esgIntervalOff
+ set $ esgTotalDuration $ vPIMSubMailboxes $ germanBankAccountNumber $ germa
+ nBankCode ) )
+matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address 
+ $ internationaliSDNNumber $ c-InternationalISDNNumber $ schacDateOfBirth $ 
+ schacYearOfBirth $ esgDuration $ esgRepeatInterval $ esgIntervalOffset $ es
+ gTotalDuration $ vPIMSubMailboxes $ germanBankAccountNumber $ germanBankCod
+ e ) )
+matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serial
+ Number $ c $ telephoneNumber $ destinationIndicator $ dnQualifier $ homePho
+ ne $ mobile $ pager $ c-TelephoneNumber $ nsAIMid $ esgContactPhone $ vPIMT
+ elephoneNumber $ oathTokenSerialNumber $ aeHwSerialNumber ) )
+matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( supporte
+ dSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labe
+ ledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows
+  $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite
+  $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallow
+ s $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olc
+ Limits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObje
+ ctClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $
+  olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral 
+ $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olc
+ Requires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSasl
+ Host $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSize
+ Limit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTime
+ Limit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertifica
+ teFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ ol
+ cTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olc
+ TLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbEnv
+ Flags $ olcDbIndex $ olcDbMode $ olcDbCryptFile $ olcDbPageSize $ olcDbLock
+ Detect $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbID
+ AssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFr
+ om $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcD
+ bNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAsser
+ tPassThru $ olcDbKeepalive $ olcChainingBehavior $ olcDbRewrite $ olcDbMap 
+ $ olcDbSubtreeExclude $ olcDbSubtreeInclude $ olcDbDefaultTarget $ olcDbDnC
+ acheTtl $ olcDbBindTimeout $ olcDbNretries $ olcDbClientPr $ olcMetaSub $ o
+ lcDbFilter $ monitoredInfo $ managedInfo $ monitorConnectionLocalAddress $ 
+ monitorConnectionPeerAddress $ monitorOverlay $ restrictedOperation $ monit
+ orConnectionProtocol $ monitorConnectionMask $ monitorConnectionListener $ 
+ monitorConnectionPeerDomain $ monitorUpdateRef $ olcAuditlogFile $ olcAcces
+ sLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAc
+ cessLogBase $ reqType $ reqSession $ reqMessage $ reqReferral $ reqMethod $
+  reqAssertion $ reqScope $ reqDerefAliases $ reqFilter $ reqAttr $ olcColle
+ ctInfo $ olcDlAttrSet $ olcRefintAttribute $ olcMemberOfDangling $ olcMembe
+ rOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD $ olcMemberOfDangl
+ ingError $ olcSpCheckpoint $ olcTranslucentLocal $ olcTranslucentRemote $ o
+ lcUniqueIgnore $ olcUniqueAttribute $ olcUniqueURI $ olcConstraintAttribute
+  $ olcValSortAttr $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ olcDDS
+ interval $ olcDDStolerance $ olmDbDirectory $ knowledgeInformation $ sn $ s
+ erialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ pos
+ talCode $ postOfficeBox $ physicalDeliveryOfficeName $ telephoneNumber $ de
+ stinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifi
+ er $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ 
+ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle 
+ $ documentVersion $ documentLocation $ homePhone $ personalTitle $ mobile $
+  pager $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ docu
+ mentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumbe
+ r $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ jav
+ aClassName $ javaClassNames $ javaFactory $ javaReferenceAddress $ corbaRep
+ ositoryId $ memberURL $ xmlPrivilegeInfo $ xmlPrivPolicy $ c-l $ c-st $ c-s
+ treet $ c-o $ c-ou $ c-PostalCode $ c-PostOfficeBox $ c-PhysicalDeliveryOff
+ iceName $ c-TelephoneNumber $ authorizedService $ defaultServerList $ prefe
+ rredServerList $ authenticationMethod $ serviceSearchDescriptor $ serviceAu
+ thenticationMethod $ entrustRoamingId $ eduPersonAffiliation $ eduPersonNic
+ kname $ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEnt
+ itlement $ eduPersonScopedAffiliation $ eduOrgLegalName $ schacMotherTongue
+  $ schacPlaceOfBirth $ schacCountryOfCitizenship $ schacSn1 $ schacSn2 $ sc
+ hacPersonalTitle $ schacHomeOrganization $ schacHomeOrganizationType $ scha
+ cCountryOfResidence $ schacUserPresenceID $ schacPersonalPosition $ schacPe
+ rsonalUniqueCode $ schacPersonalUniqueID $ schacUserStatus $ schacProjectMe
+ mbership $ schacProjectSpecificRole $ nisDomain $ SolarisLDAPServers $ Sola
+ risSearchBaseDN $ SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $
+  SolarisTransportSecurity $ SolarisDataSearchDN $ SolarisSearchScope $ Sola
+ risPreferedServer $ SolarisPreferedServerOnly $ SolarisSearchReferral $ mid
+ dleName $ xmozillanickname $ mozillaHomeLocalityName $ mozillaHomeState $ m
+ ozillaHomePostalCode $ mozillaHomeCountryName $ mozillaHomeFriendlyCountryN
+ ame $ nsAIMid $ sambaLogonScript $ sambaProfilePath $ sambaUserWorkstations
+  $ sambaHomePath $ sambaDomainName $ sambaMungedDial $ sambaShareName $ sam
+ baOptionName $ sambaStringListOption $ sambaTrustPartner $ sambaFlatName $ 
+ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaTrustForestTrustInfo
+  $ krbLdapServers $ krbPrincNamingAttr $ krbDefaultEncSaltTypes $ krbSuppor
+ tedEncSaltTypes $ krbPrincipalAuthInd $ esgSid $ esgSN $ esgInfo $ esgInfoU
+ ri $ esgContact $ esgContactPhone $ esgCategory $ esgTool $ esgSource $ esg
+ Format $ esgStreamUri $ esgSdpUri $ dlzZoneName $ dlzHostName $ dlzData $ d
+ lzType $ dlzAdminEmail $ dlzPrimaryNS $ dlzCName $ dlzRecordID $ x509keyUsa
+ ge $ vPIMTelephoneNumber $ vPIMTextName $ AstContext $ AstExtension $ AstPr
+ iority $ AstApplication $ AstApplicationData $ AstAccountAMAFlags $ AstAcco
+ untCallerID $ AstAccountContext $ AstAccountMailbox $ AstMD5secret $ AstAcc
+ ountDeny $ AstAccountPermit $ AstAccountQualify $ AstAccountType $ AstAccou
+ ntDisallowedCodec $ AstAccountExpirationTimestamp $ AstAccountRegistrationC
+ ontext $ AstAccountRegistrationExten $ AstAccountNoTransfer $ AstAccountCal
+ lGroup $ AstAccountCanReinvite $ AstAccountDTMFMode $ AstAccountFromUser $ 
+ AstAccountFromDomain $ AstAccountFullContact $ AstAccountHost $ AstAccountI
+ nsecure $ AstAccountNAT $ AstAccountPickupGroup $ AstAccountPort $ AstAccou
+ ntRestrictCID $ AstAccountRTPTimeout $ AstAccountRTPHoldTimeout $ AstAccoun
+ tRealmedPassword $ AstAccountAllowedCodec $ AstAccountMusicOnHold $ AstAcco
+ untCanCallForward $ AstAccountSecret $ AstAccountName $ AstConfigFilename $
+  AstConfigCategory $ AstConfigCategoryMetric $ AstConfigVariableName $ AstC
+ onfigVariableValue $ AstConfigCommented $ AstAccountIPAddress $ AstAccountD
+ efaultUser $ AstAccountRegistrationServer $ AstAccountLastQualifyMillisecon
+ ds $ AstAccountCallLimit $ AstVoicemailMailbox $ AstVoicemailPassword $ Ast
+ VoicemailFullname $ AstVoicemailEmail $ AstVoicemailPager $ AstVoicemailOpt
+ ions $ AstVoicemailTimestamp $ AstVoicemailContext $ AstAccountSubscribeCon
+ text $ AstAccountUserAgent $ AstAccountLanguage $ AstAccountTransport $ Ast
+ AccountPromiscRedir $ AstAccountAccountCode $ AstAccountSetVar $ AstAccount
+ AllowOverlap $ AstAccountVideoSupport $ AstAccountIgnoreSDPVersion $ AstAcc
+ ountPathSupport $ pgpSoftware $ pgpVersion $ pgpCertID $ pgpDisabled $ pgpK
+ eyID $ pgpKeyType $ pgpUserID $ pgpKeyCreateTime $ pgpSignerID $ pgpRevoked
+  $ pgpSubKeyID $ pgpKeySize $ pgpKeyExpireTime $ pgpReconCertID $ pgpElemen
+ tType $ calCalURI $ calFBURL $ calCAPURI $ calCalAdrURI $ calOtherCalURIs $
+  calOtherFBURLs $ calOtherCAPURIs $ calOtherCalAdrURIs $ turbaMembers $ arr
+ ayIndex $ dlmIdentifyingDescription $ dlmOtherIdentifyingInfo $ orderedCimK
+ eys $ orderedCimModelPath $ dlmCaption $ dlmDescription $ dlmName $ dlmStat
+ us $ dlmCreationClassName $ dlmNameFormat $ dlmPrimaryOwnerContact $ dlmPri
+ maryOwnerName $ dlmRoles $ dlmStartMode $ dlmSettingID $ dlm1FilterListDire
+ ction $ dlmProtocolType $ dlmOtherTypeDescription $ dlmIPAddress $ dlmIPSub
+ netMask $ dlmIPAddressType $ dlmIPVersionSupport $ dlmElementID $ dlmRemote
+ ID $ dlmAlgorithm $ dlmProtocol $ dlmSecret $ pcimRoles $ pcimKeywords $ pc
+ imGroupName $ pcimRuleName $ pcimRuleUsage $ pcimConditionName $ pcimAction
+ Name $ pcimRepositoryName $ pcelsPolicySetName $ pcelsVariableName $ pcelsV
+ ariableModelClass $ pcelsVariableModelProperty $ pcelsExpectedValueTypes $ 
+ pcelsValueName $ pcelsIPv4AddrList $ pcelsIPv6AddrList $ pcelsMACAddrList $
+  pcelsStringList $ pcelsBitStringList $ pcelsIntegerList $ pcelsReusableCon
+ tainerName $ pcelsRole $ pcelsRoleCollectionName $ pcelsFilterName $ pcelsF
+ ilterListName $ demailMaxAuthLevel $ fedfsAnnotation $ fedfsDescr $ fedfsNf
+ sURI $ commURI $ commOwner $ SIPIdentitySIPURI $ SIPIdentityUserName $ radi
+ usClientIdentifier $ radiusClientSecret $ radiusClientShortname $ radiusCli
+ entVirtualServer $ radiusClientType $ radiusClientComment $ birthPlace $ bi
+ rthName $ businessTitle $ academicTitle $ nickName $ labeledBICandIBAN $ ge
+ rmanTaxNr $ germanUniqueTaxIDNr $ musicalInstrument $ musicalOrchestra $ mu
+ sicalArtistName $ germanBankName $ germanBankAccountInfo $ germanBankAccoun
+ tHolder $ intlMailAddr $ oathTokenSerialNumber $ oathTokenIdentifier $ oath
+ Message $ oathSuccessMessage $ oathFailureMessage $ 1.3.6.1.4.1.5427.1.389.
+ 42.1 $ aeRemoteHost $ aeSourceUri $ aeTag $ aeSSHProxyCommand $ aeStockId $
+  aeHwSerialNumber $ aeDeviceSlot $ aeDevicePort ) )
+matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMec
+ hanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $
+  description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcAr
+ gsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAu
+ thzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcD
+ itContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $
+  olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasse
+ s $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPass
+ wordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcRep
+ lica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires
+  $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ o
+ lcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ 
+ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ 
+ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $
+  olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLF
+ ile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProto
+ colMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbEnvFlags $ 
+ olcDbIndex $ olcDbMode $ olcDbCryptFile $ olcDbPageSize $ olcDbLockDetect $
+  olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPa
+ sswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olc
+ DbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetwork
+ Timeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThr
+ u $ olcDbKeepalive $ olcChainingBehavior $ olcDbRewrite $ olcDbMap $ olcDbS
+ ubtreeExclude $ olcDbSubtreeInclude $ olcDbDefaultTarget $ olcDbDnCacheTtl 
+ $ olcDbBindTimeout $ olcDbNretries $ olcDbClientPr $ olcMetaSub $ olcDbFilt
+ er $ monitoredInfo $ managedInfo $ monitorConnectionLocalAddress $ monitorC
+ onnectionPeerAddress $ monitorOverlay $ restrictedOperation $ monitorConnec
+ tionProtocol $ monitorConnectionMask $ monitorConnectionListener $ monitorC
+ onnectionPeerDomain $ monitorUpdateRef $ olcAuditlogFile $ olcAccessLogOps 
+ $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogB
+ ase $ reqType $ reqSession $ reqMessage $ reqReferral $ reqMethod $ reqAsse
+ rtion $ reqScope $ reqDerefAliases $ reqFilter $ reqAttr $ olcCollectInfo $
+  olcDlAttrSet $ olcRefintAttribute $ olcMemberOfDangling $ olcMemberOfGroup
+ OC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD $ olcMemberOfDanglingError
+  $ olcSpCheckpoint $ olcTranslucentLocal $ olcTranslucentRemote $ olcUnique
+ Ignore $ olcUniqueAttribute $ olcUniqueURI $ olcConstraintAttribute $ olcVa
+ lSortAttr $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ olcDDSinterval
+  $ olcDDStolerance $ olmDbDirectory $ knowledgeInformation $ sn $ serialNum
+ ber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode 
+ $ postOfficeBox $ physicalDeliveryOfficeName $ telephoneNumber $ destinatio
+ nIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ hou
+ seIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ 
+ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ docume
+ ntVersion $ documentLocation $ homePhone $ personalTitle $ mobile $ pager $
+  co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPubl
+ isher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ empl
+ oyeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ javaClassNa
+ me $ javaClassNames $ javaFactory $ javaReferenceAddress $ corbaRepositoryI
+ d $ memberURL $ xmlPrivilegeInfo $ xmlPrivPolicy $ c-l $ c-st $ c-street $ 
+ c-o $ c-ou $ c-PostalCode $ c-PostOfficeBox $ c-PhysicalDeliveryOfficeName 
+ $ c-TelephoneNumber $ authorizedService $ defaultServerList $ preferredServ
+ erList $ authenticationMethod $ serviceSearchDescriptor $ serviceAuthentica
+ tionMethod $ entrustRoamingId $ eduPersonAffiliation $ eduPersonNickname $ 
+ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlement
+  $ eduPersonScopedAffiliation $ eduOrgLegalName $ schacMotherTongue $ schac
+ PlaceOfBirth $ schacCountryOfCitizenship $ schacSn1 $ schacSn2 $ schacPerso
+ nalTitle $ schacHomeOrganization $ schacHomeOrganizationType $ schacCountry
+ OfResidence $ schacUserPresenceID $ schacPersonalPosition $ schacPersonalUn
+ iqueCode $ schacPersonalUniqueID $ schacUserStatus $ schacProjectMembership
+  $ schacProjectSpecificRole $ nisDomain $ SolarisLDAPServers $ SolarisSearc
+ hBaseDN $ SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ Solaris
+ TransportSecurity $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisPrefe
+ redServer $ SolarisPreferedServerOnly $ SolarisSearchReferral $ middleName 
+ $ xmozillanickname $ mozillaHomeLocalityName $ mozillaHomeState $ mozillaHo
+ mePostalCode $ mozillaHomeCountryName $ mozillaHomeFriendlyCountryName $ ns
+ AIMid $ sambaLogonScript $ sambaProfilePath $ sambaUserWorkstations $ samba
+ HomePath $ sambaDomainName $ sambaMungedDial $ sambaShareName $ sambaOption
+ Name $ sambaStringListOption $ sambaTrustPartner $ sambaFlatName $ sambaTru
+ stAuthOutgoing $ sambaTrustAuthIncoming $ sambaTrustForestTrustInfo $ krbLd
+ apServers $ krbPrincNamingAttr $ krbDefaultEncSaltTypes $ krbSupportedEncSa
+ ltTypes $ krbPrincipalAuthInd $ esgSid $ esgSN $ esgInfo $ esgInfoUri $ esg
+ Contact $ esgContactPhone $ esgCategory $ esgTool $ esgSource $ esgFormat $
+  esgStreamUri $ esgSdpUri $ dlzZoneName $ dlzHostName $ dlzData $ dlzType $
+  dlzAdminEmail $ dlzPrimaryNS $ dlzCName $ dlzRecordID $ x509keyUsage $ vPI
+ MTelephoneNumber $ vPIMTextName $ AstContext $ AstExtension $ AstPriority $
+  AstApplication $ AstApplicationData $ AstAccountAMAFlags $ AstAccountCalle
+ rID $ AstAccountContext $ AstAccountMailbox $ AstMD5secret $ AstAccountDeny
+  $ AstAccountPermit $ AstAccountQualify $ AstAccountType $ AstAccountDisall
+ owedCodec $ AstAccountExpirationTimestamp $ AstAccountRegistrationContext $
+  AstAccountRegistrationExten $ AstAccountNoTransfer $ AstAccountCallGroup $
+  AstAccountCanReinvite $ AstAccountDTMFMode $ AstAccountFromUser $ AstAccou
+ ntFromDomain $ AstAccountFullContact $ AstAccountHost $ AstAccountInsecure 
+ $ AstAccountNAT $ AstAccountPickupGroup $ AstAccountPort $ AstAccountRestri
+ ctCID $ AstAccountRTPTimeout $ AstAccountRTPHoldTimeout $ AstAccountRealmed
+ Password $ AstAccountAllowedCodec $ AstAccountMusicOnHold $ AstAccountCanCa
+ llForward $ AstAccountSecret $ AstAccountName $ AstConfigFilename $ AstConf
+ igCategory $ AstConfigCategoryMetric $ AstConfigVariableName $ AstConfigVar
+ iableValue $ AstConfigCommented $ AstAccountIPAddress $ AstAccountDefaultUs
+ er $ AstAccountRegistrationServer $ AstAccountLastQualifyMilliseconds $ Ast
+ AccountCallLimit $ AstVoicemailMailbox $ AstVoicemailPassword $ AstVoicemai
+ lFullname $ AstVoicemailEmail $ AstVoicemailPager $ AstVoicemailOptions $ A
+ stVoicemailTimestamp $ AstVoicemailContext $ AstAccountSubscribeContext $ A
+ stAccountUserAgent $ AstAccountLanguage $ AstAccountTransport $ AstAccountP
+ romiscRedir $ AstAccountAccountCode $ AstAccountSetVar $ AstAccountAllowOve
+ rlap $ AstAccountVideoSupport $ AstAccountIgnoreSDPVersion $ AstAccountPath
+ Support $ pgpSoftware $ pgpVersion $ pgpCertID $ pgpDisabled $ pgpKeyID $ p
+ gpKeyType $ pgpUserID $ pgpKeyCreateTime $ pgpSignerID $ pgpRevoked $ pgpSu
+ bKeyID $ pgpKeySize $ pgpKeyExpireTime $ pgpReconCertID $ pgpElementType $ 
+ calCalURI $ calFBURL $ calCAPURI $ calCalAdrURI $ calOtherCalURIs $ calOthe
+ rFBURLs $ calOtherCAPURIs $ calOtherCalAdrURIs $ turbaMembers $ arrayIndex 
+ $ dlmIdentifyingDescription $ dlmOtherIdentifyingInfo $ orderedCimKeys $ or
+ deredCimModelPath $ dlmCaption $ dlmDescription $ dlmName $ dlmStatus $ dlm
+ CreationClassName $ dlmNameFormat $ dlmPrimaryOwnerContact $ dlmPrimaryOwne
+ rName $ dlmRoles $ dlmStartMode $ dlmSettingID $ dlm1FilterListDirection $ 
+ dlmProtocolType $ dlmOtherTypeDescription $ dlmIPAddress $ dlmIPSubnetMask 
+ $ dlmIPAddressType $ dlmIPVersionSupport $ dlmElementID $ dlmRemoteID $ dlm
+ Algorithm $ dlmProtocol $ dlmSecret $ pcimRoles $ pcimKeywords $ pcimGroupN
+ ame $ pcimRuleName $ pcimRuleUsage $ pcimConditionName $ pcimActionName $ p
+ cimRepositoryName $ pcelsPolicySetName $ pcelsVariableName $ pcelsVariableM
+ odelClass $ pcelsVariableModelProperty $ pcelsExpectedValueTypes $ pcelsVal
+ ueName $ pcelsIPv4AddrList $ pcelsIPv6AddrList $ pcelsMACAddrList $ pcelsSt
+ ringList $ pcelsBitStringList $ pcelsIntegerList $ pcelsReusableContainerNa
+ me $ pcelsRole $ pcelsRoleCollectionName $ pcelsFilterName $ pcelsFilterLis
+ tName $ demailMaxAuthLevel $ fedfsAnnotation $ fedfsDescr $ fedfsNfsURI $ c
+ ommURI $ commOwner $ SIPIdentitySIPURI $ SIPIdentityUserName $ radiusClient
+ Identifier $ radiusClientSecret $ radiusClientShortname $ radiusClientVirtu
+ alServer $ radiusClientType $ radiusClientComment $ birthPlace $ birthName 
+ $ businessTitle $ academicTitle $ nickName $ labeledBICandIBAN $ germanTaxN
+ r $ germanUniqueTaxIDNr $ musicalInstrument $ musicalOrchestra $ musicalArt
+ istName $ germanBankName $ germanBankAccountInfo $ germanBankAccountHolder 
+ $ intlMailAddr $ oathTokenSerialNumber $ oathTokenIdentifier $ oathMessage 
+ $ oathSuccessMessage $ oathFailureMessage $ 1.3.6.1.4.1.5427.1.389.42.1 $ a
+ eRemoteHost $ aeSourceUri $ aeTag $ aeSSHProxyCommand $ aeStockId $ aeHwSer
+ ialNumber $ aeDeviceSlot $ aeDevicePort ) )
+matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( seria
+ lNumber $ c $ telephoneNumber $ destinationIndicator $ dnQualifier $ homePh
+ one $ mobile $ pager $ c-TelephoneNumber $ nsAIMid $ esgContactPhone $ vPIM
+ TelephoneNumber $ oathTokenSerialNumber $ aeHwSerialNumber ) )
+matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( support
+ edSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ lab
+ eledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllow
+ s $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrit
+ e $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallo
+ ws $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ ol
+ cLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObj
+ ectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat 
+ $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral
+  $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ ol
+ cRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSas
+ lHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSiz
+ eLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTim
+ eLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertific
+ ateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ o
+ lcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ ol
+ cTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbEn
+ vFlags $ olcDbIndex $ olcDbMode $ olcDbCryptFile $ olcDbPageSize $ olcDbLoc
+ kDetect $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbI
+ DAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzF
+ rom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olc
+ DbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAsse
+ rtPassThru $ olcDbKeepalive $ olcChainingBehavior $ olcDbRewrite $ olcDbMap
+  $ olcDbSubtreeExclude $ olcDbSubtreeInclude $ olcDbDefaultTarget $ olcDbDn
+ CacheTtl $ olcDbBindTimeout $ olcDbNretries $ olcDbClientPr $ olcMetaSub $ 
+ olcDbFilter $ monitoredInfo $ managedInfo $ monitorConnectionLocalAddress $
+  monitorConnectionPeerAddress $ monitorOverlay $ restrictedOperation $ moni
+ torConnectionProtocol $ monitorConnectionMask $ monitorConnectionListener $
+  monitorConnectionPeerDomain $ monitorUpdateRef $ olcAuditlogFile $ olcAcce
+ ssLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcA
+ ccessLogBase $ reqType $ reqSession $ reqMessage $ reqReferral $ reqMethod 
+ $ reqAssertion $ reqScope $ reqDerefAliases $ reqFilter $ reqAttr $ olcColl
+ ectInfo $ olcDlAttrSet $ olcRefintAttribute $ olcMemberOfDangling $ olcMemb
+ erOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD $ olcMemberOfDang
+ lingError $ olcSpCheckpoint $ olcTranslucentLocal $ olcTranslucentRemote $ 
+ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueURI $ olcConstraintAttribut
+ e $ olcValSortAttr $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ olcDD
+ Sinterval $ olcDDStolerance $ olmDbDirectory $ knowledgeInformation $ sn $ 
+ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ po
+ stalCode $ postOfficeBox $ physicalDeliveryOfficeName $ telephoneNumber $ d
+ estinationIndicator $ givenName $ initials $ generationQualifier $ dnQualif
+ ier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $
+  drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle
+  $ documentVersion $ documentLocation $ homePhone $ personalTitle $ mobile 
+ $ pager $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ doc
+ umentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumb
+ er $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ ja
+ vaClassName $ javaClassNames $ javaFactory $ javaReferenceAddress $ corbaRe
+ positoryId $ memberURL $ xmlPrivilegeInfo $ xmlPrivPolicy $ c-l $ c-st $ c-
+ street $ c-o $ c-ou $ c-PostalCode $ c-PostOfficeBox $ c-PhysicalDeliveryOf
+ ficeName $ c-TelephoneNumber $ authorizedService $ defaultServerList $ pref
+ erredServerList $ authenticationMethod $ serviceSearchDescriptor $ serviceA
+ uthenticationMethod $ entrustRoamingId $ eduPersonAffiliation $ eduPersonNi
+ ckname $ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEn
+ titlement $ eduPersonScopedAffiliation $ eduOrgLegalName $ schacMotherTongu
+ e $ schacPlaceOfBirth $ schacCountryOfCitizenship $ schacSn1 $ schacSn2 $ s
+ chacPersonalTitle $ schacHomeOrganization $ schacHomeOrganizationType $ sch
+ acCountryOfResidence $ schacUserPresenceID $ schacPersonalPosition $ schacP
+ ersonalUniqueCode $ schacPersonalUniqueID $ schacUserStatus $ schacProjectM
+ embership $ schacProjectSpecificRole $ nisDomain $ SolarisLDAPServers $ Sol
+ arisSearchBaseDN $ SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod 
+ $ SolarisTransportSecurity $ SolarisDataSearchDN $ SolarisSearchScope $ Sol
+ arisPreferedServer $ SolarisPreferedServerOnly $ SolarisSearchReferral $ mi
+ ddleName $ xmozillanickname $ mozillaHomeLocalityName $ mozillaHomeState $ 
+ mozillaHomePostalCode $ mozillaHomeCountryName $ mozillaHomeFriendlyCountry
+ Name $ nsAIMid $ sambaLogonScript $ sambaProfilePath $ sambaUserWorkstation
+ s $ sambaHomePath $ sambaDomainName $ sambaMungedDial $ sambaShareName $ sa
+ mbaOptionName $ sambaStringListOption $ sambaTrustPartner $ sambaFlatName $
+  sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaTrustForestTrustInf
+ o $ krbLdapServers $ krbPrincNamingAttr $ krbDefaultEncSaltTypes $ krbSuppo
+ rtedEncSaltTypes $ krbPrincipalAuthInd $ esgSid $ esgSN $ esgInfo $ esgInfo
+ Uri $ esgContact $ esgContactPhone $ esgCategory $ esgTool $ esgSource $ es
+ gFormat $ esgStreamUri $ esgSdpUri $ dlzZoneName $ dlzHostName $ dlzData $ 
+ dlzType $ dlzAdminEmail $ dlzPrimaryNS $ dlzCName $ dlzRecordID $ x509keyUs
+ age $ vPIMTelephoneNumber $ vPIMTextName $ AstContext $ AstExtension $ AstP
+ riority $ AstApplication $ AstApplicationData $ AstAccountAMAFlags $ AstAcc
+ ountCallerID $ AstAccountContext $ AstAccountMailbox $ AstMD5secret $ AstAc
+ countDeny $ AstAccountPermit $ AstAccountQualify $ AstAccountType $ AstAcco
+ untDisallowedCodec $ AstAccountExpirationTimestamp $ AstAccountRegistration
+ Context $ AstAccountRegistrationExten $ AstAccountNoTransfer $ AstAccountCa
+ llGroup $ AstAccountCanReinvite $ AstAccountDTMFMode $ AstAccountFromUser $
+  AstAccountFromDomain $ AstAccountFullContact $ AstAccountHost $ AstAccount
+ Insecure $ AstAccountNAT $ AstAccountPickupGroup $ AstAccountPort $ AstAcco
+ untRestrictCID $ AstAccountRTPTimeout $ AstAccountRTPHoldTimeout $ AstAccou
+ ntRealmedPassword $ AstAccountAllowedCodec $ AstAccountMusicOnHold $ AstAcc
+ ountCanCallForward $ AstAccountSecret $ AstAccountName $ AstConfigFilename 
+ $ AstConfigCategory $ AstConfigCategoryMetric $ AstConfigVariableName $ Ast
+ ConfigVariableValue $ AstConfigCommented $ AstAccountIPAddress $ AstAccount
+ DefaultUser $ AstAccountRegistrationServer $ AstAccountLastQualifyMilliseco
+ nds $ AstAccountCallLimit $ AstVoicemailMailbox $ AstVoicemailPassword $ As
+ tVoicemailFullname $ AstVoicemailEmail $ AstVoicemailPager $ AstVoicemailOp
+ tions $ AstVoicemailTimestamp $ AstVoicemailContext $ AstAccountSubscribeCo
+ ntext $ AstAccountUserAgent $ AstAccountLanguage $ AstAccountTransport $ As
+ tAccountPromiscRedir $ AstAccountAccountCode $ AstAccountSetVar $ AstAccoun
+ tAllowOverlap $ AstAccountVideoSupport $ AstAccountIgnoreSDPVersion $ AstAc
+ countPathSupport $ pgpSoftware $ pgpVersion $ pgpCertID $ pgpDisabled $ pgp
+ KeyID $ pgpKeyType $ pgpUserID $ pgpKeyCreateTime $ pgpSignerID $ pgpRevoke
+ d $ pgpSubKeyID $ pgpKeySize $ pgpKeyExpireTime $ pgpReconCertID $ pgpEleme
+ ntType $ calCalURI $ calFBURL $ calCAPURI $ calCalAdrURI $ calOtherCalURIs 
+ $ calOtherFBURLs $ calOtherCAPURIs $ calOtherCalAdrURIs $ turbaMembers $ ar
+ rayIndex $ dlmIdentifyingDescription $ dlmOtherIdentifyingInfo $ orderedCim
+ Keys $ orderedCimModelPath $ dlmCaption $ dlmDescription $ dlmName $ dlmSta
+ tus $ dlmCreationClassName $ dlmNameFormat $ dlmPrimaryOwnerContact $ dlmPr
+ imaryOwnerName $ dlmRoles $ dlmStartMode $ dlmSettingID $ dlm1FilterListDir
+ ection $ dlmProtocolType $ dlmOtherTypeDescription $ dlmIPAddress $ dlmIPSu
+ bnetMask $ dlmIPAddressType $ dlmIPVersionSupport $ dlmElementID $ dlmRemot
+ eID $ dlmAlgorithm $ dlmProtocol $ dlmSecret $ pcimRoles $ pcimKeywords $ p
+ cimGroupName $ pcimRuleName $ pcimRuleUsage $ pcimConditionName $ pcimActio
+ nName $ pcimRepositoryName $ pcelsPolicySetName $ pcelsVariableName $ pcels
+ VariableModelClass $ pcelsVariableModelProperty $ pcelsExpectedValueTypes $
+  pcelsValueName $ pcelsIPv4AddrList $ pcelsIPv6AddrList $ pcelsMACAddrList 
+ $ pcelsStringList $ pcelsBitStringList $ pcelsIntegerList $ pcelsReusableCo
+ ntainerName $ pcelsRole $ pcelsRoleCollectionName $ pcelsFilterName $ pcels
+ FilterListName $ demailMaxAuthLevel $ fedfsAnnotation $ fedfsDescr $ fedfsN
+ fsURI $ commURI $ commOwner $ SIPIdentitySIPURI $ SIPIdentityUserName $ rad
+ iusClientIdentifier $ radiusClientSecret $ radiusClientShortname $ radiusCl
+ ientVirtualServer $ radiusClientType $ radiusClientComment $ birthPlace $ b
+ irthName $ businessTitle $ academicTitle $ nickName $ labeledBICandIBAN $ g
+ ermanTaxNr $ germanUniqueTaxIDNr $ musicalInstrument $ musicalOrchestra $ m
+ usicalArtistName $ germanBankName $ germanBankAccountInfo $ germanBankAccou
+ ntHolder $ intlMailAddr $ oathTokenSerialNumber $ oathTokenIdentifier $ oat
+ hMessage $ oathSuccessMessage $ oathFailureMessage $ 1.3.6.1.4.1.5427.1.389
+ .42.1 $ aeRemoteHost $ aeSourceUri $ aeTag $ aeSSHProxyCommand $ aeStockId 
+ $ aeHwSerialNumber $ aeDeviceSlot $ aeDevicePort ) )
+matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMe
+ chanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI 
+ $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcA
+ rgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcA
+ uthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olc
+ DitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits 
+ $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClass
+ es $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPas
+ swordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcRe
+ plica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequire
+ s $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ 
+ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $
+  olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $
+  olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile 
+ $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRL
+ File $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProt
+ ocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbEnvFlags $
+  olcDbIndex $ olcDbMode $ olcDbCryptFile $ olcDbPageSize $ olcDbLockDetect 
+ $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertP
+ asswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ ol
+ cDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetwor
+ kTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassTh
+ ru $ olcDbKeepalive $ olcChainingBehavior $ olcDbRewrite $ olcDbMap $ olcDb
+ SubtreeExclude $ olcDbSubtreeInclude $ olcDbDefaultTarget $ olcDbDnCacheTtl
+  $ olcDbBindTimeout $ olcDbNretries $ olcDbClientPr $ olcMetaSub $ olcDbFil
+ ter $ monitoredInfo $ managedInfo $ monitorConnectionLocalAddress $ monitor
+ ConnectionPeerAddress $ monitorOverlay $ restrictedOperation $ monitorConne
+ ctionProtocol $ monitorConnectionMask $ monitorConnectionListener $ monitor
+ ConnectionPeerDomain $ monitorUpdateRef $ olcAuditlogFile $ olcAccessLogOps
+  $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLog
+ Base $ reqType $ reqSession $ reqMessage $ reqReferral $ reqMethod $ reqAss
+ ertion $ reqScope $ reqDerefAliases $ reqFilter $ reqAttr $ olcCollectInfo 
+ $ olcDlAttrSet $ olcRefintAttribute $ olcMemberOfDangling $ olcMemberOfGrou
+ pOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD $ olcMemberOfDanglingErro
+ r $ olcSpCheckpoint $ olcTranslucentLocal $ olcTranslucentRemote $ olcUniqu
+ eIgnore $ olcUniqueAttribute $ olcUniqueURI $ olcConstraintAttribute $ olcV
+ alSortAttr $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ olcDDSinterva
+ l $ olcDDStolerance $ olmDbDirectory $ knowledgeInformation $ sn $ serialNu
+ mber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode
+  $ postOfficeBox $ physicalDeliveryOfficeName $ telephoneNumber $ destinati
+ onIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ ho
+ useIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $
+  roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ docum
+ entVersion $ documentLocation $ homePhone $ personalTitle $ mobile $ pager 
+ $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPub
+ lisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ emp
+ loyeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ javaClassN
+ ame $ javaClassNames $ javaFactory $ javaReferenceAddress $ corbaRepository
+ Id $ memberURL $ xmlPrivilegeInfo $ xmlPrivPolicy $ c-l $ c-st $ c-street $
+  c-o $ c-ou $ c-PostalCode $ c-PostOfficeBox $ c-PhysicalDeliveryOfficeName
+  $ c-TelephoneNumber $ authorizedService $ defaultServerList $ preferredSer
+ verList $ authenticationMethod $ serviceSearchDescriptor $ serviceAuthentic
+ ationMethod $ entrustRoamingId $ eduPersonAffiliation $ eduPersonNickname $
+  eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlemen
+ t $ eduPersonScopedAffiliation $ eduOrgLegalName $ schacMotherTongue $ scha
+ cPlaceOfBirth $ schacCountryOfCitizenship $ schacSn1 $ schacSn2 $ schacPers
+ onalTitle $ schacHomeOrganization $ schacHomeOrganizationType $ schacCountr
+ yOfResidence $ schacUserPresenceID $ schacPersonalPosition $ schacPersonalU
+ niqueCode $ schacPersonalUniqueID $ schacUserStatus $ schacProjectMembershi
+ p $ schacProjectSpecificRole $ nisDomain $ SolarisLDAPServers $ SolarisSear
+ chBaseDN $ SolarisBindDN $ SolarisBindPassword $ SolarisAuthMethod $ Solari
+ sTransportSecurity $ SolarisDataSearchDN $ SolarisSearchScope $ SolarisPref
+ eredServer $ SolarisPreferedServerOnly $ SolarisSearchReferral $ middleName
+  $ xmozillanickname $ mozillaHomeLocalityName $ mozillaHomeState $ mozillaH
+ omePostalCode $ mozillaHomeCountryName $ mozillaHomeFriendlyCountryName $ n
+ sAIMid $ sambaLogonScript $ sambaProfilePath $ sambaUserWorkstations $ samb
+ aHomePath $ sambaDomainName $ sambaMungedDial $ sambaShareName $ sambaOptio
+ nName $ sambaStringListOption $ sambaTrustPartner $ sambaFlatName $ sambaTr
+ ustAuthOutgoing $ sambaTrustAuthIncoming $ sambaTrustForestTrustInfo $ krbL
+ dapServers $ krbPrincNamingAttr $ krbDefaultEncSaltTypes $ krbSupportedEncS
+ altTypes $ krbPrincipalAuthInd $ esgSid $ esgSN $ esgInfo $ esgInfoUri $ es
+ gContact $ esgContactPhone $ esgCategory $ esgTool $ esgSource $ esgFormat 
+ $ esgStreamUri $ esgSdpUri $ dlzZoneName $ dlzHostName $ dlzData $ dlzType 
+ $ dlzAdminEmail $ dlzPrimaryNS $ dlzCName $ dlzRecordID $ x509keyUsage $ vP
+ IMTelephoneNumber $ vPIMTextName $ AstContext $ AstExtension $ AstPriority 
+ $ AstApplication $ AstApplicationData $ AstAccountAMAFlags $ AstAccountCall
+ erID $ AstAccountContext $ AstAccountMailbox $ AstMD5secret $ AstAccountDen
+ y $ AstAccountPermit $ AstAccountQualify $ AstAccountType $ AstAccountDisal
+ lowedCodec $ AstAccountExpirationTimestamp $ AstAccountRegistrationContext 
+ $ AstAccountRegistrationExten $ AstAccountNoTransfer $ AstAccountCallGroup 
+ $ AstAccountCanReinvite $ AstAccountDTMFMode $ AstAccountFromUser $ AstAcco
+ untFromDomain $ AstAccountFullContact $ AstAccountHost $ AstAccountInsecure
+  $ AstAccountNAT $ AstAccountPickupGroup $ AstAccountPort $ AstAccountRestr
+ ictCID $ AstAccountRTPTimeout $ AstAccountRTPHoldTimeout $ AstAccountRealme
+ dPassword $ AstAccountAllowedCodec $ AstAccountMusicOnHold $ AstAccountCanC
+ allForward $ AstAccountSecret $ AstAccountName $ AstConfigFilename $ AstCon
+ figCategory $ AstConfigCategoryMetric $ AstConfigVariableName $ AstConfigVa
+ riableValue $ AstConfigCommented $ AstAccountIPAddress $ AstAccountDefaultU
+ ser $ AstAccountRegistrationServer $ AstAccountLastQualifyMilliseconds $ As
+ tAccountCallLimit $ AstVoicemailMailbox $ AstVoicemailPassword $ AstVoicema
+ ilFullname $ AstVoicemailEmail $ AstVoicemailPager $ AstVoicemailOptions $ 
+ AstVoicemailTimestamp $ AstVoicemailContext $ AstAccountSubscribeContext $ 
+ AstAccountUserAgent $ AstAccountLanguage $ AstAccountTransport $ AstAccount
+ PromiscRedir $ AstAccountAccountCode $ AstAccountSetVar $ AstAccountAllowOv
+ erlap $ AstAccountVideoSupport $ AstAccountIgnoreSDPVersion $ AstAccountPat
+ hSupport $ pgpSoftware $ pgpVersion $ pgpCertID $ pgpDisabled $ pgpKeyID $ 
+ pgpKeyType $ pgpUserID $ pgpKeyCreateTime $ pgpSignerID $ pgpRevoked $ pgpS
+ ubKeyID $ pgpKeySize $ pgpKeyExpireTime $ pgpReconCertID $ pgpElementType $
+  calCalURI $ calFBURL $ calCAPURI $ calCalAdrURI $ calOtherCalURIs $ calOth
+ erFBURLs $ calOtherCAPURIs $ calOtherCalAdrURIs $ turbaMembers $ arrayIndex
+  $ dlmIdentifyingDescription $ dlmOtherIdentifyingInfo $ orderedCimKeys $ o
+ rderedCimModelPath $ dlmCaption $ dlmDescription $ dlmName $ dlmStatus $ dl
+ mCreationClassName $ dlmNameFormat $ dlmPrimaryOwnerContact $ dlmPrimaryOwn
+ erName $ dlmRoles $ dlmStartMode $ dlmSettingID $ dlm1FilterListDirection $
+  dlmProtocolType $ dlmOtherTypeDescription $ dlmIPAddress $ dlmIPSubnetMask
+  $ dlmIPAddressType $ dlmIPVersionSupport $ dlmElementID $ dlmRemoteID $ dl
+ mAlgorithm $ dlmProtocol $ dlmSecret $ pcimRoles $ pcimKeywords $ pcimGroup
+ Name $ pcimRuleName $ pcimRuleUsage $ pcimConditionName $ pcimActionName $ 
+ pcimRepositoryName $ pcelsPolicySetName $ pcelsVariableName $ pcelsVariable
+ ModelClass $ pcelsVariableModelProperty $ pcelsExpectedValueTypes $ pcelsVa
+ lueName $ pcelsIPv4AddrList $ pcelsIPv6AddrList $ pcelsMACAddrList $ pcelsS
+ tringList $ pcelsBitStringList $ pcelsIntegerList $ pcelsReusableContainerN
+ ame $ pcelsRole $ pcelsRoleCollectionName $ pcelsFilterName $ pcelsFilterLi
+ stName $ demailMaxAuthLevel $ fedfsAnnotation $ fedfsDescr $ fedfsNfsURI $ 
+ commURI $ commOwner $ SIPIdentitySIPURI $ SIPIdentityUserName $ radiusClien
+ tIdentifier $ radiusClientSecret $ radiusClientShortname $ radiusClientVirt
+ ualServer $ radiusClientType $ radiusClientComment $ birthPlace $ birthName
+  $ businessTitle $ academicTitle $ nickName $ labeledBICandIBAN $ germanTax
+ Nr $ germanUniqueTaxIDNr $ musicalInstrument $ musicalOrchestra $ musicalAr
+ tistName $ germanBankName $ germanBankAccountInfo $ germanBankAccountHolder
+  $ intlMailAddr $ oathTokenSerialNumber $ oathTokenIdentifier $ oathMessage
+  $ oathSuccessMessage $ oathFailureMessage $ 1.3.6.1.4.1.5427.1.389.42.1 $ 
+ aeRemoteHost $ aeSourceUri $ aeTag $ aeSSHProxyCommand $ aeStockId $ aeHwSe
+ rialNumber $ aeDeviceSlot $ aeDevicePort ) )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.4.11 NAME 'dnSuperiorMatch' APPLIES 
+ ( creatorsName $ modifiersName $ subschemaSubentry $ collectiveAttributeSub
+ entries $ entryDN $ namingContexts $ monitorContext $ configContext $ alias
+ edObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSe
+ archBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuth
+ cDn $ olcDbIDAssertAuthcDn $ monitorConnectionAuthzDN $ monitorSuperiorDN $
+  olcRelay $ olcAccessLogDB $ reqDN $ reqAuthzID $ reqNewRDN $ reqNewSuperio
+ r $ auditContext $ olcRefintNothing $ olcRefintModifiersName $ memberOf $ o
+ lcMemberOfDN $ olcUniqueBase $ pwdPolicySubentry $ olcPPolicyDefault $ memb
+ er $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associat
+ edName $ dITRedirect $ dgIdentity $ defaultSearchBase $ eduPersonOrgDN $ ed
+ uPersonOrgUnitDN $ eduPersonPrimaryOrgUnitDN $ krb5PrincipalRealm $ krbReal
+ mReferences $ krbKdcServers $ krbPwdServers $ krbPrincipalReferences $ krbA
+ dmServers $ krbPwdPolicyReference $ krbTicketPolicyReference $ krbSubTrees 
+ $ krbObjectReferences $ krbPrincContainerRef $ esgContactDN $ dhcpPrimaryDN
+  $ dhcpSecondaryDN $ dhcpOptionsDN $ dhcpHostDN $ dhcpPoolDN $ dhcpGroupDN 
+ $ dhcpSubnetDN $ dhcpLeaseDN $ dhcpLeasesDN $ dhcpClassesDN $ dhcpSubclasse
+ sDN $ dhcpSharedNetworkDN $ dhcpServiceDN $ dhcpReservedForClient $ dhcpAss
+ ignedToClient $ dhcpLocatorDN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPeerDN
+  $ dhcpServerDN $ x509CRLDPDN $ x509CRLCertIssuerDN $ x509issuer $ x509subj
+ ect $ x509authorityCertIssuer $ x509subjectDirectoryName $ x509issuerDirect
+ oryName $ x509certLocation $ x509certHolder $ x509issuerSerial $ x509ACHold
+ erPKCissuerDN $ x509ACHolderDN $ x509ACTargetDN $ x509ACTargetGroupDN $ x50
+ 9DPDN $ x509DPrelativeToIssuer $ x509DPissuerDN $ pgpBaseKeySpaceDN $ dlmEl
+ ementSettingElementRef $ dlmElementSettingSettingRef $ dlmMemberOfCollectio
+ nCollectionRef $ dlmMemberOfCollectionMemberRef $ dlmElementAsUserAnteceden
+ tRef $ dlmElementAsUserDependentRef $ dlmUsersCredentialAntecedentRef $ dlm
+ UsersCredentialDependentRef $ pcimConditionDN $ pcimActionDN $ pcelsPolicyS
+ etList $ pcelsPolicySetDN $ pcelsRuleValidityPeriodList $ pcelsConditionLis
+ t $ pcelsActionList $ pcelsVariableDN $ pcelsValueDN $ pcelsExpectedValueLi
+ st $ pcelsReusableContainerList $ pcelsElementList $ pcelsFilterEntryList $
+  fedfsNceDN $ radiusProfileDN $ delegatesTo $ oathParamsEntry $ oathToken $
+  oathHOTPToken $ oathHOTPParams $ oathTOTPParams $ oathTOTPToken $ aeRoot $
+  defaultNamingContext $ aeOwnerGroup $ aePerson $ aeVisibleGroups $ aeDispl
+ ayNameGroups $ aeVisibleSudoers $ aeDept $ aeZoneAdmins $ aeZoneAuditors $ 
+ aePasswordAdmins $ aeLoginGroups $ aeSetupGroups $ aeLogStoreGroups $ aePro
+ xyFor $ aeSrvGroup $ aeHost $ aeNwDevice ) )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.4.10 NAME 'dnSubordinateMatch' APPLI
+ ES ( creatorsName $ modifiersName $ subschemaSubentry $ collectiveAttribute
+ Subentries $ entryDN $ namingContexts $ monitorContext $ configContext $ al
+ iasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaul
+ tSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLA
+ uthcDn $ olcDbIDAssertAuthcDn $ monitorConnectionAuthzDN $ monitorSuperiorD
+ N $ olcRelay $ olcAccessLogDB $ reqDN $ reqAuthzID $ reqNewRDN $ reqNewSupe
+ rior $ auditContext $ olcRefintNothing $ olcRefintModifiersName $ memberOf 
+ $ olcMemberOfDN $ olcUniqueBase $ pwdPolicySubentry $ olcPPolicyDefault $ m
+ ember $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ assoc
+ iatedName $ dITRedirect $ dgIdentity $ defaultSearchBase $ eduPersonOrgDN $
+  eduPersonOrgUnitDN $ eduPersonPrimaryOrgUnitDN $ krb5PrincipalRealm $ krbR
+ ealmReferences $ krbKdcServers $ krbPwdServers $ krbPrincipalReferences $ k
+ rbAdmServers $ krbPwdPolicyReference $ krbTicketPolicyReference $ krbSubTre
+ es $ krbObjectReferences $ krbPrincContainerRef $ esgContactDN $ dhcpPrimar
+ yDN $ dhcpSecondaryDN $ dhcpOptionsDN $ dhcpHostDN $ dhcpPoolDN $ dhcpGroup
+ DN $ dhcpSubnetDN $ dhcpLeaseDN $ dhcpLeasesDN $ dhcpClassesDN $ dhcpSubcla
+ ssesDN $ dhcpSharedNetworkDN $ dhcpServiceDN $ dhcpReservedForClient $ dhcp
+ AssignedToClient $ dhcpLocatorDN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPee
+ rDN $ dhcpServerDN $ x509CRLDPDN $ x509CRLCertIssuerDN $ x509issuer $ x509s
+ ubject $ x509authorityCertIssuer $ x509subjectDirectoryName $ x509issuerDir
+ ectoryName $ x509certLocation $ x509certHolder $ x509issuerSerial $ x509ACH
+ olderPKCissuerDN $ x509ACHolderDN $ x509ACTargetDN $ x509ACTargetGroupDN $ 
+ x509DPDN $ x509DPrelativeToIssuer $ x509DPissuerDN $ pgpBaseKeySpaceDN $ dl
+ mElementSettingElementRef $ dlmElementSettingSettingRef $ dlmMemberOfCollec
+ tionCollectionRef $ dlmMemberOfCollectionMemberRef $ dlmElementAsUserAntece
+ dentRef $ dlmElementAsUserDependentRef $ dlmUsersCredentialAntecedentRef $ 
+ dlmUsersCredentialDependentRef $ pcimConditionDN $ pcimActionDN $ pcelsPoli
+ cySetList $ pcelsPolicySetDN $ pcelsRuleValidityPeriodList $ pcelsCondition
+ List $ pcelsActionList $ pcelsVariableDN $ pcelsValueDN $ pcelsExpectedValu
+ eList $ pcelsReusableContainerList $ pcelsElementList $ pcelsFilterEntryLis
+ t $ fedfsNceDN $ radiusProfileDN $ delegatesTo $ oathParamsEntry $ oathToke
+ n $ oathHOTPToken $ oathHOTPParams $ oathTOTPParams $ oathTOTPToken $ aeRoo
+ t $ defaultNamingContext $ aeOwnerGroup $ aePerson $ aeVisibleGroups $ aeDi
+ splayNameGroups $ aeVisibleSudoers $ aeDept $ aeZoneAdmins $ aeZoneAuditors
+  $ aePasswordAdmins $ aeLoginGroups $ aeSetupGroups $ aeLogStoreGroups $ ae
+ ProxyFor $ aeSrvGroup $ aeHost $ aeNwDevice ) )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.4.8 NAME 'dnOneLevelMatch' APPLIES (
+  creatorsName $ modifiersName $ subschemaSubentry $ collectiveAttributeSube
+ ntries $ entryDN $ namingContexts $ monitorContext $ configContext $ aliase
+ dObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSea
+ rchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthc
+ Dn $ olcDbIDAssertAuthcDn $ monitorConnectionAuthzDN $ monitorSuperiorDN $ 
+ olcRelay $ olcAccessLogDB $ reqDN $ reqAuthzID $ reqNewRDN $ reqNewSuperior
+  $ auditContext $ olcRefintNothing $ olcRefintModifiersName $ memberOf $ ol
+ cMemberOfDN $ olcUniqueBase $ pwdPolicySubentry $ olcPPolicyDefault $ membe
+ r $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associate
+ dName $ dITRedirect $ dgIdentity $ defaultSearchBase $ eduPersonOrgDN $ edu
+ PersonOrgUnitDN $ eduPersonPrimaryOrgUnitDN $ krb5PrincipalRealm $ krbRealm
+ References $ krbKdcServers $ krbPwdServers $ krbPrincipalReferences $ krbAd
+ mServers $ krbPwdPolicyReference $ krbTicketPolicyReference $ krbSubTrees $
+  krbObjectReferences $ krbPrincContainerRef $ esgContactDN $ dhcpPrimaryDN 
+ $ dhcpSecondaryDN $ dhcpOptionsDN $ dhcpHostDN $ dhcpPoolDN $ dhcpGroupDN $
+  dhcpSubnetDN $ dhcpLeaseDN $ dhcpLeasesDN $ dhcpClassesDN $ dhcpSubclasses
+ DN $ dhcpSharedNetworkDN $ dhcpServiceDN $ dhcpReservedForClient $ dhcpAssi
+ gnedToClient $ dhcpLocatorDN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPeerDN 
+ $ dhcpServerDN $ x509CRLDPDN $ x509CRLCertIssuerDN $ x509issuer $ x509subje
+ ct $ x509authorityCertIssuer $ x509subjectDirectoryName $ x509issuerDirecto
+ ryName $ x509certLocation $ x509certHolder $ x509issuerSerial $ x509ACHolde
+ rPKCissuerDN $ x509ACHolderDN $ x509ACTargetDN $ x509ACTargetGroupDN $ x509
+ DPDN $ x509DPrelativeToIssuer $ x509DPissuerDN $ pgpBaseKeySpaceDN $ dlmEle
+ mentSettingElementRef $ dlmElementSettingSettingRef $ dlmMemberOfCollection
+ CollectionRef $ dlmMemberOfCollectionMemberRef $ dlmElementAsUserAntecedent
+ Ref $ dlmElementAsUserDependentRef $ dlmUsersCredentialAntecedentRef $ dlmU
+ sersCredentialDependentRef $ pcimConditionDN $ pcimActionDN $ pcelsPolicySe
+ tList $ pcelsPolicySetDN $ pcelsRuleValidityPeriodList $ pcelsConditionList
+  $ pcelsActionList $ pcelsVariableDN $ pcelsValueDN $ pcelsExpectedValueLis
+ t $ pcelsReusableContainerList $ pcelsElementList $ pcelsFilterEntryList $ 
+ fedfsNceDN $ radiusProfileDN $ delegatesTo $ oathParamsEntry $ oathToken $ 
+ oathHOTPToken $ oathHOTPParams $ oathTOTPParams $ oathTOTPToken $ aeRoot $ 
+ defaultNamingContext $ aeOwnerGroup $ aePerson $ aeVisibleGroups $ aeDispla
+ yNameGroups $ aeVisibleSudoers $ aeDept $ aeZoneAdmins $ aeZoneAuditors $ a
+ ePasswordAdmins $ aeLoginGroups $ aeSetupGroups $ aeLogStoreGroups $ aeProx
+ yFor $ aeSrvGroup $ aeHost $ aeNwDevice ) )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.4.9 NAME 'dnSubtreeMatch' APPLIES ( 
+ creatorsName $ modifiersName $ subschemaSubentry $ collectiveAttributeSuben
+ tries $ entryDN $ namingContexts $ monitorContext $ configContext $ aliased
+ ObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSear
+ chBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcD
+ n $ olcDbIDAssertAuthcDn $ monitorConnectionAuthzDN $ monitorSuperiorDN $ o
+ lcRelay $ olcAccessLogDB $ reqDN $ reqAuthzID $ reqNewRDN $ reqNewSuperior 
+ $ auditContext $ olcRefintNothing $ olcRefintModifiersName $ memberOf $ olc
+ MemberOfDN $ olcUniqueBase $ pwdPolicySubentry $ olcPPolicyDefault $ member
+  $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associated
+ Name $ dITRedirect $ dgIdentity $ defaultSearchBase $ eduPersonOrgDN $ eduP
+ ersonOrgUnitDN $ eduPersonPrimaryOrgUnitDN $ krb5PrincipalRealm $ krbRealmR
+ eferences $ krbKdcServers $ krbPwdServers $ krbPrincipalReferences $ krbAdm
+ Servers $ krbPwdPolicyReference $ krbTicketPolicyReference $ krbSubTrees $ 
+ krbObjectReferences $ krbPrincContainerRef $ esgContactDN $ dhcpPrimaryDN $
+  dhcpSecondaryDN $ dhcpOptionsDN $ dhcpHostDN $ dhcpPoolDN $ dhcpGroupDN $ 
+ dhcpSubnetDN $ dhcpLeaseDN $ dhcpLeasesDN $ dhcpClassesDN $ dhcpSubclassesD
+ N $ dhcpSharedNetworkDN $ dhcpServiceDN $ dhcpReservedForClient $ dhcpAssig
+ nedToClient $ dhcpLocatorDN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPeerDN $
+  dhcpServerDN $ x509CRLDPDN $ x509CRLCertIssuerDN $ x509issuer $ x509subjec
+ t $ x509authorityCertIssuer $ x509subjectDirectoryName $ x509issuerDirector
+ yName $ x509certLocation $ x509certHolder $ x509issuerSerial $ x509ACHolder
+ PKCissuerDN $ x509ACHolderDN $ x509ACTargetDN $ x509ACTargetGroupDN $ x509D
+ PDN $ x509DPrelativeToIssuer $ x509DPissuerDN $ pgpBaseKeySpaceDN $ dlmElem
+ entSettingElementRef $ dlmElementSettingSettingRef $ dlmMemberOfCollectionC
+ ollectionRef $ dlmMemberOfCollectionMemberRef $ dlmElementAsUserAntecedentR
+ ef $ dlmElementAsUserDependentRef $ dlmUsersCredentialAntecedentRef $ dlmUs
+ ersCredentialDependentRef $ pcimConditionDN $ pcimActionDN $ pcelsPolicySet
+ List $ pcelsPolicySetDN $ pcelsRuleValidityPeriodList $ pcelsConditionList 
+ $ pcelsActionList $ pcelsVariableDN $ pcelsValueDN $ pcelsExpectedValueList
+  $ pcelsReusableContainerList $ pcelsElementList $ pcelsFilterEntryList $ f
+ edfsNceDN $ radiusProfileDN $ delegatesTo $ oathParamsEntry $ oathToken $ o
+ athHOTPToken $ oathHOTPParams $ oathTOTPParams $ oathTOTPToken $ aeRoot $ d
+ efaultNamingContext $ aeOwnerGroup $ aePerson $ aeVisibleGroups $ aeDisplay
+ NameGroups $ aeVisibleSudoers $ aeDept $ aeZoneAdmins $ aeZoneAuditors $ ae
+ PasswordAdmins $ aeLoginGroups $ aeSetupGroups $ aeLogStoreGroups $ aeProxy
+ For $ aeSrvGroup $ aeHost $ aeNwDevice ) )
+matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creators
+ Name $ modifiersName $ subschemaSubentry $ collectiveAttributeSubentries $ 
+ entryDN $ namingContexts $ monitorContext $ configContext $ aliasedObjectNa
+ me $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $
+  olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcDn $ olcD
+ bIDAssertAuthcDn $ monitorConnectionAuthzDN $ monitorSuperiorDN $ olcRelay 
+ $ olcAccessLogDB $ reqDN $ reqAuthzID $ reqNewRDN $ reqNewSuperior $ auditC
+ ontext $ olcRefintNothing $ olcRefintModifiersName $ memberOf $ olcMemberOf
+ DN $ olcUniqueBase $ pwdPolicySubentry $ olcPPolicyDefault $ member $ owner
+  $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ d
+ ITRedirect $ dgIdentity $ defaultSearchBase $ eduPersonOrgDN $ eduPersonOrg
+ UnitDN $ eduPersonPrimaryOrgUnitDN $ krb5PrincipalRealm $ krbRealmReference
+ s $ krbKdcServers $ krbPwdServers $ krbPrincipalReferences $ krbAdmServers 
+ $ krbPwdPolicyReference $ krbTicketPolicyReference $ krbSubTrees $ krbObjec
+ tReferences $ krbPrincContainerRef $ esgContactDN $ dhcpPrimaryDN $ dhcpSec
+ ondaryDN $ dhcpOptionsDN $ dhcpHostDN $ dhcpPoolDN $ dhcpGroupDN $ dhcpSubn
+ etDN $ dhcpLeaseDN $ dhcpLeasesDN $ dhcpClassesDN $ dhcpSubclassesDN $ dhcp
+ SharedNetworkDN $ dhcpServiceDN $ dhcpReservedForClient $ dhcpAssignedToCli
+ ent $ dhcpLocatorDN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPeerDN $ dhcpSer
+ verDN $ x509CRLDPDN $ x509CRLCertIssuerDN $ x509issuer $ x509subject $ x509
+ authorityCertIssuer $ x509subjectDirectoryName $ x509issuerDirectoryName $ 
+ x509certLocation $ x509certHolder $ x509issuerSerial $ x509ACHolderPKCissue
+ rDN $ x509ACHolderDN $ x509ACTargetDN $ x509ACTargetGroupDN $ x509DPDN $ x5
+ 09DPrelativeToIssuer $ x509DPissuerDN $ pgpBaseKeySpaceDN $ dlmElementSetti
+ ngElementRef $ dlmElementSettingSettingRef $ dlmMemberOfCollectionCollectio
+ nRef $ dlmMemberOfCollectionMemberRef $ dlmElementAsUserAntecedentRef $ dlm
+ ElementAsUserDependentRef $ dlmUsersCredentialAntecedentRef $ dlmUsersCrede
+ ntialDependentRef $ pcimConditionDN $ pcimActionDN $ pcelsPolicySetList $ p
+ celsPolicySetDN $ pcelsRuleValidityPeriodList $ pcelsConditionList $ pcelsA
+ ctionList $ pcelsVariableDN $ pcelsValueDN $ pcelsExpectedValueList $ pcels
+ ReusableContainerList $ pcelsElementList $ pcelsFilterEntryList $ fedfsNceD
+ N $ radiusProfileDN $ delegatesTo $ oathParamsEntry $ oathToken $ oathHOTPT
+ oken $ oathHOTPParams $ oathTOTPParams $ oathTOTPToken $ aeRoot $ defaultNa
+ mingContext $ aeOwnerGroup $ aePerson $ aeVisibleGroups $ aeDisplayNameGrou
+ ps $ aeVisibleSudoers $ aeDept $ aeZoneAdmins $ aeZoneAuditors $ aePassword
+ Admins $ aeLoginGroups $ aeSetupGroups $ aeLogStoreGroups $ aeProxyFor $ ae
+ SrvGroup $ aeHost $ aeNwDevice ) )
+matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( collectiv
+ eExclusions $ supportedControl $ supportedExtension $ supportedFeatures $ a
+ dministrativeRole $ supportedApplicationContext $ x509CRLDPRegisteredID $ x
+ 509CRLCertIssuerRegisteredID $ x509CRLCertHoldInstructionCode $ x509signatu
+ reAlgorithm $ x509subjectPublicKeyInfoAlgorithm $ x509policyInformationIden
+ tifier $ x509subjectRegisteredID $ x509issuerRegisteredID $ x509extKeyUsage
+  $ x509ACHolderRegisteredID $ x509ACDigestAlgorithm $ x509ACTargetRegistere
+ dID $ x509ACTargetGroupRegisteredID $ x509DPRegisteredID $ x509DPissuerRegi
+ steredID $ pcelsVendorVariableEncoding $ pcelsVendorValueEncoding $ oathHMA
+ CAlgorithm $ msPwdResetHashAlgorithm ) )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.4.5 NAME 'IA5StringApproxMatch' APPL
+ IES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ 
+ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetM
+ ailbox $ mailLocalAddress $ mailHost $ mailRoutingAddress $ rfc822MailMembe
+ r $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ip
+ HostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ ni
+ sMapEntry $ javaCodebase $ javaDoc $ corbaIor $ pwdCheckModule $ attributeM
+ ap $ credentialLevel $ objectclassMap $ defaultSearchScope $ serviceCredent
+ ialLevel $ eduOrgHomePageURI $ eduOrgIdentityAuthNPolicyURI $ eduOrgSuperio
+ rURI $ eduOrgWhitePagesURI $ schacUserPrivateAttribute $ dNSClass $ wKSReco
+ rd $ pTRRecord $ hInfoRecord $ mInfoRecord $ tXTRecord $ rPRecord $ aFSDBRe
+ cord $ SigRecord $ KeyRecord $ gPosRecord $ aAAARecord $ LocRecord $ nXTRec
+ ord $ sRVRecord $ nAPTRRecord $ kXRecord $ certRecord $ a6Record $ dNameRec
+ ord $ aPLRecord $ dSRecord $ sSHFPRecord $ iPSecKeyRecord $ rRSIGRecord $ n
+ SECRecord $ dNSKeyRecord $ dHCIDRecord $ nSec3ParamRecord $ TLSARecord $ sP
+ FRecord $ CAARecord $ DLVRecord $ nisPublickey $ nisSecretkey $ mgrpRFC822M
+ ailMember $ nisNetIdUser $ nisNetIdGroup $ nisNetIdHost $ mozillaSecondEmai
+ l $ homeurl $ workurl $ custom1 $ custom2 $ custom3 $ custom4 $ sambaLMPass
+ word $ sambaNTPassword $ sambaAcctFlags $ sambaLogonHours $ sambaHomeDrive 
+ $ sambaPasswordHistory $ sambaSID $ sambaPrimaryGroupSID $ sambaSIDList $ s
+ ambaStringOption $ sambaTrustFlags $ sambaSecurityIdentifier $ krb5Principa
+ lName $ krbPrincipalName $ krbCanonicalName $ krbHostServer $ krbPwdAllowed
+ Keysalts $ krbPrincipalAliases $ krbAllowedToDelegateTo $ esgContactMail $ 
+ dhcpStatements $ dhcpRange $ dhcpPermitList $ dhcpOption $ dhcpClassData $ 
+ dhcpVersion $ dhcpImplementation $ dhcpAddressState $ dhcpDomainName $ dhcp
+ RequestedHostName $ dhcpAssignedHostName $ dhcpHWAddress $ dhcpFailOverEndp
+ ointState $ dhcpErrorLog $ dhcpKeyAlgorithm $ dhcpDnsZoneServer $ dhcpFailO
+ verPrimaryServer $ dhcpFailOverSecondaryServer $ dhcpComments $ dlzIPAddr $
+  automountMapName $ automountKey $ automountInformation $ x509CRLDPRfc822Na
+ me $ x509CRLDPDnsName $ x509CRLDPURI $ x509CRLDPIpAddress $ x509CRLCertIssu
+ erRfc822Name $ x509CRLCertIssuerDnsName $ x509CRLCertIssuerURI $ x509CRLCer
+ tIssuerIpAddress $ x509subjectRfc822Name $ x509subjectDnsName $ x509subject
+ UniformResourceIdentifier $ x509subjectIpAddress $ x509issuerRfc822Name $ x
+ 509issuerDnsName $ x509issuerUniformResourceIdentifier $ x509issuerIpAddres
+ s $ x509fullCRLDistributionPointURI $ x509ACHolderRfc822Name $ x509ACHolder
+ DNSName $ x509ACHolderURI $ x509ACHolderIPAddress $ x509ACTargetRfc822Name 
+ $ x509ACTargetDNSName $ x509ACTargetURI $ x509ACTargetIPAddress $ x509ACTar
+ getGroupRfc822Name $ x509ACTargetGroupDNSName $ x509ACTargetGroupURI $ x509
+ ACTargetGroupIPAddress $ x509DPRfc822Name $ x509DPDNSName $ x509DPURI $ x50
+ 9DPIPAddress $ x509DPissuerRfc822Name $ x509DPissuerDNSName $ x509DPissuerU
+ RI $ x509DPissuerIPAddress $ vPIMRfc822Mailbox $ vPIMSupportedAudioMediaTyp
+ es $ vPIMSupportedMessageContext $ vPIMExtendedAbsenceStatus $ vPIMSupporte
+ dUABehaviors $ pgpKey $ hordePrefs $ impPrefs $ turbaPrefs $ turbaType $ tu
+ rbaPGPPublicKey $ kronolithPrefs $ nagPrefs $ gollemPrefs $ choraPrefs $ mn
+ emoPrefs $ trollPrefs $ klutzPrefs $ jonahPrefs $ hermesPrefs $ junoPrefs $
+  treanPrefs $ whupsPrefs $ ingoPrefs $ anselPrefs $ geniePrefs $ scryPrefs 
+ $ wickedPrefs $ agoraPrefs $ goopsPrefs $ merkPrefs $ mimpPrefs $ mottlePre
+ fs $ nicPrefs $ occamPrefs $ odinPrefs $ rakimPrefs $ seshaPrefs $ swooshPr
+ efs $ thorPrefs $ ulaformPrefs $ volosPrefs $ jetaPrefs $ sudoUser $ sudoHo
+ st $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup 
+ $ puppetClass $ parentNode $ environment $ puppetVar $ DKIMSelector $ DKIMK
+ ey $ DKIMIdentity $ DKIMDomain $ quota $ tacacsClient $ tacacsMember $ taca
+ csProfile $ tacacsFlag $ commUniqueId $ commPrivate $ SIPIdentityRegistrarA
+ ddress $ SIPIdentityProxyAddress $ SIPIdentityAddress $ SIPIdentityServiceL
+ evel $ radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ rad
+ iusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStation
+ Id $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusF
+ ilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radius
+ FramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ rad
+ iusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFrame
+ dProtocol $ radiusFramedRoute $ radiusFramedRouting $ radiusGroupName $ rad
+ iusHint $ radiusHuntgroupName $ radiusIdleTimeout $ radiusLoginIPHost $ rad
+ iusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLAT
+ Service $ radiusLoginService $ radiusLoginTCPPort $ radiusPasswordRetry $ r
+ adiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusReplicateToRealm
+  $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusTerminati
+ onAction $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnel
+ Password $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunn
+ elServerEndpoint $ radiusTunnelType $ radiusVSA $ radiusTunnelClientEndpoin
+ t $ radiusLoginTime $ radiusUserCategory $ dialupAccess $ radiusExpiration 
+ $ radiusAttribute $ radiusNASIpAddress $ radiusReplyMessage $ radiusControl
+ Attribute $ radiusReplyAttribute $ radiusRequestAttribute $ dateOfBirth $ e
+ uVATId $ msPwdResetPasswordHash $ msPwdResetAdminPw $ aeTicketId $ aeFqdn )
+  )
+matchingRuleUse: ( 1.3.6.1.4.1.4203.666.4.4 NAME 'directoryStringApproxMatch
+ ' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ na
+ me $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ o
+ lcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeType
+ s $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDa
+ tabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ o
+ lcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olc
+ ModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPassw
+ ordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLo
+ gFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $
+  olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSa
+ slAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ o
+ lcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ ol
+ cTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePa
+ th $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $
+  olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olc
+ TLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbC
+ heckpoint $ olcDbEnvFlags $ olcDbIndex $ olcDbMode $ olcDbCryptFile $ olcDb
+ PageSize $ olcDbLockDetect $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ ol
+ cDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ 
+ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $
+  olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDb
+ OnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ olcD
+ bRewrite $ olcDbMap $ olcDbSubtreeExclude $ olcDbSubtreeInclude $ olcDbDefa
+ ultTarget $ olcDbDnCacheTtl $ olcDbBindTimeout $ olcDbNretries $ olcDbClien
+ tPr $ olcMetaSub $ olcDbFilter $ monitoredInfo $ managedInfo $ monitorConne
+ ctionLocalAddress $ monitorConnectionPeerAddress $ monitorOverlay $ restric
+ tedOperation $ monitorConnectionProtocol $ monitorConnectionMask $ monitorC
+ onnectionListener $ monitorConnectionPeerDomain $ monitorUpdateRef $ olcAud
+ itlogFile $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAcce
+ ssLogOldAttr $ olcAccessLogBase $ reqType $ reqSession $ reqMessage $ reqRe
+ ferral $ reqMethod $ reqAssertion $ reqScope $ reqDerefAliases $ reqFilter 
+ $ reqAttr $ olcCollectInfo $ olcDlAttrSet $ olcRefintAttribute $ olcMemberO
+ fDangling $ olcMemberOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfA
+ D $ olcMemberOfDanglingError $ olcSpCheckpoint $ olcTranslucentLocal $ olcT
+ ranslucentRemote $ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueURI $ ol
+ cConstraintAttribute $ olcValSortAttr $ olcDDSmaxTtl $ olcDDSminTtl $ olcDD
+ SdefaultTtl $ olcDDSinterval $ olcDDStolerance $ olmDbDirectory $ knowledge
+ Information $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ bu
+ sinessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ 
+ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQuali
+ fier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info 
+ $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitl
+ e $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentif
+ ier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense 
+ $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferre
+ dLanguage $ ipServiceProtocol $ nisMapName $ javaClassName $ javaClassNames
+  $ javaFactory $ javaReferenceAddress $ corbaRepositoryId $ memberURL $ xml
+ PrivilegeInfo $ xmlPrivPolicy $ c-l $ c-st $ c-street $ c-o $ c-ou $ c-Post
+ alCode $ c-PostOfficeBox $ c-PhysicalDeliveryOfficeName $ authorizedService
+  $ defaultServerList $ preferredServerList $ authenticationMethod $ service
+ SearchDescriptor $ serviceAuthenticationMethod $ entrustRoamingId $ eduPers
+ onAffiliation $ eduPersonNickname $ eduPersonPrimaryAffiliation $ eduPerson
+ PrincipalName $ eduPersonEntitlement $ eduPersonScopedAffiliation $ eduOrgL
+ egalName $ schacMotherTongue $ schacPlaceOfBirth $ schacCountryOfCitizenshi
+ p $ schacSn1 $ schacSn2 $ schacPersonalTitle $ schacHomeOrganization $ scha
+ cHomeOrganizationType $ schacCountryOfResidence $ schacUserPresenceID $ sch
+ acPersonalPosition $ schacPersonalUniqueCode $ schacPersonalUniqueID $ scha
+ cUserStatus $ schacProjectMembership $ schacProjectSpecificRole $ nisDomain
+  $ SolarisLDAPServers $ SolarisSearchBaseDN $ SolarisBindDN $ SolarisBindPa
+ ssword $ SolarisAuthMethod $ SolarisTransportSecurity $ SolarisDataSearchDN
+  $ SolarisSearchScope $ SolarisPreferedServer $ SolarisPreferedServerOnly $
+  SolarisSearchReferral $ middleName $ xmozillanickname $ mozillaHomeLocalit
+ yName $ mozillaHomeState $ mozillaHomePostalCode $ mozillaHomeCountryName $
+  mozillaHomeFriendlyCountryName $ sambaLogonScript $ sambaProfilePath $ sam
+ baUserWorkstations $ sambaHomePath $ sambaDomainName $ sambaMungedDial $ sa
+ mbaShareName $ sambaOptionName $ sambaStringListOption $ sambaTrustPartner 
+ $ sambaFlatName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaTr
+ ustForestTrustInfo $ krbLdapServers $ krbPrincNamingAttr $ krbDefaultEncSal
+ tTypes $ krbSupportedEncSaltTypes $ krbPrincipalAuthInd $ esgSid $ esgSN $ 
+ esgInfo $ esgInfoUri $ esgContact $ esgCategory $ esgTool $ esgSource $ esg
+ Format $ esgStreamUri $ esgSdpUri $ dlzZoneName $ dlzHostName $ dlzData $ d
+ lzType $ dlzAdminEmail $ dlzPrimaryNS $ dlzCName $ dlzRecordID $ x509keyUsa
+ ge $ vPIMTelephoneNumber $ vPIMTextName $ AstContext $ AstExtension $ AstPr
+ iority $ AstApplication $ AstApplicationData $ AstAccountAMAFlags $ AstAcco
+ untCallerID $ AstAccountContext $ AstAccountMailbox $ AstMD5secret $ AstAcc
+ ountDeny $ AstAccountPermit $ AstAccountQualify $ AstAccountType $ AstAccou
+ ntDisallowedCodec $ AstAccountExpirationTimestamp $ AstAccountRegistrationC
+ ontext $ AstAccountRegistrationExten $ AstAccountNoTransfer $ AstAccountCal
+ lGroup $ AstAccountCanReinvite $ AstAccountDTMFMode $ AstAccountFromUser $ 
+ AstAccountFromDomain $ AstAccountFullContact $ AstAccountHost $ AstAccountI
+ nsecure $ AstAccountNAT $ AstAccountPickupGroup $ AstAccountPort $ AstAccou
+ ntRestrictCID $ AstAccountRTPTimeout $ AstAccountRTPHoldTimeout $ AstAccoun
+ tRealmedPassword $ AstAccountAllowedCodec $ AstAccountMusicOnHold $ AstAcco
+ untCanCallForward $ AstAccountSecret $ AstAccountName $ AstConfigFilename $
+  AstConfigCategory $ AstConfigCategoryMetric $ AstConfigVariableName $ AstC
+ onfigVariableValue $ AstConfigCommented $ AstAccountIPAddress $ AstAccountD
+ efaultUser $ AstAccountRegistrationServer $ AstAccountLastQualifyMillisecon
+ ds $ AstAccountCallLimit $ AstVoicemailMailbox $ AstVoicemailPassword $ Ast
+ VoicemailFullname $ AstVoicemailEmail $ AstVoicemailPager $ AstVoicemailOpt
+ ions $ AstVoicemailTimestamp $ AstVoicemailContext $ AstAccountSubscribeCon
+ text $ AstAccountUserAgent $ AstAccountLanguage $ AstAccountTransport $ Ast
+ AccountPromiscRedir $ AstAccountAccountCode $ AstAccountSetVar $ AstAccount
+ AllowOverlap $ AstAccountVideoSupport $ AstAccountIgnoreSDPVersion $ AstAcc
+ ountPathSupport $ pgpSoftware $ pgpVersion $ pgpCertID $ pgpDisabled $ pgpK
+ eyID $ pgpKeyType $ pgpUserID $ pgpKeyCreateTime $ pgpSignerID $ pgpRevoked
+  $ pgpSubKeyID $ pgpKeySize $ pgpKeyExpireTime $ pgpReconCertID $ pgpElemen
+ tType $ calCalURI $ calFBURL $ calCAPURI $ calCalAdrURI $ calOtherCalURIs $
+  calOtherFBURLs $ calOtherCAPURIs $ calOtherCalAdrURIs $ turbaMembers $ arr
+ ayIndex $ dlmIdentifyingDescription $ dlmOtherIdentifyingInfo $ orderedCimK
+ eys $ orderedCimModelPath $ dlmCaption $ dlmDescription $ dlmName $ dlmStat
+ us $ dlmCreationClassName $ dlmNameFormat $ dlmPrimaryOwnerContact $ dlmPri
+ maryOwnerName $ dlmRoles $ dlmStartMode $ dlmSettingID $ dlm1FilterListDire
+ ction $ dlmProtocolType $ dlmOtherTypeDescription $ dlmIPAddress $ dlmIPSub
+ netMask $ dlmIPAddressType $ dlmIPVersionSupport $ dlmElementID $ dlmRemote
+ ID $ dlmAlgorithm $ dlmProtocol $ dlmSecret $ pcimRoles $ pcimKeywords $ pc
+ imGroupName $ pcimRuleName $ pcimRuleUsage $ pcimConditionName $ pcimAction
+ Name $ pcimRepositoryName $ pcelsPolicySetName $ pcelsVariableName $ pcelsV
+ ariableModelClass $ pcelsVariableModelProperty $ pcelsExpectedValueTypes $ 
+ pcelsValueName $ pcelsIPv4AddrList $ pcelsIPv6AddrList $ pcelsMACAddrList $
+  pcelsStringList $ pcelsBitStringList $ pcelsIntegerList $ pcelsReusableCon
+ tainerName $ pcelsRole $ pcelsRoleCollectionName $ pcelsFilterName $ pcelsF
+ ilterListName $ demailMaxAuthLevel $ fedfsAnnotation $ fedfsDescr $ fedfsNf
+ sURI $ commURI $ commOwner $ SIPIdentitySIPURI $ SIPIdentityUserName $ radi
+ usClientIdentifier $ radiusClientSecret $ radiusClientShortname $ radiusCli
+ entVirtualServer $ radiusClientType $ radiusClientComment $ birthPlace $ bi
+ rthName $ businessTitle $ academicTitle $ nickName $ labeledBICandIBAN $ ge
+ rmanTaxNr $ germanUniqueTaxIDNr $ musicalInstrument $ musicalOrchestra $ mu
+ sicalArtistName $ germanBankName $ germanBankAccountInfo $ germanBankAccoun
+ tHolder $ intlMailAddr $ oathTokenSerialNumber $ oathTokenIdentifier $ oath
+ Message $ oathSuccessMessage $ oathFailureMessage $ 1.3.6.1.4.1.5427.1.389.
+ 42.1 $ aeRemoteHost $ aeSourceUri $ aeTag $ aeSSHProxyCommand $ aeStockId $
+  aeHwSerialNumber $ aeDeviceSlot $ aeDevicePort ) )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' SYNTAX 1.3
+ .6.1.4.1.4203.666.2.1 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.12 NAME 'authzMatch' SYNTAX 1.3.6.1.
+ 4.1.4203.666.2.7 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.11.2.5 NAME 'CSNSIDMatch' SYNTAX 1.3.6
+ .1.4.1.4203.666.11.2.4 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.11.2.3 NAME 'CSNOrderingMatch' SYNTAX 
+ 1.3.6.1.4.1.4203.666.11.2.1 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.11.2.2 NAME 'CSNMatch' SYNTAX 1.3.6.1.
+ 4.1.4203.666.11.2.1 )
+matchingRules: ( 1.3.6.1.1.16.3 NAME 'UUIDOrderingMatch' SYNTAX 1.3.6.1.1.16
+ .1 )
+matchingRules: ( 1.3.6.1.1.16.2 NAME 'UUIDMatch' SYNTAX 1.3.6.1.1.16.1 )
+matchingRules: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.27 )
+matchingRules: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.27 )
+matchingRules: ( 1.3.6.1.4.1.4203.1.2.1 NAME 'caseExactIA5SubstringsMatch' S
+ YNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+matchingRules: ( 1.3.6.1.4.1.1466.109.114.3 NAME 'caseIgnoreIA5SubstringsMat
+ ch' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+matchingRules: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 )
+matchingRules: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.26 )
+matchingRules: ( 2.5.13.45 NAME 'attributeCertificateExactMatch' SYNTAX 1.3.
+ 6.1.4.1.4203.666.11.10.2.2 )
+matchingRules: ( 2.5.13.38 NAME 'certificateListExactMatch' SYNTAX 1.3.6.1.1
+ .15.5 )
+matchingRules: ( 2.5.13.34 NAME 'certificateExactMatch' SYNTAX 1.3.6.1.1.15.
+ 1 )
+matchingRules: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.38 )
+matchingRules: ( 2.5.13.29 NAME 'integerFirstComponentMatch' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.27 )
+matchingRules: ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.24 )
+matchingRules: ( 2.5.13.27 NAME 'generalizedTimeMatch' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.24 )
+matchingRules: ( 2.5.13.23 NAME 'uniqueMemberMatch' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.34 )
+matchingRules: ( 2.5.13.21 NAME 'telephoneNumberSubstringsMatch' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.20 NAME 'telephoneNumberMatch' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.50 )
+matchingRules: ( 2.5.13.19 NAME 'octetStringSubstringsMatch' SYNTAX 1.3.6.1.
+ 4.1.1466.115.121.1.40 )
+matchingRules: ( 2.5.13.18 NAME 'octetStringOrderingMatch' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.40 )
+matchingRules: ( 2.5.13.17 NAME 'octetStringMatch' SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.40 )
+matchingRules: ( 2.5.13.16 NAME 'bitStringMatch' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.6 )
+matchingRules: ( 2.5.13.15 NAME 'integerOrderingMatch' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.27 )
+matchingRules: ( 2.5.13.14 NAME 'integerMatch' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.27 )
+matchingRules: ( 2.5.13.13 NAME 'booleanMatch' SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.7 )
+matchingRules: ( 2.5.13.11 NAME 'caseIgnoreListMatch' SYNTAX 1.3.6.1.4.1.146
+ 6.115.121.1.41 )
+matchingRules: ( 2.5.13.10 NAME 'numericStringSubstringsMatch' SYNTAX 1.3.6.
+ 1.4.1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.9 NAME 'numericStringOrderingMatch' SYNTAX 1.3.6.1.4
+ .1.1466.115.121.1.36 )
+matchingRules: ( 2.5.13.8 NAME 'numericStringMatch' SYNTAX 1.3.6.1.4.1.1466.
+ 115.121.1.36 )
+matchingRules: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' SYNTAX 1.3.6.1.4.1
+ .1466.115.121.1.58 )
+matchingRules: ( 2.5.13.6 NAME 'caseExactOrderingMatch' SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.15 )
+matchingRules: ( 2.5.13.5 NAME 'caseExactMatch' SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.15 )
+matchingRules: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' SYNTAX 1.3.6.1.4.
+ 1.1466.115.121.1.58 )
+matchingRules: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.15 )
+matchingRules: ( 2.5.13.2 NAME 'caseIgnoreMatch' SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.15 )
+matchingRules: ( 1.2.36.79672281.1.13.3 NAME 'rdnMatch' SYNTAX 1.2.36.796722
+ 81.1.5.0 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.11 NAME 'dnSuperiorMatch' SYNTAX 1.3
+ .6.1.4.1.1466.115.121.1.12 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.10 NAME 'dnSubordinateMatch' SYNTAX 
+ 1.3.6.1.4.1.1466.115.121.1.12 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.8 NAME 'dnOneLevelMatch' SYNTAX 1.3.
+ 6.1.4.1.1466.115.121.1.12 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.9 NAME 'dnSubtreeMatch' SYNTAX 1.3.6
+ .1.4.1.1466.115.121.1.12 )
+matchingRules: ( 2.5.13.1 NAME 'distinguishedNameMatch' SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.12 )
+matchingRules: ( 2.5.13.0 NAME 'objectIdentifierMatch' SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.38 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.5 NAME 'IA5StringApproxMatch' SYNTAX
+  1.3.6.1.4.1.1466.115.121.1.26 )
+matchingRules: ( 1.3.6.1.4.1.4203.666.4.4 NAME 'directoryStringApproxMatch' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+objectClass: top
+objectClass: subentry
+objectClass: subschema
+objectClass: extensibleObject
+objectClasses: ( 2.5.6.0 NAME 'top' DESC 'top of the superclass chain' ABSTR
+ ACT MUST objectClass )
+objectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DESC '
+ RFC4512: extensible object' SUP top AUXILIARY )
+objectClasses: ( 2.5.6.1 NAME 'alias' DESC 'RFC4512: an alias' SUP top STRUC
+ TURAL MUST aliasedObjectName )
+objectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'namedref: nam
+ ed subordinate referral' SUP top STRUCTURAL MUST ref )
+objectClasses: ( 1.3.6.1.4.1.4203.1.4.1 NAME ( 'OpenLDAProotDSE' 'LDAProotDS
+ E' ) DESC 'OpenLDAP Root DSE object' SUP top STRUCTURAL MAY cn )
+objectClasses: ( 2.5.17.0 NAME 'subentry' DESC 'RFC3672: subentry' SUP top S
+ TRUCTURAL MUST ( cn $ subtreeSpecification ) )
+objectClasses: ( 2.5.20.1 NAME 'subschema' DESC 'RFC4512: controlling subsch
+ ema (sub)entry' AUXILIARY MAY ( dITStructureRules $ nameForms $ dITContentR
+ ules $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) )
+objectClasses: ( 2.5.17.2 NAME 'collectiveAttributeSubentry' DESC 'RFC3671: 
+ collective attribute subentry' AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.1466.101.119.2 NAME 'dynamicObject' DESC 'RFC25
+ 89: Dynamic Object' SUP top AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.4 NAME 'glue' DESC 'Glue Entry' SUP 
+ top STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.5 NAME 'syncConsumerSubentry' DESC '
+ Persistent Info for SyncRepl Consumer' AUXILIARY MAY syncreplCookie )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.6 NAME 'syncProviderSubentry' DESC '
+ Persistent Info for SyncRepl Producer' AUXILIARY MAY contextCSN )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.0 NAME 'olcConfig' DESC 'OpenLD
+ AP configuration object' SUP top ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.1 NAME 'olcGlobal' DESC 'OpenLD
+ AP Global configuration options' SUP olcConfig STRUCTURAL MAY ( cn $ olcCon
+ figFile $ olcConfigDir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ ol
+ cAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcConcurrency $ olcConn
+ MaxPending $ olcConnMaxPendingAuth $ olcDisallows $ olcGentleHUP $ olcIdleT
+ imeout $ olcIndexSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ olcIndexSubstrAn
+ yLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLoc
+ alSSF $ olcLogFile $ olcLogLevel $ olcPasswordCryptSaltFormat $ olcPassword
+ Hash $ olcPidFile $ olcPluginLogFile $ olcReadOnly $ olcReferral $ olcReplo
+ gFile $ olcRequires $ olcRestrict $ olcReverseLookup $ olcRootDSE $ olcSasl
+ Auxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olc
+ ServerID $ olcSizeLimit $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth
+  $ olcTCPBuffer $ olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ olc
+ TLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ o
+ lcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ o
+ lcTLSDHParamFile $ olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olc
+ WriteTimeout $ olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $
+  olcDitContentRules $ olcLdapSyntaxes ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.2 NAME 'olcSchemaConfig' DESC '
+ OpenLDAP schema object' SUP olcConfig STRUCTURAL MAY ( cn $ olcObjectIdenti
+ fier $ olcLdapSyntaxes $ olcAttributeTypes $ olcObjectClasses $ olcDitConte
+ ntRules ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.3 NAME 'olcBackendConfig' DESC 
+ 'OpenLDAP Backend-specific options' SUP olcConfig STRUCTURAL MUST olcBacken
+ d )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.4 NAME 'olcDatabaseConfig' DESC
+  'OpenLDAP Database-specific options' SUP olcConfig STRUCTURAL MUST olcData
+ base MAY ( olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddConte
+ ntAcl $ olcLastMod $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcReadOnly
+  $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplicationInte
+ rval $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ 
+ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl
+  $ olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMirrorMode $ olcMonitorin
+ g $ olcExtraAttrs ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.5 NAME 'olcOverlayConfig' DESC 
+ 'OpenLDAP Overlay-specific options' SUP olcConfig STRUCTURAL MUST olcOverla
+ y )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.6 NAME 'olcIncludeFile' DESC 'O
+ penLDAP configuration include file' SUP olcConfig STRUCTURAL MUST olcInclud
+ e MAY ( cn $ olcRootDSE ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.7 NAME 'olcFrontendConfig' DESC
+  'OpenLDAP frontend configuration' AUXILIARY MAY ( olcDefaultSearchBase $ o
+ lcPasswordHash $ olcSortVals ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.8 NAME 'olcModuleList' DESC 'Op
+ enLDAP dynamic module info' SUP olcConfig STRUCTURAL MAY ( cn $ olcModulePa
+ th $ olcModuleLoad ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.2.1 NAME 'olcLdifConfig' DESC '
+ LDIF backend configuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDire
+ ctory )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.12.1 NAME 'olcMdbConfig' DESC '
+ MDB backend configuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirec
+ tory MAY ( olcDbCheckpoint $ olcDbEnvFlags $ olcDbNoSync $ olcDbIndex $ olc
+ DbMaxReaders $ olcDbMaxSize $ olcDbMode $ olcDbSearchStack $ olcDbRtxnSize 
+ ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.1.2 NAME 'olcHdbConfig' DESC 'H
+ DB backend configuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirect
+ ory MAY ( olcDbCacheSize $ olcDbCheckpoint $ olcDbChecksum $ olcDbConfig $ 
+ olcDbCryptFile $ olcDbCryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcac
+ heSize $ olcDbIndex $ olcDbLinearIndex $ olcDbLockDetect $ olcDbMode $ olcD
+ bSearchStack $ olcDbShmKey $ olcDbCacheFree $ olcDbDNcacheSize $ olcDbPageS
+ ize ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.3.1 NAME 'olcLDAPConfig' DESC '
+ LDAP backend configuration' SUP olcDatabaseConfig STRUCTURAL MAY ( olcDbURI
+  $ olcDbStartTLS $ olcDbACLAuthcDn $ olcDbACLPasswd $ olcDbACLBind $ olcDbI
+ DAssertAuthcDn $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMod
+ e $ olcDbIDAssertAuthzFrom $ olcDbIDAssertPassThru $ olcDbRebindAsUser $ ol
+ cDbChaseReferrals $ olcDbTFSupport $ olcDbProxyWhoAmI $ olcDbTimeout $ olcD
+ bIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbProtocolVersion $ 
+ olcDbSingleConn $ olcDbCancel $ olcDbQuarantine $ olcDbUseTemporaryConn $ o
+ lcDbConnectionPoolMax $ olcDbSessionTrackingRequest $ olcDbNoRefs $ olcDbNo
+ UndefFilter $ olcDbOnErr $ olcDbKeepalive ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.3.1 NAME 'olcChainConfig' DESC 
+ 'Chain configuration' SUP olcOverlayConfig STRUCTURAL MAY ( olcChainingBeha
+ vior $ olcChainCacheURI $ olcChainMaxReferralDepth $ olcChainReturnError ) 
+ )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.3.2 NAME 'olcChainDatabase' DES
+ C 'Chain remote server configuration' AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.3.3 NAME 'olcPBindConfig' DESC 
+ 'Proxy Bind configuration' SUP olcOverlayConfig STRUCTURAL MUST olcDbURI MA
+ Y ( olcDbStartTLS $ olcDbNetworkTimeout $ olcDbQuarantine ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.7.1 NAME 'olcDistProcConfig' DE
+ SC 'Distributed procedures <draft-sermersheim-ldap-distproc> configuration'
+  SUP olcOverlayConfig STRUCTURAL MAY ( olcChainingBehavior $ olcChainCacheU
+ RI ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.7.2 NAME 'olcDistProcDatabase' 
+ DESC 'Distributed procedure remote server configuration' AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.3.2 NAME 'olcMetaConfig' DESC '
+ Meta backend configuration' SUP olcDatabaseConfig STRUCTURAL MAY ( olcDbCon
+ nTtl $ olcDbDnCacheTtl $ olcDbIdleTimeout $ olcDbOnErr $ olcDbPseudoRootBin
+ dDefer $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbConnectionPoolMax $
+  olcDbBindTimeout $ olcDbCancel $ olcDbChaseReferrals $ olcDbClientPr $ olc
+ DbDefaultTarget $ olcDbNetworkTimeout $ olcDbNoRefs $ olcDbNoUndefFilter $ 
+ olcDbNretries $ olcDbProtocolVersion $ olcDbQuarantine $ olcDbRebindAsUser 
+ $ olcDbSessionTrackingRequest $ olcDbStartTLS $ olcDbTFSupport ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.3.3 NAME 'olcMetaTargetConfig' 
+ DESC 'Meta target configuration' SUP olcConfig STRUCTURAL MUST ( olcMetaSub
+  $ olcDbURI ) MAY ( olcDbACLAuthcDn $ olcDbACLPasswd $ olcDbIDAssertAuthzFr
+ om $ olcDbIDAssertBind $ olcDbMap $ olcDbRewrite $ olcDbSubtreeExclude $ ol
+ cDbSubtreeInclude $ olcDbTimeout $ olcDbKeepalive $ olcDbFilter $ olcDbBind
+ Timeout $ olcDbCancel $ olcDbChaseReferrals $ olcDbClientPr $ olcDbDefaultT
+ arget $ olcDbNetworkTimeout $ olcDbNoRefs $ olcDbNoUndefFilter $ olcDbNretr
+ ies $ olcDbProtocolVersion $ olcDbQuarantine $ olcDbRebindAsUser $ olcDbSes
+ sionTrackingRequest $ olcDbStartTLS $ olcDbTFSupport ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.1 NAME 'monitor' DESC 'OpenLDAP s
+ ystem monitoring' SUP top STRUCTURAL MUST cn MAY ( description $ seeAlso $ 
+ labeledURI $ monitoredInfo $ managedInfo $ monitorOverlay ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.2 NAME 'monitorServer' DESC 'Serv
+ er monitoring root entry' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.3 NAME 'monitorContainer' DESC 'm
+ onitor container class' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.4 NAME 'monitorCounterObject' DES
+ C 'monitor counter class' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.5 NAME 'monitorOperation' DESC 'm
+ onitor operation class' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.6 NAME 'monitorConnection' DESC '
+ monitor connection class' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.7 NAME 'managedObject' DESC 'moni
+ tor managed entity class' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.8 NAME 'monitoredObject' DESC 'mo
+ nitor monitored entity class' SUP monitor STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.4.1 NAME 'olcMonitorConfig' DES
+ C 'Monitor backend configuration' SUP olcDatabaseConfig STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.5.1 NAME 'olcRelayConfig' DESC 
+ 'Relay backend configuration' SUP olcDatabaseConfig STRUCTURAL MAY olcRelay
+  )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.15.1 NAME 'olcAuditlogConfig' D
+ ESC 'Auditlog configuration' SUP olcOverlayConfig STRUCTURAL MAY olcAuditlo
+ gFile )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.4.1 NAME 'olcAccessLogConfig' D
+ ESC 'Access log configuration' SUP olcOverlayConfig STRUCTURAL MUST olcAcce
+ ssLogDB MAY ( olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogSuccess $ o
+ lcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.0 NAME 'auditContainer' DESC 'A
+ uditLog container' SUP top STRUCTURAL MAY ( cn $ reqStart $ reqEnd ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.1 NAME 'auditObject' DESC 'Open
+ LDAP request auditing' SUP top STRUCTURAL MUST ( reqStart $ reqType $ reqSe
+ ssion ) MAY ( reqDN $ reqAuthzID $ reqControls $ reqRespControls $ reqEnd $
+  reqResult $ reqMessage $ reqReferral $ reqEntryUUID ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.2 NAME 'auditReadObject' DESC '
+ OpenLDAP read request record' SUP auditObject STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.3 NAME 'auditWriteObject' DESC 
+ 'OpenLDAP write request record' SUP auditObject STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.4 NAME 'auditAbandon' DESC 'Aba
+ ndon operation' SUP auditObject STRUCTURAL MUST reqId )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.5 NAME 'auditAdd' DESC 'Add ope
+ ration' SUP auditWriteObject STRUCTURAL MUST reqMod )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.6 NAME 'auditBind' DESC 'Bind o
+ peration' SUP auditObject STRUCTURAL MUST ( reqVersion $ reqMethod ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.7 NAME 'auditCompare' DESC 'Com
+ pare operation' SUP auditReadObject STRUCTURAL MUST reqAssertion )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.8 NAME 'auditDelete' DESC 'Dele
+ te operation' SUP auditWriteObject STRUCTURAL MAY reqOld )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.9 NAME 'auditModify' DESC 'Modi
+ fy operation' SUP auditWriteObject STRUCTURAL MUST reqMod MAY reqOld )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.10 NAME 'auditModRDN' DESC 'Mod
+ RDN operation' SUP auditWriteObject STRUCTURAL MUST ( reqNewRDN $ reqDelete
+ OldRDN ) MAY ( reqNewSuperior $ reqMod $ reqOld ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.11 NAME 'auditSearch' DESC 'Sea
+ rch operation' SUP auditReadObject STRUCTURAL MUST ( reqScope $ reqDerefAli
+ ases $ reqAttrsonly ) MAY ( reqFilter $ reqAttr $ reqEntries $ reqSizeLimit
+  $ reqTimeLimit ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.5.2.12 NAME 'auditExtended' DESC 'E
+ xtended operation' SUP auditObject STRUCTURAL MAY reqData )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.19.1 NAME 'olcCollectConfig' DE
+ SC 'Collective Attribute configuration' SUP olcOverlayConfig STRUCTURAL MAY
+  olcCollectInfo )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.8.1 NAME 'olcDynamicList' DESC 
+ 'Dynamic list configuration' SUP olcOverlayConfig STRUCTURAL MAY olcDLattrS
+ et )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.11.1 NAME 'olcRefintConfig' DES
+ C 'Referential integrity configuration' SUP olcOverlayConfig STRUCTURAL MAY
+  ( olcRefintAttribute $ olcRefintNothing $ olcRefintModifiersName ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.18.1 NAME 'olcMemberOf' DESC 'M
+ ember-of configuration' SUP olcOverlayConfig STRUCTURAL MAY ( olcMemberOfDN
+  $ olcMemberOfDangling $ olcMemberOfDanglingError $ olcMemberOfRefInt $ olc
+ MemberOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.1.1 NAME 'olcSyncProvConfig' DE
+ SC 'SyncRepl Provider configuration' SUP olcOverlayConfig STRUCTURAL MAY ( 
+ olcSpCheckpoint $ olcSpSessionlog $ olcSpNoPresent $ olcSpReloadHint ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.14.1 NAME 'olcTranslucentConfig
+ ' DESC 'Translucent configuration' SUP olcOverlayConfig STRUCTURAL MAY ( ol
+ cTranslucentStrict $ olcTranslucentNoGlue $ olcTranslucentLocal $ olcTransl
+ ucentRemote $ olcTranslucentBindLocal $ olcTranslucentPwModLocal ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.14.2 NAME 'olcTranslucentDataba
+ se' DESC 'Translucent target database configuration' AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.10.1 NAME 'olcUniqueConfig' DES
+ C 'Attribute value uniqueness configuration' SUP olcOverlayConfig STRUCTURA
+ L MAY ( olcUniqueBase $ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueStr
+ ict $ olcUniqueURI ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.13.1 NAME 'olcConstraintConfig'
+  DESC 'Constraint overlay configuration' SUP olcOverlayConfig STRUCTURAL MA
+ Y olcConstraintAttribute )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.5.1 NAME 'olcValSortConfig' DES
+ C 'Value Sorting configuration' SUP olcOverlayConfig STRUCTURAL MUST olcVal
+ SortAttr )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.21.1 NAME 'olcSssVlvConfig' DES
+ C 'SSS VLV configuration' SUP olcOverlayConfig STRUCTURAL MAY ( olcSssVlvMa
+ x $ olcSssVlvMaxKeys $ olcSssVlvMaxPerConn ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.12.1 NAME 'olcPPolicyConfig' DE
+ SC 'Password Policy configuration' SUP olcOverlayConfig STRUCTURAL MAY ( ol
+ cPPolicyDefault $ olcPPolicyHashCleartext $ olcPPolicyUseLockout $ olcPPoli
+ cyForwardUpdates ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.3.9.1 NAME 'olcDDSConfig' DESC 'R
+ FC2589 Dynamic directory services configuration' SUP olcOverlayConfig STRUC
+ TURAL MAY ( olcDDSstate $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ 
+ olcDDSinterval $ olcDDStolerance $ olcDDSmaxDynamicObjects ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.4.5.1 NAME 'olcLastBindConfig' DE
+ SC 'Last Bind configuration' SUP olcOverlayConfig STRUCTURAL MAY olcLastBin
+ dPrecision )
+objectClasses: ( 1.3.6.1.4.1.4203.666.3.16.0.1.1.2 NAME 'olmMDBDatabase' SUP
+  top AUXILIARY MAY olmDbDirectory )
+objectClasses: ( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP top ST
+ RUCTURAL MUST c MAY ( searchGuide $ description ) )
+objectClasses: ( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SUP top 
+ STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ description ) )
+objectClasses: ( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organization'
+  SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ bus
+ inessCategory $ x121Address $ registeredAddress $ destinationIndicator $ pr
+ eferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephone
+ Number $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ post
+ OfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ 
+ l $ description ) )
+objectClasses: ( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an organiz
+ ational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchGuide $
+  seeAlso $ businessCategory $ x121Address $ registeredAddress $ destination
+ Indicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifi
+ er $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $
+  street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOffi
+ ceName $ st $ l $ description ) )
+objectClasses: ( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP top STRU
+ CTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $ de
+ scription ) )
+objectClasses: ( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an organ
+ izational person' SUP person STRUCTURAL MAY ( title $ x121Address $ registe
+ redAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $
+  teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ fa
+ csimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddres
+ s $ physicalDeliveryOfficeName $ ou $ st $ l ) )
+objectClasses: ( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an organiz
+ ational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ registeredAddr
+ ess $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ telete
+ xTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimile
+ TelephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street
+  $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName 
+ $ ou $ st $ l $ description ) )
+objectClasses: ( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names
+  (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ se
+ eAlso $ owner $ ou $ o $ description ) )
+objectClasses: ( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an residen
+ tial person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x121Addr
+ ess $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ 
+ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliS
+ DNNumber $ facsimileTelephoneNumber $ preferredDeliveryMethod $ street $ po
+ stOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st 
+ $ l ) )
+objectClasses: ( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an applic
+ ation process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ descript
+ ion ) )
+objectClasses: ( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an applica
+ tion entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MAY ( sup
+ portedApplicationContext $ seeAlso $ ou $ o $ l $ description ) )
+objectClasses: ( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory system agent
+  (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformation )
+objectClasses: ( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP top STR
+ UCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ descrip
+ tion ) )
+objectClasses: ( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC2256: a s
+ trong authentication user' SUP top AUXILIARY MUST userCertificate )
+objectClasses: ( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256: a cer
+ tificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ cert
+ ificateRevocationList $ cACertificate ) MAY crossCertificatePair )
+objectClasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group o
+ f unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( unique
+ Member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ descripti
+ on ) )
+objectClasses: ( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC2256: a us
+ er security information' SUP top AUXILIARY MAY supportedAlgorithms )
+objectClasses: ( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP certificati
+ onAuthority AUXILIARY MAY deltaRevocationList )
+objectClasses: ( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTURAL MUS
+ T cn MAY ( certificateRevocationList $ authorityRevocationList $ deltaRevoc
+ ationList ) )
+objectClasses: ( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST dmdName MAY ( u
+ serPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ regi
+ steredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumbe
+ r $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $
+  facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAdd
+ ress $ physicalDeliveryOfficeName $ st $ l $ description ) )
+objectClasses: ( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' SUP top 
+ AUXILIARY MAY userCertificate )
+objectClasses: ( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate author
+ ity' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRevocatio
+ nList $ cACertificate $ crossCertificatePair ) )
+objectClasses: ( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SUP top A
+ UXILIARY MAY deltaRevocationList )
+objectClasses: ( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'RFC2079:
+  object that contains the URI attribute type' SUP top AUXILIARY MAY labeled
+ URI )
+objectClasses: ( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject' DESC
+  'RFC1274: simple security object' SUP top AUXILIARY MUST userPassword )
+objectClasses: ( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: domain 
+ component object' SUP top AUXILIARY MUST dc )
+objectClasses: ( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid object' S
+ UP top AUXILIARY MUST uid )
+objectClasses: ( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilotPer
+ son' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822Ma
+ ilbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ hom
+ ePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ busi
+ nessCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerT
+ elephoneNumber $ organizationalStatus $ mailPreferenceOption $ personalSign
+ ature ) )
+objectClasses: ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL
+  MUST userid MAY ( description $ seeAlso $ localityName $ organizationName 
+ $ organizationalUnitName $ host ) )
+objectClasses: ( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUCTURA
+ L MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ locali
+ tyName $ organizationName $ organizationalUnitName $ documentTitle $ docume
+ ntVersion $ documentAuthor $ documentLocation $ documentPublisher ) )
+objectClasses: ( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURAL MU
+ ST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) 
+ )
+objectClasses: ( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top STR
+ UCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ loc
+ alityName $ organizationName $ organizationalUnitName ) )
+objectClasses: ( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCTURAL
+  MUST domainComponent MAY ( associatedName $ organizationName $ description
+  $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $
+  stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalA
+ ddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNum
+ ber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier
+  $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ registere
+ dAddress $ x121Address ) )
+objectClasses: ( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP domai
+ n STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telephone
+ Number $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOffi
+ ceBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber 
+ $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDeli
+ veryMethod $ destinationIndicator $ registeredAddress $ x121Address ) )
+objectClasses: ( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain STRU
+ CTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERe
+ cord ) )
+objectClasses: ( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' DESC 
+ 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associated
+ Domain )
+objectClasses: ( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP count
+ ry STRUCTURAL MUST friendlyCountryName )
+objectClasses: ( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SUP ( o
+ rganization $ organizationalUnit ) STRUCTURAL MAY buildingName )
+objectClasses: ( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STRUCTUR
+ AL MAY dSAQuality )
+objectClasses: ( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' SUP t
+ op AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximumQu
+ ality ) )
+objectClasses: ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2798:
+  Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( 
+ audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em
+ ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ i
+ nitials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ ph
+ oto $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier
+  $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) )
+objectClasses: ( 2.16.840.1.113730.3.2.147 NAME 'inetLocalMailRecipient' DES
+ C 'Internet local mail recipient' SUP top AUXILIARY MAY ( mailLocalAddress 
+ $ mailHost $ mailRoutingAddress ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.1.2.5 NAME 'nisMailAlias' DESC 'NIS mai
+ l alias' SUP top STRUCTURAL MUST cn MAY rfc822MailMember )
+objectClasses: ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an
+  account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNumb
+ er $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ 
+ description ) )
+objectClasses: ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional attri
+ butes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPassword $
+  shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive 
+ $ shadowExpire $ shadowFlag $ description ) )
+objectClasses: ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a gr
+ oup of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassw
+ ord $ memberUid $ description ) )
+objectClasses: ( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Abstraction an Inter
+ net Protocol service' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipServ
+ iceProtocol ) MAY description )
+objectClasses: ( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Abstraction of an I
+ P protocol' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber $ description )
+  MAY description )
+objectClasses: ( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Abstraction of an ONC/R
+ PC binding' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber $ description ) MAY
+  description )
+objectClasses: ( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Abstraction of a host, 
+ an IP device' SUP top AUXILIARY MUST ( cn $ ipHostNumber ) MAY ( l $ descri
+ ption $ manager ) )
+objectClasses: ( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Abstraction of an IP
+  network' SUP top STRUCTURAL MUST ( cn $ ipNetworkNumber ) MAY ( ipNetmaskN
+ umber $ l $ description $ manager ) )
+objectClasses: ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Abstraction of a n
+ etgroup' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberNisNetg
+ roup $ description ) )
+objectClasses: ( 1.3.6.1.1.1.2.9 NAME 'nisMap' DESC 'A generic abstraction o
+ f a NIS map' SUP top STRUCTURAL MUST nisMapName MAY description )
+objectClasses: ( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'An entry in a NIS m
+ ap' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY descripti
+ on )
+objectClasses: ( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'A device with a
+  MAC address' SUP top AUXILIARY MAY macAddress )
+objectClasses: ( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'A device with 
+ boot parameters' SUP top AUXILIARY MAY ( bootFile $ bootParameter ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.1 NAME 'javaContainer' DESC 'Contai
+ ner for a Java object' SUP top STRUCTURAL MUST cn )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.4 NAME 'javaObject' DESC 'Java obje
+ ct representation' SUP top ABSTRACT MUST javaClassName MAY ( javaClassNames
+  $ javaCodebase $ javaDoc $ description ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.5 NAME 'javaSerializedObject' DESC 
+ 'Java serialized object' SUP javaObject AUXILIARY MUST javaSerializedData )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.8 NAME 'javaMarshalledObject' DESC 
+ 'Java marshalled object' SUP javaObject AUXILIARY MUST javaSerializedData )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.7 NAME 'javaNamingReference' DESC '
+ JNDI reference' SUP javaObject AUXILIARY MAY ( javaReferenceAddress $ javaF
+ actory ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.10 NAME 'corbaContainer' DESC 'Cont
+ ainer for a CORBA object' SUP top STRUCTURAL MUST cn )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.9 NAME 'corbaObject' DESC 'CORBA ob
+ ject representation' SUP top ABSTRACT MAY ( corbaRepositoryId $ description
+  ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.11 NAME 'corbaObjectReference' DESC
+  'CORBA interoperable object reference' SUP corbaObject AUXILIARY MUST corb
+ aIor )
+objectClasses: ( 2.16.840.1.113730.3.2.33 NAME 'groupOfURLs' SUP top STRUCTU
+ RAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $ own
+ er $ seeAlso ) )
+objectClasses: ( 1.3.6.1.4.1.4203.666.11.8.2.1 NAME 'dgIdentityAux' SUP top 
+ AUXILIARY MAY ( dgIdentity $ dgAuthz ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.4.3 NAME 'OpenLDAPorg' DESC 'OpenLDAP Or
+ ganizational Object' SUP organization STRUCTURAL MAY ( buildingName $ displ
+ ayName $ labeledURI ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.4.4 NAME 'OpenLDAPou' DESC 'OpenLDAP Org
+ anizational Unit Object' SUP organizationalUnit STRUCTURAL MAY ( buildingNa
+ me $ displayName $ labeledURI $ o ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.4.5 NAME 'OpenLDAPperson' DESC 'OpenLDAP
+  Person' SUP ( pilotPerson $ inetOrgPerson ) STRUCTURAL MUST ( uid $ cn ) M
+ AY ( givenName $ labeledURI $ o ) )
+objectClasses: ( 1.3.6.1.4.1.4203.1.4.6 NAME 'OpenLDAPdisplayableObject' DES
+ C 'OpenLDAP Displayable Object' AUXILIARY MAY displayName )
+objectClasses: ( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP top AUX
+ ILIARY MAY pwdCheckModule )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AUXILIAR
+ Y MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckQu
+ ality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout $
+  pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChan
+ ge $ pwdAllowUserChange $ pwdSafeModify $ pwdMaxRecordedFailure ) )
+objectClasses: ( 2.5.6.24 NAME 'pmiUser' DESC 'X.509 PMI user object class' 
+ SUP top AUXILIARY MAY attributeCertificateAttribute )
+objectClasses: ( 2.5.6.25 NAME 'pmiAA' DESC 'X.509 PMI AA object class' SUP 
+ top AUXILIARY MAY ( aACertificate $ attributeCertificateRevocationList $ at
+ tributeAuthorityRevocationList ) )
+objectClasses: ( 2.5.6.26 NAME 'pmiSOA' DESC 'X.509 PMI SOA object class' SU
+ P top AUXILIARY MAY ( attributeCertificateRevocationList $ attributeAuthori
+ tyRevocationList $ attributeDescriptorCertificate ) )
+objectClasses: ( 2.5.6.27 NAME 'attCertCRLDistributionPt' DESC 'X.509 Attrib
+ ute certificate CRL distribution point object class' SUP top AUXILIARY MAY 
+ ( attributeCertificateRevocationList $ attributeAuthorityRevocationList ) )
+objectClasses: ( 2.5.6.33 NAME 'pmiDelegationPath' DESC 'X.509 PMI delegatio
+ n path' SUP top AUXILIARY MAY delegationPath )
+objectClasses: ( 2.5.6.32 NAME 'privilegePolicy' DESC 'X.509 Privilege polic
+ y object class' SUP top AUXILIARY MAY privPolicy )
+objectClasses: ( 2.5.6.34 NAME 'protectedPrivilegePolicy' DESC 'X.509 Protec
+ ted privilege policy object class' SUP top AUXILIARY MAY protPrivPolicy )
+objectClasses: ( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject' DESC
+  'Auxiliary object class for adding authorizedService attribute' SUP top AU
+ XILIARY MAY authorizedService )
+objectClasses: ( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject' DESC 'Auxiliary o
+ bject class for adding host attribute' SUP top AUXILIARY MAY host )
+objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.5 NAME 'DUAConfigProfile' DESC 'Abst
+ raction of a base configuration for a DUA' SUP top STRUCTURAL MUST cn MAY (
+  defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearc
+ hScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authentication
+ Method $ followReferrals $ dereferenceAliases $ serviceSearchDescriptor $ s
+ erviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attr
+ ibuteMap $ profileTTL ) )
+objectClasses: ( 1.2.840.113533.7.67.9 NAME 'emailAddressUser' SUP top AUXIL
+ IARY MAY email )
+objectClasses: ( 1.2.840.113533.7.67.1 NAME 'entrustCA' SUP top AUXILIARY MA
+ Y ( cACertificate $ certificateRevocationList $ authorityRevocationList $ d
+ eltaRevocationList $ crossCertificatePair $ userPassword $ attributeCertifi
+ cate ) )
+objectClasses: ( 1.2.840.113533.7.67.14 NAME 'entrustDNQualifierUser' SUP to
+ p AUXILIARY MAY dnQualifier )
+objectClasses: ( 1.2.840.113533.7.67.15 NAME 'entrustNamedObject' SUP top AU
+ XILIARY MAY ( name $ cn $ sn $ givenName $ initials $ generationQualifier $
+  c $ l $ st $ o $ ou $ title ) )
+objectClasses: ( 1.2.840.113533.7.67.17 NAME 'entrustPolicyObject' SUP top A
+ UXILIARY MAY entrustPolicyCertificate )
+objectClasses: ( 1.2.840.113533.7.67.13 NAME 'entrustRoamingUser' SUP top AU
+ XILIARY MAY ( entrustRoamFileEncInfo $ entrustRoamingProfile $ entrustRoami
+ ngPAB $ entrustRoamingRecipList $ entrustRoamingSLA $ entrustRoamingPRV $ e
+ ntrustRoamingEOP $ entrustRoamingCAPAB $ uid ) )
+objectClasses: ( 1.2.840.113533.7.67.0 NAME 'entrustUser' SUP top AUXILIARY 
+ MAY userCertificate )
+objectClasses: ( 1.2.840.113533.7.67.18 NAME 'entrustRoamingDataUser' SUP to
+ p AUXILIARY MAY ( entrustRoamFileEncInfo $ entrustRoamingProfile $ entrustR
+ oamingPAB $ entrustRoamingRecipList $ entrustRoamingSLA $ entrustRoamingPRV
+  $ entrustRoamingEOP $ entrustRoamingCAPAB $ entrustRoamingID ) )
+objectClasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY ( edu
+ PersonAffiliation $ eduPersonNickname $ eduPersonOrgDN $ eduPersonOrgUnitDN
+  $ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlem
+ ent $ eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation ) )
+objectClasses: ( 1.3.6.1.4.1.5923.1.2.2 NAME 'eduOrg' AUXILIARY MAY ( cn $ e
+ duOrgHomePageURI $ eduOrgIdentityAuthNPolicyURI $ eduOrgLegalName $ eduOrgS
+ uperiorURI $ eduOrgWhitePagesURI ) )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.1 NAME 'schacPersonalCharacteristics'
+  DESC 'Personal characteristics describe the individual person represented 
+ by the entry' AUXILIARY MAY ( schacMotherTongue $ schacGender $ schacDateOf
+ Birth $ schacPlaceOfBirth $ schacCountryOfCitizenship $ schacSn1 $ schacSn2
+  $ schacPersonalTitle ) )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.2 NAME 'schacContactLocation' DESC 'P
+ rimary means of locating and contacting potential collaborators and other p
+ ersons-of-interest at peer institutions' AUXILIARY MAY ( schacHomeOrganizat
+ ion $ schacHomeOrganizationType $ schacCountryOfResidence $ schacUserPresen
+ ceID ) )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.3 NAME 'schacEmployeeInfo' DESC 'Empl
+ oyee information includes attributes that have relevance to the employee ro
+ le, such as position, office hours, and job title' AUXILIARY MAY schacPerso
+ nalPosition )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.4 NAME 'schacLinkageIdentifiers' DESC
+  'Used to link a directory entry with records in external data stores or ot
+ her directory entries' AUXILIARY MAY ( schacPersonalUniqueCode $ schacPerso
+ nalUniqueID ) )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.5 NAME 'schacEntryMetadata' DESC 'Use
+ d to contain information about the entry itself, often its status, birth, a
+ nd death' AUXILIARY MAY schacExpiryDate )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.6 NAME 'schacEntryConfidentiality' DE
+ SC 'Used to indicate whether an entry is visible publicly, visible only to 
+ affiliates of the institution, or not visible at all' AUXILIARY MAY schacUs
+ erPrivateAttribute )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.7 NAME 'schacUserEntitlements' DESC '
+ Authorization for services' AUXILIARY MAY schacUserStatus )
+objectClasses: ( 1.3.6.1.4.1.25178.1.1.8 NAME 'schacGroupMembership' DESC 'G
+ roups used to provide/restrict authorization to entries and attributes' AUX
+ ILIARY MAY ( schacProjectMembership $ schacProjectSpecificRole ) )
+objectClasses: ( 1.3.6.1.4.1.25178.1.0.1.1 NAME 'schacExperimentalOC' DESC '
+ Experimental Object Class' AUXILIARY MAY schacYearOfBirth )
+objectClasses: ( 1.3.6.1.4.1.2428.20.2 NAME 'dNSDomain2' SUP dNSDomain STRUC
+ TURAL MAY ( DNSTTL $ DNSClass $ WKSRecord $ PTRRecord $ HINFORecord $ MINFO
+ Record $ TXTRecord $ RPRecord $ AFSDBRecord $ SIGRecord $ KEYRecord $ GPOSR
+ ecord $ AAAARecord $ LOCRecord $ NXTRecord $ SRVRecord $ NAPTRRecord $ KXRe
+ cord $ CERTRecord $ A6Record $ DNAMERecord $ APLRecord $ DSRecord $ SSHFPRe
+ cord $ IPSECKEYRecord $ RRSIGRecord $ NSECRecord $ DNSKEYRecord $ DHCIDReco
+ rd $ SPFRecord $ nSec3ParamRecord $ TLSARecord $ CAARecord $ DLVRecord ) )
+objectClasses: ( 1.3.6.1.1.1.2.14 NAME 'NisKeyObject' DESC 'NisKeyObject' SU
+ P top STRUCTURAL MUST ( cn $ nisPublickey $ nisSecretkey ) MAY ( uidNumber 
+ $ description ) )
+objectClasses: ( 1.3.1.6.1.1.1.2.15 NAME 'nisDomainObject' DESC 'nisDomainOb
+ ject' SUP top AUXILIARY MUST nisDomain )
+objectClasses: ( 2.16.840.1.113730.3.2.4 NAME 'mailGroup' DESC 'mailGroup' S
+ UP top STRUCTURAL MUST mail MAY ( cn $ mgrpRFC822MailMember ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.1.2.6 NAME 'nisNetId' DESC 'nisNetId' S
+ UP top STRUCTURAL MUST cn MAY ( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost
+  ) )
+objectClasses: ( 1.3.6.1.4.1.42.2.27.5.2.7 NAME 'SolarisNamingProfile' DESC 
+ 'Solaris LDAP NSS Profile' SUP top AUXILIARY MUST ( cn $ SolarisLDAPServers
+  ) MAY ( SolarisBindDN $ SolarisBindPassword $ SolarisSearchBaseDN $ Solari
+ sAuthMethod $ SolarisTransportSecurity $ SolarisSearchReferral $ SolarisDat
+ aSearchDN $ SolarisSearchScope $ SolarisSearchTimeLimit $ SolarisCacheTTL )
+  )
+objectClasses: ( 1.3.6.1.4.1.1466.154.151.160.1 NAME 'liPerson' SUP person S
+ TRUCTURAL MAY ( rfc822Mailbox $ userCertificate $ labeledURI $ givenName $ 
+ generationQualifier $ o $ l $ c $ personalTitle $ initials $ middleName $ u
+ niqueIdentifier $ homeTelephoneNumber $ homeFax $ homePostalAddress $ thumb
+ nailPhoto $ title $ facsimileTelephoneNumber $ mobileTelephoneNumber $ page
+ rTelephoneNumber $ postalAddress $ ou $ roomNumber $ otherMailbox $ telexNu
+ mber $ thumbnailLogo $ secretary $ manager $ description $ telephoneNumber 
+ $ userPassword ) )
+objectClasses: ( 1.3.6.1.4.1.1466.154.151.160.2 NAME 'liOrganization' SUP or
+ ganization STRUCTURAL MAY ( rfc822Mailbox $ labeledURI $ c $ uniqueIdentifi
+ er $ otherMailbox $ thumbnailLogo $ manager ) )
+objectClasses: ( 1.3.6.1.4.1.13769.2.2.1 NAME 'mozillaAbPersonObsolete' SUP 
+ inetOrgPerson STRUCTURAL MAY ( mozillaNickname $ mozillaUseHtmlMail $ mozil
+ laSecondEmail $ mozillaPostalAddress2 $ mozillaHomePostalAddress2 $ mozilla
+ HomeLocalityName $ mozillaHomeState $ mozillaHomePostalCode $ mozillaHomeCo
+ untryName $ mozillaHomeFriendlyCountryName $ mozillaHomeUrl $ mozillaWorkUr
+ l $ mozillaCustom1 $ mozillaCustom2 $ mozillaCustom3 $ mozillaCustom4 $ nsA
+ IMid $ c $ co ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3
+ .0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn
+  $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ s
+ ambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange 
+ $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogo
+ nScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPri
+ maryGroupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ 
+ sambaBadPasswordTime $ sambaPasswordHistory $ sambaLogonHours ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba
+  Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupT
+ ype ) MAY ( displayName $ description $ sambaSIDList ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC 'Sam
+ ba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPassw
+ ord $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' D
+ ESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomainNa
+ me $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviou
+ sClearTextPassword )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domai
+ n Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY (
+  sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidB
+ ase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ samb
+ aMaxPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservatio
+ nWindow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdC
+ hange ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool fo
+ r allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber
+  ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping
+  from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ gid
+ Number ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Structura
+ l Class for a SID' SUP top STRUCTURAL MUST sambaSID )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba Conf
+ iguration Section' SUP top AUXILIARY MAY description )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba Share
+  Section' SUP top STRUCTURAL MUST sambaShareName MAY description )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC 'Samb
+ a Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( samba
+ BoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListoption
+  $ description ) )
+objectClasses: ( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC 'Sam
+ ba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustType $
+  sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFlat
+ Name $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdent
+ ifier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedE
+ ncryptionTypes ) )
+objectClasses: ( 1.3.6.1.4.1.5322.10.2.1 NAME 'krb5Principal' SUP top AUXILI
+ ARY MUST krb5PrincipalName MAY ( cn $ krb5PrincipalRealm ) )
+objectClasses: ( 1.3.6.1.4.1.5322.10.2.2 NAME 'krb5KDCEntry' SUP krb5Princip
+ al AUXILIARY MUST krb5KeyVersionNumber MAY ( krb5ValidStart $ krb5ValidEnd 
+ $ krb5PasswordEnd $ krb5MaxLife $ krb5MaxRenew $ krb5KDCFlags $ krb5Encrypt
+ ionType $ krb5Key ) )
+objectClasses: ( 1.3.6.1.4.1.5322.10.2.3 NAME 'krb5Realm' SUP top AUXILIARY 
+ MUST krb5RealmName )
+objectClasses: ( 2.16.840.1.113719.1.301.6.1.1 NAME 'krbContainer' SUP top S
+ TRUCTURAL MUST cn )
+objectClasses: ( 2.16.840.1.113719.1.301.6.2.1 NAME 'krbRealmContainer' SUP 
+ top STRUCTURAL MUST cn MAY ( krbMKey $ krbUPEnabled $ krbSubTrees $ krbSear
+ chScope $ krbLdapServers $ krbSupportedEncSaltTypes $ krbDefaultEncSaltType
+ s $ krbTicketPolicyReference $ krbKdcServers $ krbPwdServers $ krbAdmServer
+ s $ krbPrincNamingAttr $ krbPwdPolicyReference $ krbPrincContainerRef ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.3.1 NAME 'krbService' SUP top ABS
+ TRACT MUST cn MAY ( krbHostServer $ krbRealmReferences ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.4.1 NAME 'krbKdcService' SUP krbS
+ ervice STRUCTURAL )
+objectClasses: ( 2.16.840.1.113719.1.301.6.5.1 NAME 'krbPwdService' SUP krbS
+ ervice STRUCTURAL )
+objectClasses: ( 2.16.840.1.113719.1.301.6.8.1 NAME 'krbPrincipalAux' SUP to
+ p AUXILIARY MAY ( krbPrincipalName $ krbCanonicalName $ krbUPEnabled $ krbP
+ rincipalKey $ krbTicketPolicyReference $ krbPrincipalExpiration $ krbPasswo
+ rdExpiration $ krbPwdPolicyReference $ krbPrincipalType $ krbPwdHistory $ k
+ rbLastPwdChange $ krbLastAdminUnlock $ krbPrincipalAliases $ krbLastSuccess
+ fulAuth $ krbLastFailedAuth $ krbLoginFailedCount $ krbExtraData $ krbAllow
+ edToDelegateTo $ krbPrincipalAuthInd ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.9.1 NAME 'krbPrincipal' SUP top S
+ TRUCTURAL MUST krbPrincipalName MAY krbObjectReferences )
+objectClasses: ( 2.16.840.1.113719.1.301.6.11.1 NAME 'krbPrincRefAux' SUP to
+ p AUXILIARY MAY krbPrincipalReferences )
+objectClasses: ( 2.16.840.1.113719.1.301.6.13.1 NAME 'krbAdmService' SUP krb
+ Service STRUCTURAL )
+objectClasses: ( 2.16.840.1.113719.1.301.6.14.1 NAME 'krbPwdPolicy' SUP top 
+ STRUCTURAL MUST cn MAY ( krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars
+  $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailure
+ CountInterval $ krbPwdLockoutDuration $ krbPwdAttributes $ krbPwdMaxLife $ 
+ krbPwdMaxRenewableLife $ krbPwdAllowedKeysalts ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.16.1 NAME 'krbTicketPolicyAux' SU
+ P top AUXILIARY MAY ( krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAg
+ e ) )
+objectClasses: ( 2.16.840.1.113719.1.301.6.17.1 NAME 'krbTicketPolicy' SUP t
+ op STRUCTURAL MUST cn )
+objectClasses: ( 1.3.6.1.4.1.2428.70.2.1 NAME 'esg' SUP top STRUCTURAL MUST 
+ ( esgSid $ esgSN $ esgFormat $ esgAlwaysOn $ esgSource ) MAY ( esgInfo $ es
+ gInfoUri $ esgFirstShown $ esgFinalEnd $ esgDuration $ esgTotalDuration $ e
+ sgIntervalOffset $ esgRepeatInterval $ esgStreamUri $ esgSdp $ esgSdpUri $ 
+ esgTool $ esgCategory $ esgContact $ esgContactMail $ esgContactPhone $ esg
+ ContactDN ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.1 NAME 'dhcpService' DESC 'Servic
+ e object that represents the actual DHCP Service configuration. This is a c
+ ontainer object.' SUP top STRUCTURAL MUST cn MAY ( dhcpPrimaryDN $ dhcpSeco
+ ndaryDN $ dhcpServerDN $ dhcpSharedNetworkDN $ dhcpSubnetDN $ dhcpGroupDN $
+  dhcpHostDN $ dhcpClassesDN $ dhcpOptionsDN $ dhcpZoneDN $ dhcpKeyDN $ dhcp
+ FailOverPeerDN $ dhcpStatements $ dhcpComments $ dhcpOption ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.2 NAME 'dhcpSharedNetwork' DESC '
+ This stores configuration information for a shared network.' SUP top STRUCT
+ URAL MUST cn MAY ( dhcpSubnetDN $ dhcpPoolDN $ dhcpOptionsDN $ dhcpZoneDN $
+  dhcpStatements $ dhcpComments $ dhcpOption ) X-NDS_CONTAINMENT 'dhcpServic
+ e' )
+objectClasses: ( 2.16.840.1.113719.1.203.6.3 NAME 'dhcpSubnet' DESC 'This cl
+ ass defines a subnet. This is a container object.' SUP top STRUCTURAL MUST 
+ ( cn $ dhcpNetMask ) MAY ( dhcpRange $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostD
+ N $ dhcpClassesDN $ dhcpLeasesDN $ dhcpOptionsDN $ dhcpZoneDN $ dhcpKeyDN $
+  dhcpFailOverPeerDN $ dhcpStatements $ dhcpComments $ dhcpOption ) X-NDS_CO
+ NTAINMENT ( 'dhcpService' 'dhcpSharedNetwork' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.4 NAME 'dhcpPool' DESC 'This stor
+ es configuration information about a pool.' SUP top STRUCTURAL MUST ( cn $ 
+ dhcpRange ) MAY ( dhcpClassesDN $ dhcpPermitList $ dhcpLeasesDN $ dhcpOptio
+ nsDN $ dhcpZoneDN $ dhcpKeyDN $ dhcpStatements $ dhcpComments $ dhcpOption 
+ ) X-NDS_CONTAINMENT ( 'dhcpSubnet' 'dhcpSharedNetwork' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.5 NAME 'dhcpGroup' DESC 'Group ob
+ ject that lists host DNs and parameters. This is a container object.' SUP t
+ op STRUCTURAL MUST cn MAY ( dhcpHostDN $ dhcpOptionsDN $ dhcpStatements $ d
+ hcpComments $ dhcpOption ) X-NDS_CONTAINMENT ( 'dhcpSubnet' 'dhcpService' )
+  )
+objectClasses: ( 2.16.840.1.113719.1.203.6.6 NAME 'dhcpHost' DESC 'This repr
+ esents information about a particular client' SUP top STRUCTURAL MUST cn MA
+ Y ( dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComm
+ ents $ dhcpOption ) X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpGro
+ up' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.7 NAME 'dhcpClass' DESC 'Represen
+ ts information about a collection of related clients.' SUP top STRUCTURAL M
+ UST cn MAY ( dhcpSubClassesDN $ dhcpOptionsDN $ dhcpStatements $ dhcpCommen
+ ts $ dhcpOption ) X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSubnet' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.8 NAME 'dhcpSubClass' DESC 'Repre
+ sents information about a collection of related classes.' SUP top STRUCTURA
+ L MUST cn MAY ( dhcpClassData $ dhcpOptionsDN $ dhcpStatements $ dhcpCommen
+ ts $ dhcpOption ) X-NDS_CONTAINMENT 'dhcpClass' )
+objectClasses: ( 2.16.840.1.113719.1.203.6.9 NAME 'dhcpOptions' DESC 'Repres
+ ents information about a collection of options defined.' SUP top AUXILIARY 
+ MUST cn MAY ( dhcpOption $ dhcpComments ) X-NDS_CONTAINMENT ( 'dhcpService'
+  'dhcpSharedNetwork' 'dhcpSubnet' 'dhcpPool' 'dhcpGroup' 'dhcpHost' 'dhcpCl
+ ass' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.10 NAME 'dhcpLeases' DESC 'This c
+ lass represents an IP Address, which may or may not have been leased.' SUP 
+ top STRUCTURAL MUST ( cn $ dhcpAddressState ) MAY ( dhcpExpirationTime $ dh
+ cpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainNa
+ me $ dhcpDnsStatus $ dhcpRequestedHostName $ dhcpAssignedHostName $ dhcpRes
+ ervedForClient $ dhcpAssignedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress 
+ ) X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpPool' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.11 NAME 'dhcpLog' DESC 'This is t
+ he object that holds past information about the IP address. The cn is the t
+ ime/date stamp when the address was assigned or released, the address state
+  at the time, if the address was assigned or released.' SUP top STRUCTURAL 
+ MUST cn MAY ( dhcpAddressState $ dhcpExpirationTime $ dhcpStartTimeOfState 
+ $ dhcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName $ dhcpDnsStatus 
+ $ dhcpRequestedHostName $ dhcpAssignedHostName $ dhcpReservedForClient $ dh
+ cpAssignedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress $ dhcpErrorLog ) X-
+ NDS_CONTAINMENT ( 'dhcpLeases' 'dhcpPool' 'dhcpSubnet' 'dhcpSharedNetwork' 
+ 'dhcpService' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.12 NAME 'dhcpServer' DESC 'DHCP S
+ erver Object' SUP top STRUCTURAL MUST cn MAY ( dhcpServiceDN $ dhcpLocatorD
+ N $ dhcpVersion $ dhcpImplementation $ dhcpHashBucketAssignment $ dhcpDelay
+ edServiceParameter $ dhcpMaxClientLeadTime $ dhcpFailOverEndpointState $ dh
+ cpStatements $ dhcpComments $ dhcpOption ) X-NDS_CONTAINMENT ( 'organizatio
+ n' 'organizationalunit' 'domain' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.13 NAME 'dhcpTSigKey' DESC 'TSIG 
+ key for secure dynamic updates' SUP top STRUCTURAL MUST ( cn $ dhcpKeyAlgor
+ ithm $ dhcpKeySecret ) MAY dhcpComments X-NDS_CONTAINMENT ( 'dhcpService' '
+ dhcpSharedNetwork' 'dhcpSubnet' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.14 NAME 'dhcpDnsZone' DESC 'DNS Z
+ one for updating leases' SUP top STRUCTURAL MUST ( cn $ dhcpDnsZoneServer )
+  MAY ( dhcpKeyDN $ dhcpComments ) X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSh
+ aredNetwork' 'dhcpSubnet' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.15 NAME 'dhcpFailOverPeer' DESC '
+ This class defines the Fail over peer' SUP top STRUCTURAL MUST ( cn $ dhcpF
+ ailOverPrimaryServer $ dhcpFailOverSecondaryServer $ dhcpFailoverPrimaryPor
+ t $ dhcpFailOverSecondaryPort ) MAY ( dhcpFailOverResponseDelay $ dhcpFailO
+ verUnackedUpdates $ dhcpMaxClientLeadTime $ dhcpFailOverSplit $ dhcpHashBuc
+ ketAssignment $ dhcpFailOverLoadBalanceTime $ dhcpComments ) X-NDS_CONTAINM
+ ENT ( 'dhcpService' 'dhcpSharedNetwork' 'dhcpSubnet' ) )
+objectClasses: ( 2.16.840.1.113719.1.203.6.16 NAME 'dhcpLocator' DESC 'Locat
+ or object for DHCP configuration in the tree. There will be a single dhcpLo
+ cator object in the tree with links to all the DHCP objects in the tree' SU
+ P top STRUCTURAL MUST cn MAY ( dhcpServiceDN $ dhcpServerDN $ dhcpSharedNet
+ workDN $ dhcpSubnetDN $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostDN $ dhcpClasses
+ DN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPeerDN $ dhcpOption $ dhcpComment
+ s ) X-NDS_CONTAINMENT ( 'organization' 'organizationalunit' 'domain' ) )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.10 NAME 'dlzZone' DESC 'Zone name por
+ tion of a domain name' SUP top STRUCTURAL MUST ( objectclass $ dlzZoneName 
+ ) )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.20 NAME 'dlzHost' DESC 'Host name por
+ tion of a domain name' SUP top STRUCTURAL MUST ( objectclass $ dlzHostName 
+ ) )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.30 NAME 'dlzAbstractRecord' DESC 'Dat
+ a common to all DNS record types' SUP top ABSTRACT MUST ( objectclass $ dlz
+ RecordID $ dlzHostName $ dlzType $ dlzTTL ) )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.40 NAME 'dlzGenericRecord' DESC 'Gene
+ ric DNS record - useful when a specific object class has not been defined f
+ or a DNS record' SUP dlzAbstractRecord STRUCTURAL MUST dlzData )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.50 NAME 'dlzARecord' DESC 'DNS A reco
+ rd' SUP dlzAbstractrecord STRUCTURAL MUST dlzIPAddr )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.60 NAME 'dlzNSRecord' DESC 'DNS NS re
+ cord' SUP dlzGenericRecord STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.70 NAME 'dlzMXRecord' DESC 'DNS MX re
+ cord' SUP dlzGenericRecord STRUCTURAL MUST dlzPreference )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.80 NAME 'dlzSOARecord' DESC 'DNS SOA 
+ record' SUP dlzAbstractRecord STRUCTURAL MUST ( dlzSerial $ dlzRefresh $ dl
+ zRetry $ dlzExpire $ dlzMinimum $ dlzAdminEmail $ dlzPrimaryNS ) )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.90 NAME 'dlzTextRecord' DESC 'Text da
+ ta with spaces should be wrapped in double quotes' SUP dlzGenericRecord STR
+ UCTURAL )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.100 NAME 'dlzPTRRecord' DESC 'DNS PTR
+  record' SUP dlzGenericRecord STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.110 NAME 'dlzCNameRecord' DESC 'DNS C
+ Name record' SUP dlzGenericRecord STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.18420.1.2.120 NAME 'dlzXFR' DESC 'Host allowed 
+ to perform zone transfer' SUP top STRUCTURAL MUST ( objectclass $ dlzRecord
+ ID $ dlzIPAddr ) )
+objectClasses: ( 1.3.6.1.1.1.2.16 NAME 'automountMap' SUP top STRUCTURAL MUS
+ T automountMapName MAY description )
+objectClasses: ( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount informati
+ on' SUP top STRUCTURAL MUST ( automountKey $ automountInformation ) MAY des
+ cription )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.13 NAME 'x509base' ABSTRACT MAY x50
+ 9version )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.14 NAME 'x509CRL' SUP x509base ABST
+ RACT MUST ( x509CRLThisUpdate $ x509signatureAlgorithm $ x509issuer ) MAY (
+  x509CRLNextUpdate $ x509serialNumber $ x509authorityKeyIdentifier $ x509au
+ thorityCertIssuer $ x509authorityCertSerialNumber $ x509issuerRfc822Name $ 
+ x509issuerDNSName $ x509issuerDirectoryName $ x509issuerUniformResourceIden
+ tifier $ x509issuerIPAddress $ x509issuerRegisteredID $ x509CRLNumber $ x50
+ 9CRLDPRfc822Name $ x509CRLDPDNSName $ x509CRLDPDN $ x509CRLDPURI $ x509CRLD
+ PIPAddress $ x509CRLDPRegisteredID $ x509CRLDPOnlyUserCerts $ x509CRLDPOnly
+ CACerts $ x509CRLDPOnlySomeReasons $ x509CRLDPOnlyAttCerts $ x509CRLDPindir
+ ect $ x509CRLDeltaIndicator ) )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.19 NAME 'x509certificateRevocationL
+ ist' SUP x509CRL STRUCTURAL MUST certificateRevocationList )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.20 NAME 'x509authorityRevocationLis
+ t' SUP x509CRL STRUCTURAL MUST authorityRevocationList )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.21 NAME 'x509deltaRevocationList' S
+ UP x509CRL STRUCTURAL MUST deltaRevocationList )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.15 NAME 'x509CRLentry' SUP x509base
+  STRUCTURAL MUST ( x509serialNumber $ x509CRLCertRevocationDate ) MAY ( x50
+ 9CRLCertInvalidityDate $ x509CRLCertReasonCode $ x509CRLCertHoldInstruction
+ Code $ x509CRLCertIssuerRfc822Name $ x509CRLCertIssuerDnsName $ x509CRLCert
+ IssuerDN $ x509CRLCertIssuerURI $ x509CRLCertIssuerIpAddress $ x509CRLCertI
+ ssuerRegisteredID ) )
+objectClasses: ( 1.3.6.1.4.1.10126.1.5.4.2.3 NAME 'x509PKC' SUP x509base ABS
+ TRACT MUST ( x509serialNumber $ x509validityNotBefore $ x509signatureAlgori
+ thm $ x509issuer $ x509validityNotAfter $ x509subjectPublicKeyInfoAlgorithm
+  ) MAY ( x509authorityKeyIdentifier $ x509authorityCertIssuer $ x509authori
+ tyCertSerialNumber $ x509subjectKeyIdentifier $ x509keyUsage $ x509policyIn
+ formationIdentifier $ x509subjectRfc822Name $ x509subjectDnsName $ x509subj
+ ectDirectoryName $ x509subjectUniformResourceIdentifier $ x509subjectIpAddr
+ ess $ x509subjectRegisteredID $ x509issuerRfc822Name $ x509issuerDnsName $ 
+ x509issuerDirectoryName $ x509issuerUniformResourceIdentifier $ x509issuerI
+ pAddress $ x509issuerRegisteredID $ x509extKeyUsage $ x509FullcRLDistributi
+ onPointURI $ x509certHolder $ x509issuerSerial $ x509basicConstraintsCa ) )
+objectClasses: ( 1.3.6.1.4.1.10126.1.5.4.2.4 NAME 'x509userCertificate' SUP 
+ x509PKC STRUCTURAL MUST userCertificate MAY x509subject )
+objectClasses: ( 1.3.6.1.4.1.10126.1.5.4.2.5 NAME 'x509caCertificate' SUP x5
+ 09PKC STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.10126.1.5.4.2.2 NAME 'x509certificateHolder' AU
+ XILIARY MAY x509certLocation )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.16 NAME 'x509AC' SUP x509base ABSTR
+ ACT MUST ( x509version $ x509signatureAlgorithm $ x509issuer $ x509serialNu
+ mber $ x509validityNotBefore $ x509validityNotAfter ) MAY ( x509ACHolderPKC
+ SerialNumber $ x509ACHolderPKCissuerDN $ x509ACHolderRfc822Name $ x509ACHol
+ derDNSName $ x509ACHolderDN $ x509ACHolderURI $ x509ACHolderIPAddress $ x50
+ 9ACHolderRegisteredID $ x509authorityCertIssuer $ x509authorityCertSerialNu
+ mber $ x509authorityKeyIdentifier $ x509ACObjectDigest $ x509ACDigestAlgori
+ thm $ x509ACDigestedObjectType $ x509issuerSerial ) )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.17 NAME 'x509attributeCertificate' 
+ SUP x509AC STRUCTURAL )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.18 NAME 'x509aACertificate' SUP x50
+ 9AC STRUCTURAL )
+objectClasses: ( 1.2.826.0.1.3344810.1.0.22 NAME 'x509ACext' AUXILIARY MAY (
+  x509issuerRfc822Name $ x509issuerDNSName $ x509issuerUniformResourceIdenti
+ fier $ x509issuerIPAddress $ x509issuerRegisteredID $ x509authorityCertIssu
+ er $ x509authorityCertSerialNumber $ x509authorityKeyIdentifier $ x509ACAud
+ itID $ x509ACTargetRfc822Name $ x509ACTargetDNSName $ x509ACTargetDN $ x509
+ ACTargetURI $ x509ACTargetIPAddress $ x509ACTargetRegisteredID $ x509ACTarg
+ etGroupRfc822Name $ x509ACTargetGroupDNSName $ x509ACTargetGroupDN $ x509AC
+ TargetGroupURI $ x509ACTargetGroupIPAddress $ x509ACTargetGroupRegisteredID
+  $ x509DPRfc822Name $ x509DPDNSName $ x509DPDN $ x509DPURI $ x509DPIPAddres
+ s $ x509DPRegisteredID $ x509DPrelativeToIssuer $ x509DPissuerRfc822Name $ 
+ x509DPissuerDNSName $ x509DPissuerDN $ x509DPissuerURI $ x509DPissuerIPAddr
+ ess $ x509DPissuerRegisteredID $ x509DPReasonCodes $ x509ACNoRevocation ) )
+objectClasses: ( 1.3.6.1.1.11.1.1 NAME 'vPIMUser' DESC 'draft-ietf-vpim-vpim
+ dir: vPIMUser object contains about the dialed telephone number' SUP top AU
+ XILIARY MUST ( vPIMRfc822Mailbox $ vPIMTelephoneNumber ) MAY ( vPIMSpokenNa
+ me $ vPIMSupportedUABehaviors $ vPIMSupportedAudioMediaTypes $ vPIMSupporte
+ dMessageContext $ vPIMTextName $ vPIMExtendedAbsenceStatus $ vPIMMaxMessage
+ Size $ vPIMSubMailboxes ) )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.1 NAME 'AsteriskExtension' DESC 'PBX 
+ Extension Information for Asterisk' SUP top AUXILIARY MUST cn MAY ( AstCont
+ ext $ AstExtension $ AstPriority $ AstApplication $ AstApplicationData ) )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.2 NAME 'AsteriskIAXUser' DESC 'IAX2 U
+ ser information for Asterisk' SUP AsteriskExtension AUXILIARY MUST cn MAY (
+  AstAccountAMAFlags $ AstAccountCallerID $ AstAccountContext $ AstAccountFu
+ llContact $ AstAccountHost $ AstAccountMailbox $ AstMD5secret $ AstAccountD
+ eny $ AstAccountPermit $ AstAccountPort $ AstAccountQualify $ AstAccountTyp
+ e $ AstAccountLanguage $ AstAccountDisallowedCodec $ AstAccountExpirationTi
+ mestamp $ AstAccountRegistrationContext $ AstAccountRegistrationExten $ Ast
+ AccountNoTransfer $ AstAccountName $ AstAccountLastQualifyMilliseconds $ As
+ tAccountCallLimit $ AstAccountSubscribeContext $ AstAccountIPAddress $ AstA
+ ccountUserAgent ) )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.3 NAME 'AsteriskSIPUser' DESC 'SIP Us
+ er information for Asterisk' SUP AsteriskExtension AUXILIARY MUST cn MAY ( 
+ AstAccountAccountCode $ AstAccountAllowOverlap $ AstAccountAllowedCodec $ A
+ stAccountAMAFlags $ AstAccountCallGroup $ AstAccountCallLimit $ AstAccountC
+ allerID $ AstAccountCanCallForward $ AstAccountCanReinvite $ AstAccountCont
+ ext $ AstAccountDTMFMode $ AstAccountDefaultUser $ AstAccountDeny $ AstAcco
+ untDisallowedCodec $ AstAccountExpirationTimestamp $ AstAccountFromDomain $
+  AstAccountFromUser $ AstAccountFullContact $ AstAccountHost $ AstAccountIg
+ noreSDPVersion $ AstAccountInsecure $ AstAccountIPAddress $ AstAccountLangu
+ age $ AstAccountLastQualifyMilliseconds $ AstAccountMailbox $ AstAccountMus
+ icOnHold $ AstAccountNAT $ AstAccountName $ AstAccountPermit $ AstAccountPi
+ ckupGroup $ AstAccountPort $ AstAccountPromiscRedir $ AstAccountQualify $ A
+ stAccountRTPHoldTimeout $ AstAccountRTPTimeout $ AstAccountRealmedPassword 
+ $ AstAccountRegistrationContext $ AstAccountRegistrationExten $ AstAccountR
+ egistrationServer $ AstAccountRestrictCID $ AstAccountSecret $ AstAccountSe
+ tVar $ AstAccountSubscribeContext $ AstAccountTransport $ AstAccountType $ 
+ AstAccountUserAgent $ AstAccountVideoSupport $ AstAccountPathSupport ) )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.4 NAME 'AsteriskConfig' DESC 'Asteris
+ k configuration Information' SUP top AUXILIARY MUST cn MAY ( AstConfigFilen
+ ame $ AstConfigCategory $ AstConfigCategoryMetric $ AstConfigVariableName $
+  AstConfigVariableValue $ AstConfigCommented ) )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.5 NAME 'AsteriskVoiceMail' DESC 'Aste
+ risk voicemail information' SUP top AUXILIARY MUST ( cn $ AstContext $ AstV
+ oicemailMailbox $ AstVoicemailPassword ) MAY ( AstVoicemailFullname $ AstVo
+ icemailEmail $ AstVoicemailPager $ AstVoicemailOptions $ AstVoicemailTimest
+ amp $ AstVoicemailContext ) )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.6 NAME 'AsteriskDialplan' DESC 'Aster
+ isk Dialplan Information' SUP top STRUCTURAL MUST AstExtension )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.7 NAME 'AsteriskAccount' DESC 'Asteri
+ sk Account Information' SUP top STRUCTURAL MUST AstAccountName )
+objectClasses: ( 1.3.6.1.4.1.22736.5.2.8 NAME 'AsteriskMailbox' DESC 'Asteri
+ sk Mailbox Information' SUP top STRUCTURAL MUST AstVoicemailMailbox )
+objectClasses: ( 1.3.6.1.4.1.3401.8.2.23 NAME 'pgpServerInfo' DESC 'PGP defi
+ ned objectclass to maintain information about PGP key space store' SUP top 
+ STRUCTURAL MUST ( cn $ pgpBaseKeySpaceDN ) MAY ( pgpSoftware $ pgpVersion )
+  X-ORIGIN 'Pretty Good Privacy (PGP)' )
+objectClasses: ( 1.3.6.1.4.1.3401.8.2.24 NAME 'pgpKeyInfo' DESC 'PGP defined
+  objectclass to maintain information about a PGP key' SUP top STRUCTURAL MU
+ ST ( pgpCertID $ pgpKey ) MAY ( pgpDisabled $ pgpKeyID $ pgpKeyType $ pgpUs
+ erID $ pgpKeyCreateTime $ pgpSignerID $ pgpRevoked $ pgpSubKeyID $ pgpKeySi
+ ze $ pgpKeyExpireTime ) X-ORIGIN 'Pretty Good Privacy (PGP)' )
+objectClasses: ( 1.3.6.1.4.1.3401.8.2.5 NAME 'pgpReconElement' DESC 'PGP def
+ ined objectclass of a reconstruction data object' STRUCTURAL MUST objectCla
+ ss MAY ( pgpReconCertID $ pgpReconData $ owner ) X-ORIGIN 'Pretty Good Priv
+ acy (PGP)' )
+objectClasses: ( 1.3.6.1.4.1.3401.8.2.4 NAME 'pgpProfile' DESC 'PGP defined 
+ objectclass of a collection admin prefs' SUP top STRUCTURAL MUST objectClas
+ s MAY ( cn $ owner ) X-ORIGIN 'Pretty Good Privacy (PGP)' )
+objectClasses: ( 1.3.6.1.4.1.3401.8.2.1 NAME 'pgpElement' DESC 'PGP defined 
+ objectclass of a single admin pref object' SUP top STRUCTURAL MUST objectCl
+ ass MAY ( pgpElementType $ pgpData $ owner ) X-ORIGIN 'Pretty Good Privacy 
+ (PGP)' )
+objectClasses: ( 1.2.840.113556.1.5.87 NAME 'calEntry' DESC 'Calendering and
+  free/busy information' SUP top AUXILIARY MAY ( calCalURI $ calFBURL $ calC
+ APURI $ calCalAdrURI $ calOtherCAPURIs $ calOtherCalURIs $ calOtherFBURLs $
+  calOtherCalAdrURIs ) )
+objectClasses: ( 1.3.6.1.4.1.13040.2.2.1 NAME 'hordePerson' DESC 'Horde Pref
+ erences' SUP top AUXILIARY MAY ( mail $ hordePrefs $ impPrefs $ turbaPrefs 
+ $ gollemPrefs $ kronolithPrefs $ mnemoPrefs $ trollPrefs $ nagPrefs $ klutz
+ Prefs $ jonahPrefs $ hermesPrefs $ junoPrefs $ treanPrefs $ whupsPrefs $ in
+ goPrefs $ geniePrefs $ scryPrefs $ anselPrefs $ wickedPrefs $ choraPrefs $ 
+ agoraPrefs $ goopsPrefs $ merkPrefs $ volosPrefs $ mimpPrefs $ mottlePrefs 
+ $ nicPrefs $ occamPrefs $ odinPrefs $ rakimPrefs $ seshaPrefs $ swooshPrefs
+  $ thorPrefs $ ulaformPrefs ) )
+objectClasses: ( 1.3.6.1.4.1.13040.2.2.2 NAME 'hordeGroup' DESC 'Horde Group
+ ' SUP top AUXILIARY MAY mail )
+objectClasses: ( 1.3.6.1.4.1.13040.4.2.1 NAME 'turbaContact' DESC 'Turba Con
+ tact' SUP top AUXILIARY MAY ( turbaType $ turbaMembers $ calFBURL ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.92 NAME 'dlmOtherIdentifyingInfoI
+ nstance' DESC 'helper class to tie indexed arrays in core model together' S
+ UP top STRUCTURAL MUST arrayIndex MAY ( dlmOtherIdentifyingInfo $ dlmIdenti
+ fyingDescription ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.1 NAME 'dlm1ManagedElement' DESC 
+ 'ManagedElement is an abstract class that provides             a common sup
+ erclass (or top of the inheritance tree)            for the non-association
+  classes in the CIM Schema.' SUP top ABSTRACT MAY ( dlmCaption $ dlmDescrip
+ tion $ orderedCimModelPath $ orderedCimKeys ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.2 NAME 'dlm1ManagedSystemElement'
+  DESC 'ManagedSystemElement is the base class for the            System Ele
+ ment hierarchy. Membership Criteria: Any            distinguishable compone
+ nt of a System is a candidate            for inclusion in this class. Examp
+ les: software            components, such as files; and devices, such as di
+ sk            drives and controllers, and physical components such         
+    as chips and cards.' SUP dlm1ManagedElement ABSTRACT MAY ( dlmInstallDat
+ e $ dlmName $ dlmStatus ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.10 NAME 'dlm1Collection' DESC 'Co
+ llection is an abstract class that provides a            common superclass 
+ for data elements that represent            collections of ManagedElements 
+ and its subclasses.' SUP dlm1ManagedElement ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.4 NAME 'dlm1LogicalElement' DESC 
+ 'LogicalElement is a base class for all the            components of a Syst
+ em that represent abstract system            components, such as Files, Pro
+ cesses, or system            capabilities in the form of Logical Devices.' 
+ SUP dlm1ManagedSystemElement ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.5 NAME 'dlm1System' DESC 'A Syste
+ m is a LogicalElement that aggregates an            enumerable set of Manag
+ ed System Elements. The            aggregation operates as a functional who
+ le. Within any             particular subclass of System, there is a well-d
+ efined            list of Managed System Element classes whose instances   
+           must be aggregated.' SUP dlm1LogicalElement ABSTRACT MAY ( dlmCre
+ ationClassName $ dlmName $ dlmNameFormat $ dlmPrimaryOwnerContact $ dlmPrim
+ aryOwnerName $ dlmRoles ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.6 NAME 'dlm1ComputerSystem' DESC 
+ 'A class derived from System that is a special            collection of Man
+ agedSystemElements. This collection            provides compute capabilitie
+ s and serves as            aggregation point to associate one or more of th
+ e            following elements: FileSystem, OperatingSystem,            Pr
+ ocessor and Memory (Volatile and/or NonVolatile            Storage).' SUP d
+ lm1System ABSTRACT MAY ( dlmDedicated $ dlmNameFormat ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.93 NAME 'dlm1AdminDomain' DESC 'T
+ his is a special grouping of            ManagedSystemElements. The grouping
+  is viewed as a            single entity, reflecting that all of its compon
+ ents            are administered similarly - either by the same user,      
+       group of users or policy. It serves as an aggregation            poin
+ t to associate one or more of the following            elements: network de
+ vices, such as routers and            switches, servers, and other resource
+ s that can be            accessed by end systems. This grouping of devices 
+            plays an essential role in ensuring that the same            adm
+ inistrative policy and actions are applied to all            of the devices
+  in the grouping. The specific behavior            and/or semantics of the 
+ AdminDomain can be identified            through its aggregated and associa
+ ted entities. The            System class and its subclasses provide the sc
+ ope for            numerous types of managed objects. As such, these       
+      classes must have the ability to create unique keys.            This a
+ ttribute is used by the System class and its            subclasses to defin
+ e a unique Name, independent of the             specific discovery protocol
+  used. Use of the heuristic            is optional, but recommended. AdminD
+ omain is a part of             the Core model, which has frequently been us
+ ed in the            Networks Model to group together various network      
+       resources that must be administered the same way,            perhaps 
+ using the same policies. Viewed in this light,             its principal su
+ bclass is AutonomousSystem.' SUP dlm1System ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.94 NAME 'dlm1AdminDomainAuxClass'
+  DESC 'This is a special grouping of            ManagedSystemElements. The 
+ grouping is viewed as a            single entity, reflecting that all of it
+ s components            are administered similarly - either by the same use
+ r,            group of users or policy. It serves as an aggregation        
+     point to associate one or more of the following            elements: ne
+ twork devices, such as routers and            switches, servers, and other 
+ resources that can be            accessed by end systems. This grouping of 
+ devices            plays an essential role in ensuring that the same       
+      administrative policy and actions are applied to all            of the
+  devices in the grouping. The specific behavior            and/or semantics
+  of the AdminDomain can be identified            through its aggregated and
+  associated entities. The            System class and its subclasses provid
+ e the scope for            numerous types of managed objects. As such, thes
+ e            classes must have the ability to create unique keys.          
+   This attribute is used by the System class and its            subclasses 
+ to define a unique Name, independent of the             specific discovery 
+ protocol used. Use of the heuristic            is optional, but recommended
+ . AdminDomain is a part of             the Core model, which has frequently
+  been used in the            Networks Model to group together various netwo
+ rk            resources that must be administered the same way,            
+ perhaps using the same policies. Viewed in this light,             its prin
+ cipal subclass is AutonomousSystem.' SUP dlm1AdminDomain AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.95 NAME 'dlm1AdminDomainInstance'
+  DESC 'This is a special grouping of            ManagedSystemElements. The 
+ grouping is viewed as a            single entity, reflecting that all of it
+ s components            are administered similarly - either by the same use
+ r,            group of users or policy. It serves as an aggregation        
+     point to associate one or more of the following            elements: ne
+ twork devices, such as routers and            switches, servers, and other 
+ resources that can be            accessed by end systems. This grouping of 
+ devices            plays an essential role in ensuring that the same       
+      administrative policy and actions are applied to all            of the
+  devices in the grouping. The specific behavior            and/or semantics
+  of the AdminDomain can be identified            through its aggregated and
+  associated entities. The            System class and its subclasses provid
+ e the scope for            numerous types of managed objects. As such, thes
+ e            classes must have the ability to create unique keys.          
+   This attribute is used by the System class and its            subclasses 
+ to define a unique Name, independent of the             specific discovery 
+ protocol used. Use of the heuristic            is optional, but recommended
+ . AdminDomain is a part of             the Core model, which has frequently
+  been used in the            Networks Model to group together various netwo
+ rk            resources that must be administered the same way,            
+ perhaps using the same policies. Viewed in this light,             its prin
+ cipal subclass is AutonomousSystem.' SUP dlm1AdminDomain STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.8 NAME 'dlm1Service' DESC 'A Serv
+ ice is a Logical Element that contains the            information necessary
+  to represent and manage the            functionality provided by a Device 
+ and/or            SoftwareFeature. A Service is a general-purpose object   
+           to configure and manage the implementation of            function
+ ality.  It is not the functionality itself.' SUP dlm1LogicalElement ABSTRAC
+ T MAY ( dlmCreationClassName $ dlmName $ dlmStartMode $ dlmStarted ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.9 NAME 'dlm1ServiceAccessPoint' D
+ ESC 'ServiceAccessPoint represents the ability to            utilize or inv
+ oke a Service.  Access points represent            that a Service is made a
+ vailable to other entities for             use.' SUP dlm1LogicalElement ABS
+ TRACT MAY ( dlmCreationClassName $ dlmName ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.15 NAME 'dlm1Setting' DESC 'The S
+ etting class represents            configuration-related and operational pa
+ rameters for            one or more ManagedSystem Element(s). A            
+ ManagedSystemElement may have multiple Setting objects             associat
+ ed with it. The current operational values for            an Element"s para
+ meters are reflected by properties in             the Element itself or by 
+ properties in its            associations. These properties do not have to 
+ be the            same values present in the Setting object. For           
+  example, a modem may have a Setting baud rate of            56Kb/sec but b
+ e operating at 19.2Kb/sec.' SUP dlm1ManagedElement ABSTRACT MAY dlmSettingI
+ D )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.42 NAME 'dlm1Dependency' DESC 'De
+ pendency is a generic association used to            establish dependency r
+ elationships between            ManagedElements.' SUP top ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.34 NAME 'dlm1ElementSetting' DESC
+  'ElementSetting represents the association between             Managed Sys
+ temElements and the Setting class(es)            defined for them.' SUP top
+  ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.35 NAME 'dlm1ElementSettingAuxCla
+ ss' DESC 'ElementSetting represents the association between             Man
+ aged SystemElements and the Setting class(es)            defined for them.'
+  SUP dlm1ElementSetting AUXILIARY MAY ( dlmElementSettingElementRef $ dlmEl
+ ementSettingSettingRef ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.60 NAME 'dlm1MemberOfCollection' 
+ DESC 'MemberOfCollection is an aggregation used to            establish mem
+ bership of ManagedElements in a            Collection.' SUP top ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.2.1.3.61 NAME 'dlm1MemberOfCollectionAu
+ xClass' DESC 'MemberOfCollection is an aggregation used to            estab
+ lish membership of ManagedElements in a            Collection.' SUP dlm1Mem
+ berOfCollection AUXILIARY MAY ( dlmMemberOfCollectionCollectionRef $ dlmMem
+ berOfCollectionMemberRef ) )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.8 NAME 'dlm1FilterList' DESC 'A F
+ ilterList is used by network devices to identify routes          by aggrega
+ ting a set of FilterEntries into a unit, called a          FilterList. Filt
+ erLists can also be used to accept or deny          routing updates.       
+    A FilterList is weak to the network device (e.g., the          ComputerS
+ ystem) that contains it. Hence, the ComputerSystem          keys are propag
+ ated to this class.' SUP dlm1LogicalElement STRUCTURAL MAY ( dlmName $ dlm1
+ FilterListDirection ) )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.1 NAME 'dlm1FilterEntryBase' DESC
+  'FilterEntryBase is an abstract class to define the naming          of all
+  filter entries, and to allow their common          aggregation into Filter
+ Lists. The FilterEntry subclass          represents packet filtering. Other
+  types of Entries are          possible - for example, to filter security c
+ redentials.          FilterEntryBase is weak to the network device (e.g., t
+ he          ComputerSystem) that contains it. Hence, the ComputerSystem    
+       keys are propagated to this class.' SUP dlm1LogicalElement ABSTRACT M
+ AY ( dlmCreationClassName $ dlmName $ dlm1FilterEntryBaseIsNegated ) )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.2 NAME 'dlm1FilterEntryBaseAuxCla
+ ss' SUP dlm1FilterEntryBase AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.3 NAME 'dlm1FilterEntryBaseInstan
+ ce' SUP dlm1FilterEntryBase STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.4 NAME 'dlm1ProtocolEndpoint' DES
+ C 'A communication point from which data may be sent or          received. 
+ ProtocolEndpoints link router interfaces and          switch ports to Logic
+ alNetworks.' SUP dlm1ServiceAccessPoint ABSTRACT MAY ( dlmName $ dlmProtoco
+ lType $ dlmOtherTypeDescription ) )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.5 NAME 'dlm1IPProtocolEndpoint' D
+ ESC 'The IP address that this ProtocolEndpoint represents,          formatt
+ ed according to the appropriate convention as          defined in the Addre
+ ssType property of this class          (e.g., 171.79.6.40).' SUP dlm1Protoc
+ olEndpoint ABSTRACT MAY ( dlmIPAddress $ dlmIPSubnetMask $ dlmIPAddressType
+  $ dlmIPVersionSupport ) )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.6 NAME 'dlm1IPProtocolEndpointAux
+ Class' DESC 'Auxilary Class for this IPProtocolEndpoint.' SUP dlm1IPProtoco
+ lEndpoint AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.10126.7.1.4.1.7 NAME 'dlm1IPProtocolEndpointIns
+ tance' DESC 'A structural class for an IPProtocolEndpoint.' SUP dlm1IPProto
+ colEndpoint STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.47 NAME 'dlm1OrganizationalEntity
+ ' DESC 'OrganizationalEntity is an abstract class from            which cla
+ sses that fit into an organizational            structure are derived.' SUP
+  dlm1ManagedElement ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.48 NAME 'dlm1UserEntity' DESC 'Us
+ erEntity is an abstract class that represents            users.' SUP dlm1Or
+ ganizationalEntity ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.49 NAME 'dlm1UsersAccess' DESC 'T
+ he UsersAccess object class is used to specify a             system user th
+ at permitted access to system resources.              The ManagedElement th
+ at has access to system resources            (represented in the model in t
+ he ElementAsUser            association) may be a person, a service, a serv
+ ice            access point or any collection thereof. Whereas the         
+    Account class represents the user"s relationship to a            system 
+ from the perspective of the security services            of the system, the
+  UserAccess class represents the            relationships to the systems in
+ dependent of a            particular system or service.' SUP dlm1UserEntity
+  ABSTRACT MAY ( dlmBiometric $ dlmCreationClassName $ dlmElementID $ dlmNam
+ e ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.4 NAME 'dlm1SecurityService' DESC
+  'SecurityService ...' SUP dlm1Service ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.8 NAME 'dlm1AuthenticationService
+ ' DESC 'AuthenticationService verifies users" identities           through 
+ some means.  These services are decomposed           into a subclass that p
+ rovides credentials to users and            a subclass that provides for th
+ e verification of the           validity of a credential and, perhaps, the 
+           appropriateness of its use for access to target           resourc
+ es. The persistent state information used from           one such verificat
+ ion to another is maintained in an           Account for that Users Access 
+ on that           AuthenticationService.' SUP dlm1SecurityService ABSTRACT 
+ )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.9 NAME 'dlm1AuthenticationService
+ AuxClass' DESC 'AuthenticationService verifies users" identities           
+ through some means.  These services are decomposed           into a subclas
+ s that provides credentials to users and            a subclass that provide
+ s for the verification of the           validity of a credential and, perha
+ ps, the           appropriateness of its use for access to target          
+  resources. The persistent state information used from           one such v
+ erification to another is maintained in an           Account for that Users
+  Access on that           AuthenticationService.' SUP dlm1AuthenticationSer
+ vice AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.10 NAME 'dlm1AuthenticationServic
+ eInstance' DESC 'AuthenticationService verifies users" identities          
+  through some means.  These services are decomposed           into a subcla
+ ss that provides credentials to users and            a subclass that provid
+ es for the verification of the           validity of a credential and, perh
+ aps, the           appropriateness of its use for access to target         
+   resources. The persistent state information used from           one such 
+ verification to another is maintained in an           Account for that User
+ s Access on that           AuthenticationService.' SUP dlm1AuthenticationSe
+ rvice STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.14 NAME 'dlm1CredentialManagement
+ Service' DESC 'CredentialManagementService issues credentials           and
+  manages the credential lifecycle.' SUP dlm1AuthenticationService ABSTRACT 
+ )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.15 NAME 'dlm1CredentialManagement
+ ServiceAuxClass' DESC 'CredentialManagementService issues credentials      
+      and manages the credential lifecycle.' SUP dlm1CredentialManagementSer
+ vice AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.16 NAME 'dlm1CredentialManagement
+ ServiceInstance' DESC 'CredentialManagementService issues credentials      
+      and manages the credential lifecycle.' SUP dlm1CredentialManagementSer
+ vice STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.50 NAME 'dlm1UsersAccessAuxClass'
+  DESC 'The UsersAccess object class is used to specify a             system
+  user that permitted access to system resources.              The ManagedEl
+ ement that has access to system resources            (represented in the mo
+ del in the ElementAsUser            association) may be a person, a service
+ , a service            access point or any collection thereof. Whereas the 
+            Account class represents the user"s relationship to a           
+  system from the perspective of the security services            of the sys
+ tem, the UserAccess class represents the            relationships to the sy
+ stems independent of a            particular system or service.' SUP dlm1Us
+ ersAccess AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.51 NAME 'dlm1UsersAccessInstance'
+  DESC 'The UsersAccess object class is used to specify a             system
+  user that permitted access to system resources.              The ManagedEl
+ ement that has access to system resources            (represented in the mo
+ del in the ElementAsUser            association) may be a person, a service
+ , a service            access point or any collection thereof. Whereas the 
+            Account class represents the user"s relationship to a           
+  system from the perspective of the security services            of the sys
+ tem, the UserAccess class represents the            relationships to the sy
+ stems independent of a            particular system or service.' SUP dlm1Us
+ ersAccess STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.75 NAME 'dlm1ElementAsUser' DESC 
+ 'ElementAsUser is an association used to establish             the "ownersh
+ ip" of UsersAccess object instances.  That            is, the ManagedElemen
+ t may have UsersAccess to systems             and, therefore, be "users" on
+  those systems.             UsersAccess instances must have an "owning"    
+         ManagedElement.  Typically, the ManagedElements will            be 
+ limited to Collection, Person, Service and            ServiceAccessPoint. O
+ ther non-human ManagedElements            that might be thought of as havin
+ g UsersAccess (e.g.,            a device or system) have services that have
+  the            UsersAccess.' SUP dlm1Dependency ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.76 NAME 'dlm1ElementAsUserAuxClas
+ s' DESC 'ElementAsUser is an association used to establish             the 
+ "ownership" of UsersAccess object instances.  That            is, the Manag
+ edElement may have UsersAccess to systems             and, therefore, be "u
+ sers" on those systems.             UsersAccess instances must have an "own
+ ing"            ManagedElement.  Typically, the ManagedElements will       
+      be limited to Collection, Person, Service and            ServiceAccess
+ Point. Other non-human ManagedElements            that might be thought of 
+ as having UsersAccess (e.g.,            a device or system) have services t
+ hat have the            UsersAccess.' SUP dlm1ElementAsUser AUXILIARY MAY (
+  dlmElementAsUserAntecedentRef $ dlmElementAsUserDependentRef ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.91 NAME 'dlm1UsersCredential' DES
+ C 'UsersCredential is an association used to            establish the crede
+ ntials that may be used for a            UsersAccess to a system or set of 
+ systems. ' SUP dlm1Dependency ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.92 NAME 'dlm1UsersCredentialAuxCl
+ ass' DESC 'UsersCredential is an association used to            establish t
+ he credentials that may be used for a            UsersAccess to a system or
+  set of systems. ' SUP dlm1UsersCredential AUXILIARY MAY ( dlmUsersCredenti
+ alAntecedentRef $ dlmUsersCredentialDependentRef ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.52 NAME 'dlm1Credential' DESC 'Su
+ bclasses of Credential define materials,           information, or other da
+ ta which are used to prove the            identity of a UsersAccess to a pa
+ rticular           SecurityService.  Generally, there may be some shared   
+         information, or credential material which is used to           iden
+ tify and authenticate ones self in the process of           gaining access 
+ to, or permission to use, an Account.           Such credential material ma
+ y be used to authenticate a            users access identity  initially, as
+  done by a           AuthenticationService (see later), and additionally on
+             an ongoing basis during the course of a connection or          
+  other  security association, as proof that each           received message
+  or communication came from the owning            user access of that crede
+ ntial material.' SUP dlm1ManagedElement ABSTRACT )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.62 NAME 'dlm1SharedSecret' DESC '
+ SharedSecret is the secret shared between a Users            Access and a p
+ articular SharedSecret security service.             Secrets may be in the 
+ form of a password used for           initial authentication, or as with a 
+ session key, used            as part of a message authentication code to ve
+ rify that            a message originated by the pricinpal with whom the   
+         secret is shared. It is important to note that           SharedSecr
+ et is not just the password, but rather is           the password used with
+  a particular security service.' SUP dlm1Credential ABSTRACT MAY ( dlmRemot
+ eID $ dlmAlgorithm $ dlmProtocol $ dlmSecret ) )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.63 NAME 'dlm1SharedSecretAuxClass
+ ' DESC 'SharedSecret is the secret shared between a Users            Access
+  and a particular SharedSecret security service.             Secrets may be
+  in the form of a password used for           initial authentication, or as
+  with a session key, used            as part of a message authentication co
+ de to verify that            a message originated by the pricinpal with who
+ m the           secret is shared. It is important to note that           Sh
+ aredSecret is not just the password, but rather is           the password u
+ sed with a particular security service.' SUP dlm1SharedSecret AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.412.100.4.1.1.64 NAME 'dlm1SharedSecretInstance
+ ' DESC 'SharedSecret is the secret shared between a Users            Access
+  and a particular SharedSecret security service.             Secrets may be
+  in the form of a password used for           initial authentication, or as
+  with a session key, used            as part of a message authentication co
+ de to verify that            a message originated by the pricinpal with who
+ m the           secret is shared. It is important to note that           Sh
+ aredSecret is not just the password, but rather is           the password u
+ sed with a particular security service.' SUP dlm1SharedSecret STRUCTURAL )
+objectClasses: ( 1.3.6.1.1.6.1.1 NAME 'pcimPolicy' DESC 'RFC 3703: An abstra
+ ct class that is the base class for all classes that describe policy-relate
+ d instances.' SUP dlm1ManagedElement ABSTRACT MAY ( cn $ dlmCaption $ dlmDe
+ scription $ orderedCimKeys $ pcimKeywords ) )
+objectClasses: ( 1.3.6.1.1.6.1.8 NAME 'pcimRuleConditionAssociation' DESC 'R
+ FC 3703: This class contains attributes characterizing the relationship bet
+ ween a policy rule and one of its policy conditions.' SUP pcimPolicy STRUCT
+ URAL MUST ( pcimConditionGroupNumber $ pcimConditionNegated ) MAY ( pcimCon
+ ditionName $ pcimConditionDN ) )
+objectClasses: ( 1.3.6.1.1.6.1.10 NAME 'pcimRuleActionAssociation' DESC 'RFC
+  3703: This class contains attributes characterizing the relationship betwe
+ en a policy rule and one of its policy actions.' SUP pcimPolicy STRUCTURAL 
+ MUST pcimActionOrder MAY ( pcimActionName $ pcimActionDN ) )
+objectClasses: ( 1.3.6.1.1.6.1.11 NAME 'pcimConditionAuxClass' DESC 'RFC 370
+ 3: A class representing a condition to be evaluated in conjunction with a p
+ olicy rule.' SUP top AUXILIARY )
+objectClasses: ( 1.3.6.1.1.6.1.14 NAME 'pcimActionAuxClass' DESC 'RFC 3703: 
+ A class representing an action to be performed as a result of a policy rule
+ .' SUP top AUXILIARY )
+objectClasses: ( 1.3.6.1.1.6.1.18 NAME 'pcimRepository' DESC 'RFC 3703: A co
+ ntainer for reusable policy information.' SUP dlm1AdminDomain ABSTRACT MAY 
+ pcimRepositoryName )
+objectClasses: ( 1.3.6.1.1.9.1.1 NAME 'pcelsPolicySet' DESC 'RFC 4104: Set o
+ f policies' SUP pcimPolicy ABSTRACT MAY ( pcelsPolicySetName $ pcelsDecisio
+ nStrategy $ pcimRoles $ pcelsPolicySetList ) )
+objectClasses: ( 1.3.6.1.1.9.1.2 NAME 'pcelsPolicySetAssociation' DESC 'RFC 
+ 4104: Associates a policy set to an aggregating entry' SUP pcimPolicy STRUC
+ TURAL MUST pcelsPriority MAY ( pcelsPolicySetName $ pcelsPolicySetDN ) )
+objectClasses: ( 1.3.6.1.1.9.1.3 NAME 'pcelsGroup' DESC 'RFC 4104: Base clas
+ s for representing a policy group' SUP pcelsPolicySet ABSTRACT MAY pcimGrou
+ pName )
+objectClasses: ( 1.3.6.1.1.9.1.4 NAME 'pcelsGroupAuxClass' DESC 'RFC 4104: A
+ uxiliary class for representing a policy group' SUP pcelsGroup AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.5 NAME 'pcelsGroupInstance' DESC 'RFC 4104: S
+ tructural class for representing a policy group' SUP pcelsGroup STRUCTURAL 
+ )
+objectClasses: ( 1.3.6.1.1.9.1.6 NAME 'pcelsRule' DESC 'RFC 4104: Base class
+  for representing a policy rule' SUP pcelsPolicySet ABSTRACT MAY ( pcimRule
+ Name $ pcimRuleEnabled $ pcimRuleUsage $ pcimRuleMandatory $ pcelsRuleValid
+ ityPeriodList $ pcelsConditionListType $ pcelsConditionList $ pcelsActionLi
+ st $ pcelsSequencedActions $ pcelsExecutionStrategy ) )
+objectClasses: ( 1.3.6.1.1.9.1.7 NAME 'pcelsRuleAuxClass' DESC 'RFC 4104: Au
+ xiliary class for representing a policy rule' SUP pcelsRule AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.8 NAME 'pcelsRuleInstance' DESC 'RFC 4104: St
+ ructural class for representing a policy rule' SUP pcelsRule STRUCTURAL )
+objectClasses: ( 1.3.6.1.1.9.1.9 NAME 'pcelsConditionAssociation' DESC 'RFC 
+ 4104: Associates a policy conditions to an aggregating entry' SUP pcimRuleC
+ onditionAssociation STRUCTURAL )
+objectClasses: ( 1.3.6.1.1.9.1.10 NAME 'pcelsActionAssociation' DESC 'RFC 41
+ 04: Associates a policy conditions to an aggregating entry' SUP pcimRuleAct
+ ionAssociation STRUCTURAL )
+objectClasses: ( 1.3.6.1.1.9.1.11 NAME 'pcelsSimpleConditionAuxClass' DESC '
+ RFC 4104: Value matching condition for a policy variable' SUP pcimCondition
+ AuxClass AUXILIARY MAY ( pcelsVariableDN $ pcelsValueDN ) )
+objectClasses: ( 1.3.6.1.1.9.1.12 NAME 'pcelsCompoundConditionAuxClass' DESC
+  'RFC 4104: Boolean combination of simpler conditions' SUP pcimConditionAux
+ Class AUXILIARY MAY ( pcelsConditionListType $ pcelsConditionList ) )
+objectClasses: ( 1.3.6.1.1.9.1.13 NAME 'pcelsCompoundFilterConditionAuxClass
+ ' DESC 'RFC 4104: A compound condition with mirroring capabilities' SUP pce
+ lsCompoundConditionAuxClass AUXILIARY MAY pcelsIsMirrored )
+objectClasses: ( 1.3.6.1.1.9.1.14 NAME 'pcelsSimpleActionAuxClass' DESC 'RFC
+  4104: Value assignment action for a policy variable' SUP pcimActionAuxClas
+ s AUXILIARY MAY ( pcelsVariableDN $ pcelsValueDN ) )
+objectClasses: ( 1.3.6.1.1.9.1.15 NAME 'pcelsCompoundActionAuxClass' DESC 'R
+ FC 4104: Sequence of actions with specific execution strategy' SUP pcimActi
+ onAuxClass AUXILIARY MAY ( pcelsActionList $ pcelsSequencedActions $ pcelsE
+ xecutionStrategy ) )
+objectClasses: ( 1.3.6.1.1.9.1.16 NAME 'pcelsVariable' DESC 'RFC 4104: Base 
+ class for representing a policy variable' SUP top ABSTRACT MAY ( pcelsVaria
+ bleName $ pcelsExpectedValueList ) )
+objectClasses: ( 1.3.6.1.1.9.1.17 NAME 'pcelsExplicitVariableAuxClass' DESC 
+ 'RFC 4104: Explicitly defined policy variable' SUP pcelsVariable AUXILIARY 
+ MUST ( pcelsVariableModelClass $ pcelsVariableModelProperty ) )
+objectClasses: ( 1.3.6.1.1.9.1.18 NAME 'pcelsImplicitVariableAuxClass' DESC 
+ 'RFC 4104: Implicitly defined policy variable' SUP pcelsVariable AUXILIARY 
+ MAY pcelsExpectedValueTypes )
+objectClasses: ( 1.3.6.1.1.9.1.19 NAME 'pcelsSourceIPv4VariableAuxClass' DES
+ C 'RFC 4104: Source IP v4 address' SUP pcelsImplicitVariableAuxClass AUXILI
+ ARY )
+objectClasses: ( 1.3.6.1.1.9.1.20 NAME 'pcelsSourceIPv6VariableAuxClass' DES
+ C 'RFC 4104: Source IP v6 address' SUP pcelsImplicitVariableAuxClass AUXILI
+ ARY )
+objectClasses: ( 1.3.6.1.1.9.1.21 NAME 'pcelsDestinationIPv4VariableAuxClass
+ ' DESC 'RFC 4104: Destination IP v4 address' SUP pcelsImplicitVariableAuxCl
+ ass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.22 NAME 'pcelsDestinationIPv6VariableAuxClass
+ ' DESC 'RFC 4104: Destination IP v6 address' SUP pcelsImplicitVariableAuxCl
+ ass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.23 NAME 'pcelsSourcePortVariableAuxClass' DES
+ C 'RFC 4104: Source port' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.24 NAME 'pcelsDestinationPortVariableAuxClass
+ ' DESC 'RFC 4104: Destination port' SUP pcelsImplicitVariableAuxClass AUXIL
+ IARY )
+objectClasses: ( 1.3.6.1.1.9.1.25 NAME 'pcelsIPProtocolVariableAuxClass' DES
+ C 'RFC 4104: IP protocol number' SUP pcelsImplicitVariableAuxClass AUXILIAR
+ Y )
+objectClasses: ( 1.3.6.1.1.9.1.26 NAME 'pcelsIPVersionVariableAuxClass' DESC
+  'RFC 4104: IP version number' SUP pcelsImplicitVariableAuxClass AUXILIARY 
+ )
+objectClasses: ( 1.3.6.1.1.9.1.27 NAME 'pcelsIPToSVariableAuxClass' DESC 'RF
+ C 4104: IP ToS octet' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.28 NAME 'pcelsDSCPVariableAuxClass' DESC 'RFC
+  4104: DiffServ code point' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.29 NAME 'pcelsFlowIdVariableAuxClass' DESC 'R
+ FC 4104: Flow Identifier' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.30 NAME 'pcelsSourceMACVariableAuxClass' DESC
+  'RFC 4104: Source MAC address' SUP pcelsImplicitVariableAuxClass AUXILIARY
+  )
+objectClasses: ( 1.3.6.1.1.9.1.31 NAME 'pcelsDestinationMACVariableAuxClass'
+  DESC 'RFC 4104: Destination MAC address' SUP pcelsImplicitVariableAuxClass
+  AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.32 NAME 'pcelsVLANVariableAuxClass' DESC 'RFC
+  4104: VLAN' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.33 NAME 'pcelsCoSVariableAuxClass' DESC 'RFC 
+ 4104: Class of service' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.34 NAME 'pcelsEthertypeVariableAuxClass' DESC
+  'RFC 4104: Ethertype' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.35 NAME 'pcelsSourceSAPVariableAuxClass' DESC
+  'RFC 4104: Source SAP' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.36 NAME 'pcelsDestinationSAPVariableAuxClass'
+  DESC 'RFC 4104: Destination SAP' SUP pcelsImplicitVariableAuxClass AUXILIA
+ RY )
+objectClasses: ( 1.3.6.1.1.9.1.37 NAME 'pcelsSNAPOUIVariableAuxClass' DESC '
+ RFC 4104: SNAP OUI' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.38 NAME 'pcelsSNAPTypeVariableAuxClass' DESC 
+ 'RFC 4104: SNAP type' SUP pcelsImplicitVariableAuxClass AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.39 NAME 'pcelsFlowDirectionVariableAuxClass' 
+ DESC 'RFC 4104: Flow direction' SUP pcelsImplicitVariableAuxClass AUXILIARY
+  )
+objectClasses: ( 1.3.6.1.1.9.1.40 NAME 'pcelsValueAuxClass' DESC 'RFC 4104: 
+ Base class for representing a policy value' SUP top AUXILIARY MAY pcelsValu
+ eName )
+objectClasses: ( 1.3.6.1.1.9.1.41 NAME 'pcelsIPv4AddrValueAuxClass' DESC 'RF
+ C 4104: Provides IPv4 addresses' SUP pcelsValueAuxClass AUXILIARY MUST pcel
+ sIPv4AddrList )
+objectClasses: ( 1.3.6.1.1.9.1.42 NAME 'pcelsIPv6AddrValueAuxClass' DESC 'RF
+ C 4104: Provides IPv6 addresses' SUP pcelsValueAuxClass AUXILIARY MUST pcel
+ sIPv6AddrList )
+objectClasses: ( 1.3.6.1.1.9.1.43 NAME 'pcelsMACAddrValueAuxClass' DESC 'RFC
+  4104: Provides MAC addresses' SUP pcelsValueAuxClass AUXILIARY MUST pcelsM
+ ACAddrList )
+objectClasses: ( 1.3.6.1.1.9.1.44 NAME 'pcelsStringValueAuxClass' DESC 'RFC 
+ 4104: Provides string values' SUP pcelsValueAuxClass AUXILIARY MUST pcelsSt
+ ringList )
+objectClasses: ( 1.3.6.1.1.9.1.45 NAME 'pcelsBitStringValueAuxClass' DESC 'R
+ FC 4104: Provides bit strings' SUP pcelsValueAuxClass AUXILIARY MUST pcelsB
+ itStringList )
+objectClasses: ( 1.3.6.1.1.9.1.46 NAME 'pcelsIntegerValueAuxClass' DESC 'RFC
+  4104: Provides integer values' SUP pcelsValueAuxClass AUXILIARY MUST pcels
+ IntegerList )
+objectClasses: ( 1.3.6.1.1.9.1.47 NAME 'pcelsBooleanValueAuxClass' DESC 'RFC
+  4104: Provides a boolean value.' SUP pcelsValueAuxClass AUXILIARY MUST pce
+ lsBoolean )
+objectClasses: ( 1.3.6.1.1.9.1.48 NAME 'pcelsReusableContainer' DESC 'RFC 41
+ 04: Container for reusable policy information' SUP pcimRepository ABSTRACT 
+ MAY ( pcelsReusableContainerName $ pcelsReusableContainerList ) )
+objectClasses: ( 1.3.6.1.1.9.1.49 NAME 'pcelsReusableContainerAuxClass' DESC
+  'RFC 4104: Container for reusable policy information' SUP pcelsReusableCon
+ tainer AUXILIARY )
+objectClasses: ( 1.3.6.1.1.9.1.50 NAME 'pcelsReusableContainerInstance' DESC
+  'RFC 4104: Container for reusable policy information' SUP pcelsReusableCon
+ tainer STRUCTURAL )
+objectClasses: ( 1.3.6.1.1.9.1.51 NAME 'pcelsRoleCollection' DESC 'RFC 4104:
+  Collection of managed elements that share a common role' SUP pcimPolicy ST
+ RUCTURAL MUST pcelsRole MAY ( pcelsRoleCollectionName $ pcelsElementList ) 
+ )
+objectClasses: ( 1.3.6.1.1.9.1.52 NAME 'pcelsFilterEntryBase' DESC 'RFC 4104
+ : Base class for message or packet filters' SUP pcimPolicy ABSTRACT MAY ( p
+ celsFilterName $ pcelsFilterIsNegated ) )
+objectClasses: ( 1.3.6.1.1.9.1.53 NAME 'pcelsIPHeadersFilter' DESC 'RFC 4104
+ : IP header filter' SUP pcelsFilterEntryBase STRUCTURAL MAY ( pcelsIPHdrVer
+ sion $ pcelsIPHdrSourceAddress $ pcelsIPHdrSourceAddressEndOfRange $ pcelsI
+ PHdrSourceMask $ pcelsIPHdrDestAddress $ pcelsIPHdrDestAddressEndOfRange $ 
+ pcelsIPHdrDestMask $ pcelsIPHdrProtocolID $ pcelsIPHdrSourcePortStart $ pce
+ lsIPHdrSourcePortEnd $ pcelsIPHdrDestPortStart $ pcelsIPHdrDestPortEnd $ pc
+ elsIPHdrDSCPList $ pcelsIPHdrFlowLabel ) )
+objectClasses: ( 1.3.6.1.1.9.1.54 NAME 'pcels8021Filter' DESC 'RFC 4104: 802
+ .1 header filter' SUP pcelsFilterEntryBase STRUCTURAL MAY ( pcels8021HdrSou
+ rceMACAddress $ pcels8021HdrSourceMACMask $ pcels8021HdrDestMACAddress $ pc
+ els8021HdrDestMACMask $ pcels8021HdrProtocolID $ pcels8021HdrPriority $ pce
+ ls8021HdrVLANID ) )
+objectClasses: ( 1.3.6.1.1.9.1.55 NAME 'pcelsFilterListAuxClass' DESC 'RFC 4
+ 104: Collection of pcelsFilterEntryBase filters' SUP pcimConditionAuxClass 
+ AUXILIARY MAY ( pcelsFilterListName $ pcelsFilterDirection $ pcelsFilterEnt
+ ryList ) )
+objectClasses: ( 1.3.6.1.1.9.1.56 NAME 'pcelsVendorVariableAuxClass' DESC 'R
+ FC 4104: Defines registered means to describe a policy variable' SUP pcelsV
+ ariable AUXILIARY MAY ( pcelsVendorVariableData $ pcelsVendorVariableEncodi
+ ng ) )
+objectClasses: ( 1.3.6.1.1.9.1.57 NAME 'pcelsVendorValueAuxClass' DESC 'RFC 
+ 4104: Defines registered means to describe a policy value' SUP pcelsValueAu
+ xClass AUXILIARY MAY ( pcelsVendorValueData $ pcelsVendorValueEncoding ) )
+objectClasses: ( 1.3.6.1.4.1.7924.2.1.2.1 NAME 'demailBaseObject' DESC '' SU
+ P top AUXILIARY MUST mail MAY c )
+objectClasses: ( 1.3.6.1.4.1.7924.2.1.2.2 NAME 'demailSecurityObject' DESC '
+ ' SUP demailBaseObject AUXILIARY MUST demailMaxAuthLevel )
+objectClasses: ( 1.3.6.1.4.1.7924.2.1.2.3 NAME 'demailPersonObject' DESC '' 
+ SUP demailSecurityObject AUXILIARY MAY personalTitle )
+objectClasses: ( 1.3.6.1.4.1.7924.2.1.2.4 NAME 'demailLegalPersonObject' DES
+ C '' SUP demailSecurityObject AUXILIARY MUST displayName )
+objectClasses: ( 1.3.6.1.4.1.7924.2.1.2.5 NAME 'demailLegalPersonUserObject'
+  DESC '' SUP demailSecurityObject AUXILIARY MUST ( displayName $ o ) )
+objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer Entrie
+ s' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ sud
+ oRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudo
+ NotAfter $ sudoOrder $ description ) )
+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' DESC 'MA
+ NDATORY: OpenSSH LPK objectclass' SUP top AUXILIARY MAY ( sshPublicKey $ ui
+ d ) )
+objectClasses: ( 1.3.6.1.4.1.34380.1.1.1.2 NAME 'puppetClient' DESC 'Puppet 
+ Client object class' SUP top AUXILIARY MAY ( puppetClass $ parentNode $ env
+ ironment $ puppetVar ) )
+objectClasses: ( 1.3.6.1.4.1.29426.2.2.2.1 NAME 'DKIM' DESC 'DKIM Selector a
+ nd Key container' SUP top AUXILIARY MUST ( DKIMSelector $ DKIMKey ) MAY ( D
+ KIMIdentity $ DKIMDomain ) )
+objectClasses: ( 1.3.6.1.4.1.19937.1.2.1 NAME 'systemQuotas' DESC 'System Qu
+ otas' SUP posixAccount AUXILIARY MUST uid MAY quota )
+objectClasses: ( 1.3.6.1.3.1.1.1.1.2 NAME 'tacacsAccount' DESC 'Tacacs user 
+ object' SUP top AUXILIARY MUST cn MAY ( tacacsClient $ tacacsMember $ tacac
+ sProfile $ tacacsFlag ) )
+objectClasses: ( 1.3.6.1.4.1.3.8.1.2.1 NAME 'cmuSaslUser' SUP top AUXILIARY 
+ MAY ( userPassword $ cmusaslsecretCRAM-MD5 $ cmusaslsecretDIGEST-MD5 $ cmus
+ aslsecretOTP $ cmusaslsecretSRP ) )
+objectClasses: ( 1.3.6.1.4.1.31103.1.1001 NAME 'fedfsNsdbContainerInfo' DESC
+  'Describes NCE location' SUP top AUXILIARY MUST fedfsNceDN MAY ( fedfsAnno
+ tation $ fedfsDescr ) )
+objectClasses: ( 1.3.6.1.4.1.31103.1.1002 NAME 'fedfsFsn' DESC 'Represents a
+  fileset' SUP top STRUCTURAL MUST ( fedfsFsnUuid $ fedfsFsnTTL ) MAY ( fedf
+ sAnnotation $ fedfsDescr ) )
+objectClasses: ( 1.3.6.1.4.1.31103.1.1003 NAME 'fedfsFsl' DESC 'A physical l
+ ocation of a fileset' SUP top ABSTRACT MUST ( fedfsFslUuid $ fedfsFsnUuid )
+  MAY ( fedfsAnnotation $ fedfsDescr ) )
+objectClasses: ( 1.3.6.1.4.1.31103.1.1004 NAME 'fedfsNfsFsl' DESC 'An NFS lo
+ cation of a fileset' SUP fedfsFsl STRUCTURAL MUST ( fedfsNfsURI $ fedfsNfsC
+ urrency $ fedfsNfsGenFlagWritable $ fedfsNfsGenFlagGoing $ fedfsNfsGenFlagS
+ plit $ fedfsNfsTransFlagRdma $ fedfsNfsClassSimul $ fedfsNfsClassHandle $ f
+ edfsNfsClassFileid $ fedfsNfsClassWritever $ fedfsNfsClassChange $ fedfsNfs
+ ClassReaddir $ fedfsNfsReadRank $ fedfsNfsReadOrder $ fedfsNfsWriteRank $ f
+ edfsNfsWriteOrder $ fedfsNfsVarSub $ fedfsNfsValidFor ) )
+objectClasses: ( 0.0.8.350.1.1.1.2.1 NAME 'commURIObject' DESC 'object that 
+ contains the URI attribute type' SUP top AUXILIARY MAY commURI )
+objectClasses: ( 0.0.8.350.1.1.2.2.1 NAME 'commObject' DESC 'object that con
+ tains the Communication attributes' SUP top STRUCTURAL MUST commUniqueId MA
+ Y ( commOwner $ commPrivate ) )
+objectClasses: ( 0.0.8.350.1.1.6.2.1 NAME 'SIPIdentity' DESC 'SIPIdentity ob
+ ject' SUP top AUXILIARY MAY ( SIPIdentitySIPURI $ SIPIdentityRegistrarAddre
+ ss $ SIPIdentityProxyAddress $ SIPIdentityAddress $ SIPIdentityPassword $ S
+ IPIdentityUserName $ SIPIdentityServiceLevel $ userSMIMECertificate ) )
+objectClasses: ( 1.3.6.1.4.1.11344.4.3.2.1 NAME 'radiusprofile' SUP top AUXI
+ LIARY MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess 
+ $ radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledSt
+ ationId $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ ra
+ diusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ r
+ adiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress 
+ $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radius
+ FramedProtocol $ radiusAttribute $ radiusFramedRoute $ radiusFramedRouting 
+ $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ radiusHuntgroupName $ 
+ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ radiusLoginL
+ ATPort $ radiusLoginLATService $ radiusLoginService $ radiusLoginTCPPort $ 
+ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ radiusPrompt $ ra
+ diusProxyToRealm $ radiusRealm $ radiusReplicateToRealm $ radiusServiceType
+  $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminationAction $ r
+ adiusTunnelClientEndpoint $ radiusProfileDN $ radiusSimultaneousUse $ radiu
+ sTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelPassword $ radiu
+ sTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint
+  $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $ d
+ ialupAccess $ radiusNASIpAddress $ radiusReplyMessage $ radiusControlAttrib
+ ute $ radiusReplyAttribute $ radiusRequestAttribute ) )
+objectClasses: ( 1.3.6.1.4.1.11344.4.3.2.2 NAME 'radiusObjectProfile' DESC '
+ A Container Objectclass to be used for creating radius profile object' SUP 
+ top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) )
+objectClasses: ( 1.3.6.1.4.1.11344.1.100.1.1 NAME 'radiusClient' DESC 'radiu
+ sClient object class' SUP top STRUCTURAL MUST ( radiusClientIdentifier $ ra
+ diusClientSecret ) MAY ( radiusClientShortname $ radiusClientVirtualServer 
+ $ radiusClientType $ radiusClientRequireMa $ radiusClientComment ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.1 NAME 'msPerson' DESC 'Supplement
+  class for person entries' AUXILIARY MAY ( c $ gender $ businessTitle $ per
+ sonalTitle $ dateOfBirth $ uniqueIdentifier $ nickName $ organizationalStat
+ us $ userClass $ buildingName $ houseIdentifier $ labeledBICandIBAN $ emplo
+ yeeType $ birthName $ birthPlace $ euVATId $ delegatesTo $ serialNumber ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.8 NAME 'msOrganization' DESC 'Supp
+ lement class for organizations/companies' AUXILIARY MAY ( c $ mail $ labele
+ dURI $ euVATId $ labeledBICandIBAN $ uniqueIdentifier $ displayName $ organ
+ izationalStatus ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.6 NAME 'musician' DESC 'Musician' 
+ AUXILIARY MAY ( musicalInstrument $ musicalOrchestra $ musicalArtistName ) 
+ )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.660 NAME 'germanBankArrangement' D
+ ESC 'German bank account information' AUXILIARY MUST ( germanBankAccountNum
+ ber $ germanBankCode ) MAY ( germanBankAccountHolder $ germanBankName $ ger
+ manBankAccountInfo ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.20 NAME 'namedObject' SUP top STRU
+ CTURAL MUST cn MAY ( uniqueIdentifier $ description ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.21 NAME 'namedPolicy' SUP namedObj
+ ect STRUCTURAL )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.9 NAME 'mailboxRelatedObject' DESC
+  'For pointing to an associated RFC2821 (functional) mailbox from any entry
+ ' AUXILIARY MAY ( displayName $ mail $ intlMailAddr ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.1 NAME 'oathUser' DESC 'OATH-
+ LDAP: User Object' ABSTRACT X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.2 NAME 'oathParams' DESC 'OAT
+ H-LDAP: Parameter object' ABSTRACT MUST ( oathOTPLength $ oathHMACAlgorithm
+  ) MAY ( oathSecretMaxAge $ oathSecretLength $ oathMaxUsageCount $ oathThro
+ ttleLimit $ oathEncCert $ oathSuccessResultCode $ oathSuccessMessage $ oath
+ FailureResultCode $ oathFailureMessage ) X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.3 NAME 'oathToken' DESC 'OATH
+ -LDAP: User Object' ABSTRACT MAY ( oathSecret $ oathSecretTime $ oathLastLo
+ gin $ oathFailureCount $ oathLastFailure $ oathTokenSerialNumber $ oathToke
+ nIdentifier $ oathTokenPIN ) X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.1.1 NAME 'oathHOTPUser' DESC 
+ 'OATH-LDAP: HOTP user object' SUP oathUser AUXILIARY MAY oathHOTPToken X-OR
+ IGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.2.1 NAME 'oathHOTPParams' DES
+ C 'OATH-LDAP: HOTP parameter object' SUP oathParams AUXILIARY MUST oathHOTP
+ LookAhead X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.3.1 NAME 'oathHOTPToken' DESC
+  'OATH-LDAP: HOTP token object' SUP oathToken AUXILIARY MAY ( oathHOTPParam
+ s $ oathHOTPCounter ) X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.1.2 NAME 'oathTOTPUser' DESC 
+ 'OATH-LDAP: TOTP user object' SUP oathUser AUXILIARY MUST oathTOTPToken X-O
+ RIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.2.2 NAME 'oathTOTPParams' DES
+ C 'OATH-LDAP: TOTP parameter object' SUP oathParams AUXILIARY MUST oathTOTP
+ TimeStepPeriod X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.4226.6.3.2 NAME 'oathTOTPToken' DESC
+  'OATH-LDAP: TOTP token' SUP oathToken AUXILIARY MAY ( oathTOTPParams $ oat
+ hTOTPLastTimeStep ) X-ORIGIN 'OATH-LDAP' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.42.201 DESC 'Test object class witho
+ ut NAME' SUP top STRUCTURAL MUST 1.3.6.1.4.1.5427.1.389.42.1 )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.42.202 DESC 'Test object class with 
+ experimental flag' SUP top AUXILIARY MUST X-experimentalFlag )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.42.203 NAME 'X-experimentalNoSuperCl
+ assAuxiliary' DESC 'Auxiliary object class without superior class' AUXILIAR
+ Y )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.42.204 NAME 'X-experimentalNoSuperCl
+ assStructural' DESC 'Auxiliary object class without superior class' STRUCTU
+ RAL )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.42.824753556 DESC 'Testing really bi
+ g OID number' AUXILIARY )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.42.8247535563333 NAME 'testPersonAcc
+ ount' DESC 'account/inetOrgPerson' SUP ( account $ inetOrgPerson ) STRUCTUR
+ AL )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.330 NAME 'msPwdResetObject' DESC '
+ Entry for which a temporary password was set' AUXILIARY MUST ( msPwdResetPa
+ sswordHash $ msPwdResetTimestamp $ msPwdResetExpirationTime $ msPwdResetEna
+ bled ) MAY msPwdResetAdminPw )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.6.331 NAME 'msPwdResetPolicy' DESC '
+ Entry defining the password reset policy' AUXILIARY MUST ( msPwdResetMaxAge
+  $ msPwdResetEnabled $ msPwdResetHashAlgorithm $ msPwdResetPwLen $ msPwdRes
+ etAdminPwLen ) )
+objectClasses: ( 1.2.826.0.1.3458854.2.1.1.1 NAME 'groupOfEntries' SUP top S
+ TRUCTURAL MUST cn MAY ( member $ businessCategory $ seeAlso $ owner $ ou $ 
+ o $ description ) )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.24 NAME 'aeTag' DESC 'AE-DIR: 
+ Tag for marking objects with arbitrary shared information' SUP namedObject 
+ STRUCTURAL MUST ( aeStatus $ description ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.21 NAME 'aeObject' DESC 'AE-DI
+ R: Managed object' ABSTRACT MUST aeStatus MAY ( description $ aeNotBefore $
+  aeNotAfter $ aeTicketId $ aeTag ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.23 NAME 'aePosixIdRanges' DESC
+  'AE-DIR: POSIX UID/GID pool' AUXILIARY MAY ( aeUidNumberMin $ aeUidNumberM
+ ax $ uidNumber $ aeGidNumberMin $ aeGidNumberMax $ gidNumber ) X-ORIGIN 'AE
+ -DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.26 NAME 'aePolicy' DESC 'AE-DI
+ R: policy entry' SUP ( namedPolicy $ aeObject ) STRUCTURAL MUST description
+  X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.22 NAME 'aeRoot' DESC 'AE-DIR:
+  Top-level search root entry' SUP ( organizationalUnit $ aeObject ) STRUCTU
+ RAL X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.29 NAME 'aeDept' DESC 'AE-DIR:
+  Department within an organization' SUP ( organizationalUnit $ aeObject ) S
+ TRUCTURAL MUST departmentNumber MAY ( o $ displayName $ manager $ aeSourceU
+ ri ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.20 NAME 'aeZone' DESC 'AE-DIR:
+  Zone for delegated administration' SUP ( namedObject $ aeObject ) STRUCTUR
+ AL MUST description MAY ( aeDept $ aeZoneAdmins $ aeZoneAuditors $ aePasswo
+ rdAdmins ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.1 NAME 'aeGroup' DESC 'AE-DIR:
+  Group entry' SUP ( groupOfEntries $ posixGroup $ groupOfURLs $ aeObject ) 
+ STRUCTURAL MUST description MAY aeDept X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.7 NAME 'aeSudoRule' DESC 'AE-D
+ IR: Specific SUDO rule' SUP ( sudoRole $ aeObject ) STRUCTURAL MUST ( sudoU
+ ser $ description ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.2 NAME 'aeUser' DESC 'AE-DIR: 
+ User' SUP ( inetOrgPerson $ account $ aeObject ) STRUCTURAL MUST ( uid $ ae
+ Person $ givenName $ displayName ) MAY aeRemoteHost X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.13 NAME 'aeSrvGroup' DESC 'AE-
+ DIR: Server type/group' SUP ( namedObject $ aeObject ) STRUCTURAL MUST ( cn
+  $ description ) MAY ( aeSrvGroup $ aeProxyFor $ aeLogStorePeriod $ aeSetup
+ Groups $ aeLogStoreGroups $ aeLoginGroups $ aeVisibleGroups $ aeDisplayName
+ Groups $ aeVisibleSudoers $ aeSSHProxyCommand ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.5 NAME 'aeMailbox' DESC 'AE-DI
+ R: Mailbox entry' SUP ( namedObject $ aeObject ) STRUCTURAL X-ORIGIN 'AE-DI
+ R' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.6 NAME 'aeDevice' DESC 'AE-DIR
+ : Arbitrary device mounted in a case' SUP ( device $ aeObject ) STRUCTURAL 
+ MUST aeStatus MAY ( displayName $ aeStockId $ aeHwSerialNumber $ aePerson )
+  X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.6.1 NAME 'aeHost' DESC 'AE-DIR
+ : Single host (server)' SUP aeDevice STRUCTURAL MUST host MAY ( aeSrvGroup 
+ $ aeStockId $ aeRemoteHost $ userPassword ) X-ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.6.2 NAME 'aeNwDevice' DESC 'AE
+ -DIR: Single network adapter built into aeDevice' SUP aeDevice STRUCTURAL M
+ AY ( aeFqdn $ aeDeviceSlot $ aeDevicePort $ aeNwDevice ) X-ORIGIN 'AE-DIR' 
+ )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.8 NAME 'aePerson' DESC 'AE-DIR
+ : person class' SUP ( inetOrgPerson $ aeObject ) STRUCTURAL MUST ( givenNam
+ e $ aeDept ) MAY ( aeSourceUri $ uniqueIdentifier $ employeeNumber $ c ) X-
+ ORIGIN 'AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.4 NAME 'aeService' DESC 'AE-DI
+ R: Service user' SUP ( account $ aeObject ) STRUCTURAL MUST ( uid $ descrip
+ tion ) MAY ( aeRemoteHost $ aeHost $ aeSrvGroup $ userPassword ) X-ORIGIN '
+ AE-DIR' )
+objectClasses: ( 1.3.6.1.4.1.5427.1.389.100.6.25 NAME 'aeAuthcToken' DESC 'A
+ E-DIR: Authentication token device (e.g. yubikey)' SUP aeDevice STRUCTURAL 
+ MUST ( aeHwSerialNumber $ serialNumber $ aePerson $ displayName ) MAY userP
+ assword X-ORIGIN 'AE-DIR' )
+
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
new file mode 100644
index 0000000..e24f1db
--- /dev/null
+++ b/Tests/t_ldap_schema_subentry.py
@@ -0,0 +1,32 @@
+"""
+test class ldap.schema.SubSchema
+"""
+
+import unittest
+import time
+
+import ldif
+import ldap.schema
+
+TEST_SUBSCHEMA_FILES = (
+    'Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif',
+    'Tests/ldif/subschema-openldap-all.ldif',
+)
+
+class TestSubschemaLDIF(unittest.TestCase):
+    """
+    test ldap.schema.SubSchema with subschema subentries read from LDIF files
+    """
+
+    def test_subschema_file(self):
+        for test_file in TEST_SUBSCHEMA_FILES:
+            # Read and parse LDIF file
+            ldif_file = open(test_file, 'rb')
+            ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
+            ldif_parser.parse()
+            _, subschema_subentry = ldif_parser.all_records[0]
+            sub_schema = ldap.schema.SubSchema(subschema_subentry)
+
+
+if __name__ == '__main__':
+    unittest.main()

From e0f5a421cbcc030f57449a7c40be57e4e52d8f07 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 17:26:45 +0000
Subject: [PATCH 332/868] new test script t_ldap_schema_subentry.py needs LDIF
 files

---
 MANIFEST.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MANIFEST.in b/MANIFEST.in
index 459af43..4f56647 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -4,4 +4,4 @@ recursive-include Build *.cfg*
 recursive-include Lib *.py
 recursive-include Demo *.py
 include tox.ini
-recursive-include Tests *.py
+recursive-include Tests *.py *.ldif

From 8639796f2421f13f2b1e8caaf535597feb9f8d6b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Feb 2017 17:36:41 +0000
Subject: [PATCH 333/868] new t_ldap_schema_subentry

---
 Tests/__init__.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Tests/__init__.py b/Tests/__init__.py
index 739dd08..5367f82 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -11,5 +11,6 @@
 import t_ldapurl 
 import t_ldif 
 import t_search 
+import t_ldap_schema_subentry
 
 import slapd
\ No newline at end of file

From 909b2ea693cb597dfdef3ced27d76b37803a0fec Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Feb 2017 12:36:21 +0000
Subject: [PATCH 334/868] more changes related to
 ldap.schema.tokenizer.split_tokens

---
 CHANGES | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 463bb00..c7157b4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,12 @@
 ----------------------------------------------------------------
 Released 2.4.33 2017-02-xx
 
+Lib/
+* removed unused 2nd argument of ldap.schema.tokenizer.split_tokens()
+
+Tests/
+* re-factored t_ldap_schema_tokenizer.py
+
 ----------------------------------------------------------------
 Released 2.4.32 2017-02-14
 
@@ -1339,4 +1345,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.410 2017/02/18 14:50:24 stroeder Exp $
+$Id: CHANGES,v 1.411 2017/02/19 12:36:21 stroeder Exp $

From adb6b471507a50ded256787ca3b9002009276604 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Feb 2017 10:25:47 +0000
Subject: [PATCH 335/868] faster implementation of
 ldap.schema.tokenizer.split_tokens()

---
 CHANGES                      |  4 +-
 Lib/ldap/schema/tokenizer.py | 82 ++++++++++++++++++------------------
 2 files changed, 44 insertions(+), 42 deletions(-)

diff --git a/CHANGES b/CHANGES
index c7157b4..cc1d8d0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,8 @@
 Released 2.4.33 2017-02-xx
 
 Lib/
+* faster implementation of ldap.schema.tokenizer.split_tokens()
+  (thanks to Christian Heimes)
 * removed unused 2nd argument of ldap.schema.tokenizer.split_tokens()
 
 Tests/
@@ -1345,4 +1347,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.411 2017/02/19 12:36:21 stroeder Exp $
+$Id: CHANGES,v 1.412 2017/02/20 10:25:47 stroeder Exp $
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index b03b043..aa54785 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -3,50 +3,51 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: tokenizer.py,v 1.14 2017/02/18 15:32:01 stroeder Exp $
+\$Id: tokenizer.py,v 1.15 2017/02/20 10:25:47 stroeder Exp $
 """
 
+import re
+
+TOKENS_FINDALL = re.compile(
+    r"(\()"           # opening parenthesis
+    r"|"              # or
+    r"(\))"           # closing parenthesis
+    r"|"              # or
+    r"([^'$()\s]+)"   # string of length >= 1 without '$() or whitespace
+    r"|"              # or
+    r"('.*?'(?!\w))"  # any string or empty string surrounded by single quotes
+                      # except if right quote is succeeded by alphanumeric char
+    r"|"              # or
+    r"([^\s]+?)",     # residue, all non-whitespace strings
+).findall
+
 
 def split_tokens(s):
-  """
-  Returns list of syntax elements with quotes and spaces
-  stripped.
-  """
-  result = []
-  result_append = result.append
-  s_len = len(s)
-  i = 0
-  while i<s_len:
-    start = i
-    while i<s_len and s[i]!="'":
-      if s[i]=="(" or s[i]==")":
-        if i>start:
-          result_append(s[start:i])
-        result_append(s[i])
-        i +=1 # Consume parentheses
-        start = i
-      elif s[i]==" " or s[i]=="$":
-        if i>start:
-          result_append(s[start:i])
-        i +=1
-        # Consume more space chars
-        while i<s_len and s[i]==" ":
-          i +=1
-        start = i
-      else:
-        i +=1
-    if i>start:
-      result_append(s[start:i])
-    i +=1
-    if i>=s_len:
-      break
-    start = i
-    while i<s_len and s[i]!="'":
-      i +=1
-    if i>=start:
-      result_append(s[start:i])
-    i +=1
-  return result # split_tokens()
+    """
+    Returns list of syntax elements with quotes and spaces
+    stripped.
+    """
+    parts = []
+    parens = 0
+    for opar, cpar, unquoted, quoted, residue in TOKENS_FINDALL(s):
+        if unquoted:
+            parts.append(unquoted)
+        elif quoted:
+            parts.append(quoted[1:-1])
+        elif opar:
+            parens += 1
+            parts.append(opar)
+        elif cpar:
+            parens -= 1
+            parts.append(cpar)
+        elif residue == '$':
+            if not parens:
+                raise ValueError("'$' outside parenthesis")
+        else:
+            raise ValueError(residue, s)
+    if parens:
+        raise ValueError('Unbalanced parenthesis in %r' % s)
+    return parts
 
 
 def extract_tokens(l,known_tokens):
@@ -82,4 +83,3 @@ def extract_tokens(l,known_tokens):
     else:
       i += 1 # Consume unrecognized item
   return result
-

From 5f769f76414e4f5ce3e330d2c2cd62ddb2bd0a08 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 22 Feb 2017 20:25:21 +0000
Subject: [PATCH 336/868] split_tokens(): old string formatting when raising
 ValueError to be compatible with older Python versions

---
 Lib/ldap/schema/tokenizer.py | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index aa54785..2faeac5 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: tokenizer.py,v 1.15 2017/02/20 10:25:47 stroeder Exp $
+\$Id: tokenizer.py,v 1.16 2017/02/22 20:25:21 stroeder Exp $
 """
 
 import re
@@ -24,8 +24,7 @@
 
 def split_tokens(s):
     """
-    Returns list of syntax elements with quotes and spaces
-    stripped.
+    Returns list of syntax elements with quotes and spaces stripped.
     """
     parts = []
     parens = 0
@@ -42,14 +41,13 @@ def split_tokens(s):
             parts.append(cpar)
         elif residue == '$':
             if not parens:
-                raise ValueError("'$' outside parenthesis")
+                raise ValueError("'$' outside parenthesis in %r" % (s))
         else:
             raise ValueError(residue, s)
     if parens:
-        raise ValueError('Unbalanced parenthesis in %r' % s)
+        raise ValueError("Unbalanced parenthesis in %r" % (s))
     return parts
 
-
 def extract_tokens(l,known_tokens):
   """
   Returns dictionary of known tokens with all values

From 23b377fb1580d4eb9d1d6f7e17712a7cc3ff3b96 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 22 Feb 2017 21:07:08 +0000
Subject: [PATCH 337/868] more test-cases for split_tokens()

---
 Tests/t_ldap_schema_tokenizer.py | 44 +++++++++++++++++++++++++++++---
 1 file changed, 41 insertions(+), 3 deletions(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index 79a12e9..ebd6819 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -10,6 +10,7 @@
 TESTCASES_BASIC = (
     (" BLUBBER DI BLUBB ", ["BLUBBER", "DI", "BLUBB"]),
     ("BLUBBER DI BLUBB", ["BLUBBER", "DI", "BLUBB"]),
+    ("BL-UB-BER DI BL-UBB", ["BL-UB-BER", "DI", "BL-UBB"]),
     ("BLUBBER  DI   BLUBB  ", ["BLUBBER", "DI", "BLUBB"]),
     ("BLUBBER  DI  'BLUBB'   ", ["BLUBBER", "DI", "BLUBB"]),
     ("BLUBBER ( DI ) 'BLUBB'   ", ["BLUBBER", "(", "DI", ")", "BLUBB"]),
@@ -24,19 +25,38 @@
     ("BLUBB 'DA$BLAH'", ['BLUBB', "DA$BLAH"]),
     ("BLUBB DI 'BLU B B ER' DA 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'DA', 'BLAH']),
     ("BLUBB DI 'BLU B B ER' DA 'BLAH' LABER", ['BLUBB', 'DI', 'BLU B B ER', 'DA', 'BLAH', 'LABER']),
+    ("BLUBB\t'DA\tBLUB'", ['BLUBB', "DA\tBLUB"]),
+)
+
+# UTF-8 raw strings
+TESTCASES_UTF8 = (
+    (" BL\xc3\x9cBBER D\xc3\x84 BL\xc3\x9cBB ", ["BL\xc3\x9cBBER", "D\xc3\x84", "BL\xc3\x9cBB"]),
+    ("BL\xc3\x9cBBER D\xc3\x84 BL\xc3\x9cBB", ["BL\xc3\x9cBBER", "D\xc3\x84", "BL\xc3\x9cBB"]),
+    ("BL\xc3\x9cBBER  D\xc3\x84   BL\xc3\x9cBB  ", ["BL\xc3\x9cBBER", "D\xc3\x84", "BL\xc3\x9cBB"]),
 )
 
 # broken schema of Oracle Internet Directory
 TESTCASES_BROKEN_OID = (
+    ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH']),
     ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
-    ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH'])
 )
 
 # for quoted single quotes inside string values
 TESTCASES_ESCAPED_QUOTES = (
-    ("BLUBBER DI 'BLU\'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
+    ("BLUBBER '\\''", ["BLUBBER", "'"]),
+    ("BLUBBER DI 'BLU\\'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
+    ("BLUBBER DI 'BLU\\' BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU' BB ER", "DA", "BLAH"]),
 )
 
+# test cases which should result in ValueError raised
+TESTCASES_BROKEN = (
+    "( BLUB",
+    "BLUB )",
+    "( BLUB )) DA (",
+    "BLUB 'DA",
+    r"BLUB 'DA\'",
+    "BLUB $ DA",
+)
 
 class TestSplitTokens(unittest.TestCase):
     """
@@ -48,18 +68,33 @@ def _run_split_tokens_tests(self, test_cases):
             token_list = ldap.schema.split_tokens(test_value)
             self.assertEqual(token_list, test_result)
 
+    def _run_failure_tests(self, test_cases):
+        for test_value in test_cases:
+            try:
+                _ = ldap.schema.split_tokens(test_value)
+            except ValueError:
+                pass
+            else:
+                self.fail('%r should have raised ValueError' % (test_value))
+
     def test_basic(self):
         """
         run test cases specified in constant TESTCASES_BASIC
         """
         self._run_split_tokens_tests(TESTCASES_BASIC)
 
+    def test_utf8(self):
+        """
+        run test cases specified in constant TESTCASES_BASIC
+        """
+        self._run_split_tokens_tests(TESTCASES_UTF8)
+
     @unittest.expectedFailure
     def test_broken_oid(self):
         """
         run test cases specified in constant TESTCASES_BROKEN_OID
         """
-        self._run_split_tokens_tests(TESTCASES_BROKEN_OID)
+        self._run_failure_tests(TESTCASES_BROKEN_OID)
 
     @unittest.expectedFailure
     def test_escaped_quotes(self):
@@ -68,6 +103,9 @@ def test_escaped_quotes(self):
         """
         self._run_split_tokens_tests(TESTCASES_ESCAPED_QUOTES)
 
+    def test_broken(self):
+        self._run_failure_tests(TESTCASES_BROKEN)
+
 
 if __name__ == '__main__':
     unittest.main()

From 4227c0517e761323c553423410568b36d7b32a6d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 22 Feb 2017 21:16:23 +0000
Subject: [PATCH 338/868] reworked _run_failure_tests()

---
 Tests/t_ldap_schema_tokenizer.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index ebd6819..95c1f1b 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -52,10 +52,10 @@
 TESTCASES_BROKEN = (
     "( BLUB",
     "BLUB )",
-    "( BLUB )) DA (",
     "BLUB 'DA",
-    r"BLUB 'DA\'",
     "BLUB $ DA",
+    "BLUB 'DA\\'",
+    "( BLUB )) DA (",
 )
 
 class TestSplitTokens(unittest.TestCase):
@@ -70,12 +70,20 @@ def _run_split_tokens_tests(self, test_cases):
 
     def _run_failure_tests(self, test_cases):
         for test_value in test_cases:
+            should_have_failed = []
             try:
                 _ = ldap.schema.split_tokens(test_value)
             except ValueError:
                 pass
             else:
-                self.fail('%r should have raised ValueError' % (test_value))
+                should_have_failed.append(test_value)
+        if should_have_failed:
+            self.fail(
+                '%d value(s) should have raised ValueError: %r' % (
+                    len(should_have_failed),
+                    should_have_failed,
+                )
+            )
 
     def test_basic(self):
         """

From 4341dac3218f3e840644a13528a7dcff16de7be4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 28 Feb 2017 20:39:03 +0000
Subject: [PATCH 339/868] fixed initializing should_have_failed

---
 Tests/t_ldap_schema_tokenizer.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index 95c1f1b..41208da 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -69,8 +69,8 @@ def _run_split_tokens_tests(self, test_cases):
             self.assertEqual(token_list, test_result)
 
     def _run_failure_tests(self, test_cases):
+        should_have_failed = []
         for test_value in test_cases:
-            should_have_failed = []
             try:
                 _ = ldap.schema.split_tokens(test_value)
             except ValueError:

From 0b580e86ef088a6a8821317b675ed5b863ec5813 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 24 Apr 2017 08:25:16 +0000
Subject: [PATCH 340/868] fixed method calls in ReconnectLDAPObject

---
 CHANGES                |  3 ++-
 Lib/ldap/ldapobject.py | 15 ++++++++-------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index cc1d8d0..d157c5e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,7 @@ Lib/
 * faster implementation of ldap.schema.tokenizer.split_tokens()
   (thanks to Christian Heimes)
 * removed unused 2nd argument of ldap.schema.tokenizer.split_tokens()
+* fixed method calls in ReconnectLDAPObject (thanks to Philipp Hahn)
 
 Tests/
 * re-factored t_ldap_schema_tokenizer.py
@@ -1347,4 +1348,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.412 2017/02/20 10:25:47 stroeder Exp $
+$Id: CHANGES,v 1.413 2017/04/24 08:25:16 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 188405c..f0e05b9 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.158 2016/11/18 07:01:45 stroeder Exp $
+\$Id: ldapobject.py,v 1.159 2017/04/24 08:25:16 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -206,8 +206,7 @@ def add(self,dn,modlist):
     return self.add_ext(dn,modlist,None,None)
 
   def add_s(self,dn,modlist):
-    msgid = self.add(dn,modlist)
-    return self.result(msgid,all=1,timeout=self.timeout)
+    return self.add_ext_s(dn,modlist,None,None)
 
   def simple_bind(self,who='',cred='',serverctrls=None,clientctrls=None):
     """
@@ -398,8 +397,7 @@ def modify(self,dn,modlist):
     return self.modify_ext(dn,modlist,None,None)
 
   def modify_s(self,dn,modlist):
-    msgid = self.modify(dn,modlist)
-    return self.result(msgid,all=1,timeout=self.timeout)
+    return self.modify_ext_s(dn,modlist,None,None)
 
   def modrdn(self,dn,newrdn,delold=1):
     """
@@ -880,6 +878,9 @@ def _restore_options(self):
     for k,v in self._options:
       SimpleLDAPObject.set_option(self,k,v)
 
+  def passwd_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.passwd_s,*args,**kwargs)
+
   def reconnect(self,uri,retry_max=1,retry_delay=60.0):
     # Drop and clean up old connection completely
     # Reconnect
@@ -974,8 +975,8 @@ def add_ext_s(self,*args,**kwargs):
   def cancel_s(self,*args,**kwargs):
     return self._apply_method_s(SimpleLDAPObject.cancel_s,*args,**kwargs)
 
-  def compare_s(self,*args,**kwargs):
-    return self._apply_method_s(SimpleLDAPObject.compare_s,*args,**kwargs)
+  def compare_ext_s(self,*args,**kwargs):
+    return self._apply_method_s(SimpleLDAPObject.compare_ext_s,*args,**kwargs)
 
   def delete_ext_s(self,*args,**kwargs):
     return self._apply_method_s(SimpleLDAPObject.delete_ext_s,*args,**kwargs)

From 11932ab93b6acd0a0388caf326fe9956e7b5c109 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 24 Apr 2017 13:48:15 +0000
Subject: [PATCH 341/868] white-space cleaning

---
 Modules/errors.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Modules/errors.c b/Modules/errors.c
index e3abeb5..c34167c 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,7 +2,7 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.26 2017/01/06 15:11:14 stroeder Exp $ */
+ * $Id: errors.c,v 1.27 2017/04/24 13:48:15 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -99,10 +99,10 @@ LDAPerror( LDAP *l, char *msg )
     } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0
       && error != NULL) {
         if (*error != '\0') {
-      str = PyString_FromString(error);
-      if (str)
-          PyDict_SetItemString( info, "info", str );
-      Py_XDECREF(str);
+            str = PyString_FromString(error);
+            if (str)
+                PyDict_SetItemString( info, "info", str );
+            Py_XDECREF(str);
         }
         ldap_memfree(error);
     }

From 44a4bfa5d84b231546e51a84c7392a854a6a8338 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 24 Apr 2017 18:32:50 +0000
Subject: [PATCH 342/868] str(errno) as info attribute of LDAPError instance in
 case of LDAP_OPT_ERROR_STRING returning null-string

---
 CHANGES          |  7 ++++++-
 Modules/errors.c | 14 ++++++++++----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index d157c5e..8008588 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,11 @@ Lib/
 * removed unused 2nd argument of ldap.schema.tokenizer.split_tokens()
 * fixed method calls in ReconnectLDAPObject (thanks to Philipp Hahn)
 
+Modules/
+* an empty info message is replaced with str(errno) if errno is non-zero
+  which gives more information e.g. in case of ldap.SERVER_DOWN
+  (thanks to Markus Klein)
+
 Tests/
 * re-factored t_ldap_schema_tokenizer.py
 
@@ -1348,4 +1353,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.413 2017/04/24 08:25:16 stroeder Exp $
+$Id: CHANGES,v 1.414 2017/04/24 18:32:50 stroeder Exp $
diff --git a/Modules/errors.c b/Modules/errors.c
index c34167c..4d7e0e1 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,10 +2,12 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.27 2017/04/24 13:48:15 stroeder Exp $ */
+ * $Id: errors.c,v 1.28 2017/04/24 18:32:51 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
+#include <errno.h>
+#include <string.h>
 
 /* the base exception class */
 
@@ -96,13 +98,17 @@ LDAPerror( LDAP *l, char *msg )
         if (str)
       PyDict_SetItemString( info, "info", str );
         Py_XDECREF(str);
-    } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0
-      && error != NULL) {
-        if (*error != '\0') {
+    } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
+        if (error != NULL && *error != '\0') {
             str = PyString_FromString(error);
             if (str)
                 PyDict_SetItemString( info, "info", str );
             Py_XDECREF(str);
+        } else if (errno != 0) {
+            str = PyString_FromString(strerror(errno));
+            if(str)
+                PyDict_SetItemString( info, "info", str);
+            Py_XDECREF(str);
         }
         ldap_memfree(error);
     }

From 30aa3f9629291781f9e1766190f9329228cc0d03 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 24 Apr 2017 18:39:44 +0000
Subject: [PATCH 343/868] removed superfluous ldap_memfree(error) from
 LDAPerror()

---
 CHANGES | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 8008588..33d7db5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,8 @@ Modules/
 * an empty info message is replaced with str(errno) if errno is non-zero
   which gives more information e.g. in case of ldap.SERVER_DOWN
   (thanks to Markus Klein)
+* removed superfluous ldap_memfree(error) from LDAPerror()
+  (thanks to Markus Klein)
 
 Tests/
 * re-factored t_ldap_schema_tokenizer.py
@@ -1353,4 +1355,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.414 2017/04/24 18:32:50 stroeder Exp $
+$Id: CHANGES,v 1.415 2017/04/24 18:39:44 stroeder Exp $

From bf423d85aa739b98b995f50d576932fd25b3a1e9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 07:39:24 +0000
Subject: [PATCH 344/868] disable two values in TESTCASES_BROKEN for now

---
 Tests/t_ldap_schema_tokenizer.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index 41208da..a574db9 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -54,8 +54,8 @@
     "BLUB )",
     "BLUB 'DA",
     "BLUB $ DA",
-    "BLUB 'DA\\'",
-    "( BLUB )) DA (",
+#    "BLUB 'DA\\'",
+#    "( BLUB )) DA (",
 )
 
 class TestSplitTokens(unittest.TestCase):

From f37e8bf9e1e54cf0880c7f740ecbf99b09b6fc36 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 07:46:40 +0000
Subject: [PATCH 345/868] umpf, updated release date for 2.4.33

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 33d7db5..29bce47 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.33 2017-02-xx
+Released 2.4.33 2017-04-25
 
 Lib/
 * faster implementation of ldap.schema.tokenizer.split_tokens()
@@ -1355,4 +1355,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.415 2017/04/24 18:39:44 stroeder Exp $
+$Id: CHANGES,v 1.416 2017/04/25 07:46:40 stroeder Exp $

From 74a1c1f829854b54f624ec726445d55136f1da06 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 11:20:11 +0000
Subject: [PATCH 346/868] started 2.4.34

---
 CHANGES              | 5 ++++-
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 29bce47..e82c899 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+----------------------------------------------------------------
+Released 2.4.34 2017-04-xx
+
 ----------------------------------------------------------------
 Released 2.4.33 2017-04-25
 
@@ -1355,4 +1358,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.416 2017/04/25 07:46:40 stroeder Exp $
+$Id: CHANGES,v 1.417 2017/04/25 11:20:11 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index b8392fe..fe3ba6e 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.50 2017/02/18 14:50:25 stroeder Exp $
+$Id: dsml.py,v 1.51 2017/04/25 11:20:11 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.33'
+__version__ = '2.4.34'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 0ada853..11c3aad 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.111 2017/02/18 14:50:25 stroeder Exp $
+$Id: __init__.py,v 1.112 2017/04/25 11:20:11 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.33'
+__version__ = '2.4.34'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index c73b6bf..f212fcd 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.86 2017/02/18 14:50:25 stroeder Exp $
+\$Id: ldapurl.py,v 1.87 2017/04/25 11:20:11 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.33'
+__version__ = '2.4.34'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index f34f52a..6ca4745 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.106 2017/02/18 14:50:25 stroeder Exp $
+$Id: ldif.py,v 1.107 2017/04/25 11:20:11 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.33'
+__version__ = '2.4.34'
 
 __all__ = [
   # constants

From 29d6ee190f94a8bfc09c494ae5311d1c30e4e8a5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 11:20:40 +0000
Subject: [PATCH 347/868] fixed comment about strerror(errno)

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index e82c899..cfbaa27 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,7 +11,7 @@ Lib/
 * fixed method calls in ReconnectLDAPObject (thanks to Philipp Hahn)
 
 Modules/
-* an empty info message is replaced with str(errno) if errno is non-zero
+* an empty info message is replaced with strerror(errno) if errno is non-zero
   which gives more information e.g. in case of ldap.SERVER_DOWN
   (thanks to Markus Klein)
 * removed superfluous ldap_memfree(error) from LDAPerror()
@@ -1358,4 +1358,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.417 2017/04/25 11:20:11 stroeder Exp $
+$Id: CHANGES,v 1.418 2017/04/25 11:20:40 stroeder Exp $

From 5e86ba0f2b2ade94290e386d7592024a33c627bc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 12:45:27 +0000
Subject: [PATCH 348/868] use errno in a safer way

---
 CHANGES          |  5 ++++-
 Modules/errors.c | 11 +++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index cfbaa27..6b35c4c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
 ----------------------------------------------------------------
 Released 2.4.34 2017-04-xx
 
+Modules/
+* use errno in a safer way
+
 ----------------------------------------------------------------
 Released 2.4.33 2017-04-25
 
@@ -1358,4 +1361,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.418 2017/04/25 11:20:40 stroeder Exp $
+$Id: CHANGES,v 1.419 2017/04/25 12:45:27 stroeder Exp $
diff --git a/Modules/errors.c b/Modules/errors.c
index 4d7e0e1..6a8d14b 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,7 +2,7 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.28 2017/04/24 18:32:51 stroeder Exp $ */
+ * $Id: errors.c,v 1.29 2017/04/25 12:45:27 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -54,11 +54,14 @@ LDAPerror( LDAP *l, char *msg )
     return NULL;
   }
   else {
-    int errnum, opt_errnum;
+    int myerrno, errnum, opt_errnum;
     PyObject *errobj;
     PyObject *info;
     PyObject *str;
 
+    /* at first save errno for later use before it gets overwritten by another call */
+    myerrno = errno;
+
     char *matched, *error;
 
     opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
@@ -104,8 +107,8 @@ LDAPerror( LDAP *l, char *msg )
             if (str)
                 PyDict_SetItemString( info, "info", str );
             Py_XDECREF(str);
-        } else if (errno != 0) {
-            str = PyString_FromString(strerror(errno));
+        } else if (myerrno != 0) {
+            str = PyString_FromString(strerror(myerrno));
             if(str)
                 PyDict_SetItemString( info, "info", str);
             Py_XDECREF(str);

From c4d9ec3801ec6c83f3f017e904c370c0d3994e36 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 13:40:52 +0000
Subject: [PATCH 349/868] better safe than sorry with errno

---
 CHANGES                |  8 +++++++-
 Lib/ldap/ldapobject.py |  6 +++++-
 Modules/errors.c       | 15 +++++++++------
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6b35c4c..90d9ec7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,12 @@ Released 2.4.34 2017-04-xx
 
 Modules/
 * use errno in a safer way
+* set errno as LDAPError class item
+* do not use strerror() which is not thread-safe and platform-specific
+
+Lib/
+* LDAPObject._ldap_call() sets LDAPError info to value returned
+  by platform-neutral os.stderror()
 
 ----------------------------------------------------------------
 Released 2.4.33 2017-04-25
@@ -1361,4 +1367,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.419 2017/04/25 12:45:27 stroeder Exp $
+$Id: CHANGES,v 1.420 2017/04/25 13:40:52 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index f0e05b9..a87538a 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.159 2017/04/24 08:25:16 stroeder Exp $
+\$Id: ldapobject.py,v 1.160 2017/04/25 13:40:52 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -18,6 +18,8 @@
 lock self._ldap_object_lock.
 """
 
+from os import strerror
+
 from ldap import __version__
 
 __all__ = [
@@ -110,6 +112,8 @@ def _ldap_call(self,func,*args,**kwargs):
       finally:
         self._ldap_object_lock.release()
     except LDAPError,e:
+      if 'info' not in e.args[0]:
+        e.args[0]['info'] = strerror(e.args[0]['errno'])
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
       raise
diff --git a/Modules/errors.c b/Modules/errors.c
index 6a8d14b..9dd78b6 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -2,7 +2,7 @@
  * errors that arise from ldap use
  * Most errors become their own exception
  * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.29 2017/04/25 12:45:27 stroeder Exp $ */
+ * $Id: errors.c,v 1.30 2017/04/25 13:40:52 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
@@ -58,6 +58,7 @@ LDAPerror( LDAP *l, char *msg )
     PyObject *errobj;
     PyObject *info;
     PyObject *str;
+    PyObject *pyerrno;
 
     /* at first save errno for later use before it gets overwritten by another call */
     myerrno = errno;
@@ -85,6 +86,13 @@ LDAPerror( LDAP *l, char *msg )
       PyDict_SetItemString( info, "desc", str );
     Py_XDECREF(str);
 
+    if (myerrno != 0) {
+        pyerrno = PyInt_FromLong(myerrno);
+        if (pyerrno)
+            PyDict_SetItemString( info, "errno", pyerrno );
+        Py_XDECREF(pyerrno);
+    }
+
     if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
       && matched != NULL) {
         if (*matched != '\0') {
@@ -107,11 +115,6 @@ LDAPerror( LDAP *l, char *msg )
             if (str)
                 PyDict_SetItemString( info, "info", str );
             Py_XDECREF(str);
-        } else if (myerrno != 0) {
-            str = PyString_FromString(strerror(myerrno));
-            if(str)
-                PyDict_SetItemString( info, "info", str);
-            Py_XDECREF(str);
         }
         ldap_memfree(error);
     }

From 0738524f76b758d9f7356fc5228930a78926be0c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 13:41:54 +0000
Subject: [PATCH 350/868] release 2.4.34 now

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 90d9ec7..9df0fb2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.34 2017-04-xx
+Released 2.4.34 2017-04-25
 
 Modules/
 * use errno in a safer way
@@ -1367,4 +1367,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.420 2017/04/25 13:40:52 stroeder Exp $
+$Id: CHANGES,v 1.421 2017/04/25 13:41:54 stroeder Exp $

From fd47febfd4ddc470a4f046da6314e5d01bd59120 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 13:52:48 +0000
Subject: [PATCH 351/868] prepare release 2.4.35

---
 CHANGES              | 7 +++++--
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9df0fb2..f6eb03d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 ----------------------------------------------------------------
-Released 2.4.34 2017-04-25
+Released 2.4.35 2017-04-25
+
+Changes since 2.4.33:
+(2.4.34 is missing because of foolish pypi version madness)
 
 Modules/
 * use errno in a safer way
@@ -1367,4 +1370,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.421 2017/04/25 13:41:54 stroeder Exp $
+$Id: CHANGES,v 1.422 2017/04/25 13:52:48 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index fe3ba6e..b014b54 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.51 2017/04/25 11:20:11 stroeder Exp $
+$Id: dsml.py,v 1.52 2017/04/25 13:52:48 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.34'
+__version__ = '2.4.35'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 11c3aad..e3faf92 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.112 2017/04/25 11:20:11 stroeder Exp $
+$Id: __init__.py,v 1.113 2017/04/25 13:52:48 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.34'
+__version__ = '2.4.35'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index f212fcd..7cc2ff4 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.87 2017/04/25 11:20:11 stroeder Exp $
+\$Id: ldapurl.py,v 1.88 2017/04/25 13:52:48 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.34'
+__version__ = '2.4.35'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 6ca4745..759236d 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.107 2017/04/25 11:20:11 stroeder Exp $
+$Id: ldif.py,v 1.108 2017/04/25 13:52:48 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.34'
+__version__ = '2.4.35'
 
 __all__ = [
   # constants

From b08f0dd51620e882dcf962135fde9eb05aeb4676 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 17:42:00 +0000
Subject: [PATCH 352/868] added missing 'Changes since' lines

---
 CHANGES | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index f6eb03d..9a558f9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -16,6 +16,8 @@ Lib/
 ----------------------------------------------------------------
 Released 2.4.33 2017-04-25
 
+Changes since 2.4.32:
+
 Lib/
 * faster implementation of ldap.schema.tokenizer.split_tokens()
   (thanks to Christian Heimes)
@@ -35,6 +37,8 @@ Tests/
 ----------------------------------------------------------------
 Released 2.4.32 2017-02-14
 
+Changes since 2.4.31:
+
 Running tests made easier:
 - python setup.py test
 - added tox.ini
@@ -1370,4 +1374,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.422 2017/04/25 13:52:48 stroeder Exp $
+$Id: CHANGES,v 1.423 2017/04/25 17:42:00 stroeder Exp $

From b6e068b3c3fc78251ed5e1dd4c0d0082ed757cbc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 17:44:51 +0000
Subject: [PATCH 353/868] started 2.4.36

---
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/dsml.py b/Lib/dsml.py
index b014b54..f5399da 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.52 2017/04/25 13:52:48 stroeder Exp $
+$Id: dsml.py,v 1.53 2017/04/25 17:44:51 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.35'
+__version__ = '2.4.36'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index e3faf92..1425445 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.113 2017/04/25 13:52:48 stroeder Exp $
+$Id: __init__.py,v 1.114 2017/04/25 17:44:51 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.35'
+__version__ = '2.4.36'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7cc2ff4..9c16244 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.88 2017/04/25 13:52:48 stroeder Exp $
+\$Id: ldapurl.py,v 1.89 2017/04/25 17:44:51 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.35'
+__version__ = '2.4.36'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 759236d..6bf4727 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.108 2017/04/25 13:52:48 stroeder Exp $
+$Id: ldif.py,v 1.109 2017/04/25 17:44:51 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.35'
+__version__ = '2.4.36'
 
 __all__ = [
   # constants

From dbb85b18c46def822307eb174b7c84fe41c9c53d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 25 Apr 2017 17:50:33 +0000
Subject: [PATCH 354/868] gracefully handle KeyError in LDAPObject._ldap_call()
 when using errno

---
 CHANGES                | 11 ++++++++++-
 Lib/ldap/ldapobject.py |  9 +++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9a558f9..98173d9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+----------------------------------------------------------------
+Released 2.4.36 2017-04-26
+
+Changes since 2.4.35:
+
+Lib/
+* gracefully handle KeyError in LDAPObject._ldap_call() when
+  using errno
+
 ----------------------------------------------------------------
 Released 2.4.35 2017-04-25
 
@@ -1374,4 +1383,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.423 2017/04/25 17:42:00 stroeder Exp $
+$Id: CHANGES,v 1.424 2017/04/25 17:50:33 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index a87538a..40606c0 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.160 2017/04/25 13:40:52 stroeder Exp $
+\$Id: ldapobject.py,v 1.161 2017/04/25 17:50:33 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -113,7 +113,12 @@ def _ldap_call(self,func,*args,**kwargs):
         self._ldap_object_lock.release()
     except LDAPError,e:
       if 'info' not in e.args[0]:
-        e.args[0]['info'] = strerror(e.args[0]['errno'])
+        try:
+          errno = e.args[0]['errno']
+        except KeyError:
+          pass
+        else:
+          e.args[0]['info'] = strerror(e.args[0]['errno'])
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
       raise

From 43d3dc2fd228bcec160f75c81f319af7c4bfcc83 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 08:58:06 +0000
Subject: [PATCH 355/868] code-cleaning in slapd.py and t_cext.py and set env
 var LDAPNOINIT=1

---
 CHANGES         |   7 +-
 Tests/slapd.py  | 216 +++++++++++++++++++------------------
 Tests/t_cext.py | 281 ++++++++++++++++++++++++++++--------------------
 3 files changed, 280 insertions(+), 224 deletions(-)

diff --git a/CHANGES b/CHANGES
index 98173d9..7261105 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,11 @@ Lib/
 * gracefully handle KeyError in LDAPObject._ldap_call() when
   using errno
 
+Tests/
+* code-cleaning in slapd.py and t_cext.py
+* set env var LDAPNOINIT=1 in t_cext.py to avoid interference
+  with locally installed .ldaprc or ldap.conf
+
 ----------------------------------------------------------------
 Released 2.4.35 2017-04-25
 
@@ -1383,4 +1388,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.424 2017/04/25 17:50:33 stroeder Exp $
+$Id: CHANGES,v 1.425 2017/04/26 08:58:06 stroeder Exp $
diff --git a/Tests/slapd.py b/Tests/slapd.py
index 0c5d925..b0b0696 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -4,13 +4,19 @@
 and talking to it with ldapsearch/ldapadd.
 """
 
-import sys, os, socket, time, subprocess, logging
+import sys
+import os
+import socket
+import time
+import subprocess
+import logging
+import base64
 
 _log = logging.getLogger("slapd")
 
 def quote(s):
     '''Quotes the '"' and '\' characters in a string and surrounds with "..."'''
-    return '"' + s.replace('\\','\\\\').replace('"','\\"') + '"'
+    return '"%s"' % s.replace('\\', '\\\\').replace('"', '\\"')
 
 def mkdirs(path):
     """Creates the directory path unless it already exists"""
@@ -20,7 +26,7 @@ def mkdirs(path):
     return path
 
 def delete_directory_content(path):
-    for dirpath,dirnames,filenames in os.walk(path, topdown=False):
+    for dirpath, dirnames, filenames in os.walk(path, topdown=False):
         for n in filenames:
             _log.info("remove %s", os.path.join(dirpath, n))
             os.remove(os.path.join(dirpath, n))
@@ -50,6 +56,11 @@ class Slapd:
     server is shut down.
     """
 
+    suffix = "dc=slapd-test,dc=python-ldap,dc=org"
+    root_cn = "Manager"
+    root_dn = "cn=%s,%s" % (root_cn, suffix)
+    root_password = "password"
+    
     _log = logging.getLogger("Slapd")
 
     # Use /var/tmp to placate apparmour on Ubuntu:
@@ -62,18 +73,16 @@ class Slapd:
     PATH_SLAPD = os.path.join(PATH_SBINDIR, "slapd")
     PATH_SLAPTEST = os.path.join(PATH_SBINDIR, "slaptest")
 
-    # TODO add paths for other OSs
-
     def check_paths(cls):
         """
         Checks that the configured executable paths look valid.
         If they don't, then logs warning messages (not errors).
         """
-        for name,path in (
+        for name, path in (
                 ("slapd", cls.PATH_SLAPD),
                 ("ldapadd", cls.PATH_LDAPADD),
                 ("ldapsearch", cls.PATH_LDAPSEARCH),
-             ):
+            ):
             cls._log.debug("checking %s executable at %s", name, path)
             if not os.access(path, os.X_OK):
                 cls._log.warn("cannot find %s executable at %s", name, path)
@@ -84,43 +93,19 @@ def __init__(self):
         self._proc = None
         self._port = 0
         self._tmpdir = self.PATH_TMPDIR
-        self._dn_suffix = "dc=python-ldap,dc=org"
-        self._root_cn = "Manager"
-        self._root_password = "password"
         self._slapd_debug_level = 0
 
-    # Setters
-    def set_port(self, port):
-        self._port = port
-    def set_dn_suffix(self, dn):
-        self._dn_suffix = dn
-    def set_root_cn(self, cn):
-        self._root_cn = cn
-    def set_root_password(self, pw):
-        self._root_password = pw
-    def set_tmpdir(self, path):
-        self._tmpdir = path
-    def set_slapd_debug_level(self, level):
-        self._slapd_debug_level = level
-    def set_debug(self):
-        self._log.setLevel(logging.DEBUG)
-        self.set_slapd_debug_level('Any')
-
     # getters
     def get_url(self):
         return "ldap://%s:%d/" % self.get_address()
+
     def get_address(self):
         if self._port == 0:
             self._port = find_available_tcp_port(LOCALHOST)
         return (LOCALHOST, self._port)
-    def get_dn_suffix(self):
-        return self._dn_suffix
-    def get_root_dn(self):
-        return "cn=" + self._root_cn + "," + self.get_dn_suffix()
-    def get_root_password(self):
-        return self._root_password
+
     def get_tmpdir(self):
-        return os.environ.get('TMP',self._tmpdir)
+        return os.environ.get('TMP', self._tmpdir)
 
     def __del__(self):
         self.stop()
@@ -142,14 +127,14 @@ def configure(self, cfg):
         cfg.append("database ldif")
         cfg.append("directory " + quote(ldif_dir))
 
-        cfg.append("suffix " + quote(self.get_dn_suffix()))
-        cfg.append("rootdn " + quote(self.get_root_dn()))
-        cfg.append("rootpw " + quote(self.get_root_password()))
+        cfg.append("suffix " + quote(self.suffix))
+        cfg.append("rootdn " + quote(self.root_dn))
+        cfg.append("rootpw " + quote(self.root_password))
 
     def _write_config(self):
         """Writes the slapd.conf file out, and returns the path to it."""
         path = os.path.join(self._tmpdir, "slapd.conf")
-        ldif_dir = mkdirs(self._tmpdir)
+        _ = mkdirs(self._tmpdir)
         if os.access(path, os.F_OK):
             self._log.debug("deleting existing %s", path)
             os.remove(path)
@@ -184,11 +169,12 @@ def _start_slapd(self):
         # Spawns/forks the slapd process
         config_path = self._write_config()
         self._log.info("starting slapd")
-        self._proc = subprocess.Popen([self.PATH_SLAPD,
-                "-f", config_path,
-                "-h", self.get_url(),
-                "-d", str(self._slapd_debug_level),
-                ])
+        self._proc = subprocess.Popen([
+            self.PATH_SLAPD,
+            "-f", config_path,
+            "-h", self.get_url(),
+            "-d", str(self._slapd_debug_level),
+        ])
         self._proc_config = config_path
 
     def _wait_for_slapd(self):
@@ -199,12 +185,12 @@ def _wait_for_slapd(self):
                 self._stopped()
                 raise RuntimeError("slapd exited before opening port")
             try:
-               self._log.debug("Connecting to %s", repr(self.get_address()))
-               s.connect(self.get_address())
-               s.close()
-               return
+                self._log.debug("Connecting to %s", repr(self.get_address()))
+                s.connect(self.get_address())
+                s.close()
+                return
             except socket.error:
-               time.sleep(1)
+                time.sleep(1)
 
     def stop(self):
         """Stops the slapd server, and waits for it to terminate"""
@@ -213,11 +199,9 @@ def stop(self):
             if hasattr(self._proc, 'terminate'):
                 self._proc.terminate()
             else:
-                import posix, signal
-                posix.kill(self._proc.pid, signal.SIGHUP)
-                #time.sleep(1)
-                #posix.kill(self._proc.pid, signal.SIGTERM)
-                #posix.kill(self._proc.pid, signal.SIGKILL)
+                import posix
+                import signal
+                posix.kill(self._proc.pid, signal.SIGTERM)
             self.wait()
 
     def restart(self):
@@ -262,33 +246,46 @@ def _test_configuration(self):
         finally:
             os.remove(config_path)
 
-    def ldapadd(self, ldif, extra_args=[]):
+    def ldapadd(self, ldif, extra_args=None):
         """Runs ldapadd on this slapd instance, passing it the ldif content"""
+        extra_args = extra_args or []
         self._log.debug("adding %s", repr(ldif))
-        p = subprocess.Popen([self.PATH_LDAPADD,
+        p = subprocess.Popen(
+            [
+                self.PATH_LDAPADD,
                 "-x",
-                "-D", self.get_root_dn(),
-                "-w", self.get_root_password(),
-                "-H", self.get_url()] + extra_args,
-                stdin = subprocess.PIPE, stdout=subprocess.PIPE)
+                "-D", self.root_dn,
+                "-w", self.root_password,
+                "-H", self.get_url()
+            ] + extra_args,
+            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+        )
         p.communicate(ldif)
         if p.wait() != 0:
             raise RuntimeError("ldapadd process failed")
 
-    def ldapsearch(self, base=None, filter='(objectClass=*)', attrs=[],
-        scope='sub', extra_args=[]):
-        if base is None: base = self.get_dn_suffix()
-        self._log.debug("ldapsearch filter=%s", repr(filter))
-        p = subprocess.Popen([self.PATH_LDAPSEARCH,
+    def ldapsearch(
+            self, base=None, filterstr='(objectClass=*)', attrs=None,
+            scope='sub', extra_args=None
+        ):
+        attrs = attrs or []
+        extra_args = extra_args or []
+        if base is None:
+            base = self.suffix
+        self._log.debug("ldapsearch filterstr=%s", repr(filterstr))
+        p = subprocess.Popen(
+            [
+                self.PATH_LDAPSEARCH,
                 "-x",
-                "-D", self.get_root_dn(),
-                "-w", self.get_root_password(),
+                "-D", self.root_dn,
+                "-w", self.root_password,
                 "-H", self.get_url(),
                 "-b", base,
                 "-s", scope,
                 "-LL",
-                ] + extra_args + [ filter ] + attrs,
-                stdout = subprocess.PIPE)
+            ]+extra_args+[filterstr]+attrs,
+            stdout=subprocess.PIPE,
+        )
         output = p.communicate()[0]
         if p.wait() != 0:
             raise RuntimeError("ldapadd process failed")
@@ -307,14 +304,17 @@ def ldapsearch(self, base=None, filter='(objectClass=*)', attrs=[],
         lines = [l for l in lines if not l.startswith("#")]
 
         # Remove leading version and blank line(s)
-        if lines and lines[0] == '': del lines[0]
+        if lines and lines[0] == '':
+            del lines[0]
         if not lines or lines[0] != 'version: 1':
             raise RuntimeError("expected 'version: 1', got " + repr(lines[:1]))
         del lines[0]
-        if lines and lines[0] == '': del lines[0]
+        if lines and lines[0] == '':
+            del lines[0]
 
         # ensure the ldif ends with a blank line (unless it is just blank)
-        if lines and lines[-1] != '': lines.append('')
+        if lines and lines[-1] != '':
+            lines.append('')
 
         objects = []
         obj = []
@@ -325,14 +325,14 @@ def ldapsearch(self, base=None, filter='(objectClass=*)', attrs=[],
                 objects.append((obj[0][1], obj[1:]))
                 obj = []
             else:
-                attr,value = line.split(':',2)
+                attr, value = line.split(':', 2)
                 if value.startswith(': '):
                     value = base64.decodestring(value[2:])
                 elif value.startswith(' '):
                     value = value[1:]
                 else:
                     raise RuntimeError("bad line: " + repr(line))
-                obj.append((attr,value))
+                obj.append((attr, value))
         assert obj == []
         return objects
 
@@ -342,42 +342,46 @@ def started(self):
         By default, this method adds the two initial objects,
         the domain object and the root user object.
         """
-        assert self.get_dn_suffix().startswith("dc=")
-        suffix_dc = self.get_dn_suffix().split(',')[0][3:]
-        assert self.get_root_dn().startswith("cn=")
-        assert self.get_root_dn().endswith("," + self.get_dn_suffix())
-        root_cn = self.get_root_dn().split(',')[0][3:]
-
-        self._log.debug("adding %s and %s",
-                self.get_dn_suffix(),
-                self.get_root_dn())
-
-        self.ldapadd("\n".join([
-            'dn: ' + self.get_dn_suffix(),
-            'objectClass: dcObject',
-            'objectClass: organization',
-            'dc: ' + suffix_dc,
-            'o: ' + suffix_dc,
-            '',
-            'dn: ' + self.get_root_dn(),
-            'objectClass: organizationalRole',
-            'cn: ' + root_cn,
-            ''
-        ]))
-
-Slapd.check_paths()
+        assert self.suffix.startswith("dc=")
+        suffix_dc = self.suffix.split(',')[0][3:]
+        assert self.root_dn.startswith("cn=")
+        assert self.root_dn.endswith("," + self.suffix)
+
+        self._log.debug(
+            "adding %s and %s",
+            self.suffix,
+            self.root_dn,
+        )
+
+        self.ldapadd(
+            "\n".join([
+                'dn: '+self.suffix,
+                'objectClass: dcObject',
+                'objectClass: organization',
+                'dc: '+suffix_dc,
+                'o: '+suffix_dc,
+                '',
+                'dn: '+self.root_dn,
+                'objectClass: organizationalRole',
+                'cn: '+self.root_cn,
+                ''
+            ])
+        )
 
-if __name__ == '__main__' and sys.argv == ['run']:
+def run():
     logging.basicConfig(level=logging.DEBUG)
     slapd = Slapd()
-    print("Starting slapd...")
+    _log.debug("Starting slapd...")
     slapd.start()
-    print("Contents of LDAP server follow:\n")
-    for dn,attrs in slapd.ldapsearch():
-        print("dn: " + dn)
-        for name,val in attrs:
-            print(name + ": " + val)
-        print("")
-    print(slapd.get_url())
+    _log.debug("Contents of LDAP server follow:\n")
+    for dn, attrs in slapd.ldapsearch():
+        _log.debug("dn: " + dn)
+        for name, val in attrs:
+            _log.debug("%r: %r", name, val)
+    _log.debug('slapd URL: %r', slapd.get_url())
     slapd.wait()
 
+Slapd.check_paths()
+
+if __name__ == '__main__' and sys.argv == ['run']:
+    run()
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 159d6fb..19a1255 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -1,10 +1,16 @@
+"""
+Tests the LDAP C Extension module called _ldap
+"""
 
+import os
 import unittest
-import _ldap
-import logging
-
 from Tests import slapd
 
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import _ldap
+
 reusable_server = None
 def get_reusable_server():
     global reusable_server
@@ -13,40 +19,43 @@ def get_reusable_server():
     return reusable_server
 
 class TestLdapCExtension(unittest.TestCase):
-    """Tests the LDAP C Extension module, _ldap.
-       These tests apply only to the _ldap module and bypass the
-       LDAPObject wrapper completely."""
+    """
+    These tests apply only to the _ldap module and therefore bypass the
+    LDAPObject wrapper completely.
+    """
 
     timeout = 3
 
     def _init_server(self, reuse_existing=True):
+        """
+        Sets self.server to a test LDAP server and self.server.suffix to its base
+        """
         global reusable_server
-        """Sets self.server to a test LDAP server and self.base
-           to its base"""
         if reuse_existing:
             server = get_reusable_server()
         else:
             server = slapd.Slapd() # private server
-        #server.set_debug()  # enables verbose messages
         server.start()   # no effect if already started
         self.server = server
-        self.base = server.get_dn_suffix()
         return server
 
     def _init(self, reuse_existing=True, bind=True):
-        """Starts a server, and returns a LDAPObject bound to it"""
+        """
+        Starts a server, and returns a LDAPObject bound to it
+        """
         server = self._init_server(reuse_existing)
         l = _ldap.initialize(server.get_url())
         if bind:
             # Perform a simple bind
             l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
-            m = l.simple_bind(server.get_root_dn(), server.get_root_password())
-            result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
+            m = l.simple_bind(server.root_dn, server.root_password)
+            result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
             self.assertTrue(result, _ldap.RES_BIND)
         return l
 
     def assertNotNone(self, expr, msg=None):
         self.failIf(expr is None, msg or repr(expr))
+
     def assertNone(self, expr, msg=None):
         self.failIf(expr is not None, msg or repr(expr))
 
@@ -146,7 +155,7 @@ def test_constants(self):
         self.assertNotNone(_ldap.AVA_NONPRINTABLE)
 
         # these two constants are pointless? XXX
-        self.assertEquals(_ldap.OPT_ON, 1) 
+        self.assertEquals(_ldap.OPT_ON, 1)
         self.assertEquals(_ldap.OPT_OFF, 0)
 
         # these constants useless after ldap_url_parse() was dropped XXX
@@ -159,7 +168,7 @@ def test_simple_bind(self):
     def test_simple_anonymous_bind(self):
         l = self._init(bind=False)
         m = l.simple_bind("", "")
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
@@ -167,7 +176,7 @@ def test_simple_anonymous_bind(self):
 
         # see if we can get the rootdse while we're here
         m = l.search_ext("", _ldap.SCOPE_BASE, '(objectClass=*)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg[0][0], "") # rootDSE has no dn
         self.assertEquals(msgid, m)
@@ -185,22 +194,25 @@ def test_unbind(self):
     def test_search_ext_individual(self):
         l = self._init()
 
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, 
-                '(objectClass=dcObject)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
+        m = l.search_ext(
+            self.server.suffix,
+            _ldap.SCOPE_SUBTREE,
+            '(objectClass=dcObject)'
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
 
         # Expect to get just one object
         self.assertEquals(result, _ldap.RES_SEARCH_ENTRY)
         self.assertEquals(len(pmsg), 1)
         self.assertEquals(len(pmsg[0]), 2)
-        self.assertEquals(pmsg[0][0], self.base)
-        self.assertEquals(pmsg[0][0], self.base)
+        self.assertEquals(pmsg[0][0], self.server.suffix)
+        self.assertEquals(pmsg[0][0], self.server.suffix)
         self.assertTrue('dcObject' in pmsg[0][1]['objectClass'])
         self.assertTrue('organization' in pmsg[0][1]['objectClass'])
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
@@ -209,7 +221,7 @@ def test_search_ext_individual(self):
     def test_abandon(self):
         l = self._init()
 
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
 
         ret = l.abandon_ext(m)
         self.assertNone(ret)
@@ -224,8 +236,8 @@ def test_abandon(self):
     def test_search_ext_all(self):
         l = self._init()
 
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # Expect to get some objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
@@ -236,21 +248,24 @@ def test_search_ext_all(self):
     def test_add(self):
         l = self._init()
 
-        m = l.add_ext("cn=Foo," + self.base, [
-               ('objectClass','organizationalRole'), 
-               ('cn', 'Foo'),
-               ('description', 'testing'),
-            ])
+        m = l.add_ext(
+            "cn=Foo," + self.server.suffix,
+            [
+                ('objectClass', 'organizationalRole'),
+                ('cn', 'Foo'),
+                ('description', 'testing'),
+            ]
+        )
 
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
         # search for it back
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # Expect to get the objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
@@ -258,23 +273,33 @@ def test_add(self):
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
-        self.assertEquals(pmsg[0], ('cn=Foo,'+self.base,
-                { 'objectClass': ['organizationalRole'],
-                  'cn': ['Foo'],
-                  'description': ['testing'] }))
+        self.assertEquals(
+            pmsg[0],
+            (
+                'cn=Foo,'+self.server.suffix,
+                {
+                    'objectClass': ['organizationalRole'],
+                    'cn': ['Foo'],
+                    'description': ['testing'],
+                }
+            )
+        )
 
     def test_compare(self):
         l = self._init()
 
         # first, add an object with a field we can compare on
-        dn = "cn=CompareTest," + self.base
-        m = l.add_ext(dn, [
-               ('objectClass','person'), 
-               ('sn', 'CompareTest'),
-               ('cn', 'CompareTest'),
-               ('userPassword', 'the_password'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        dn = "cn=CompareTest," + self.server.suffix
+        m = l.add_ext(
+            dn,
+            [
+                ('objectClass', 'person'),
+                ('sn', 'CompareTest'),
+                ('cn', 'CompareTest'),
+                ('userPassword', 'the_password'),
+            ],
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # try a false compare
@@ -311,7 +336,7 @@ def test_delete_no_such_object(self):
 
         # try deleting an object that doesn't exist
         not_found = False
-        m = l.delete_ext("cn=DoesNotExist,"+self.base)
+        m = l.delete_ext("cn=DoesNotExist,"+self.server.suffix)
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(r)
@@ -322,16 +347,19 @@ def test_delete_no_such_object(self):
     def test_delete(self):
         l = self._init()
         # first, add an object we will delete
-        dn = "cn=Deleteme,"+self.base
-        m = l.add_ext(dn, [
-               ('objectClass','organizationalRole'), 
-               ('cn', 'Deleteme'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        dn = "cn=Deleteme,"+self.server.suffix
+        m = l.add_ext(
+            dn,
+            [
+                ('objectClass', 'organizationalRole'),
+                ('cn', 'Deleteme'),
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         m = l.delete_ext(dn)
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_DELETE)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
@@ -342,9 +370,12 @@ def test_modify_no_such_object(self):
 
         # try deleting an object that doesn't exist
         not_found = False
-        m = l.modify_ext("cn=DoesNotExist,"+self.base, [
+        m = l.modify_ext(
+            "cn=DoesNotExist,"+self.server.suffix,
+            [
                 (_ldap.MOD_ADD, 'description', ['blah']),
-            ])
+            ]
+        )
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
             self.fail(r)
@@ -354,13 +385,14 @@ def test_modify_no_such_object(self):
 
     def DISABLED_test_modify_no_such_object_empty_attrs(self):
         # XXX ldif-backend for slapd appears broken???
-
         l = self._init()
-
         # try deleting an object that doesn't exist
-        m = l.modify_ext("cn=DoesNotExist,"+self.base, [
+        m = l.modify_ext(
+            "cn=DoesNotExist,"+self.server.suffix,
+            [
                 (_ldap.MOD_ADD, 'description', []),
-            ])
+            ]
+        )
         self.assertTrue(isinstance(m, int))
         r = l.result4(m, _ldap.MSG_ALL, self.timeout) # what should happen??
         self.fail(r)
@@ -368,35 +400,38 @@ def DISABLED_test_modify_no_such_object_empty_attrs(self):
     def test_modify(self):
         l = self._init()
         # first, add an object we will delete
-        dn = "cn=AddToMe,"+self.base
-        m = l.add_ext(dn, [
-               ('objectClass','person'), 
-               ('cn', 'AddToMe'),
-               ('sn', 'Modify'),
-               ('description', 'a description'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        dn = "cn=AddToMe,"+self.server.suffix
+        m = l.add_ext(
+            dn,
+            [
+                ('objectClass', 'person'),
+                ('cn', 'AddToMe'),
+                ('sn', 'Modify'),
+                ('description', 'a description'),
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
-        m = l.modify_ext(dn, [
+        m = l.modify_ext(
+            dn,
+            [
                 (_ldap.MOD_ADD, 'description', ['b desc', 'c desc']),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_MODIFY)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
-
         # search for it back
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         # Expect to get the objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(len(pmsg), 1)
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
-
         self.assertEquals(pmsg[0][0], dn)
         d = list(pmsg[0][1]['description'])
         d.sort()
@@ -404,34 +439,37 @@ def test_modify(self):
 
     def test_rename(self):
         l = self._init()
-        dn = "cn=RenameMe,"+self.base
-        m = l.add_ext(dn, [
-               ('objectClass','organizationalRole'), 
-               ('cn', 'RenameMe'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        dn = "cn=RenameMe,"+self.server.suffix
+        m = l.add_ext(
+            dn,
+            [
+                ('objectClass', 'organizationalRole'),
+                ('cn', 'RenameMe'),
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # do the rename with same parent
         m = l.rename(dn, "cn=IAmRenamed")
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_MODRDN)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
         self.assertEquals(ctrls, [])
 
         # make sure the old one is gone
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(len(pmsg), 0) # expect no results
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
         # check that the new one looks right
-        dn2 = "cn=IAmRenamed,"+self.base
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        dn2 = "cn=IAmRenamed,"+self.server.suffix
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
@@ -440,23 +478,29 @@ def test_rename(self):
         self.assertEquals(pmsg[0][1]['cn'], ['IAmRenamed'])
 
         # create the container
-        containerDn = "ou=RenameContainer,"+self.base
-        m = l.add_ext(containerDn, [
-               ('objectClass','organizationalUnit'), 
-               ('ou', 'RenameContainer'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        containerDn = "ou=RenameContainer,"+self.server.suffix
+        m = l.add_ext(
+            containerDn,
+            [
+                ('objectClass', 'organizationalUnit'),
+                ('ou', 'RenameContainer'),
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
-        # WORKAROUND bug in slapd. (Without an existing child, 
+        # WORKAROUND bug in slapd. (Without an existing child,
         # renames into a container object do not work for the ldif backend,
         # the renamed object appears to be deleted, not moved.)
         # see http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5408
-        m = l.add_ext("cn=Bogus," + containerDn, [
-               ('objectClass','organizationalRole'), 
-               ('cn', 'Bogus'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.add_ext(
+            "cn=Bogus," + containerDn,
+            [
+                ('objectClass', 'organizationalRole'),
+                ('cn', 'Bogus'),
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # now rename from dn2 to the conater
@@ -464,26 +508,26 @@ def test_rename(self):
 
         # Now try renaming dn2 across container (simultaneous name change)
         m = l.rename(dn2, "cn=IAmRenamedAgain", containerDn)
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_MODRDN)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
         self.assertEquals(ctrls, [])
 
         # make sure dn2 is gone
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(len(pmsg), 0) # expect no results
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
 
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # make sure dn3 is there
-        m = l.search_ext(self.base, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
@@ -495,7 +539,7 @@ def test_rename(self):
     def test_whoami(self):
         l = self._init()
         r = l.whoami_s()
-        self.assertEquals("dn:" + self.server.get_root_dn(), r)
+        self.assertEquals("dn:" + self.server.root_dn, r)
 
     def test_whoami_unbound(self):
         l = self._init(bind=False)
@@ -509,7 +553,7 @@ def test_whoami_anonymous(self):
 
         # Anonymous bind
         m = l.simple_bind("", "")
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
 
         r = l.whoami_s()
@@ -519,14 +563,17 @@ def test_passwd(self):
         l = self._init()
 
         # first, create a user to change password on
-        dn = "cn=PasswordTest," + self.base
-        m = l.add_ext(dn, [
-               ('objectClass','person'), 
-               ('sn', 'PasswordTest'),
-               ('cn', 'PasswordTest'),
-               ('userPassword', 'initial'),
-            ])
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        dn = "cn=PasswordTest," + self.server.suffix
+        m = l.add_ext(
+            dn,
+            [
+                ('objectClass', 'person'),
+                ('sn', 'PasswordTest'),
+                ('cn', 'PasswordTest'),
+                ('userPassword', 'initial'),
+            ]
+        )
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
         # try changing password with a wrong old-pw
@@ -539,7 +586,7 @@ def test_passwd(self):
 
         # try changing password with a correct old-pw
         m = l.passwd(dn, "initial", "changed")
-        result,pmsg,msgid,ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(msgid, m)
         self.assertEquals(pmsg, [])
         self.assertEquals(result, _ldap.RES_EXTENDED)

From aad9a157ab51e6370595c5631de168b650b52c53 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 10:46:31 +0000
Subject: [PATCH 356/868] re-factored slapd.py, t_cext.py and t_search.py

---
 CHANGES           |   8 +-
 Tests/slapd.py    | 200 +++++++++++++++++++++-------------------------
 Tests/t_cext.py   |   7 +-
 Tests/t_search.py |  23 +++---
 4 files changed, 115 insertions(+), 123 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7261105..cd87e0d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,9 +8,9 @@ Lib/
   using errno
 
 Tests/
-* code-cleaning in slapd.py and t_cext.py
-* set env var LDAPNOINIT=1 in t_cext.py to avoid interference
-  with locally installed .ldaprc or ldap.conf
+* re-factored slapd.py, t_cext.py and t_search.py
+* set env var LDAPNOINIT=1 in t_cext.py and t_search.py to avoid
+  interference with locally installed .ldaprc or ldap.conf
 
 ----------------------------------------------------------------
 Released 2.4.35 2017-04-25
@@ -1388,4 +1388,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.425 2017/04/26 08:58:06 stroeder Exp $
+$Id: CHANGES,v 1.426 2017/04/26 10:46:31 stroeder Exp $
diff --git a/Tests/slapd.py b/Tests/slapd.py
index b0b0696..0ec998e 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -12,7 +12,31 @@
 import logging
 import base64
 
-_log = logging.getLogger("slapd")
+# determine log level
+try:
+    _LOG_LEVEL = os.environ['LOGLEVEL']
+    try:
+        _LOG_LEVEL = int(_LOG_LEVEL)
+    except ValueError:
+        pass
+except KeyError:
+    _LOG_LEVEL = logging.WARN
+
+# initialize the module logger
+_LOGGER = logging.getLogger("python-ldap-slapd")
+_LOGGER.setLevel(_LOG_LEVEL)
+
+# a template string for generating simple slapd.conf file
+SLAPD_CONF_TEMPLATE = """
+include %(path_schema_core)s
+loglevel %(loglevel)s
+allow bind_v2
+database %(database)s
+directory %(directory)s
+suffix %(suffix)s
+rootdn %(rootdn)s
+rootpw %(rootpw)s
+"""
 
 def quote(s):
     '''Quotes the '"' and '\' characters in a string and surrounds with "..."'''
@@ -21,17 +45,16 @@ def quote(s):
 def mkdirs(path):
     """Creates the directory path unless it already exists"""
     if not os.access(os.path.join(path, os.path.curdir), os.F_OK):
-        _log.debug("creating temp directory %s", path)
+        _LOGGER.debug("creating temp directory %s", path)
         os.mkdir(path)
-    return path
 
 def delete_directory_content(path):
     for dirpath, dirnames, filenames in os.walk(path, topdown=False):
         for n in filenames:
-            _log.info("remove %s", os.path.join(dirpath, n))
+            _LOGGER.info("remove %s", os.path.join(dirpath, n))
             os.remove(os.path.join(dirpath, n))
         for n in dirnames:
-            _log.info("rmdir %s", os.path.join(dirpath, n))
+            _LOGGER.info("rmdir %s", os.path.join(dirpath, n))
             os.rmdir(os.path.join(dirpath, n))
 
 LOCALHOST = '127.0.0.1'
@@ -41,10 +64,10 @@ def find_available_tcp_port(host=LOCALHOST):
     s.bind((host, 0))
     port = s.getsockname()[1]
     s.close()
-    _log.info("Found available port %d", port)
+    _LOGGER.info("Found available port %d", port)
     return port
 
-class Slapd:
+class SlapdObject:
     """
     Controller class for a slapd instance, OpenLDAP's server.
 
@@ -56,44 +79,33 @@ class Slapd:
     server is shut down.
     """
 
-    suffix = "dc=slapd-test,dc=python-ldap,dc=org"
-    root_cn = "Manager"
-    root_dn = "cn=%s,%s" % (root_cn, suffix)
-    root_password = "password"
+    database = 'ldif'
+    suffix = 'dc=slapd-test,dc=python-ldap,dc=org'
+    root_cn = 'Manager'
+    root_dn = 'cn=%s,%s' % (root_cn, suffix)
+    root_pw = 'password'
+    slapd_loglevel = 'stats stats2'
     
-    _log = logging.getLogger("Slapd")
+    _log = _LOGGER
 
     # Use /var/tmp to placate apparmour on Ubuntu:
-    PATH_TMPDIR = "/var/tmp/python-ldap-test"
-    PATH_SBINDIR = "/usr/sbin"
-    PATH_BINDIR = "/usr/bin"
-    PATH_SCHEMA_CORE = "/etc/openldap/schema/core.schema"
-    PATH_LDAPADD = os.path.join(PATH_BINDIR, "ldapadd")
-    PATH_LDAPSEARCH = os.path.join(PATH_BINDIR, "ldapsearch")
-    PATH_SLAPD = os.path.join(PATH_SBINDIR, "slapd")
-    PATH_SLAPTEST = os.path.join(PATH_SBINDIR, "slaptest")
-
-    def check_paths(cls):
-        """
-        Checks that the configured executable paths look valid.
-        If they don't, then logs warning messages (not errors).
-        """
-        for name, path in (
-                ("slapd", cls.PATH_SLAPD),
-                ("ldapadd", cls.PATH_LDAPADD),
-                ("ldapsearch", cls.PATH_LDAPSEARCH),
-            ):
-            cls._log.debug("checking %s executable at %s", name, path)
-            if not os.access(path, os.X_OK):
-                cls._log.warn("cannot find %s executable at %s", name, path)
-    check_paths = classmethod(check_paths)
+    PATH_TMPDIR = '/var/tmp'
+    PATH_SBINDIR = '/usr/sbin'
+    PATH_BINDIR = '/usr/bin'
+    PATH_SCHEMA_CORE = '/etc/openldap/schema/core.schema'
+    PATH_LDAPADD = os.path.join(PATH_BINDIR, 'ldapadd')
+    PATH_LDAPSEARCH = os.path.join(PATH_BINDIR, 'ldapsearch')
+    PATH_SLAPD = os.path.join(PATH_SBINDIR, 'slapd')
+    PATH_SLAPTEST = os.path.join(PATH_SBINDIR, 'slaptest')
 
     def __init__(self):
-        self._config = []
         self._proc = None
         self._port = 0
-        self._tmpdir = self.PATH_TMPDIR
-        self._slapd_debug_level = 0
+        self._tmpdir = os.path.join(os.environ.get('TMP', self.PATH_TMPDIR), 'python-ldap-test')
+        self._slapd_conf = os.path.join(self._tmpdir, "slapd.conf")
+        self._db_directory = os.path.join(self._tmpdir, "openldap-data")
+        self._config = self._generate_slapd_conf()
+        self._log.setLevel(_LOG_LEVEL)
 
     # getters
     def get_url(self):
@@ -104,43 +116,35 @@ def get_address(self):
             self._port = find_available_tcp_port(LOCALHOST)
         return (LOCALHOST, self._port)
 
-    def get_tmpdir(self):
-        return os.environ.get('TMP', self._tmpdir)
-
     def __del__(self):
         self.stop()
 
-    def configure(self, cfg):
+    def _generate_slapd_conf(self):
         """
-        Appends slapd.conf configuration lines to cfg.
-        Also re-initializes any backing storage.
-        Feel free to subclass and override this method.
+        returns a string with a complete slapd.conf
         """
-
-        # Global
-        cfg.append("include " + quote(self.PATH_SCHEMA_CORE))
-        cfg.append("allow bind_v2")
-
-        # Database
-        ldif_dir = mkdirs(os.path.join(self.get_tmpdir(), "ldif-data"))
-        delete_directory_content(ldif_dir) # clear it out
-        cfg.append("database ldif")
-        cfg.append("directory " + quote(ldif_dir))
-
-        cfg.append("suffix " + quote(self.suffix))
-        cfg.append("rootdn " + quote(self.root_dn))
-        cfg.append("rootpw " + quote(self.root_password))
+        # reinitialize database
+        delete_directory_content(self._db_directory)
+        # generate slapd.conf lines
+        config_dict = {
+            'path_schema_core': quote(self.PATH_SCHEMA_CORE),
+            'loglevel': self.slapd_loglevel,
+            'database': quote(self.database),
+            'directory': quote(self._db_directory),
+            'suffix': quote(self.suffix),
+            'rootdn': quote(self.root_dn),
+            'rootpw': quote(self.root_pw),
+        }
+        return SLAPD_CONF_TEMPLATE % config_dict
 
     def _write_config(self):
         """Writes the slapd.conf file out, and returns the path to it."""
-        path = os.path.join(self._tmpdir, "slapd.conf")
-        _ = mkdirs(self._tmpdir)
-        if os.access(path, os.F_OK):
-            self._log.debug("deleting existing %s", path)
-            os.remove(path)
-        self._log.debug("writing config to %s", path)
-        file(path, "w").writelines([line + "\n" for line in self._config])
-        return path
+        mkdirs(self._tmpdir)
+        mkdirs(self._db_directory)
+        self._log.debug("writing config to %s", self._config)
+        config_file = file(self._slapd_conf, "wb")
+        config_file.write(self._config)
+        config_file.close()
 
     def start(self):
         """
@@ -150,7 +154,6 @@ def start(self):
             ok = False
             config_path = None
             try:
-                self.configure(self._config)
                 self._test_configuration()
                 self._start_slapd()
                 self._wait_for_slapd()
@@ -167,15 +170,14 @@ def start(self):
 
     def _start_slapd(self):
         # Spawns/forks the slapd process
-        config_path = self._write_config()
+        self._write_config()
         self._log.info("starting slapd")
         self._proc = subprocess.Popen([
             self.PATH_SLAPD,
-            "-f", config_path,
+            "-f", self._slapd_conf,
             "-h", self.get_url(),
-            "-d", str(self._slapd_debug_level),
+            "-d", "0",
         ])
-        self._proc_config = config_path
 
     def _wait_for_slapd(self):
         # Waits until the LDAP server socket is open, or slapd crashed
@@ -224,27 +226,31 @@ def _stopped(self):
             self._log.info("slapd terminated")
             self._proc = None
             try:
-                os.remove(self._proc_config)
+                os.remove(self._slapd_conf)
             except os.error:
-                self._log.debug("could not remove %s", self._proc_config)
+                self._log.debug("could not remove %s", self._slapd_conf)
 
     def _test_configuration(self):
-        config_path = self._write_config()
+        self._write_config()
+        self._log.debug("testing configuration")
+        popen_list = [
+            self.PATH_SLAPTEST,
+            "-f", self._slapd_conf,
+#            "-u", os.environ['USER'],
+        ]
+        if self._log.isEnabledFor(logging.DEBUG):
+            popen_list.append('-v')
+            popen_list.extend(['-d', 'config'])
+        else:
+            popen_list.append('-Q')
         try:
-            self._log.debug("testing configuration")
-            verboseflag = "-Q"
-            if self._log.isEnabledFor(logging.DEBUG):
-                verboseflag = "-v"
-            p = subprocess.Popen([
-                self.PATH_SLAPTEST,
-                verboseflag,
-                "-f", config_path
-            ])
+            p = subprocess.Popen(popen_list)
             if p.wait() != 0:
                 raise RuntimeError("configuration test failed")
             self._log.debug("configuration seems ok")
         finally:
-            os.remove(config_path)
+            pass
+            #os.remove(self._slapd_conf)
 
     def ldapadd(self, ldif, extra_args=None):
         """Runs ldapadd on this slapd instance, passing it the ldif content"""
@@ -255,7 +261,7 @@ def ldapadd(self, ldif, extra_args=None):
                 self.PATH_LDAPADD,
                 "-x",
                 "-D", self.root_dn,
-                "-w", self.root_password,
+                "-w", self.root_pw,
                 "-H", self.get_url()
             ] + extra_args,
             stdin=subprocess.PIPE, stdout=subprocess.PIPE,
@@ -278,7 +284,7 @@ def ldapsearch(
                 self.PATH_LDAPSEARCH,
                 "-x",
                 "-D", self.root_dn,
-                "-w", self.root_password,
+                "-w", self.root_pw,
                 "-H", self.get_url(),
                 "-b", base,
                 "-s", scope,
@@ -346,13 +352,11 @@ def started(self):
         suffix_dc = self.suffix.split(',')[0][3:]
         assert self.root_dn.startswith("cn=")
         assert self.root_dn.endswith("," + self.suffix)
-
         self._log.debug(
             "adding %s and %s",
             self.suffix,
             self.root_dn,
         )
-
         self.ldapadd(
             "\n".join([
                 'dn: '+self.suffix,
@@ -367,21 +371,3 @@ def started(self):
                 ''
             ])
         )
-
-def run():
-    logging.basicConfig(level=logging.DEBUG)
-    slapd = Slapd()
-    _log.debug("Starting slapd...")
-    slapd.start()
-    _log.debug("Contents of LDAP server follow:\n")
-    for dn, attrs in slapd.ldapsearch():
-        _log.debug("dn: " + dn)
-        for name, val in attrs:
-            _log.debug("%r: %r", name, val)
-    _log.debug('slapd URL: %r', slapd.get_url())
-    slapd.wait()
-
-Slapd.check_paths()
-
-if __name__ == '__main__' and sys.argv == ['run']:
-    run()
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 19a1255..0311605 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -5,6 +5,7 @@
 import os
 import unittest
 from Tests import slapd
+from Tests.slapd import SlapdObject
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -15,7 +16,7 @@
 def get_reusable_server():
     global reusable_server
     if reusable_server is None:
-        reusable_server = slapd.Slapd()
+        reusable_server = SlapdObject()
     return reusable_server
 
 class TestLdapCExtension(unittest.TestCase):
@@ -34,7 +35,7 @@ def _init_server(self, reuse_existing=True):
         if reuse_existing:
             server = get_reusable_server()
         else:
-            server = slapd.Slapd() # private server
+            server = SlapdObject() # private server
         server.start()   # no effect if already started
         self.server = server
         return server
@@ -48,7 +49,7 @@ def _init(self, reuse_existing=True, bind=True):
         if bind:
             # Perform a simple bind
             l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
-            m = l.simple_bind(server.root_dn, server.root_password)
+            m = l.simple_bind(server.root_dn, server.root_pw)
             result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
             self.assertTrue(result, _ldap.RES_BIND)
         return l
diff --git a/Tests/t_search.py b/Tests/t_search.py
index e938cab..f051fe2 100644
--- a/Tests/t_search.py
+++ b/Tests/t_search.py
@@ -1,6 +1,11 @@
-import ldap, unittest
-import slapd
+import os
+import unittest
+from Tests.slapd import SlapdObject
 
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
 from ldap.ldapobject import LDAPObject
 
 server = None
@@ -10,9 +15,9 @@ class TestSearch(unittest.TestCase):
     def setUp(self):
         global server
         if server is None:
-            server = slapd.Slapd()
+            server = SlapdObject()
             server.start()
-            base = server.get_dn_suffix()
+            base = server.suffix
 
             # insert some Foo* objects via ldapadd
             server.ldapadd("\n".join([
@@ -41,13 +46,13 @@ def setUp(self):
         l = LDAPObject(server.get_url())
         l.protocol_version = 3
         l.set_option(ldap.OPT_REFERRALS,0)
-        l.simple_bind_s(server.get_root_dn(), 
-                server.get_root_password())
+        l.simple_bind_s(server.root_dn, 
+                server.root_pw)
         self.ldap = l
         self.server = server
 
     def test_search_subtree(self):
-        base = self.server.get_dn_suffix()
+        base = self.server.suffix
         l = self.ldap
 
         result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
@@ -65,7 +70,7 @@ def test_search_subtree(self):
         )
 
     def test_search_onelevel(self):
-        base = self.server.get_dn_suffix()
+        base = self.server.suffix
         l = self.ldap
 
         result = l.search_s(base, ldap.SCOPE_ONELEVEL, '(cn=Foo*)', ['*'])
@@ -81,7 +86,7 @@ def test_search_onelevel(self):
         )
 
     def test_search_oneattr(self):
-        base = self.server.get_dn_suffix()
+        base = self.server.suffix
         l = self.ldap
 
         result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo4)', ['cn'])

From cc5b6c595503b1b1006e1c59aeda7be0cbc3440b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 10:54:11 +0000
Subject: [PATCH 357/868] removed cruft

---
 Tests/slapd.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Tests/slapd.py b/Tests/slapd.py
index 0ec998e..07f92e7 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -85,7 +85,7 @@ class SlapdObject:
     root_dn = 'cn=%s,%s' % (root_cn, suffix)
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
-    
+
     _log = _LOGGER
 
     # Use /var/tmp to placate apparmour on Ubuntu:
@@ -236,7 +236,6 @@ def _test_configuration(self):
         popen_list = [
             self.PATH_SLAPTEST,
             "-f", self._slapd_conf,
-#            "-u", os.environ['USER'],
         ]
         if self._log.isEnabledFor(logging.DEBUG):
             popen_list.append('-v')

From b38ad5e383c056d61dffa7df075d8e6c8bbf13ac Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 11:14:25 +0000
Subject: [PATCH 358/868] by default back-mdb is now used for slapd-based tests

---
 CHANGES        | 4 +++-
 Tests/slapd.py | 6 ++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index cd87e0d..1f14622 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,8 @@ Tests/
 * re-factored slapd.py, t_cext.py and t_search.py
 * set env var LDAPNOINIT=1 in t_cext.py and t_search.py to avoid
   interference with locally installed .ldaprc or ldap.conf
+* by default back-mdb is now used for slapd-based tests
+  which requires fairly recent OpenLDAP builds
 
 ----------------------------------------------------------------
 Released 2.4.35 2017-04-25
@@ -1388,4 +1390,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.426 2017/04/26 10:46:31 stroeder Exp $
+$Id: CHANGES,v 1.427 2017/04/26 11:14:25 stroeder Exp $
diff --git a/Tests/slapd.py b/Tests/slapd.py
index 07f92e7..6ac027c 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -28,6 +28,7 @@
 
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = """
+moduleload back_%(database)s
 include %(path_schema_core)s
 loglevel %(loglevel)s
 allow bind_v2
@@ -79,7 +80,7 @@ class SlapdObject:
     server is shut down.
     """
 
-    database = 'ldif'
+    database = 'mdb'
     suffix = 'dc=slapd-test,dc=python-ldap,dc=org'
     root_cn = 'Manager'
     root_dn = 'cn=%s,%s' % (root_cn, suffix)
@@ -129,7 +130,7 @@ def _generate_slapd_conf(self):
         config_dict = {
             'path_schema_core': quote(self.PATH_SCHEMA_CORE),
             'loglevel': self.slapd_loglevel,
-            'database': quote(self.database),
+            'database': self.database,
             'directory': quote(self._db_directory),
             'suffix': quote(self.suffix),
             'rootdn': quote(self.root_dn),
@@ -236,6 +237,7 @@ def _test_configuration(self):
         popen_list = [
             self.PATH_SLAPTEST,
             "-f", self._slapd_conf,
+            '-u',
         ]
         if self._log.isEnabledFor(logging.DEBUG):
             popen_list.append('-v')

From 3fa67ea556b85543e9257776dc28d7c659f677e0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 11:37:09 +0000
Subject: [PATCH 359/868] re-factored slapd.py, t_cext.py and t_search.py

---
 Tests/slapd.py    | 82 +++++++++++++++++++++++------------------------
 Tests/t_cext.py   |  2 +-
 Tests/t_search.py |  2 +-
 3 files changed, 42 insertions(+), 44 deletions(-)

diff --git a/Tests/slapd.py b/Tests/slapd.py
index 6ac027c..10028ea 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -4,7 +4,6 @@
 and talking to it with ldapsearch/ldapadd.
 """
 
-import sys
 import os
 import socket
 import time
@@ -87,8 +86,6 @@ class SlapdObject:
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
 
-    _log = _LOGGER
-
     # Use /var/tmp to placate apparmour on Ubuntu:
     PATH_TMPDIR = '/var/tmp'
     PATH_SBINDIR = '/usr/sbin'
@@ -96,37 +93,28 @@ class SlapdObject:
     PATH_SCHEMA_CORE = '/etc/openldap/schema/core.schema'
     PATH_LDAPADD = os.path.join(PATH_BINDIR, 'ldapadd')
     PATH_LDAPSEARCH = os.path.join(PATH_BINDIR, 'ldapsearch')
+    PATH_LDAPWHOAMI = os.path.join(PATH_BINDIR, 'ldapwhoami')
     PATH_SLAPD = os.path.join(PATH_SBINDIR, 'slapd')
     PATH_SLAPTEST = os.path.join(PATH_SBINDIR, 'slaptest')
 
     def __init__(self):
         self._proc = None
-        self._port = 0
+        self._port = find_available_tcp_port(LOCALHOST)
+        self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
+        self._log = _LOGGER
         self._tmpdir = os.path.join(os.environ.get('TMP', self.PATH_TMPDIR), 'python-ldap-test')
         self._slapd_conf = os.path.join(self._tmpdir, "slapd.conf")
         self._db_directory = os.path.join(self._tmpdir, "openldap-data")
-        self._config = self._generate_slapd_conf()
-        self._log.setLevel(_LOG_LEVEL)
-
-    # getters
-    def get_url(self):
-        return "ldap://%s:%d/" % self.get_address()
-
-    def get_address(self):
-        if self._port == 0:
-            self._port = find_available_tcp_port(LOCALHOST)
-        return (LOCALHOST, self._port)
+        # init directory structure
+        delete_directory_content(self._tmpdir)
+        mkdirs(self._tmpdir)
+        mkdirs(self._db_directory)
 
     def __del__(self):
         self.stop()
 
-    def _generate_slapd_conf(self):
-        """
-        returns a string with a complete slapd.conf
-        """
-        # reinitialize database
-        delete_directory_content(self._db_directory)
-        # generate slapd.conf lines
+    def _write_config(self):
+        """Writes the slapd.conf file out, and returns the path to it."""
         config_dict = {
             'path_schema_core': quote(self.PATH_SCHEMA_CORE),
             'loglevel': self.slapd_loglevel,
@@ -136,15 +124,9 @@ def _generate_slapd_conf(self):
             'rootdn': quote(self.root_dn),
             'rootpw': quote(self.root_pw),
         }
-        return SLAPD_CONF_TEMPLATE % config_dict
-
-    def _write_config(self):
-        """Writes the slapd.conf file out, and returns the path to it."""
-        mkdirs(self._tmpdir)
-        mkdirs(self._db_directory)
-        self._log.debug("writing config to %s", self._config)
+        self._log.debug("writing config to %s", self._slapd_conf)
         config_file = file(self._slapd_conf, "wb")
-        config_file.write(self._config)
+        config_file.write(SLAPD_CONF_TEMPLATE % config_dict)
         config_file.close()
 
     def start(self):
@@ -155,11 +137,12 @@ def start(self):
             ok = False
             config_path = None
             try:
+                self._write_config()
                 self._test_configuration()
                 self._start_slapd()
                 self._wait_for_slapd()
                 ok = True
-                self._log.debug("slapd ready at %s", self.get_url())
+                self._log.debug("slapd ready at %s", self.ldap_uri)
                 self.started()
             finally:
                 if not ok:
@@ -176,7 +159,7 @@ def _start_slapd(self):
         self._proc = subprocess.Popen([
             self.PATH_SLAPD,
             "-f", self._slapd_conf,
-            "-h", self.get_url(),
+            "-h", self.ldap_uri,
             "-d", "0",
         ])
 
@@ -188,12 +171,12 @@ def _wait_for_slapd(self):
                 self._stopped()
                 raise RuntimeError("slapd exited before opening port")
             try:
-                self._log.debug("Connecting to %s", repr(self.get_address()))
-                s.connect(self.get_address())
-                s.close()
-                return
-            except socket.error:
+                self._log.debug("Connecting to %s", self.ldap_uri)
+                self.ldapwhoami()
+            except RuntimeError:
                 time.sleep(1)
+            else:
+                return
 
     def stop(self):
         """Stops the slapd server, and waits for it to terminate"""
@@ -232,7 +215,6 @@ def _stopped(self):
                 self._log.debug("could not remove %s", self._slapd_conf)
 
     def _test_configuration(self):
-        self._write_config()
         self._log.debug("testing configuration")
         popen_list = [
             self.PATH_SLAPTEST,
@@ -250,8 +232,24 @@ def _test_configuration(self):
                 raise RuntimeError("configuration test failed")
             self._log.debug("configuration seems ok")
         finally:
-            pass
-            #os.remove(self._slapd_conf)
+            os.remove(self._slapd_conf)
+
+    def ldapwhoami(self, extra_args=None):
+        """Runs ldapwhoami on this slapd instance"""
+        extra_args = extra_args or []
+        self._log.debug("whoami")
+        p = subprocess.Popen(
+            [
+                self.PATH_LDAPWHOAMI,
+                "-x",
+                "-D", self.root_dn,
+                "-w", self.root_pw,
+                "-H", self.ldap_uri
+            ] + extra_args,
+            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+        )
+        if p.wait() != 0:
+            raise RuntimeError("ldapwhoami process failed")
 
     def ldapadd(self, ldif, extra_args=None):
         """Runs ldapadd on this slapd instance, passing it the ldif content"""
@@ -263,7 +261,7 @@ def ldapadd(self, ldif, extra_args=None):
                 "-x",
                 "-D", self.root_dn,
                 "-w", self.root_pw,
-                "-H", self.get_url()
+                "-H", self.ldap_uri
             ] + extra_args,
             stdin=subprocess.PIPE, stdout=subprocess.PIPE,
         )
@@ -286,7 +284,7 @@ def ldapsearch(
                 "-x",
                 "-D", self.root_dn,
                 "-w", self.root_pw,
-                "-H", self.get_url(),
+                "-H", self.ldap_uri,
                 "-b", base,
                 "-s", scope,
                 "-LL",
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 0311605..1c55b4c 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -45,7 +45,7 @@ def _init(self, reuse_existing=True, bind=True):
         Starts a server, and returns a LDAPObject bound to it
         """
         server = self._init_server(reuse_existing)
-        l = _ldap.initialize(server.get_url())
+        l = _ldap.initialize(server.ldap_uri)
         if bind:
             # Perform a simple bind
             l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
diff --git a/Tests/t_search.py b/Tests/t_search.py
index f051fe2..2c5fa7b 100644
--- a/Tests/t_search.py
+++ b/Tests/t_search.py
@@ -43,7 +43,7 @@ def setUp(self):
                 "",
             ])+"\n")
 
-        l = LDAPObject(server.get_url())
+        l = LDAPObject(server.ldap_uri)
         l.protocol_version = 3
         l.set_option(ldap.OPT_REFERRALS,0)
         l.simple_bind_s(server.root_dn, 

From 07111165cf5826b4397ad6a03e47639af3f00377 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 12:40:44 +0000
Subject: [PATCH 360/868] re-added SlapdObject._gen_config()

---
 Tests/slapd.py | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/Tests/slapd.py b/Tests/slapd.py
index 10028ea..990d0c6 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -78,7 +78,7 @@ class SlapdObject:
     When a reference to an instance of this class is lost, the slapd
     server is shut down.
     """
-
+    slapd_conf_template = SLAPD_CONF_TEMPLATE
     database = 'mdb'
     suffix = 'dc=slapd-test,dc=python-ldap,dc=org'
     root_cn = 'Manager'
@@ -113,8 +113,10 @@ def __init__(self):
     def __del__(self):
         self.stop()
 
-    def _write_config(self):
-        """Writes the slapd.conf file out, and returns the path to it."""
+    def _gen_config(self):
+        """
+        generates a slapd.conf and returns it as one string
+        """
         config_dict = {
             'path_schema_core': quote(self.PATH_SCHEMA_CORE),
             'loglevel': self.slapd_loglevel,
@@ -124,9 +126,13 @@ def _write_config(self):
             'rootdn': quote(self.root_dn),
             'rootpw': quote(self.root_pw),
         }
+        return self.slapd_conf_template % config_dict
+
+    def _write_config(self):
+        """Writes the slapd.conf file out, and returns the path to it."""
         self._log.debug("writing config to %s", self._slapd_conf)
         config_file = file(self._slapd_conf, "wb")
-        config_file.write(SLAPD_CONF_TEMPLATE % config_dict)
+        config_file.write(self._gen_config())
         config_file.close()
 
     def start(self):

From 48a8cb1fc42450128dfc5d5122c48cc06e049fc7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 13:12:52 +0000
Subject: [PATCH 361/868] env vars can be set for slapd.py to tweak path names

---
 CHANGES        |  4 +++-
 Tests/slapd.py | 28 +++++++++++++++-------------
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1f14622..e574f9e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,8 @@ Tests/
   interference with locally installed .ldaprc or ldap.conf
 * by default back-mdb is now used for slapd-based tests
   which requires fairly recent OpenLDAP builds
+* env vars can be set for slapd.py to tweak path names
+  of executables, temporary and schema data to be used
 
 ----------------------------------------------------------------
 Released 2.4.35 2017-04-25
@@ -1390,4 +1392,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.427 2017/04/26 11:14:25 stroeder Exp $
+$Id: CHANGES,v 1.428 2017/04/26 13:12:52 stroeder Exp $
diff --git a/Tests/slapd.py b/Tests/slapd.py
index 990d0c6..9cba85e 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -28,7 +28,7 @@
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = """
 moduleload back_%(database)s
-include %(path_schema_core)s
+include %(schema_include)s
 loglevel %(loglevel)s
 allow bind_v2
 database %(database)s
@@ -86,23 +86,24 @@ class SlapdObject:
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
 
-    # Use /var/tmp to placate apparmour on Ubuntu:
-    PATH_TMPDIR = '/var/tmp'
-    PATH_SBINDIR = '/usr/sbin'
-    PATH_BINDIR = '/usr/bin'
-    PATH_SCHEMA_CORE = '/etc/openldap/schema/core.schema'
-    PATH_LDAPADD = os.path.join(PATH_BINDIR, 'ldapadd')
-    PATH_LDAPSEARCH = os.path.join(PATH_BINDIR, 'ldapsearch')
-    PATH_LDAPWHOAMI = os.path.join(PATH_BINDIR, 'ldapwhoami')
-    PATH_SLAPD = os.path.join(PATH_SBINDIR, 'slapd')
-    PATH_SLAPTEST = os.path.join(PATH_SBINDIR, 'slaptest')
+    TMPDIR = os.environ.get('TMP', os.getcwd())
+    SBINDIR = os.environ.get('SBIN', '/usr/sbin')
+    BINDIR = os.environ.get('BIN', '/usr/bin')
+    SCHEMADIR = os.environ.get('SCHEMA', '/etc/openldap/schema')
+    INIT_SCHEMA_FILE = os.environ.get('SCHEMA_FILE', 'core.schema')
+    INIT_SCHEMA_PATH = os.environ.get('SCHEMA_PATH', os.path.join(SCHEMADIR, INIT_SCHEMA_FILE))
+    PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
+    PATH_LDAPSEARCH = os.path.join(BINDIR, 'ldapsearch')
+    PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
+    PATH_SLAPD = os.path.join(SBINDIR, 'slapd')
+    PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
 
     def __init__(self):
         self._proc = None
         self._port = find_available_tcp_port(LOCALHOST)
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         self._log = _LOGGER
-        self._tmpdir = os.path.join(os.environ.get('TMP', self.PATH_TMPDIR), 'python-ldap-test')
+        self._tmpdir = os.path.join(self.TMPDIR, 'python-ldap-test')
         self._slapd_conf = os.path.join(self._tmpdir, "slapd.conf")
         self._db_directory = os.path.join(self._tmpdir, "openldap-data")
         # init directory structure
@@ -112,13 +113,14 @@ def __init__(self):
 
     def __del__(self):
         self.stop()
+        delete_directory_content(self._tmpdir)
 
     def _gen_config(self):
         """
         generates a slapd.conf and returns it as one string
         """
         config_dict = {
-            'path_schema_core': quote(self.PATH_SCHEMA_CORE),
+            'schema_include': quote(self.INIT_SCHEMA_PATH),
             'loglevel': self.slapd_loglevel,
             'database': self.database,
             'directory': quote(self._db_directory),

From 2ce408cf8b7d5b084556de0d36bf5666c1fda515 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 14:54:14 +0000
Subject: [PATCH 362/868] re-factored slapd.py, t_cext.py and t_search.py: new
 class SlapdTestCase used

---
 CHANGES           |   3 +-
 Tests/slapd.py    |  50 +++++++++--
 Tests/t_cext.py   | 212 ++++++++++++++++++++++------------------------
 Tests/t_search.py | 109 +++++++++++-------------
 4 files changed, 193 insertions(+), 181 deletions(-)

diff --git a/CHANGES b/CHANGES
index e574f9e..4174f6a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -15,6 +15,7 @@ Tests/
   which requires fairly recent OpenLDAP builds
 * env vars can be set for slapd.py to tweak path names
   of executables, temporary and schema data to be used
+* new class SlapdTestCase
 
 ----------------------------------------------------------------
 Released 2.4.35 2017-04-25
@@ -1392,4 +1393,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.428 2017/04/26 13:12:52 stroeder Exp $
+$Id: CHANGES,v 1.429 2017/04/26 14:54:14 stroeder Exp $
diff --git a/Tests/slapd.py b/Tests/slapd.py
index 9cba85e..98ec6d4 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -10,6 +10,7 @@
 import subprocess
 import logging
 import base64
+import unittest
 
 # determine log level
 try:
@@ -106,14 +107,6 @@ def __init__(self):
         self._tmpdir = os.path.join(self.TMPDIR, 'python-ldap-test')
         self._slapd_conf = os.path.join(self._tmpdir, "slapd.conf")
         self._db_directory = os.path.join(self._tmpdir, "openldap-data")
-        # init directory structure
-        delete_directory_content(self._tmpdir)
-        mkdirs(self._tmpdir)
-        mkdirs(self._db_directory)
-
-    def __del__(self):
-        self.stop()
-        delete_directory_content(self._tmpdir)
 
     def _gen_config(self):
         """
@@ -144,6 +137,10 @@ def start(self):
         if self._proc is None:
             ok = False
             config_path = None
+            # init directory structure
+            delete_directory_content(self._tmpdir)
+            mkdirs(self._tmpdir)
+            mkdirs(self._db_directory)
             try:
                 self._write_config()
                 self._test_configuration()
@@ -378,3 +375,40 @@ def started(self):
                 ''
             ])
         )
+
+
+class SlapdTestCase(unittest.TestCase):
+    """
+    test class which also clones or initializes a running slapd
+    """
+
+    server = None
+
+    def _open_ldap_conn(self, who=None, cred=None):
+        """
+        return a LDAPObject instance after simple bind
+        """
+        import ldap
+        ldap_conn = self.ldap_object_class(self.server.ldap_uri)
+        ldap_conn.protocol_version = 3
+        ldap_conn.set_option(ldap.OPT_REFERRALS,0)
+        ldap_conn.simple_bind_s(who or self.server.root_dn, cred or self.server.root_pw)
+        return ldap_conn
+
+    @classmethod
+    def setUpClass(cls):
+        if cls.server is None:
+            cls.server = SlapdObject()
+            cls.server.start()       
+        cls.server = cls.server
+
+    @classmethod
+    def tearDownClass(cls):
+        try:
+            cls.server.stop()
+        except Exception, err:
+            pass
+        try:
+            delete_directory_content(cls.server._tmpdir)
+        except Exception, err:
+            pass
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 1c55b4c..f9b28d8 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -4,54 +4,35 @@
 
 import os
 import unittest
-from Tests import slapd
-from Tests.slapd import SlapdObject
+from Tests.slapd import SlapdTestCase
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
+# import the plain C wrapper module
 import _ldap
 
-reusable_server = None
-def get_reusable_server():
-    global reusable_server
-    if reusable_server is None:
-        reusable_server = SlapdObject()
-    return reusable_server
 
-class TestLdapCExtension(unittest.TestCase):
+class TestLdapCExtension(SlapdTestCase):
     """
     These tests apply only to the _ldap module and therefore bypass the
     LDAPObject wrapper completely.
     """
 
-    timeout = 3
+    timeout = 5
 
-    def _init_server(self, reuse_existing=True):
-        """
-        Sets self.server to a test LDAP server and self.server.suffix to its base
-        """
-        global reusable_server
-        if reuse_existing:
-            server = get_reusable_server()
-        else:
-            server = SlapdObject() # private server
-        server.start()   # no effect if already started
-        self.server = server
-        return server
-
-    def _init(self, reuse_existing=True, bind=True):
+    def _open_conn(self, bind=True):
         """
         Starts a server, and returns a LDAPObject bound to it
         """
-        server = self._init_server(reuse_existing)
-        l = _ldap.initialize(server.ldap_uri)
+        l = _ldap.initialize(self.server.ldap_uri)
         if bind:
             # Perform a simple bind
             l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
-            m = l.simple_bind(server.root_dn, server.root_pw)
+            m = l.simple_bind(self.server.root_dn, self.server.root_pw)
             result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
-            self.assertTrue(result, _ldap.RES_BIND)
+            self.assertEqual(result, _ldap.RES_BIND)
+            self.assertEqual(type(msgid), type(0))
         return l
 
     def assertNotNone(self, expr, msg=None):
@@ -63,6 +44,9 @@ def assertNone(self, expr, msg=None):
     # Test for the existence of a whole bunch of constants
     # that the C module is supposed to export
     def test_constants(self):
+        """
+        Test whether all libldap-derived constants are correct
+        """
         self.assertEquals(_ldap.PORT, 389)
         self.assertEquals(_ldap.VERSION1, 1)
         self.assertEquals(_ldap.VERSION2, 2)
@@ -164,11 +148,12 @@ def test_constants(self):
         self.assertNotNone(_ldap.URL_ERR_MEM)
 
     def test_simple_bind(self):
-        l = self._init()
+        l = self._open_conn()
 
     def test_simple_anonymous_bind(self):
-        l = self._init(bind=False)
+        l = self._open_conn(bind=False)
         m = l.simple_bind("", "")
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
         self.assertEquals(msgid, m)
@@ -184,24 +169,25 @@ def test_simple_anonymous_bind(self):
         self.assertTrue(pmsg[0][1].has_key('objectClass'))
 
     def test_unbind(self):
-        l = self._init()
+        l = self._open_conn()
         m = l.unbind_ext()
         self.assertNone(m)
-
         # Second attempt to unbind should yield an exception
-        try: l.unbind_ext()
-        except _ldap.error: pass
+        try:
+            l.unbind_ext()
+        except _ldap.error:
+            pass
 
     def test_search_ext_individual(self):
-        l = self._init()
-
+        l = self._open_conn()
+        # send search request
         m = l.search_ext(
             self.server.suffix,
             _ldap.SCOPE_SUBTREE,
             '(objectClass=dcObject)'
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
-
         # Expect to get just one object
         self.assertEquals(result, _ldap.RES_SEARCH_ENTRY)
         self.assertEquals(len(pmsg), 1)
@@ -220,26 +206,23 @@ def test_search_ext_individual(self):
         self.assertEquals(ctrls, [])
 
     def test_abandon(self):
-        l = self._init()
-
+        l = self._open_conn()
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
-
         ret = l.abandon_ext(m)
         self.assertNone(ret)
-
-        got_timeout = False
         try:
             r = l.result4(m, _ldap.MSG_ALL, 0.3)  # (timeout /could/ be longer)
         except _ldap.TIMEOUT, e:
-            got_timeout = True
-        self.assertTrue(got_timeout)
+            pass
+        else:
+            self.fail("expected TIMEOUT, got %r" % r)
 
     def test_search_ext_all(self):
-        l = self._init()
-
+        l = self._open_conn()
+        # send search request
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-
         # Expect to get some objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertTrue(len(pmsg) >= 2)
@@ -247,8 +230,10 @@ def test_search_ext_all(self):
         self.assertEquals(ctrls, [])
 
     def test_add(self):
-        l = self._init()
-
+        """
+        test add operation
+        """
+        l = self._open_conn()
         m = l.add_ext(
             "cn=Foo," + self.server.suffix,
             [
@@ -257,23 +242,20 @@ def test_add(self):
                 ('description', 'testing'),
             ]
         )
-
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
         self.assertEquals(pmsg, [])
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
-
         # search for it back
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-
         # Expect to get the objects
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(len(pmsg), 1)
         self.assertEquals(msgid, m)
         self.assertEquals(ctrls, [])
-
         self.assertEquals(
             pmsg[0],
             (
@@ -287,8 +269,10 @@ def test_add(self):
         )
 
     def test_compare(self):
-        l = self._init()
-
+        """
+        test compare operation
+        """
+        l = self._open_conn()
         # first, add an object with a field we can compare on
         dn = "cn=CompareTest," + self.server.suffix
         m = l.add_ext(
@@ -300,53 +284,49 @@ def test_compare(self):
                 ('userPassword', 'the_password'),
             ],
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
-
         # try a false compare
         m = l.compare_ext(dn, "userPassword", "bad_string")
-        compared_false = False
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-            self.fail(repr(r))
         except _ldap.COMPARE_FALSE:
-            compared_false = True
-        self.assertTrue(compared_false)
-
+            pass
+        else:
+            self.fail("expected COMPARE_FALSE, got %r" % r)
         # try a true compare
         m = l.compare_ext(dn, "userPassword", "the_password")
-        compared_true = False
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-            self.fail(repr(r))
         except _ldap.COMPARE_TRUE:
-            compared_true = True
-        self.assertTrue(compared_true)
-
+            pass
+        else:
+            self.fail("expected COMPARE_TRUE, got %r" % r)
+        # try a compare on bad attribute
         m = l.compare_ext(dn, "badAttribute", "ignoreme")
-        raised_error = False
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-            self.fail(repr(r))
         except _ldap.error:
-            raised_error = True
-        self.assertTrue(raised_error)
+            pass
+        else:
+            self.fail("expected LDAPError, got %r" % r)
 
     def test_delete_no_such_object(self):
-        l = self._init()
-
-        # try deleting an object that doesn't exist
-        not_found = False
+        """
+        try deleting an object that doesn't exist
+        """
+        l = self._open_conn()
         m = l.delete_ext("cn=DoesNotExist,"+self.server.suffix)
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-            self.fail(r)
         except _ldap.NO_SUCH_OBJECT:
-            not_found = True
-        self.assertTrue(not_found)
+            pass
+        else:
+            self.fail("expected NO_SUCH_OBJECT, got %r" % r)
 
     def test_delete(self):
-        l = self._init()
+        l = self._open_conn()
         # first, add an object we will delete
         dn = "cn=Deleteme,"+self.server.suffix
         m = l.add_ext(
@@ -356,6 +336,7 @@ def test_delete(self):
                 ('cn', 'Deleteme'),
             ]
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
@@ -367,10 +348,9 @@ def test_delete(self):
         self.assertEquals(ctrls, [])
 
     def test_modify_no_such_object(self):
-        l = self._init()
+        l = self._open_conn()
 
         # try deleting an object that doesn't exist
-        not_found = False
         m = l.modify_ext(
             "cn=DoesNotExist,"+self.server.suffix,
             [
@@ -379,27 +359,35 @@ def test_modify_no_such_object(self):
         )
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-            self.fail(r)
         except _ldap.NO_SUCH_OBJECT:
-            not_found = True
-        self.assertTrue(not_found)
+            pass
+        else:
+            self.fail("expected NO_SUCH_OBJECT, got %r" % r)
 
-    def DISABLED_test_modify_no_such_object_empty_attrs(self):
-        # XXX ldif-backend for slapd appears broken???
-        l = self._init()
-        # try deleting an object that doesn't exist
+    def test_modify_no_such_object_empty_attrs(self):
+        """
+        try deleting an object that doesn't exist
+        """
+        l = self._open_conn()
         m = l.modify_ext(
             "cn=DoesNotExist,"+self.server.suffix,
             [
-                (_ldap.MOD_ADD, 'description', []),
+                (_ldap.MOD_ADD, 'description', ['dummy']),
             ]
         )
         self.assertTrue(isinstance(m, int))
-        r = l.result4(m, _ldap.MSG_ALL, self.timeout) # what should happen??
-        self.fail(r)
+        try:
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        except _ldap.NO_SUCH_OBJECT:
+            pass
+        else:
+            self.fail("expected NO_SUCH_OBJECT, got %r" % r)
 
     def test_modify(self):
-        l = self._init()
+        """
+        test modify operation
+        """
+        l = self._open_conn()
         # first, add an object we will delete
         dn = "cn=AddToMe,"+self.server.suffix
         m = l.add_ext(
@@ -411,6 +399,7 @@ def test_modify(self):
                 ('description', 'a description'),
             ]
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
@@ -439,7 +428,7 @@ def test_modify(self):
         self.assertEquals(d, ['a description', 'b desc', 'c desc'])
 
     def test_rename(self):
-        l = self._init()
+        l = self._open_conn()
         dn = "cn=RenameMe,"+self.server.suffix
         m = l.add_ext(
             dn,
@@ -448,6 +437,7 @@ def test_rename(self):
                 ('cn', 'RenameMe'),
             ]
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
 
@@ -538,31 +528,29 @@ def test_rename(self):
 
 
     def test_whoami(self):
-        l = self._init()
+        l = self._open_conn()
         r = l.whoami_s()
         self.assertEquals("dn:" + self.server.root_dn, r)
 
     def test_whoami_unbound(self):
-        l = self._init(bind=False)
+        l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
         r = l.whoami_s()
         self.assertEquals("", r)
 
     def test_whoami_anonymous(self):
-        l = self._init(bind=False)
+        l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
-
         # Anonymous bind
         m = l.simple_bind("", "")
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
-
+        # check with Who Am I? extended operation
         r = l.whoami_s()
         self.assertEquals("", r)
 
     def test_passwd(self):
-        l = self._init()
-
+        l = self._open_conn()
         # first, create a user to change password on
         dn = "cn=PasswordTest," + self.server.suffix
         m = l.add_ext(
@@ -574,17 +562,18 @@ def test_passwd(self):
                 ('userPassword', 'initial'),
             ]
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_ADD)
-
         # try changing password with a wrong old-pw
         m = l.passwd(dn, "bogus", "ignored")
+        self.assertEqual(type(m), type(0))
         try:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-            self.fail("expected UNWILLING_TO_PERFORM")
         except _ldap.UNWILLING_TO_PERFORM:
             pass
-
+        else:
+            self.fail("expected UNWILLING_TO_PERFORM, got %r" % r)
         # try changing password with a correct old-pw
         m = l.passwd(dn, "initial", "changed")
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
@@ -599,8 +588,10 @@ def test_options(self):
 
             try:
                 _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, "3")
-                self.fail("expected string value to raise a type error")
-            except TypeError: pass
+            except TypeError:
+                pass
+            else:
+                self.fail("expected string value to raise a TypeError")
 
             _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION2)
             v = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
@@ -611,7 +602,7 @@ def test_options(self):
         finally:
             _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, oldval)
 
-        l = self._init()
+        l = self._open_conn()
 
         # Try changing some basic options and checking that they took effect
 
@@ -626,9 +617,10 @@ def test_options(self):
         # Try setting options that will yield a known error.
         try:
             _ldap.get_option(_ldap.OPT_MATCHED_DN)
-            self.fail("expected ValueError")
         except ValueError:
             pass
+        else:
+            self.fail("expected ValueError")
 
     def _require_attr(self, obj, attrname):
         """Returns true if the attribute exists on the object.
@@ -643,24 +635,22 @@ def _require_attr(self, obj, attrname):
         return False
 
     def test_sasl(self):
-        l = self._init()
+        l = self._open_conn()
         if not self._require_attr(l, 'sasl_interactive_bind_s'): # HAVE_SASL
             return
         # TODO
 
     def test_tls(self):
-        l = self._init()
+        l = self._open_conn()
         if not self._require_attr(l, 'start_tls_s'):    # HAVE_TLS
             return
         # TODO
 
     def test_cancel(self):
-        l = self._init()
+        l = self._open_conn()
         if not self._require_attr(l, 'cancel'):         # FEATURE_CANCEL
             return
 
-    def test_str2dn(self):
-        pass
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tests/t_search.py b/Tests/t_search.py
index 2c5fa7b..a2a6a99 100644
--- a/Tests/t_search.py
+++ b/Tests/t_search.py
@@ -1,6 +1,6 @@
 import os
 import unittest
-from Tests.slapd import SlapdObject
+from Tests.slapd import SlapdTestCase
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -8,93 +8,80 @@
 import ldap
 from ldap.ldapobject import LDAPObject
 
-server = None
+LDIF_TEMPLATE = """dn: cn=Foo1,%(suffix)s
+objectClass: organizationalRole
+cn: Foo1
 
-class TestSearch(unittest.TestCase):
+dn: cn=Foo2,%(suffix)s
+objectClass: organizationalRole
+cn: Foo2
+
+dn: cn=Foo3,%(suffix)s
+objectClass: organizationalRole
+cn: Foo3
+
+dn: ou=Container,%(suffix)s
+objectClass: organizationalUnit
+ou: Container
+
+dn: cn=Foo4,ou=Container,%(suffix)s
+objectClass: organizationalRole
+cn: Foo4
+
+"""
+
+
+class TestSearch(SlapdTestCase):
+
+    ldap_object_class = LDAPObject
+
+    @classmethod
+    def setUpClass(cls):
+        SlapdTestCase.setUpClass()
+        # insert some Foo* objects via ldapadd
+        cls.server.ldapadd(LDIF_TEMPLATE % {'suffix':cls.server.suffix})
 
     def setUp(self):
-        global server
-        if server is None:
-            server = SlapdObject()
-            server.start()
-            base = server.suffix
-
-            # insert some Foo* objects via ldapadd
-            server.ldapadd("\n".join([
-                "dn: cn=Foo1,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo1",
-                "",
-                "dn: cn=Foo2,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo2",
-                "",
-                "dn: cn=Foo3,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo3",
-                "",
-                "dn: ou=Container,"+base,
-                "objectClass: organizationalUnit",
-                "ou: Container",
-                "",
-                "dn: cn=Foo4,ou=Container,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo4",
-                "",
-            ])+"\n")
-
-        l = LDAPObject(server.ldap_uri)
-        l.protocol_version = 3
-        l.set_option(ldap.OPT_REFERRALS,0)
-        l.simple_bind_s(server.root_dn, 
-                server.root_pw)
-        self.ldap = l
-        self.server = server
+        try:
+            self._ldap_conn
+        except AttributeError:
+            # open local LDAP connection
+            self._ldap_conn = self._open_ldap_conn()
 
     def test_search_subtree(self):
-        base = self.server.suffix
-        l = self.ldap
-
-        result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
+        result = self._ldap_conn.search_s(self.server.suffix, ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
         result.sort()
         self.assertEquals(result,
-            [('cn=Foo1,'+base,
+            [('cn=Foo1,'+self.server.suffix,
                {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo2,'+base,
+             ('cn=Foo2,'+self.server.suffix,
                {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo3,'+base,
+             ('cn=Foo3,'+self.server.suffix,
                {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo4,ou=Container,'+base,
+             ('cn=Foo4,ou=Container,'+self.server.suffix,
                {'cn': ['Foo4'], 'objectClass': ['organizationalRole']}),
             ]
         )
 
     def test_search_onelevel(self):
-        base = self.server.suffix
-        l = self.ldap
-
-        result = l.search_s(base, ldap.SCOPE_ONELEVEL, '(cn=Foo*)', ['*'])
+        result = self._ldap_conn.search_s(self.server.suffix, ldap.SCOPE_ONELEVEL, '(cn=Foo*)', ['*'])
         result.sort()
         self.assertEquals(result,
-            [('cn=Foo1,'+base,
+            [('cn=Foo1,'+self.server.suffix,
                {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo2,'+base,
+             ('cn=Foo2,'+self.server.suffix,
                {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo3,'+base,
+             ('cn=Foo3,'+self.server.suffix,
                {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}),
             ]
         )
 
     def test_search_oneattr(self):
-        base = self.server.suffix
-        l = self.ldap
-
-        result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo4)', ['cn'])
+        result = self._ldap_conn.search_s(self.server.suffix, ldap.SCOPE_SUBTREE, '(cn=Foo4)', ['cn'])
         result.sort()
         self.assertEquals(result,
-            [('cn=Foo4,ou=Container,'+base, {'cn': ['Foo4']})]
+            [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': ['Foo4']})]
         )
 
-
 if __name__ == '__main__':
     unittest.main()

From 2a19d61e64358e1ae040be640f9955e71d211625 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 15:06:11 +0000
Subject: [PATCH 363/868] added and use SlapdTestCase.server_class

---
 Tests/slapd.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Tests/slapd.py b/Tests/slapd.py
index 98ec6d4..8e2bd65 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -382,6 +382,7 @@ class SlapdTestCase(unittest.TestCase):
     test class which also clones or initializes a running slapd
     """
 
+    server_class = SlapdObject
     server = None
 
     def _open_ldap_conn(self, who=None, cred=None):
@@ -398,7 +399,7 @@ def _open_ldap_conn(self, who=None, cred=None):
     @classmethod
     def setUpClass(cls):
         if cls.server is None:
-            cls.server = SlapdObject()
+            cls.server = cls.server_class()
             cls.server.start()       
         cls.server = cls.server
 

From 28e862c4b09935c69e8dd2c94f796d780092e961 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 16:11:26 +0000
Subject: [PATCH 364/868] removed obsolete stuff, make pylint happy

---
 Tests/slapd.py | 180 +++++++++++++++----------------------------------
 1 file changed, 55 insertions(+), 125 deletions(-)

diff --git a/Tests/slapd.py b/Tests/slapd.py
index 8e2bd65..caafac7 100644
--- a/Tests/slapd.py
+++ b/Tests/slapd.py
@@ -1,4 +1,3 @@
-
 """
 Utilities for starting up a test slapd server
 and talking to it with ldapsearch/ldapadd.
@@ -9,7 +8,6 @@
 import time
 import subprocess
 import logging
-import base64
 import unittest
 
 # determine log level
@@ -29,46 +27,50 @@
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = """
 moduleload back_%(database)s
-include %(schema_include)s
+include "%(schema_include)s"
 loglevel %(loglevel)s
 allow bind_v2
 database %(database)s
-directory %(directory)s
-suffix %(suffix)s
-rootdn %(rootdn)s
-rootpw %(rootpw)s
+directory "%(directory)s"
+suffix "%(suffix)s"
+rootdn "%(rootdn)s"
+rootpw "%(rootpw)s"
 """
 
-def quote(s):
-    '''Quotes the '"' and '\' characters in a string and surrounds with "..."'''
-    return '"%s"' % s.replace('\\', '\\\\').replace('"', '\\"')
+LOCALHOST = '127.0.0.1'
 
 def mkdirs(path):
-    """Creates the directory path unless it already exists"""
+    """
+    Creates the directory path unless it already exists
+    """
     if not os.access(os.path.join(path, os.path.curdir), os.F_OK):
         _LOGGER.debug("creating temp directory %s", path)
         os.mkdir(path)
 
 def delete_directory_content(path):
+    """
+    Recursively delete content of directory
+    """
     for dirpath, dirnames, filenames in os.walk(path, topdown=False):
-        for n in filenames:
-            _LOGGER.info("remove %s", os.path.join(dirpath, n))
-            os.remove(os.path.join(dirpath, n))
-        for n in dirnames:
-            _LOGGER.info("rmdir %s", os.path.join(dirpath, n))
-            os.rmdir(os.path.join(dirpath, n))
-
-LOCALHOST = '127.0.0.1'
+        for filename in filenames:
+            _LOGGER.info("remove %s", os.path.join(dirpath, filename))
+            os.remove(os.path.join(dirpath, filename))
+        for dirname in dirnames:
+            _LOGGER.info("rmdir %s", os.path.join(dirpath, dirname))
+            os.rmdir(os.path.join(dirpath, dirname))
 
 def find_available_tcp_port(host=LOCALHOST):
-    s = socket.socket()
-    s.bind((host, 0))
-    port = s.getsockname()[1]
-    s.close()
+    """
+    find an available port for TCP connection
+    """
+    sock = socket.socket()
+    sock.bind((host, 0))
+    port = sock.getsockname()[1]
+    sock.close()
     _LOGGER.info("Found available port %d", port)
     return port
 
-class SlapdObject:
+class SlapdObject(object):
     """
     Controller class for a slapd instance, OpenLDAP's server.
 
@@ -94,7 +96,6 @@ class SlapdObject:
     INIT_SCHEMA_FILE = os.environ.get('SCHEMA_FILE', 'core.schema')
     INIT_SCHEMA_PATH = os.environ.get('SCHEMA_PATH', os.path.join(SCHEMADIR, INIT_SCHEMA_FILE))
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
-    PATH_LDAPSEARCH = os.path.join(BINDIR, 'ldapsearch')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
     PATH_SLAPD = os.path.join(SBINDIR, 'slapd')
     PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
@@ -104,22 +105,22 @@ def __init__(self):
         self._port = find_available_tcp_port(LOCALHOST)
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         self._log = _LOGGER
-        self._tmpdir = os.path.join(self.TMPDIR, 'python-ldap-test')
-        self._slapd_conf = os.path.join(self._tmpdir, "slapd.conf")
-        self._db_directory = os.path.join(self._tmpdir, "openldap-data")
+        self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test')
+        self._slapd_conf = os.path.join(self.testrundir, "slapd.conf")
+        self._db_directory = os.path.join(self.testrundir, "openldap-data")
 
     def _gen_config(self):
         """
         generates a slapd.conf and returns it as one string
         """
         config_dict = {
-            'schema_include': quote(self.INIT_SCHEMA_PATH),
+            'schema_include': self.INIT_SCHEMA_PATH,
             'loglevel': self.slapd_loglevel,
             'database': self.database,
-            'directory': quote(self._db_directory),
-            'suffix': quote(self.suffix),
-            'rootdn': quote(self.root_dn),
-            'rootpw': quote(self.root_pw),
+            'directory': self._db_directory,
+            'suffix': self.suffix,
+            'rootdn': self.root_dn,
+            'rootpw': self.root_pw,
         }
         return self.slapd_conf_template % config_dict
 
@@ -135,25 +136,27 @@ def start(self):
         Starts the slapd server process running, and waits for it to come up.
         """
         if self._proc is None:
-            ok = False
+            start_ok = False
             config_path = None
             # init directory structure
-            delete_directory_content(self._tmpdir)
-            mkdirs(self._tmpdir)
+            delete_directory_content(self.testrundir)
+            mkdirs(self.testrundir)
             mkdirs(self._db_directory)
             try:
                 self._write_config()
                 self._test_configuration()
                 self._start_slapd()
                 self._wait_for_slapd()
-                ok = True
+                start_ok = True
                 self._log.debug("slapd ready at %s", self.ldap_uri)
                 self.started()
             finally:
-                if not ok:
+                if not start_ok:
                     if config_path:
-                        try: os.remove(config_path)
-                        except os.error: pass
+                        try:
+                            os.remove(config_path)
+                        except os.error:
+                            pass
                     if self._proc:
                         self.stop()
 
@@ -170,7 +173,6 @@ def _start_slapd(self):
 
     def _wait_for_slapd(self):
         # Waits until the LDAP server socket is open, or slapd crashed
-        s = socket.socket()
         while 1:
             if self._proc.poll() is not None:
                 self._stopped()
@@ -232,8 +234,8 @@ def _test_configuration(self):
         else:
             popen_list.append('-Q')
         try:
-            p = subprocess.Popen(popen_list)
-            if p.wait() != 0:
+            proc = subprocess.Popen(popen_list)
+            if proc.wait() != 0:
                 raise RuntimeError("configuration test failed")
             self._log.debug("configuration seems ok")
         finally:
@@ -243,7 +245,7 @@ def ldapwhoami(self, extra_args=None):
         """Runs ldapwhoami on this slapd instance"""
         extra_args = extra_args or []
         self._log.debug("whoami")
-        p = subprocess.Popen(
+        proc = subprocess.Popen(
             [
                 self.PATH_LDAPWHOAMI,
                 "-x",
@@ -253,14 +255,14 @@ def ldapwhoami(self, extra_args=None):
             ] + extra_args,
             stdin=subprocess.PIPE, stdout=subprocess.PIPE,
         )
-        if p.wait() != 0:
+        if proc.wait() != 0:
             raise RuntimeError("ldapwhoami process failed")
 
     def ldapadd(self, ldif, extra_args=None):
         """Runs ldapadd on this slapd instance, passing it the ldif content"""
         extra_args = extra_args or []
         self._log.debug("adding %s", repr(ldif))
-        p = subprocess.Popen(
+        proc = subprocess.Popen(
             [
                 self.PATH_LDAPADD,
                 "-x",
@@ -270,82 +272,10 @@ def ldapadd(self, ldif, extra_args=None):
             ] + extra_args,
             stdin=subprocess.PIPE, stdout=subprocess.PIPE,
         )
-        p.communicate(ldif)
-        if p.wait() != 0:
+        proc.communicate(ldif)
+        if proc.wait() != 0:
             raise RuntimeError("ldapadd process failed")
 
-    def ldapsearch(
-            self, base=None, filterstr='(objectClass=*)', attrs=None,
-            scope='sub', extra_args=None
-        ):
-        attrs = attrs or []
-        extra_args = extra_args or []
-        if base is None:
-            base = self.suffix
-        self._log.debug("ldapsearch filterstr=%s", repr(filterstr))
-        p = subprocess.Popen(
-            [
-                self.PATH_LDAPSEARCH,
-                "-x",
-                "-D", self.root_dn,
-                "-w", self.root_pw,
-                "-H", self.ldap_uri,
-                "-b", base,
-                "-s", scope,
-                "-LL",
-            ]+extra_args+[filterstr]+attrs,
-            stdout=subprocess.PIPE,
-        )
-        output = p.communicate()[0]
-        if p.wait() != 0:
-            raise RuntimeError("ldapadd process failed")
-
-        # RFC 2849: LDIF format
-        # unfold
-        lines = []
-        for l in output.split('\n'):
-            if l.startswith(' '):
-                lines[-1] = lines[-1] + l[1:]
-            elif l == '' and lines and lines[-1] == '':
-                pass # ignore multiple blank lines
-            else:
-                lines.append(l)
-        # Remove comments
-        lines = [l for l in lines if not l.startswith("#")]
-
-        # Remove leading version and blank line(s)
-        if lines and lines[0] == '':
-            del lines[0]
-        if not lines or lines[0] != 'version: 1':
-            raise RuntimeError("expected 'version: 1', got " + repr(lines[:1]))
-        del lines[0]
-        if lines and lines[0] == '':
-            del lines[0]
-
-        # ensure the ldif ends with a blank line (unless it is just blank)
-        if lines and lines[-1] != '':
-            lines.append('')
-
-        objects = []
-        obj = []
-        for line in lines:
-            if line == '': # end of an object
-                if obj[0][0] != 'dn':
-                    raise RuntimeError("first line not dn", repr(obj))
-                objects.append((obj[0][1], obj[1:]))
-                obj = []
-            else:
-                attr, value = line.split(':', 2)
-                if value.startswith(': '):
-                    value = base64.decodestring(value[2:])
-                elif value.startswith(' '):
-                    value = value[1:]
-                else:
-                    raise RuntimeError("bad line: " + repr(line))
-                obj.append((attr, value))
-        assert obj == []
-        return objects
-
     def started(self):
         """
         This method is called when the LDAP server has started up and is empty.
@@ -392,7 +322,7 @@ def _open_ldap_conn(self, who=None, cred=None):
         import ldap
         ldap_conn = self.ldap_object_class(self.server.ldap_uri)
         ldap_conn.protocol_version = 3
-        ldap_conn.set_option(ldap.OPT_REFERRALS,0)
+        ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
         ldap_conn.simple_bind_s(who or self.server.root_dn, cred or self.server.root_pw)
         return ldap_conn
 
@@ -400,16 +330,16 @@ def _open_ldap_conn(self, who=None, cred=None):
     def setUpClass(cls):
         if cls.server is None:
             cls.server = cls.server_class()
-            cls.server.start()       
+            cls.server.start()
         cls.server = cls.server
 
     @classmethod
     def tearDownClass(cls):
         try:
             cls.server.stop()
-        except Exception, err:
+        except AttributeError:
             pass
         try:
-            delete_directory_content(cls.server._tmpdir)
-        except Exception, err:
+            delete_directory_content(cls.server.testrundir)
+        except AttributeError:
             pass

From 762a90aac6f1fa3bea2fc0d53c086be4ee4cc2b1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 16:33:44 +0000
Subject: [PATCH 365/868] updated .cvsignore files

---
 .cvsignore                     | 2 ++
 Demo/.cvsignore                | 1 +
 Demo/Lib/.cvsignore            | 1 +
 Demo/Lib/ldap/.cvsignore       | 1 +
 Demo/Lib/ldap/async/.cvsignore | 1 +
 Demo/Lib/ldapurl/.cvsignore    | 1 +
 Demo/Lib/ldif/.cvsignore       | 1 +
 Doc/.cvsignore                 | 1 +
 Lib/.cvsignore                 | 1 +
 Lib/ldap/.cvsignore            | 1 +
 Lib/ldap/controls/.cvsignore   | 5 +++++
 Lib/ldap/extop/.cvsignore      | 5 +++++
 Lib/ldap/schema/.cvsignore     | 1 +
 Tests/.cvsignore               | 5 +++++
 14 files changed, 27 insertions(+)
 create mode 100644 Lib/ldap/controls/.cvsignore
 create mode 100644 Lib/ldap/extop/.cvsignore
 create mode 100644 Tests/.cvsignore

diff --git a/.cvsignore b/.cvsignore
index 1a36453..5e004b9 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,7 +1,9 @@
 build
 dist
 MANIFEST
+.tox
 *.pyc
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Demo/.cvsignore b/Demo/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Demo/.cvsignore
+++ b/Demo/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Demo/Lib/.cvsignore b/Demo/Lib/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Demo/Lib/.cvsignore
+++ b/Demo/Lib/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Demo/Lib/ldap/.cvsignore b/Demo/Lib/ldap/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Demo/Lib/ldap/.cvsignore
+++ b/Demo/Lib/ldap/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Demo/Lib/ldap/async/.cvsignore b/Demo/Lib/ldap/async/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Demo/Lib/ldap/async/.cvsignore
+++ b/Demo/Lib/ldap/async/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Demo/Lib/ldapurl/.cvsignore b/Demo/Lib/ldapurl/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Demo/Lib/ldapurl/.cvsignore
+++ b/Demo/Lib/ldapurl/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Demo/Lib/ldif/.cvsignore b/Demo/Lib/ldif/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Demo/Lib/ldif/.cvsignore
+++ b/Demo/Lib/ldif/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Doc/.cvsignore b/Doc/.cvsignore
index 5557280..3b5c5ee 100644
--- a/Doc/.cvsignore
+++ b/Doc/.cvsignore
@@ -1,3 +1,4 @@
+.build
 python-ldap.pdf
 python-ldap.ps
 *.bck
diff --git a/Lib/.cvsignore b/Lib/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Lib/.cvsignore
+++ b/Lib/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Lib/ldap/.cvsignore b/Lib/ldap/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Lib/ldap/.cvsignore
+++ b/Lib/ldap/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Lib/ldap/controls/.cvsignore b/Lib/ldap/controls/.cvsignore
new file mode 100644
index 0000000..e1d0aec
--- /dev/null
+++ b/Lib/ldap/controls/.cvsignore
@@ -0,0 +1,5 @@
+*.pyc
+*.pyo
+*.bck
+*~
+*.egg-info
diff --git a/Lib/ldap/extop/.cvsignore b/Lib/ldap/extop/.cvsignore
new file mode 100644
index 0000000..e1d0aec
--- /dev/null
+++ b/Lib/ldap/extop/.cvsignore
@@ -0,0 +1,5 @@
+*.pyc
+*.pyo
+*.bck
+*~
+*.egg-info
diff --git a/Lib/ldap/schema/.cvsignore b/Lib/ldap/schema/.cvsignore
index f7c976a..e1d0aec 100644
--- a/Lib/ldap/schema/.cvsignore
+++ b/Lib/ldap/schema/.cvsignore
@@ -2,3 +2,4 @@
 *.pyo
 *.bck
 *~
+*.egg-info
diff --git a/Tests/.cvsignore b/Tests/.cvsignore
new file mode 100644
index 0000000..e1d0aec
--- /dev/null
+++ b/Tests/.cvsignore
@@ -0,0 +1,5 @@
+*.pyc
+*.pyo
+*.bck
+*~
+*.egg-info

From e6a5501b5eb4aee1e7c5c5f5f8492390086db18e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 16:33:45 +0000
Subject: [PATCH 366/868] updated .cvsignore files

---
 .cvsignore | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.cvsignore b/.cvsignore
index 5e004b9..269e98a 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,7 +1,6 @@
 build
 dist
 MANIFEST
-.tox
 *.pyc
 *.pyo
 *.bck

From 263615438d33c3d0b49434b612c352c3247c22f2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 16:52:50 +0000
Subject: [PATCH 367/868] added new stand-alone module slapdtest (formerly
 Tests/slapd.py)

---
 CHANGES                            |  9 ++++++---
 Tests/slapd.py => Lib/slapdtest.py | 10 ++++++++--
 Tests/__init__.py                  |  2 --
 Tests/t_cext.py                    |  2 +-
 Tests/t_search.py                  |  2 +-
 setup.py                           |  3 ++-
 6 files changed, 18 insertions(+), 10 deletions(-)
 rename Tests/slapd.py => Lib/slapdtest.py (97%)

diff --git a/CHANGES b/CHANGES
index 4174f6a..004fa57 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,13 +6,16 @@ Changes since 2.4.35:
 Lib/
 * gracefully handle KeyError in LDAPObject._ldap_call() when
   using errno
+* added new stand-alone module slapdtest (formerly Tests/slapd.py)
+  for general use (still experimental)
 
 Tests/
-* re-factored slapd.py, t_cext.py and t_search.py
+* re-factored t_cext.py and t_search.py
 * set env var LDAPNOINIT=1 in t_cext.py and t_search.py to avoid
   interference with locally installed .ldaprc or ldap.conf
 * by default back-mdb is now used for slapd-based tests
-  which requires fairly recent OpenLDAP builds
+  which requires fairly recent OpenLDAP builds but implements
+  full feature set
 * env vars can be set for slapd.py to tweak path names
   of executables, temporary and schema data to be used
 * new class SlapdTestCase
@@ -1393,4 +1396,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.429 2017/04/26 14:54:14 stroeder Exp $
+$Id: CHANGES,v 1.430 2017/04/26 16:52:50 stroeder Exp $
diff --git a/Tests/slapd.py b/Lib/slapdtest.py
similarity index 97%
rename from Tests/slapd.py
rename to Lib/slapdtest.py
index caafac7..aa8573a 100644
--- a/Tests/slapd.py
+++ b/Lib/slapdtest.py
@@ -1,6 +1,12 @@
 """
-Utilities for starting up a test slapd server
-and talking to it with ldapsearch/ldapadd.
+slapdtest - module for spawning test instances of OpenLDAP's slapd server
+
+See http://www.python-ldap.org/ for details.
+
+\$Id: slapdtest.py,v 1.1 2017/04/26 16:52:50 stroeder Exp $
+
+Python compability note:
+This module only works with Python 2.7.x since
 """
 
 import os
diff --git a/Tests/__init__.py b/Tests/__init__.py
index 5367f82..db0f9a6 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -12,5 +12,3 @@
 import t_ldif 
 import t_search 
 import t_ldap_schema_subentry
-
-import slapd
\ No newline at end of file
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index f9b28d8..0887738 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -4,7 +4,7 @@
 
 import os
 import unittest
-from Tests.slapd import SlapdTestCase
+from slapdtest import SlapdTestCase
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
diff --git a/Tests/t_search.py b/Tests/t_search.py
index a2a6a99..8922a1d 100644
--- a/Tests/t_search.py
+++ b/Tests/t_search.py
@@ -1,6 +1,6 @@
 import os
 import unittest
-from Tests.slapd import SlapdTestCase
+from slapdtest import SlapdTestCase
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
diff --git a/setup.py b/setup.py
index 5b1241a..7790f27 100644
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.78 2017/02/14 21:38:13 stroeder Exp $
+$Id: setup.py,v 1.79 2017/04/26 16:52:50 stroeder Exp $
 """
 
 has_setuptools = False
@@ -149,6 +149,7 @@ class OpenLDAP2:
     'ldif',
     'dsml',
     'ldap',
+    'slapdtest',
     'ldap.async',
     'ldap.controls',
     'ldap.controls.deref',

From c59ef53cb4b3f11b06144d6dbaa656a4d3ac2cd8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:28:06 +0000
Subject: [PATCH 368/868] added TestLdapCExtension.test_errno107()

---
 Tests/t_cext.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 0887738..ac0f335 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -651,6 +651,18 @@ def test_cancel(self):
         if not self._require_attr(l, 'cancel'):         # FEATURE_CANCEL
             return
 
+    def test_errno107(self):
+        l = _ldap.initialize('ldap://127.0.0.1:42')
+        try:
+            m = l.simple_bind("", "")
+            result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        except _ldap.SERVER_DOWN, ldap_err:
+            errno = ldap_err.args[0]['errno']
+            if errno!=107:
+                self.fail("expected errno=107, got %d" % errno)
+        else:
+            self.fail("expected SERVER_DOWN, got %r" % r)
+            
 
 if __name__ == '__main__':
     unittest.main()

From 10a4d50b5b5289baefd1e7844d43cb8d41b8858a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:33:12 +0000
Subject: [PATCH 369/868] cosmetics in TestLdapCExtension.test_errno107()

---
 Tests/t_cext.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index ac0f335..398a4fa 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -655,14 +655,14 @@ def test_errno107(self):
         l = _ldap.initialize('ldap://127.0.0.1:42')
         try:
             m = l.simple_bind("", "")
-            result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
         except _ldap.SERVER_DOWN, ldap_err:
             errno = ldap_err.args[0]['errno']
-            if errno!=107:
+            if errno != 107:
                 self.fail("expected errno=107, got %d" % errno)
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
-            
+
 
 if __name__ == '__main__':
     unittest.main()

From 30a3be65bcff093ab7e51111e3f36736d8fde053 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:37:17 +0000
Subject: [PATCH 370/868] cosmetics in TestLdapCExtension.test_errno107()

---
 Tests/t_cext.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 398a4fa..a93265e 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -166,7 +166,11 @@ def test_simple_anonymous_bind(self):
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg[0][0], "") # rootDSE has no dn
         self.assertEquals(msgid, m)
-        self.assertTrue(pmsg[0][1].has_key('objectClass'))
+        root_dse = pmsg[0][1]
+        self.assertTrue('objectClass' in root_dse)
+        self.assertTrue('OpenLDAProotDSE' in root_dse['objectClass'])
+        self.assertTrue('namingContexts' in root_dse)
+        self.assertEquals(root_dse['namingContexts'], [self.server.suffix])
 
     def test_unbind(self):
         l = self._open_conn()

From 519d2136f4263a6d99a736f93d32069b89f2296d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:39:12 +0000
Subject: [PATCH 371/868] more attribute checks in test_simple_anonymous_bind

---
 Tests/t_cext.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index a93265e..51c446a 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -161,7 +161,12 @@ def test_simple_anonymous_bind(self):
         self.assertEquals(ctrls, [])
 
         # see if we can get the rootdse while we're here
-        m = l.search_ext("", _ldap.SCOPE_BASE, '(objectClass=*)')
+        m = l.search_ext(
+            "",
+            _ldap.SCOPE_BASE,
+            '(objectClass=*)',
+            ['objectClass', 'namingContexts'],
+        )
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg[0][0], "") # rootDSE has no dn

From 447870d4274169b7d5ddd75eb7fca74b3e890600 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:42:25 +0000
Subject: [PATCH 372/868] added TestLdapCExtension.test_anon_rootdse_search()

---
 Tests/t_cext.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 51c446a..f3d6283 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -160,13 +160,16 @@ def test_simple_anonymous_bind(self):
         self.assertEquals(pmsg, [])
         self.assertEquals(ctrls, [])
 
-        # see if we can get the rootdse while we're here
+    def test_anon_rootdse_search(self):
+        l = self._open_conn(bind=False)
+        # see if we can get the rootdse with anon search (without prior bind)
         m = l.search_ext(
             "",
             _ldap.SCOPE_BASE,
             '(objectClass=*)',
             ['objectClass', 'namingContexts'],
         )
+        self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg[0][0], "") # rootDSE has no dn

From 9a378ecc0a5ef206c0bcea94e2742b3e4284d4b6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:46:37 +0000
Subject: [PATCH 373/868] add and use SlapdObject._start_sleep

---
 Lib/slapdtest.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index aa8573a..0996356 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,12 +3,14 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.1 2017/04/26 16:52:50 stroeder Exp $
+\$Id: slapdtest.py,v 1.2 2017/04/26 20:46:37 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
+__version__ = '2.4.37'
+
 import os
 import socket
 import time
@@ -106,6 +108,9 @@ class SlapdObject(object):
     PATH_SLAPD = os.path.join(SBINDIR, 'slapd')
     PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
 
+    # time in secs to wait before trying to access slapd via LDAP (again)
+    _start_sleep = 1.5
+
     def __init__(self):
         self._proc = None
         self._port = find_available_tcp_port(LOCALHOST)
@@ -183,11 +188,12 @@ def _wait_for_slapd(self):
             if self._proc.poll() is not None:
                 self._stopped()
                 raise RuntimeError("slapd exited before opening port")
+            time.sleep(self._start_sleep)
             try:
                 self._log.debug("Connecting to %s", self.ldap_uri)
                 self.ldapwhoami()
             except RuntimeError:
-                time.sleep(1)
+                pass
             else:
                 return
 

From 96dc9d116efeccb121e558cc42be466fb90e448a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:48:43 +0000
Subject: [PATCH 374/868] started 2.4.37

---
 CHANGES              | 13 ++++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 004fa57..9e4fef4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+----------------------------------------------------------------
+Released 2.4.37 2017-05-xx
+
+Changes since 2.4.36:
+
+Lib/
+* 
+
+Tests/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.36 2017-04-26
 
@@ -1396,4 +1407,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.430 2017/04/26 16:52:50 stroeder Exp $
+$Id: CHANGES,v 1.431 2017/04/26 20:48:43 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index f5399da..c905b0f 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.53 2017/04/25 17:44:51 stroeder Exp $
+$Id: dsml.py,v 1.54 2017/04/26 20:48:43 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.36'
+__version__ = '2.4.37'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 1425445..42f2f1b 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.114 2017/04/25 17:44:51 stroeder Exp $
+$Id: __init__.py,v 1.115 2017/04/26 20:48:43 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.36'
+__version__ = '2.4.37'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 9c16244..35c5785 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.89 2017/04/25 17:44:51 stroeder Exp $
+\$Id: ldapurl.py,v 1.90 2017/04/26 20:48:43 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.36'
+__version__ = '2.4.37'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 6bf4727..0f66300 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.109 2017/04/25 17:44:51 stroeder Exp $
+$Id: ldif.py,v 1.110 2017/04/26 20:48:43 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.36'
+__version__ = '2.4.37'
 
 __all__ = [
   # constants

From 49dd66be44f1a29a119c476a0ee52c3ec08c0f4f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:51:49 +0000
Subject: [PATCH 375/868] check for empty controls in
 test_anon_rootdse_search()

---
 Tests/t_cext.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index f3d6283..595d3cd 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -174,6 +174,7 @@ def test_anon_rootdse_search(self):
         self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
         self.assertEquals(pmsg[0][0], "") # rootDSE has no dn
         self.assertEquals(msgid, m)
+        self.assertEquals(ctrls, [])
         root_dse = pmsg[0][1]
         self.assertTrue('objectClass' in root_dse)
         self.assertTrue('OpenLDAProotDSE' in root_dse['objectClass'])

From bfec74cc1ebd98396e1373e3c40f6d2d1ccfa2b3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 20:59:19 +0000
Subject: [PATCH 376/868] make pylint happy

---
 Tests/t_search.py | 81 +++++++++++++++++++++++++++++++++++------------
 1 file changed, 61 insertions(+), 20 deletions(-)

diff --git a/Tests/t_search.py b/Tests/t_search.py
index 8922a1d..504795d 100644
--- a/Tests/t_search.py
+++ b/Tests/t_search.py
@@ -1,3 +1,7 @@
+"""
+test LDAP operations with Python wrapper module
+"""
+
 import os
 import unittest
 from slapdtest import SlapdTestCase
@@ -32,6 +36,9 @@
 
 
 class TestSearch(SlapdTestCase):
+    """
+    test LDAP search operations
+    """
 
     ldap_object_class = LDAPObject
 
@@ -49,37 +56,71 @@ def setUp(self):
             self._ldap_conn = self._open_ldap_conn()
 
     def test_search_subtree(self):
-        result = self._ldap_conn.search_s(self.server.suffix, ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
+        result = self._ldap_conn.search_s(
+            self.server.suffix,
+            ldap.SCOPE_SUBTREE,
+            '(cn=Foo*)',
+            attrlist=['*'],
+        )
         result.sort()
-        self.assertEquals(result,
-            [('cn=Foo1,'+self.server.suffix,
-               {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo2,'+self.server.suffix,
-               {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo3,'+self.server.suffix,
-               {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo4,ou=Container,'+self.server.suffix,
-               {'cn': ['Foo4'], 'objectClass': ['organizationalRole']}),
+        self.assertEquals(
+            result,
+            [
+                (
+                    'cn=Foo1,'+self.server.suffix,
+                    {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}
+                ),
+                (
+                    'cn=Foo2,'+self.server.suffix,
+                    {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}
+                ),
+                (
+                    'cn=Foo3,'+self.server.suffix,
+                    {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}
+                ),
+                (
+                    'cn=Foo4,ou=Container,'+self.server.suffix,
+                    {'cn': ['Foo4'], 'objectClass': ['organizationalRole']}
+                ),
             ]
         )
 
     def test_search_onelevel(self):
-        result = self._ldap_conn.search_s(self.server.suffix, ldap.SCOPE_ONELEVEL, '(cn=Foo*)', ['*'])
+        result = self._ldap_conn.search_s(
+            self.server.suffix,
+            ldap.SCOPE_ONELEVEL,
+            '(cn=Foo*)',
+            ['*'],
+        )
         result.sort()
-        self.assertEquals(result,
-            [('cn=Foo1,'+self.server.suffix,
-               {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo2,'+self.server.suffix,
-               {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}),
-             ('cn=Foo3,'+self.server.suffix,
-               {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}),
+        self.assertEquals(
+            result,
+            [
+                (
+                    'cn=Foo1,'+self.server.suffix,
+                    {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}
+                ),
+                (
+                    'cn=Foo2,'+self.server.suffix,
+                    {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}
+                ),
+                (
+                    'cn=Foo3,'+self.server.suffix,
+                    {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}
+                ),
             ]
         )
 
     def test_search_oneattr(self):
-        result = self._ldap_conn.search_s(self.server.suffix, ldap.SCOPE_SUBTREE, '(cn=Foo4)', ['cn'])
+        result = self._ldap_conn.search_s(
+            self.server.suffix,
+            ldap.SCOPE_SUBTREE,
+            '(cn=Foo4)',
+            ['cn'],
+        )
         result.sort()
-        self.assertEquals(result,
+        self.assertEquals(
+            result,
             [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': ['Foo4']})]
         )
 

From c61cd9b66344ab2044e27e9dca79a278a9709123 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 21:04:31 +0000
Subject: [PATCH 377/868] code-cleaning in t_search.py

---
 CHANGES | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9e4fef4..966562b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,7 +7,8 @@ Lib/
 * 
 
 Tests/
-* 
+* added more checks to t_cext.py
+* code-cleaning in t_search.py
 
 ----------------------------------------------------------------
 Released 2.4.36 2017-04-26
@@ -1407,4 +1408,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.431 2017/04/26 20:48:43 stroeder Exp $
+$Id: CHANGES,v 1.432 2017/04/26 21:04:31 stroeder Exp $

From 0a5b1e1b9a0f713a24381312dddd28c88664ff3c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 21:06:34 +0000
Subject: [PATCH 378/868] python-ldap-test added to .cvsignore

---
 .cvsignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.cvsignore b/.cvsignore
index 269e98a..03123b5 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,6 +1,8 @@
 build
 dist
+python-ldap-test
 MANIFEST
+.tox
 *.pyc
 *.pyo
 *.bck

From 014a74fe39cfd83c6018627f7deef4fc6939763e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 26 Apr 2017 21:19:12 +0000
Subject: [PATCH 379/868] added TestLdapCExtension.test_invalid_filter()

---
 Tests/t_cext.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 595d3cd..8778bb4 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -676,6 +676,22 @@ def test_errno107(self):
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 
+    def test_invalid_filter(self):
+        l = self._open_conn(bind=False)
+        # search with invalid filter
+        try:
+            m = l.search_ext(
+                "",
+                _ldap.SCOPE_BASE,
+                '(|(objectClass=*)',
+            )
+            self.assertEqual(type(m), type(0))
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        except _ldap.FILTER_ERROR:
+            pass
+        else:
+            self.fail("expected FILTER_ERROR, got %r" % r)
+
 
 if __name__ == '__main__':
     unittest.main()

From 0789a45445410a9c7d483d85e0003059fe39e496 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:27:33 +0000
Subject: [PATCH 380/868] renamed t_search.py to t_ldapobject.py and
 code-cleaning

---
 CHANGES                                | 5 ++---
 Tests/{t_search.py => t_ldapobject.py} | 0
 2 files changed, 2 insertions(+), 3 deletions(-)
 rename Tests/{t_search.py => t_ldapobject.py} (100%)

diff --git a/CHANGES b/CHANGES
index 966562b..d3a9235 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,11 +4,10 @@ Released 2.4.37 2017-05-xx
 Changes since 2.4.36:
 
 Lib/
-* 
 
 Tests/
 * added more checks to t_cext.py
-* code-cleaning in t_search.py
+* renamed t_search.py to t_ldapobject.py and code-cleaning
 
 ----------------------------------------------------------------
 Released 2.4.36 2017-04-26
@@ -1408,4 +1407,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.432 2017/04/26 21:04:31 stroeder Exp $
+$Id: CHANGES,v 1.433 2017/04/27 08:27:33 stroeder Exp $
diff --git a/Tests/t_search.py b/Tests/t_ldapobject.py
similarity index 100%
rename from Tests/t_search.py
rename to Tests/t_ldapobject.py

From d92435d68bdc3258545f81c02fdc6843eed0a23e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:32:33 +0000
Subject: [PATCH 381/868] added TestLDAPObject.test_errno107()

---
 Tests/t_ldapobject.py | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 504795d..a92a7f4 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -1,5 +1,5 @@
 """
-test LDAP operations with Python wrapper module
+test LDAP operations with ldap.ldapobject
 """
 
 import os
@@ -35,7 +35,7 @@
 """
 
 
-class TestSearch(SlapdTestCase):
+class TestLDAPObject(SlapdTestCase):
     """
     test LDAP search operations
     """
@@ -124,5 +124,20 @@ def test_search_oneattr(self):
             [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': ['Foo4']})]
         )
 
+    def test_errno107(self):
+        l = self.ldap_object_class('ldap://127.0.0.1:42')
+        try:
+            m = l.simple_bind_s("", "")
+            r = l.result4(m, ldap.MSG_ALL, self.timeout)
+        except ldap.SERVER_DOWN, ldap_err:
+            errno = ldap_err.args[0]['errno']
+            if errno != 107:
+                self.fail("expected errno=107, got %d" % errno)
+            info = ldap_err.args[0]['info']
+            if info != os.strerror(107):
+                self.fail("expected info=%r, got %d" % (os.strerror(107), info))
+        else:
+            self.fail("expected SERVER_DOWN, got %r" % r)
+
 if __name__ == '__main__':
     unittest.main()

From 60bbb278dded31ff3e6579ab7724d3624637e4d8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:36:54 +0000
Subject: [PATCH 382/868] added TestLdapCExtension.test_invalid_credentials()

---
 Tests/t_cext.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 8778bb4..1da4116 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -692,6 +692,17 @@ def test_invalid_filter(self):
         else:
             self.fail("expected FILTER_ERROR, got %r" % r)
 
+    def test_invalid_credentials(self):
+        l = self._open_conn(bind=False)
+        # search with invalid filter
+        try:
+            m = l.simple_bind(self.server.root_dn, self.server.root_pw+'wrong')
+            r = l.result4(m, _ldap.MSG_ALL, self.timeout)
+        except _ldap.INVALID_CREDENTIALS:
+            pass
+        else:
+            self.fail("expected INVALID_CREDENTIALS, got %r" % r)
+
 
 if __name__ == '__main__':
     unittest.main()

From 44304ca7a323e3531bd36325284898bfa4b0e18e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:39:23 +0000
Subject: [PATCH 383/868] added TestLDAPObject.test_invalid_credentials()

---
 Tests/t_ldapobject.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index a92a7f4..ac21922 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -139,5 +139,17 @@ def test_errno107(self):
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 
+    def test_invalid_credentials(self):
+        l = self.ldap_object_class(self.server.ldap_uri)
+        # search with invalid filter
+        try:
+            m = l.simple_bind(self.server.root_dn, self.server.root_pw+'wrong')
+            r = l.result4(m, ldap.MSG_ALL)
+        except ldap.INVALID_CREDENTIALS:
+            pass
+        else:
+            self.fail("expected INVALID_CREDENTIALS, got %r" % r)
+
+
 if __name__ == '__main__':
     unittest.main()

From 1800cf615df2a0ccfce5aa787690385d7f562650 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:40:10 +0000
Subject: [PATCH 384/868] fixed errno-related regression introduced in 2.4.35

---
 CHANGES                |  4 +++-
 Lib/ldap/ldapobject.py | 11 +++--------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index d3a9235..d4a5318 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,10 +4,12 @@ Released 2.4.37 2017-05-xx
 Changes since 2.4.36:
 
 Lib/
+* fixed errno-related regression introduced in 2.4.35
 
 Tests/
 * added more checks to t_cext.py
 * renamed t_search.py to t_ldapobject.py and code-cleaning
+* added test for errno-related regression to t_ldapobject.py
 
 ----------------------------------------------------------------
 Released 2.4.36 2017-04-26
@@ -1407,4 +1409,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.433 2017/04/27 08:27:33 stroeder Exp $
+$Id: CHANGES,v 1.434 2017/04/27 08:40:10 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 40606c0..ae52733 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.161 2017/04/25 17:50:33 stroeder Exp $
+\$Id: ldapobject.py,v 1.162 2017/04/27 08:40:10 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -111,13 +111,8 @@ def _ldap_call(self,func,*args,**kwargs):
             diagnostic_message_success = self._l.get_option(ldap.OPT_DIAGNOSTIC_MESSAGE)
       finally:
         self._ldap_object_lock.release()
-    except LDAPError,e:
-      if 'info' not in e.args[0]:
-        try:
-          errno = e.args[0]['errno']
-        except KeyError:
-          pass
-        else:
+    except LDAPError, e:
+      if not e.args[0].has_key('info') and e.args[0].has_key('errno'):
           e.args[0]['info'] = strerror(e.args[0]['errno'])
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))

From 060e28adfa930dc0845d97911095217643a87fa4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:41:28 +0000
Subject: [PATCH 385/868] t_search was renamed to t_ldapobject

---
 Tests/__init__.py | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/Tests/__init__.py b/Tests/__init__.py
index db0f9a6..e17e215 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -2,13 +2,13 @@
 python-ldap tests module package
 """
 
-import t_cext 
-import t_ldap_dn 
-import t_ldap_filter 
-import t_ldap_functions 
-import t_ldap_modlist 
-import t_ldap_schema_tokenizer 
-import t_ldapurl 
-import t_ldif 
-import t_search 
+import t_cext
+import t_ldap_dn
+import t_ldap_filter
+import t_ldap_functions
+import t_ldap_modlist
+import t_ldap_schema_tokenizer
+import t_ldapurl
+import t_ldif
+import t_ldapobject
 import t_ldap_schema_subentry

From 1ab02ac8efb36aec8fcc7c17dc7eb8f3a69867ab Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 08:43:14 +0000
Subject: [PATCH 386/868] release 2.4.37 now

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index d4a5318..77777d9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.37 2017-05-xx
+Released 2.4.37 2017-04-27
 
 Changes since 2.4.36:
 
@@ -1409,4 +1409,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.434 2017/04/27 08:40:10 stroeder Exp $
+$Id: CHANGES,v 1.435 2017/04/27 08:43:14 stroeder Exp $

From 92a8394ac889d70480447e939668fc919ecf565d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 11:11:01 +0000
Subject: [PATCH 387/868] started 2.4.38

---
 CHANGES              | 11 ++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 Lib/slapdtest.py     |  4 ++--
 6 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 77777d9..8629cb2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+----------------------------------------------------------------
+Released 2.4.38 2017-05-xx
+
+Changes since 2.4.37:
+
+Lib/
+
+Tests/
+
 ----------------------------------------------------------------
 Released 2.4.37 2017-04-27
 
@@ -1409,4 +1418,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.435 2017/04/27 08:43:14 stroeder Exp $
+$Id: CHANGES,v 1.436 2017/04/27 11:11:01 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index c905b0f..de0b884 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.54 2017/04/26 20:48:43 stroeder Exp $
+$Id: dsml.py,v 1.55 2017/04/27 11:11:01 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.37'
+__version__ = '2.4.38'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 42f2f1b..fd5dc11 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.115 2017/04/26 20:48:43 stroeder Exp $
+$Id: __init__.py,v 1.116 2017/04/27 11:11:01 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.37'
+__version__ = '2.4.38'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 35c5785..112a29a 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.90 2017/04/26 20:48:43 stroeder Exp $
+\$Id: ldapurl.py,v 1.91 2017/04/27 11:11:01 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.37'
+__version__ = '2.4.38'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 0f66300..16897a6 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.110 2017/04/26 20:48:43 stroeder Exp $
+$Id: ldif.py,v 1.111 2017/04/27 11:11:01 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.37'
+__version__ = '2.4.38'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 0996356..4939a78 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.2 2017/04/26 20:46:37 stroeder Exp $
+\$Id: slapdtest.py,v 1.3 2017/04/27 11:11:01 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.37'
+__version__ = '2.4.38'
 
 import os
 import socket

From d787d3f86174c725dc1ae34d9c6876351ea315c5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 11:13:39 +0000
Subject: [PATCH 388/868] slapdtest now evaluates env var SLAPD for optionally
 pointing to OpenLDAP's slapd executable

---
 CHANGES          | 4 +++-
 Lib/slapdtest.py | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8629cb2..2482f05 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,8 @@ Released 2.4.38 2017-05-xx
 Changes since 2.4.37:
 
 Lib/
+* slapdtest now evaluates env var SLAPD for optionally pointing
+  to OpenLDAP's slapd executable
 
 Tests/
 
@@ -1418,4 +1420,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.436 2017/04/27 11:11:01 stroeder Exp $
+$Id: CHANGES,v 1.437 2017/04/27 11:13:39 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 4939a78..836b71e 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.3 2017/04/27 11:11:01 stroeder Exp $
+\$Id: slapdtest.py,v 1.4 2017/04/27 11:13:39 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -105,7 +105,7 @@ class SlapdObject(object):
     INIT_SCHEMA_PATH = os.environ.get('SCHEMA_PATH', os.path.join(SCHEMADIR, INIT_SCHEMA_FILE))
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
-    PATH_SLAPD = os.path.join(SBINDIR, 'slapd')
+    PATH_SLAPD = os.environ.get('SLAPD', os.path.join(SBINDIR, 'slapd'))
     PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
 
     # time in secs to wait before trying to access slapd via LDAP (again)

From 3e6a2eab2f966bae9751e091d8a3175e0aad878d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 12:24:50 +0000
Subject: [PATCH 389/868] added LDAPI support in slaptest.SlapdObject which is
 internally used in methods ldapadd() and ldapwhoami()

---
 CHANGES          |  4 +++-
 Lib/slapdtest.py | 17 ++++++++++-------
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2482f05..5e7ebac 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,8 @@ Changes since 2.4.37:
 Lib/
 * slapdtest now evaluates env var SLAPD for optionally pointing
   to OpenLDAP's slapd executable
+* added LDAPI support in slaptest.SlapdObject which is internally used
+  in methods ldapadd() and ldapwhoami()
 
 Tests/
 
@@ -1420,4 +1422,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.437 2017/04/27 11:13:39 stroeder Exp $
+$Id: CHANGES,v 1.438 2017/04/27 12:24:50 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 836b71e..bc4ff48 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.4 2017/04/27 11:13:39 stroeder Exp $
+\$Id: slapdtest.py,v 1.5 2017/04/27 12:24:50 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -17,6 +17,7 @@
 import subprocess
 import logging
 import unittest
+import urllib
 
 # determine log level
 try:
@@ -114,11 +115,13 @@ class SlapdObject(object):
     def __init__(self):
         self._proc = None
         self._port = find_available_tcp_port(LOCALHOST)
-        self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         self._log = _LOGGER
         self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test')
         self._slapd_conf = os.path.join(self.testrundir, "slapd.conf")
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
+        self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
+        ldapi_path = os.path.join(self.testrundir, 'ldapi-%d' % self._port)
+        self.ldapi_uri = "ldapi://%s" % urllib.quote_plus(ldapi_path)
 
     def _gen_config(self):
         """
@@ -177,9 +180,9 @@ def _start_slapd(self):
         self._log.info("starting slapd")
         self._proc = subprocess.Popen([
             self.PATH_SLAPD,
-            "-f", self._slapd_conf,
-            "-h", self.ldap_uri,
-            "-d", "0",
+            '-f', self._slapd_conf,
+            '-h', '%s' % ' '.join((self.ldap_uri, self.ldapi_uri)),
+            '-d', '0',
         ])
 
     def _wait_for_slapd(self):
@@ -263,7 +266,7 @@ def ldapwhoami(self, extra_args=None):
                 "-x",
                 "-D", self.root_dn,
                 "-w", self.root_pw,
-                "-H", self.ldap_uri
+                "-H", self.ldapi_uri
             ] + extra_args,
             stdin=subprocess.PIPE, stdout=subprocess.PIPE,
         )
@@ -280,7 +283,7 @@ def ldapadd(self, ldif, extra_args=None):
                 "-x",
                 "-D", self.root_dn,
                 "-w", self.root_pw,
-                "-H", self.ldap_uri
+                "-H", self.ldapi_uri
             ] + extra_args,
             stdin=subprocess.PIPE, stdout=subprocess.PIPE,
         )

From 561d4fe063741fdae8a6add512fb0fd45d3c76f5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 16:06:52 +0000
Subject: [PATCH 390/868] more re-factoring of slapdtest and Tests/

---
 CHANGES               |  14 +-
 Lib/slapdtest.py      | 338 +++++++++++++++++++++++-------------------
 Tests/t_ldapobject.py |  18 ++-
 3 files changed, 214 insertions(+), 156 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5e7ebac..d12f1f9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,13 +3,19 @@ Released 2.4.38 2017-05-xx
 
 Changes since 2.4.37:
 
-Lib/
-* slapdtest now evaluates env var SLAPD for optionally pointing
-  to OpenLDAP's slapd executable
+Lib/slapdtest.py
+* SlapdObject now evaluates env var SLAPD for optionally pointing
+  to OpenLDAP's slapd executable (e.g. with OpenLDAP LTB builds)
 * added LDAPI support in slaptest.SlapdObject which is internally used
   in methods ldapadd() and ldapwhoami()
+* fixed enabling logger in slaptest
+* directory name now contains port to be able to run several SlapdObject 
+  instances side-by-side (e.g. with replication)
+* added authz-regexp mapping to rootdn for user running the test
+* internally use SASL/EXTERNAL via LDAPI to bind
 
 Tests/
+* ReconnectLDAPObject is also tested by sub-classing test class
 
 ----------------------------------------------------------------
 Released 2.4.37 2017-04-27
@@ -1422,4 +1428,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.438 2017/04/27 12:24:50 stroeder Exp $
+$Id: CHANGES,v 1.439 2017/04/27 16:06:52 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index bc4ff48..614d3cd 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.5 2017/04/27 12:24:50 stroeder Exp $
+\$Id: slapdtest.py,v 1.6 2017/04/27 16:06:52 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -16,6 +16,7 @@
 import time
 import subprocess
 import logging
+from logging.handlers import SysLogHandler
 import unittest
 import urllib
 
@@ -29,16 +30,17 @@
 except KeyError:
     _LOG_LEVEL = logging.WARN
 
-# initialize the module logger
-_LOGGER = logging.getLogger("python-ldap-slapd")
-_LOGGER.setLevel(_LOG_LEVEL)
-
 # a template string for generating simple slapd.conf file
-SLAPD_CONF_TEMPLATE = """
+SLAPD_CONF_TEMPLATE = r"""
 moduleload back_%(database)s
 include "%(schema_include)s"
 loglevel %(loglevel)s
 allow bind_v2
+
+authz-regexp
+  "gidnumber=%(root_gid)s\\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth"
+  "%(rootdn)s"
+
 database %(database)s
 directory "%(directory)s"
 suffix "%(suffix)s"
@@ -48,36 +50,34 @@
 
 LOCALHOST = '127.0.0.1'
 
-def mkdirs(path):
-    """
-    Creates the directory path unless it already exists
-    """
-    if not os.access(os.path.join(path, os.path.curdir), os.F_OK):
-        _LOGGER.debug("creating temp directory %s", path)
-        os.mkdir(path)
-
-def delete_directory_content(path):
+def combined_logger(
+        log_name,
+        log_level=_LOG_LEVEL,
+        sys_log_format='%(levelname)s %(message)s',
+        console_log_format='%(asctime)s %(levelname)s %(message)s',
+    ):
     """
-    Recursively delete content of directory
+    Returns a combined SysLogHandler/StreamHandler logging instance
+    with formatters
     """
-    for dirpath, dirnames, filenames in os.walk(path, topdown=False):
-        for filename in filenames:
-            _LOGGER.info("remove %s", os.path.join(dirpath, filename))
-            os.remove(os.path.join(dirpath, filename))
-        for dirname in dirnames:
-            _LOGGER.info("rmdir %s", os.path.join(dirpath, dirname))
-            os.rmdir(os.path.join(dirpath, dirname))
-
-def find_available_tcp_port(host=LOCALHOST):
-    """
-    find an available port for TCP connection
-    """
-    sock = socket.socket()
-    sock.bind((host, 0))
-    port = sock.getsockname()[1]
-    sock.close()
-    _LOGGER.info("Found available port %d", port)
-    return port
+    # for writing to syslog
+    new_logger = logging.getLogger(log_name)
+    if sys_log_format:
+        my_syslog_formatter = logging.Formatter(
+            fmt=' '.join((log_name, sys_log_format)))
+        my_syslog_handler = logging.handlers.SysLogHandler(
+            address='/dev/log',
+            facility=SysLogHandler.LOG_DAEMON,
+        )
+        my_syslog_handler.setFormatter(my_syslog_formatter)
+        new_logger.addHandler(my_syslog_handler)
+    if console_log_format:
+        my_stream_formatter = logging.Formatter(fmt=console_log_format)
+        my_stream_handler = logging.StreamHandler()
+        my_stream_handler.setFormatter(my_stream_formatter)
+        new_logger.addHandler(my_stream_handler)
+    new_logger.setLevel(log_level)
+    return new_logger  # end of combined_logger()
 
 class SlapdObject(object):
     """
@@ -97,6 +97,9 @@ class SlapdObject(object):
     root_dn = 'cn=%s,%s' % (root_cn, suffix)
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
+    # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
+    cli_sasl_external = True
+    local_host = '127.0.0.1'
 
     TMPDIR = os.environ.get('TMP', os.getcwd())
     SBINDIR = os.environ.get('SBIN', '/usr/sbin')
@@ -105,6 +108,7 @@ class SlapdObject(object):
     INIT_SCHEMA_FILE = os.environ.get('SCHEMA_FILE', 'core.schema')
     INIT_SCHEMA_PATH = os.environ.get('SCHEMA_PATH', os.path.join(SCHEMADIR, INIT_SCHEMA_FILE))
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
+    PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
     PATH_SLAPD = os.environ.get('SLAPD', os.path.join(SBINDIR, 'slapd'))
     PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
@@ -113,16 +117,54 @@ class SlapdObject(object):
     _start_sleep = 1.5
 
     def __init__(self):
+        self._log = combined_logger('python-ldap-test')
         self._proc = None
-        self._port = find_available_tcp_port(LOCALHOST)
-        self._log = _LOGGER
-        self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test')
-        self._slapd_conf = os.path.join(self.testrundir, "slapd.conf")
+        self._port = self._avail_tcp_port()
+        self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test-%d' % self._port)
+        self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
-        ldapi_path = os.path.join(self.testrundir, 'ldapi-%d' % self._port)
+        ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % urllib.quote_plus(ldapi_path)
 
+    def _setup_rundir(self):
+        """
+        creates rundir structure
+        """
+        os.mkdir(self.testrundir)
+        os.mkdir(self._db_directory)
+
+    def _cleanup_rundir(self):
+        """
+        Recursively delete whole directory specified by `path'
+        """
+        if not os.path.exists(self.testrundir):
+            return
+        self._log.debug('clean-up %s', self.testrundir)
+        for dirpath, dirnames, filenames in os.walk(
+                self.testrundir,
+                topdown=False
+            ):
+            for filename in filenames:
+                self._log.debug('remove %s', os.path.join(dirpath, filename))
+                os.remove(os.path.join(dirpath, filename))
+            for dirname in dirnames:
+                self._log.debug('rmdir %s', os.path.join(dirpath, dirname))
+                os.rmdir(os.path.join(dirpath, dirname))
+        os.rmdir(self.testrundir)
+        self._log.info('cleaned-up %s', self.testrundir)
+
+    def _avail_tcp_port(self):
+        """
+        find an available port for TCP connection
+        """
+        sock = socket.socket()
+        sock.bind((self.local_host, 0))
+        port = sock.getsockname()[1]
+        sock.close()
+        self._log.info('Found available port %d', port)
+        return port
+
     def _gen_config(self):
         """
         generates a slapd.conf and returns it as one string
@@ -135,57 +177,51 @@ def _gen_config(self):
             'suffix': self.suffix,
             'rootdn': self.root_dn,
             'rootpw': self.root_pw,
+            'root_uid': os.getuid(),
+            'root_gid': os.getgid(),
         }
         return self.slapd_conf_template % config_dict
 
     def _write_config(self):
         """Writes the slapd.conf file out, and returns the path to it."""
-        self._log.debug("writing config to %s", self._slapd_conf)
-        config_file = file(self._slapd_conf, "wb")
+        self._log.debug('Writing config to %s', self._slapd_conf)
+        config_file = file(self._slapd_conf, 'wb')
         config_file.write(self._gen_config())
         config_file.close()
+        self._log.info('Wrote config to %s', self._slapd_conf)
 
-    def start(self):
-        """
-        Starts the slapd server process running, and waits for it to come up.
-        """
-        if self._proc is None:
-            start_ok = False
-            config_path = None
-            # init directory structure
-            delete_directory_content(self.testrundir)
-            mkdirs(self.testrundir)
-            mkdirs(self._db_directory)
-            try:
-                self._write_config()
-                self._test_configuration()
-                self._start_slapd()
-                self._wait_for_slapd()
-                start_ok = True
-                self._log.debug("slapd ready at %s", self.ldap_uri)
-                self.started()
-            finally:
-                if not start_ok:
-                    if config_path:
-                        try:
-                            os.remove(config_path)
-                        except os.error:
-                            pass
-                    if self._proc:
-                        self.stop()
+    def _test_config(self):
+        self._log.debug('testing config %s', self._slapd_conf)
+        popen_list = [
+            self.PATH_SLAPTEST,
+            "-f", self._slapd_conf,
+            '-u',
+        ]
+        if self._log.isEnabledFor(logging.DEBUG):
+            popen_list.append('-v')
+            popen_list.extend(['-d', 'config'])
+        else:
+            popen_list.append('-Q')
+        proc = subprocess.Popen(popen_list)
+        if proc.wait() != 0:
+            raise RuntimeError("configuration test failed")
+        self._log.info("config ok: %s", self._slapd_conf)
 
     def _start_slapd(self):
-        # Spawns/forks the slapd process
-        self._write_config()
-        self._log.info("starting slapd")
-        self._proc = subprocess.Popen([
+        """
+        Spawns/forks the slapd process
+        """
+        slapd_args = [
             self.PATH_SLAPD,
             '-f', self._slapd_conf,
             '-h', '%s' % ' '.join((self.ldap_uri, self.ldapi_uri)),
-            '-d', '0',
-        ])
-
-    def _wait_for_slapd(self):
+        ]
+        if self._log.isEnabledFor(logging.DEBUG):
+            slapd_args.extend(['-d', '-1'])
+        else:
+            slapd_args.extend(['-d', '0'])
+        self._log.info('starting slapd: %r', ' '.join(slapd_args))
+        self._proc = subprocess.Popen(slapd_args)
         # Waits until the LDAP server socket is open, or slapd crashed
         while 1:
             if self._proc.poll() is not None:
@@ -200,17 +236,35 @@ def _wait_for_slapd(self):
             else:
                 return
 
+    def start(self):
+        """
+        Starts the slapd server process running, and waits for it to come up.
+        """
+        if self._proc is None:
+            config_path = None
+            # prepare directory structure
+            self._cleanup_rundir()
+            self._setup_rundir()
+            try:
+                self._write_config()
+                self._test_config()
+                self._start_slapd()
+                self._log.debug(
+                    'slapd with pid=%d listing on %s and %s',
+                    self._proc.pid, self.ldap_uri, self.ldapi_uri
+                )
+                self.started()
+            finally:
+                pass
+                #self._cleanup_rundir()
+
     def stop(self):
         """Stops the slapd server, and waits for it to terminate"""
         if self._proc is not None:
-            self._log.debug("stopping slapd")
-            if hasattr(self._proc, 'terminate'):
-                self._proc.terminate()
-            else:
-                import posix
-                import signal
-                posix.kill(self._proc.pid, signal.SIGTERM)
+            self._log.debug('stopping slapd with pid %d', self._proc.pid)
+            self._proc.terminate()
             self.wait()
+        self._cleanup_rundir()
 
     def restart(self):
         """
@@ -229,67 +283,62 @@ def wait(self):
     def _stopped(self):
         """Called when the slapd server is known to have terminated"""
         if self._proc is not None:
-            self._log.info("slapd terminated")
+            self._log.info('slapd terminated')
             self._proc = None
             try:
                 os.remove(self._slapd_conf)
             except os.error:
-                self._log.debug("could not remove %s", self._slapd_conf)
-
-    def _test_configuration(self):
-        self._log.debug("testing configuration")
-        popen_list = [
-            self.PATH_SLAPTEST,
-            "-f", self._slapd_conf,
-            '-u',
-        ]
-        if self._log.isEnabledFor(logging.DEBUG):
-            popen_list.append('-v')
-            popen_list.extend(['-d', 'config'])
+                self._log.debug('could not remove %s', self._slapd_conf)
+
+    def _cli_auth_args(self):
+        if self.cli_sasl_external:
+            authc_args = [
+                '-Y', 'EXTERNAL',
+            ]
+            if not self._log.isEnabledFor(logging.DEBUG):
+                authc_args.append('-Q')
         else:
-            popen_list.append('-Q')
-        try:
-            proc = subprocess.Popen(popen_list)
-            if proc.wait() != 0:
-                raise RuntimeError("configuration test failed")
-            self._log.debug("configuration seems ok")
-        finally:
-            os.remove(self._slapd_conf)
+            authc_args = [
+                '-x',
+                '-D', self.root_dn,
+                '-w', self.root_pw,
+            ]
+        return authc_args
+
+    def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None, stdin_data=None):
+        args = [
+            ldapcommand,
+            '-H', ldap_uri or self.ldapi_uri,
+        ] + self._cli_auth_args() + (extra_args or [])
+        self._log.debug('Run command: %r', ' '.join(args))
+        proc = subprocess.Popen(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+        self._log.debug('stdin_data=%r', stdin_data)
+        stdout_data, stderr_data = proc.communicate(stdin_data)
+        if stdout_data is not None:
+            self._log.debug('stdout_data=%r', stdout_data)
+        if stderr_data is not None:
+            self._log.debug('stderr_data=%r', stderr_data)
+        if proc.wait() != 0:
+            raise RuntimeError('ldapadd process failed')
+        return stdout_data, stderr_data
 
     def ldapwhoami(self, extra_args=None):
-        """Runs ldapwhoami on this slapd instance"""
-        extra_args = extra_args or []
-        self._log.debug("whoami")
-        proc = subprocess.Popen(
-            [
-                self.PATH_LDAPWHOAMI,
-                "-x",
-                "-D", self.root_dn,
-                "-w", self.root_pw,
-                "-H", self.ldapi_uri
-            ] + extra_args,
-            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-        )
-        if proc.wait() != 0:
-            raise RuntimeError("ldapwhoami process failed")
+        """
+        Runs ldapwhoami on this slapd instance
+        """
+        self._cli_popen(self.PATH_LDAPWHOAMI, extra_args=extra_args)
 
     def ldapadd(self, ldif, extra_args=None):
-        """Runs ldapadd on this slapd instance, passing it the ldif content"""
-        extra_args = extra_args or []
-        self._log.debug("adding %s", repr(ldif))
-        proc = subprocess.Popen(
-            [
-                self.PATH_LDAPADD,
-                "-x",
-                "-D", self.root_dn,
-                "-w", self.root_pw,
-                "-H", self.ldapi_uri
-            ] + extra_args,
-            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-        )
-        proc.communicate(ldif)
-        if proc.wait() != 0:
-            raise RuntimeError("ldapadd process failed")
+        """
+        Runs ldapadd on this slapd instance, passing it the ldif content
+        """
+        self._cli_popen(self.PATH_LDAPADD, extra_args=extra_args, stdin_data=ldif)
+
+    def ldapmodify(self, ldif, extra_args=None):
+        """
+        Runs ldapadd on this slapd instance, passing it the ldif content
+        """
+        self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args, stdin_data=ldif)
 
     def started(self):
         """
@@ -334,27 +383,18 @@ def _open_ldap_conn(self, who=None, cred=None):
         """
         return a LDAPObject instance after simple bind
         """
-        import ldap
         ldap_conn = self.ldap_object_class(self.server.ldap_uri)
         ldap_conn.protocol_version = 3
-        ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
+        #ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
         ldap_conn.simple_bind_s(who or self.server.root_dn, cred or self.server.root_pw)
         return ldap_conn
 
     @classmethod
     def setUpClass(cls):
-        if cls.server is None:
-            cls.server = cls.server_class()
-            cls.server.start()
+        cls.server = cls.server_class()
+        cls.server.start()
         cls.server = cls.server
 
     @classmethod
     def tearDownClass(cls):
-        try:
-            cls.server.stop()
-        except AttributeError:
-            pass
-        try:
-            delete_directory_content(cls.server.testrundir)
-        except AttributeError:
-            pass
+        cls.server.stop()
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index ac21922..b7767f1 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -10,7 +10,7 @@
 os.environ['LDAPNOINIT'] = '1'
 
 import ldap
-from ldap.ldapobject import LDAPObject
+from ldap.ldapobject import SimpleLDAPObject, ReconnectLDAPObject
 
 LDIF_TEMPLATE = """dn: cn=Foo1,%(suffix)s
 objectClass: organizationalRole
@@ -35,12 +35,12 @@
 """
 
 
-class TestLDAPObject(SlapdTestCase):
+class Test01_SimpleLDAPObject(SlapdTestCase):
     """
     test LDAP search operations
     """
 
-    ldap_object_class = LDAPObject
+    ldap_object_class = SimpleLDAPObject
 
     @classmethod
     def setUpClass(cls):
@@ -151,5 +151,17 @@ def test_invalid_credentials(self):
             self.fail("expected INVALID_CREDENTIALS, got %r" % r)
 
 
+class Test02_ReconnectLDAPObject(Test01_SimpleLDAPObject):
+    """
+    test LDAP search operations
+    """
+
+    ldap_object_class = ReconnectLDAPObject
+
+    @classmethod
+    def setUpClass(cls):
+        Test01_SimpleLDAPObject.setUpClass()
+
+
 if __name__ == '__main__':
     unittest.main()

From 48b65a4fd779d56e912755389f0eb9018cb8ce11 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 16:10:27 +0000
Subject: [PATCH 391/868] added method slaptest.SlapdObject.ldapmodify()

---
 CHANGES | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index d12f1f9..e158a1c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ Lib/slapdtest.py
   to OpenLDAP's slapd executable (e.g. with OpenLDAP LTB builds)
 * added LDAPI support in slaptest.SlapdObject which is internally used
   in methods ldapadd() and ldapwhoami()
+* added method slaptest.SlapdObject.ldapmodify()
 * fixed enabling logger in slaptest
 * directory name now contains port to be able to run several SlapdObject 
   instances side-by-side (e.g. with replication)
@@ -1428,4 +1429,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.439 2017/04/27 16:06:52 stroeder Exp $
+$Id: CHANGES,v 1.440 2017/04/27 16:10:27 stroeder Exp $

From b17af2596a80b5968da008e8ed74ae7944803de5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 16:45:19 +0000
Subject: [PATCH 392/868] more re-factoring of slapdtest

---
 CHANGES          |  3 ++-
 Lib/slapdtest.py | 39 +++++++++++++++++----------------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/CHANGES b/CHANGES
index e158a1c..530e245 100644
--- a/CHANGES
+++ b/CHANGES
@@ -14,6 +14,7 @@ Lib/slapdtest.py
   instances side-by-side (e.g. with replication)
 * added authz-regexp mapping to rootdn for user running the test
 * internally use SASL/EXTERNAL via LDAPI to bind
+* SlapdObject.server_id used as serverID in slapd.conf for MMR
 
 Tests/
 * ReconnectLDAPObject is also tested by sub-classing test class
@@ -1429,4 +1430,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.440 2017/04/27 16:10:27 stroeder Exp $
+$Id: CHANGES,v 1.441 2017/04/27 16:45:19 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 614d3cd..7255781 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.6 2017/04/27 16:06:52 stroeder Exp $
+\$Id: slapdtest.py,v 1.7 2017/04/27 16:45:19 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -32,6 +32,7 @@
 
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = r"""
+serverID %(serverid)s
 moduleload back_%(database)s
 include "%(schema_include)s"
 loglevel %(loglevel)s
@@ -120,12 +121,16 @@ def __init__(self):
         self._log = combined_logger('python-ldap-test')
         self._proc = None
         self._port = self._avail_tcp_port()
+        self.server_id = self._port % 4096
         self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test-%d' % self._port)
         self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % urllib.quote_plus(ldapi_path)
+        assert self.suffix.startswith("dc=")
+        assert self.root_dn.startswith("cn=")
+        assert self.root_dn.endswith("," + self.suffix)
 
     def _setup_rundir(self):
         """
@@ -170,6 +175,7 @@ def _gen_config(self):
         generates a slapd.conf and returns it as one string
         """
         config_dict = {
+            'serverid': hex(self.server_id),
             'schema_include': self.INIT_SCHEMA_PATH,
             'loglevel': self.slapd_loglevel,
             'database': self.database,
@@ -229,7 +235,7 @@ def _start_slapd(self):
                 raise RuntimeError("slapd exited before opening port")
             time.sleep(self._start_sleep)
             try:
-                self._log.debug("Connecting to %s", self.ldap_uri)
+                self._log.debug("slapd connection check to %s", self.ldapi_uri)
                 self.ldapwhoami()
             except RuntimeError:
                 pass
@@ -245,18 +251,14 @@ def start(self):
             # prepare directory structure
             self._cleanup_rundir()
             self._setup_rundir()
-            try:
-                self._write_config()
-                self._test_config()
-                self._start_slapd()
-                self._log.debug(
-                    'slapd with pid=%d listing on %s and %s',
-                    self._proc.pid, self.ldap_uri, self.ldapi_uri
-                )
-                self.started()
-            finally:
-                pass
-                #self._cleanup_rundir()
+            self._write_config()
+            self._test_config()
+            self._start_slapd()
+            self._log.debug(
+                'slapd with pid=%d listening on %s and %s',
+                self._proc.pid, self.ldap_uri, self.ldapi_uri
+            )
+            self.started()
 
     def stop(self):
         """Stops the slapd server, and waits for it to terminate"""
@@ -285,10 +287,6 @@ def _stopped(self):
         if self._proc is not None:
             self._log.info('slapd terminated')
             self._proc = None
-            try:
-                os.remove(self._slapd_conf)
-            except os.error:
-                self._log.debug('could not remove %s', self._slapd_conf)
 
     def _cli_auth_args(self):
         if self.cli_sasl_external:
@@ -346,10 +344,7 @@ def started(self):
         By default, this method adds the two initial objects,
         the domain object and the root user object.
         """
-        assert self.suffix.startswith("dc=")
         suffix_dc = self.suffix.split(',')[0][3:]
-        assert self.root_dn.startswith("cn=")
-        assert self.root_dn.endswith("," + self.suffix)
         self._log.debug(
             "adding %s and %s",
             self.suffix,
@@ -364,7 +359,7 @@ def started(self):
                 'o: '+suffix_dc,
                 '',
                 'dn: '+self.root_dn,
-                'objectClass: organizationalRole',
+                'objectClass: applicationProcess',
                 'cn: '+self.root_cn,
                 ''
             ])

From 900d3282f59b32921814dabbe40833d7014c262a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 27 Apr 2017 21:13:00 +0000
Subject: [PATCH 393/868] Test02_ReconnectLDAPObject.setUpClass() not needed

---
 Tests/t_ldapobject.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index b7767f1..6c650e8 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -158,10 +158,6 @@ class Test02_ReconnectLDAPObject(Test01_SimpleLDAPObject):
 
     ldap_object_class = ReconnectLDAPObject
 
-    @classmethod
-    def setUpClass(cls):
-        Test01_SimpleLDAPObject.setUpClass()
-
 
 if __name__ == '__main__':
     unittest.main()

From 31784791b62225898600da1fd80c28fe665326c1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 06:21:04 +0000
Subject: [PATCH 394/868] Removed method SlapdObject.started()

---
 CHANGES               |  6 ++++--
 Tests/t_cext.py       | 25 +++++++++++++++++++++++++
 Tests/t_ldapobject.py | 24 ++++++++++++++++++++++--
 3 files changed, 51 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 530e245..1b84aa2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,11 +10,13 @@ Lib/slapdtest.py
   in methods ldapadd() and ldapwhoami()
 * added method slaptest.SlapdObject.ldapmodify()
 * fixed enabling logger in slaptest
-* directory name now contains port to be able to run several SlapdObject 
+* directory name now contains port to be able to run several SlapdObject
   instances side-by-side (e.g. with replication)
 * added authz-regexp mapping to rootdn for user running the test
 * internally use SASL/EXTERNAL via LDAPI to bind
 * SlapdObject.server_id used as serverID in slapd.conf for MMR
+* Removed method SlapdObject.started() because SlapdTestCase.setUpClass()
+  will be used to add initial entries
 
 Tests/
 * ReconnectLDAPObject is also tested by sub-classing test class
@@ -1430,4 +1432,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.441 2017/04/27 16:45:19 stroeder Exp $
+$Id: CHANGES,v 1.442 2017/04/28 06:21:04 stroeder Exp $
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 1da4116..173c28d 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -21,6 +21,31 @@ class TestLdapCExtension(SlapdTestCase):
 
     timeout = 5
 
+    @classmethod
+    def setUpClass(cls):
+        SlapdTestCase.setUpClass()
+        # add two initial objects after server was started and is still empty
+        suffix_dc = cls.server.suffix.split(',')[0][3:]
+        cls.server._log.debug(
+            "adding %s and %s",
+            cls.server.suffix,
+            cls.server.root_dn,
+        )
+        cls.server.ldapadd(
+            "\n".join([
+                'dn: '+cls.server.suffix,
+                'objectClass: dcObject',
+                'objectClass: organization',
+                'dc: '+suffix_dc,
+                'o: '+suffix_dc,
+                '',
+                'dn: '+cls.server.root_dn,
+                'objectClass: applicationProcess',
+                'cn: '+cls.server.root_cn,
+                ''
+            ])
+        )
+
     def _open_conn(self, bind=True):
         """
         Starts a server, and returns a LDAPObject bound to it
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 6c650e8..4795ac4 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -12,7 +12,19 @@
 import ldap
 from ldap.ldapobject import SimpleLDAPObject, ReconnectLDAPObject
 
-LDIF_TEMPLATE = """dn: cn=Foo1,%(suffix)s
+LDIF_TEMPLATE = """dn: %(suffix)s
+objectClass: dcObject
+objectClass: organization
+dc: %(dc)s
+o: %(dc)s
+
+dn: %(rootdn)s
+objectClass: applicationProcess
+objectClass: simpleSecurityObject
+cn: %(rootcn)s
+userPassword: %(rootpw)s
+
+dn: cn=Foo1,%(suffix)s
 objectClass: organizationalRole
 cn: Foo1
 
@@ -46,7 +58,15 @@ class Test01_SimpleLDAPObject(SlapdTestCase):
     def setUpClass(cls):
         SlapdTestCase.setUpClass()
         # insert some Foo* objects via ldapadd
-        cls.server.ldapadd(LDIF_TEMPLATE % {'suffix':cls.server.suffix})
+        cls.server.ldapadd(
+            LDIF_TEMPLATE % {
+                'suffix':cls.server.suffix,
+                'rootdn':cls.server.root_dn,
+                'rootcn':cls.server.root_cn,
+                'rootpw':cls.server.root_pw,
+                'dc': cls.server.suffix.split(',')[0][3:],
+            }
+        )
 
     def setUp(self):
         try:

From 2afdc24f11e8214f46502d6ae6cf84055a521063 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 06:34:20 +0000
Subject: [PATCH 395/868] Removed method SlapdObject.started()

---
 Lib/slapdtest.py | 30 +-----------------------------
 1 file changed, 1 insertion(+), 29 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 7255781..ce015fc 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.7 2017/04/27 16:45:19 stroeder Exp $
+\$Id: slapdtest.py,v 1.8 2017/04/28 06:34:20 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -258,7 +258,6 @@ def start(self):
                 'slapd with pid=%d listening on %s and %s',
                 self._proc.pid, self.ldap_uri, self.ldapi_uri
             )
-            self.started()
 
     def stop(self):
         """Stops the slapd server, and waits for it to terminate"""
@@ -338,33 +337,6 @@ def ldapmodify(self, ldif, extra_args=None):
         """
         self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args, stdin_data=ldif)
 
-    def started(self):
-        """
-        This method is called when the LDAP server has started up and is empty.
-        By default, this method adds the two initial objects,
-        the domain object and the root user object.
-        """
-        suffix_dc = self.suffix.split(',')[0][3:]
-        self._log.debug(
-            "adding %s and %s",
-            self.suffix,
-            self.root_dn,
-        )
-        self.ldapadd(
-            "\n".join([
-                'dn: '+self.suffix,
-                'objectClass: dcObject',
-                'objectClass: organization',
-                'dc: '+suffix_dc,
-                'o: '+suffix_dc,
-                '',
-                'dn: '+self.root_dn,
-                'objectClass: applicationProcess',
-                'cn: '+self.root_cn,
-                ''
-            ])
-        )
-
 
 class SlapdTestCase(unittest.TestCase):
     """

From b6e058ec8a430afd8983abe3a02f58341b36f974 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 07:30:58 +0000
Subject: [PATCH 396/868] unified module __doc__ and encoding declaration

---
 Lib/slapdtest.py                 | 3 ++-
 Tests/__init__.py                | 7 ++++++-
 Tests/t_cext.py                  | 7 ++++++-
 Tests/t_ldap_dn.py               | 6 +++++-
 Tests/t_ldap_filter.py           | 6 +++++-
 Tests/t_ldap_functions.py        | 6 +++++-
 Tests/t_ldap_modlist.py          | 8 +++++++-
 Tests/t_ldap_schema_subentry.py  | 7 ++++++-
 Tests/t_ldap_schema_tokenizer.py | 7 ++++++-
 Tests/t_ldapobject.py            | 7 ++++++-
 Tests/t_ldapurl.py               | 9 +++++++++
 11 files changed, 63 insertions(+), 10 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index ce015fc..ee32814 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -1,9 +1,10 @@
+# -*- coding: utf-8 -*-
 """
 slapdtest - module for spawning test instances of OpenLDAP's slapd server
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.8 2017/04/28 06:34:20 stroeder Exp $
+\$Id: slapdtest.py,v 1.9 2017/04/28 07:30:58 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
diff --git a/Tests/__init__.py b/Tests/__init__.py
index e17e215..cd0b8d8 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -1,5 +1,10 @@
+# -*- coding: utf-8 -*-
 """
-python-ldap tests module package
+Automatic tests for python-ldap
+
+See http://www.python-ldap.org/ for details.
+
+$Id: __init__.py,v 1.5 2017/04/28 07:30:59 stroeder Exp $
 """
 
 import t_cext
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 173c28d..cde242a 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -1,5 +1,10 @@
+# -*- coding: utf-8 -*-
 """
-Tests the LDAP C Extension module called _ldap
+Automatic tests for python-ldap's C wrapper module _ldap
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_cext.py,v 1.22 2017/04/28 07:30:59 stroeder Exp $
 """
 
 import os
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index ee47e07..df18f03 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -1,6 +1,10 @@
 # -*- coding: utf-8 -*-
 """
-Automatic tests for module ldap.dn
+Automatic tests for python-ldap's module ldap.dn
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_dn.py,v 1.4 2017/04/28 07:30:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index 2fe1f2f..60041cb 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -1,6 +1,10 @@
 # -*- coding: utf-8 -*-
 """
-Automatic tests for module ldap.filter
+Automatic tests for python-ldap's module ldap.filter
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_filter.py,v 1.3 2017/04/28 07:30:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
index 6947352..ac5f3b3 100644
--- a/Tests/t_ldap_functions.py
+++ b/Tests/t_ldap_functions.py
@@ -1,6 +1,10 @@
 # -*- coding: utf-8 -*-
 """
-Automatic tests for module ldap.functions
+Automatic tests for python-ldap's module ldap.functions
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_functions.py,v 1.2 2017/04/28 07:30:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
index 3d24a70..04a913b 100644
--- a/Tests/t_ldap_modlist.py
+++ b/Tests/t_ldap_modlist.py
@@ -1,6 +1,12 @@
+# -*- coding: utf-8 -*-
 """
-Tests for module ldap.modlist
+Automatic tests for python-ldap's module ldap.modlist
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_modlist.py,v 1.2 2017/04/28 07:30:59 stroeder Exp $
 """
+
 import unittest
 
 import ldap
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index e24f1db..3131969 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -1,5 +1,10 @@
+# -*- coding: utf-8 -*-
 """
-test class ldap.schema.SubSchema
+Automatic tests for python-ldap's class ldap.schema.SubSchema
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_schema_subentry.py,v 1.2 2017/04/28 07:30:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index a574db9..2ba50ab 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -1,5 +1,10 @@
+# -*- coding: utf-8 -*-
 """
-test module ldap.schema.tokenizer
+Automatic tests for python-ldap's module ldap.schema.tokenizer
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_schema_tokenizer.py,v 1.10 2017/04/28 07:30:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 4795ac4..fbd69d0 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -1,5 +1,10 @@
+# -*- coding: utf-8 -*-
 """
-test LDAP operations with ldap.ldapobject
+Automatic tests for python-ldap's module ldap.ldapobject
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldapobject.py,v 1.7 2017/04/28 07:30:59 stroeder Exp $
 """
 
 import os
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 9d78f6f..0e99244 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -1,3 +1,12 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for python-ldap's module ldapurl
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldapurl.py,v 1.12 2017/04/28 07:30:59 stroeder Exp $
+"""
+
 import unittest
 import urllib
 

From a40ee184df9a5315597d171185bbdc5f75434c2c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 08:59:09 +0000
Subject: [PATCH 397/868] no global _LOG_LEVEL, make pylint happy

---
 Lib/slapdtest.py | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index ee32814..3b3b545 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: slapdtest.py,v 1.9 2017/04/28 07:30:58 stroeder Exp $
+$Id: slapdtest.py,v 1.10 2017/04/28 08:59:09 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -21,16 +21,6 @@
 import unittest
 import urllib
 
-# determine log level
-try:
-    _LOG_LEVEL = os.environ['LOGLEVEL']
-    try:
-        _LOG_LEVEL = int(_LOG_LEVEL)
-    except ValueError:
-        pass
-except KeyError:
-    _LOG_LEVEL = logging.WARN
-
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = r"""
 serverID %(serverid)s
@@ -54,7 +44,7 @@
 
 def combined_logger(
         log_name,
-        log_level=_LOG_LEVEL,
+        log_level=logging.WARN,
         sys_log_format='%(levelname)s %(message)s',
         console_log_format='%(asctime)s %(levelname)s %(message)s',
     ):
@@ -62,6 +52,12 @@ def combined_logger(
     Returns a combined SysLogHandler/StreamHandler logging instance
     with formatters
     """
+    if 'LOGLEVEL' in os.environ:
+        log_level = os.environ['LOGLEVEL']
+        try:
+            log_level = int(log_level)
+        except ValueError:
+            pass
     # for writing to syslog
     new_logger = logging.getLogger(log_name)
     if sys_log_format:
@@ -81,6 +77,7 @@ def combined_logger(
     new_logger.setLevel(log_level)
     return new_logger  # end of combined_logger()
 
+
 class SlapdObject(object):
     """
     Controller class for a slapd instance, OpenLDAP's server.
@@ -247,8 +244,8 @@ def start(self):
         """
         Starts the slapd server process running, and waits for it to come up.
         """
+
         if self._proc is None:
-            config_path = None
             # prepare directory structure
             self._cleanup_rundir()
             self._setup_rundir()
@@ -346,6 +343,7 @@ class SlapdTestCase(unittest.TestCase):
 
     server_class = SlapdObject
     server = None
+    ldap_object_class = None
 
     def _open_ldap_conn(self, who=None, cred=None):
         """

From 19e21dd11da800da32748791ac26a3c275ee3b98 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 09:03:22 +0000
Subject: [PATCH 398/868] release 2.4.38 now

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1b84aa2..910e2ae 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.38 2017-05-xx
+Released 2.4.38 2017-04-28
 
 Changes since 2.4.37:
 
@@ -1432,4 +1432,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.442 2017/04/28 06:21:04 stroeder Exp $
+$Id: CHANGES,v 1.443 2017/04/28 09:03:22 stroeder Exp $

From 722247574f4c8ed79f7c5f58743ddb2d3ba6fbf8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 20:01:50 +0000
Subject: [PATCH 399/868] removed obsolete assert statements

---
 CHANGES          | 10 +++++++++-
 Lib/slapdtest.py |  5 +----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 910e2ae..40a0cfd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.39 2017-05-xx
+
+Changes since 2.4.38:
+
+Lib/slapdtest.py
+* Removed obsolete assert statements
+
 ----------------------------------------------------------------
 Released 2.4.38 2017-04-28
 
@@ -1432,4 +1440,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.443 2017/04/28 09:03:22 stroeder Exp $
+$Id: CHANGES,v 1.445 2017/04/28 20:04:34 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 3b3b545..e7a34ed 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.10 2017/04/28 08:59:09 stroeder Exp $
+$Id: slapdtest.py,v 1.11 2017/04/28 20:01:50 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -126,9 +126,6 @@ def __init__(self):
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % urllib.quote_plus(ldapi_path)
-        assert self.suffix.startswith("dc=")
-        assert self.root_dn.startswith("cn=")
-        assert self.root_dn.endswith("," + self.suffix)
 
     def _setup_rundir(self):
         """

From 663a276e9dd5f57c74fa1fb10df1944af46e8855 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 28 Apr 2017 20:03:51 +0000
Subject: [PATCH 400/868] started 2.4.39

---
 CHANGES              | 5 +----
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 5 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/CHANGES b/CHANGES
index 40a0cfd..83569eb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,9 +3,6 @@ Released 2.4.39 2017-05-xx
 
 Changes since 2.4.38:
 
-Lib/slapdtest.py
-* Removed obsolete assert statements
-
 ----------------------------------------------------------------
 Released 2.4.38 2017-04-28
 
@@ -1440,4 +1437,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.445 2017/04/28 20:04:34 stroeder Exp $
+$Id: CHANGES,v 1.444 2017/04/28 20:03:52 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index de0b884..d1c854b 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.55 2017/04/27 11:11:01 stroeder Exp $
+$Id: dsml.py,v 1.56 2017/04/28 20:03:51 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.38'
+__version__ = '2.4.39'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index fd5dc11..939d0be 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.116 2017/04/27 11:11:01 stroeder Exp $
+$Id: __init__.py,v 1.117 2017/04/28 20:03:52 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.38'
+__version__ = '2.4.39'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 112a29a..73fe73a 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.91 2017/04/27 11:11:01 stroeder Exp $
+\$Id: ldapurl.py,v 1.92 2017/04/28 20:03:51 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.38'
+__version__ = '2.4.39'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 16897a6..ce37a07 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.111 2017/04/27 11:11:01 stroeder Exp $
+$Id: ldif.py,v 1.112 2017/04/28 20:03:51 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.38'
+__version__ = '2.4.39'
 
 __all__ = [
   # constants

From 0e0c191d20157ea573aace5d11383184220f8c95 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 29 May 2017 09:00:15 +0000
Subject: [PATCH 401/868] fixed errno-related ldap.TIMEOUT regression

---
 CHANGES                | 8 +++++++-
 Lib/ldap/ldapobject.py | 7 +++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 83569eb..df6fa92 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,12 @@ Released 2.4.39 2017-05-xx
 
 Changes since 2.4.38:
 
+Lib/
+* fixed errno-related ldap.TIMEOUT regression
+
+Lib/slapdtest.py
+* Removed obsolete assert statements
+
 ----------------------------------------------------------------
 Released 2.4.38 2017-04-28
 
@@ -1437,4 +1443,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.444 2017/04/28 20:03:52 stroeder Exp $
+$Id: CHANGES,v 1.446 2017/05/29 09:00:15 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index ae52733..40bb016 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.162 2017/04/27 08:40:10 stroeder Exp $
+\$Id: ldapobject.py,v 1.163 2017/05/29 09:00:15 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -112,8 +112,11 @@ def _ldap_call(self,func,*args,**kwargs):
       finally:
         self._ldap_object_lock.release()
     except LDAPError, e:
-      if not e.args[0].has_key('info') and e.args[0].has_key('errno'):
+      try:
+        if not e.args[0].has_key('info') and e.args[0].has_key('errno'):
           e.args[0]['info'] = strerror(e.args[0]['errno'])
+      except IndexError:
+        pass
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
       raise

From fa524554c2cd3989b6d142ad61d6720cd2c56135 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 31 May 2017 12:35:00 +0000
Subject: [PATCH 402/868] prepare release 2.4.39

---
 CHANGES          | 4 ++--
 Lib/slapdtest.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index df6fa92..1b65f40 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.39 2017-05-xx
+Released 2.4.39 2017-05-31
 
 Changes since 2.4.38:
 
@@ -1443,4 +1443,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.446 2017/05/29 09:00:15 stroeder Exp $
+$Id: CHANGES,v 1.447 2017/05/31 12:35:00 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index e7a34ed..67e5464 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.11 2017/04/28 20:01:50 stroeder Exp $
+$Id: slapdtest.py,v 1.12 2017/05/31 12:35:00 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.38'
+__version__ = '2.4.39'
 
 import os
 import socket

From 0a39b18adf2a857d934b64f38401500293291c93 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 23 Jun 2017 07:16:26 +0000
Subject: [PATCH 403/868] started 2.4.40

---
 CHANGES              | 7 ++++++-
 Lib/dsml.py          | 4 ++--
 Lib/ldap/__init__.py | 4 ++--
 Lib/ldapurl.py       | 4 ++--
 Lib/ldif.py          | 4 ++--
 Lib/slapdtest.py     | 4 ++--
 6 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1b65f40..8cb2016 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+----------------------------------------------------------------
+Released 2.4.40 2017-06-xx
+
+Changes since 2.4.39:
+
 ----------------------------------------------------------------
 Released 2.4.39 2017-05-31
 
@@ -1443,4 +1448,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.447 2017/05/31 12:35:00 stroeder Exp $
+$Id: CHANGES,v 1.448 2017/06/23 07:16:26 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index d1c854b..0449628 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.56 2017/04/28 20:03:51 stroeder Exp $
+$Id: dsml.py,v 1.57 2017/06/23 07:16:26 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.39'
+__version__ = '2.4.40'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 939d0be..45d4c27 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.117 2017/04/28 20:03:52 stroeder Exp $
+$Id: __init__.py,v 1.118 2017/06/23 07:16:26 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.39'
+__version__ = '2.4.40'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 73fe73a..65d7dc9 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.92 2017/04/28 20:03:51 stroeder Exp $
+\$Id: ldapurl.py,v 1.93 2017/06/23 07:16:26 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.39'
+__version__ = '2.4.40'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index ce37a07..6dce79a 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.112 2017/04/28 20:03:51 stroeder Exp $
+$Id: ldif.py,v 1.113 2017/06/23 07:16:26 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.39'
+__version__ = '2.4.40'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 67e5464..c1d57c8 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.12 2017/05/31 12:35:00 stroeder Exp $
+$Id: slapdtest.py,v 1.13 2017/06/23 07:16:26 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.39'
+__version__ = '2.4.40'
 
 import os
 import socket

From 8a3484cd91c9904ceb5402a3d817c4ec0c4264d3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Fri, 23 Jun 2017 18:09:59 +0000
Subject: [PATCH 404/868] fixed memory leaks when using extended controls

---
 CHANGES               | 6 +++++-
 Modules/ldapcontrol.c | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8cb2016..aacffd1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,10 @@ Released 2.4.40 2017-06-xx
 
 Changes since 2.4.39:
 
+Modules/
+* fixed memory leaks when using extended controls
+  (thanks to Erik Cumps)
+
 ----------------------------------------------------------------
 Released 2.4.39 2017-05-31
 
@@ -1448,4 +1452,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.448 2017/06/23 07:16:26 stroeder Exp $
+$Id: CHANGES,v 1.449 2017/06/23 18:09:59 stroeder Exp $
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 14a8625..a1097b3 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -1,5 +1,5 @@
 /* See http://www.python-ldap.org/ for details.
- * $Id: ldapcontrol.c,v 1.20 2011/10/26 18:38:06 stroeder Exp $ */
+ * $Id: ldapcontrol.c,v 1.21 2017/06/23 18:09:59 stroeder Exp $ */
 
 #include "common.h"
 #include "LDAPObject.h"
@@ -231,6 +231,7 @@ encode_rfc3876(PyObject *self, PyObject *args)
 	}
 
 	res = LDAPberval_to_object(ctrl_val);
+	ber_bvfree(ctrl_val);
 
 endlbl:
 	if (vrber)
@@ -287,6 +288,7 @@ encode_rfc2696(PyObject *self, PyObject *args)
     }
 
     res = LDAPberval_to_object(ctrl_val);
+    ber_bvfree(ctrl_val);
 
  endlbl:
     if (ber)
@@ -324,6 +326,7 @@ decode_rfc2696(PyObject *self, PyObject *args)
     }
 
     res = Py_BuildValue("(lO&)", count, LDAPberval_to_object, cookiep);
+    ber_bvfree(cookiep);
 
  endlbl:
     if (ber)

From d567af934b48a7660832794b629917f2f3216b4b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 27 Jun 2017 18:38:08 +0000
Subject: [PATCH 405/868] release 2.4.40 now

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index aacffd1..50204fd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.40 2017-06-xx
+Released 2.4.40 2017-06-27
 
 Changes since 2.4.39:
 
@@ -1452,4 +1452,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.449 2017/06/23 18:09:59 stroeder Exp $
+$Id: CHANGES,v 1.450 2017/06/27 18:38:08 stroeder Exp $

From 6390b59ba7a5bb77fe33b5d39848f210f8b73105 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Jul 2017 17:30:12 +0000
Subject: [PATCH 406/868] started 2.4.41: Added support for increment: lines in
 LDIF changes records

---
 CHANGES              | 10 +++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          | 11 ++++++-----
 Lib/slapdtest.py     |  4 ++--
 6 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/CHANGES b/CHANGES
index 50204fd..9306264 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.40 2017-07-xx
+
+Changes since 2.4.40:
+
+Lib/
+* Added support for increment: lines in LDIF changes records
+
 ----------------------------------------------------------------
 Released 2.4.40 2017-06-27
 
@@ -1452,4 +1460,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.450 2017/06/27 18:38:08 stroeder Exp $
+$Id: CHANGES,v 1.451 2017/07/12 17:30:12 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 0449628..4d78bb8 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.57 2017/06/23 07:16:26 stroeder Exp $
+$Id: dsml.py,v 1.58 2017/07/12 17:30:12 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.40'
+__version__ = '2.4.41'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 45d4c27..6be3ce6 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.118 2017/06/23 07:16:26 stroeder Exp $
+$Id: __init__.py,v 1.119 2017/07/12 17:30:12 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.40'
+__version__ = '2.4.41'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 65d7dc9..ba0ea8a 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.93 2017/06/23 07:16:26 stroeder Exp $
+\$Id: ldapurl.py,v 1.94 2017/07/12 17:30:12 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.40'
+__version__ = '2.4.41'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 6dce79a..bfd0dc5 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.113 2017/06/23 07:16:26 stroeder Exp $
+$Id: ldif.py,v 1.114 2017/07/12 17:30:12 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.40'
+__version__ = '2.4.41'
 
 __all__ = [
   # constants
@@ -40,13 +40,14 @@
 ldif_pattern = '^((dn(:|::) %(dn_pattern)s)|(%(attrtype_pattern)s(:|::) .*)$)+' % vars()
 
 MOD_OP_INTEGER = {
-  'add'    :0, # ldap.MOD_REPLACE
-  'delete' :1, # ldap.MOD_DELETE
+  'add':0, # ldap.MOD_ADD
+  'delete':1, # ldap.MOD_DELETE
   'replace':2, # ldap.MOD_REPLACE
+  'increment':3, # ldap.MOD_INCREMENT
 }
 
 MOD_OP_STR = {
-  0:'add',1:'delete',2:'replace'
+  0:'add',1:'delete',2:'replace',3:'increment'
 }
 
 CHANGE_TYPES = ['add','delete','modify','modrdn']
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index c1d57c8..26432cc 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.13 2017/06/23 07:16:26 stroeder Exp $
+$Id: slapdtest.py,v 1.14 2017/07/12 17:30:12 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.40'
+__version__ = '2.4.41'
 
 import os
 import socket

From 3fd72167b878be348cc131aedb634d13feb318a0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Jul 2017 18:04:30 +0000
Subject: [PATCH 407/868] release 2.4.41 now

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9306264..d8e33b6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.40 2017-07-xx
+Released 2.4.41 2017-07-12
 
 Changes since 2.4.40:
 
@@ -1460,4 +1460,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.451 2017/07/12 17:30:12 stroeder Exp $
+$Id: CHANGES,v 1.452 2017/07/12 18:04:30 stroeder Exp $

From a239152ac78814ae64f03a0049b2ebfb393b0fb1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 12 Jul 2017 18:05:27 +0000
Subject: [PATCH 408/868] Added test for increment: lines in LDIF changes
 records

---
 Tests/t_ldif.py | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index e8a8399..48f4467 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.22 2016/07/30 17:15:22 stroeder Exp $
+$Id: t_ldif.py,v 1.23 2017/07/12 18:05:27 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -645,6 +645,29 @@ def test_bad_change_records(self):
             else:
                 self.fail("should have raised ValueError: %r" % ldif_str)
 
+    def test_mod_increment(self):
+        self.check_records(
+            """
+            version: 1
+
+            dn: cn=x,cn=y,cn=z
+            changetype: modify
+            increment: gidNumber
+            gidNumber: 1
+            -
+
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    [
+                        (ldif.MOD_OP_INTEGER['increment'], 'gidNumber', [b'1']),
+                    ],
+                    None,
+                ),
+            ],
+        )
+
 
 if __name__ == '__main__':
     unittest.main()

From 83e2ec02ee2a7f4aab7539dea403924eb62ba21d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 1 Aug 2017 17:48:00 +0000
Subject: [PATCH 409/868] fixed module doc heading for ldap.sasl

---
 Doc/ldap-sasl.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Doc/ldap-sasl.rst b/Doc/ldap-sasl.rst
index c91b49a..6bc9afe 100644
--- a/Doc/ldap-sasl.rst
+++ b/Doc/ldap-sasl.rst
@@ -1,9 +1,9 @@
-.. % $Id: ldap-sasl.rst,v 1.3 2015/10/24 13:41:02 stroeder Exp $
+.. % $Id: ldap-sasl.rst,v 1.4 2017/08/01 17:48:00 stroeder Exp $
 
 
-********************************************
-:py:mod:`ldap.sasl` Handling LDAPv3 schema
-********************************************
+***********************************************
+:py:mod:`ldap.sasl` SASL Authentication Methods
+***********************************************
 
 .. py:module:: ldap.sasl
 

From e17b11e099d8a6456d822a2290f048995d6f27bb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 1 Aug 2017 17:50:24 +0000
Subject: [PATCH 410/868] added doc stub for module slapdtest

---
 Doc/index.rst     |  3 ++-
 Doc/slapdtest.rst | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 Doc/slapdtest.rst

diff --git a/Doc/index.rst b/Doc/index.rst
index 2338eb2..592bb26 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -2,7 +2,7 @@
 python-ldap Documentation
 ##########################
 
-.. % $Id: index.rst,v 1.9 2015/10/24 12:49:41 stroeder Exp $
+.. % $Id: index.rst,v 1.10 2017/08/01 17:50:24 stroeder Exp $
 
 .. topic:: Abstract
 
@@ -34,6 +34,7 @@ Contents
    ldif.rst
    ldapurl.rst
    dsml.rst
+   slapdtest.rst
 
 
 ******************
diff --git a/Doc/slapdtest.rst b/Doc/slapdtest.rst
new file mode 100644
index 0000000..b353402
--- /dev/null
+++ b/Doc/slapdtest.rst
@@ -0,0 +1,25 @@
+.. % $Id: slapdtest.rst,v 1.1 2017/08/01 17:50:24 stroeder Exp $
+
+#####################################
+:mod:`slapdtest` Spawning test instances of OpenLDAP's slapd server
+#####################################
+
+.. py:module:: slapdtest
+   :synopsis: Spawning test instances of OpenLDAP's slapd server
+.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
+
+
+The module is used for testing python-ldap itself but can be used for 
+automatically testing any OpenLDAP-based configuration setup.
+
+This module is pure Python and does not rely on any non-standard modules.
+Therefore it can be used stand-alone without the rest of the python-ldap
+package.
+
+Functions
+^^^^^^^^^
+
+
+Classes
+^^^^^^^
+

From 3e7aa46115e1dea872341144fba984bd7f5a6397 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 1 Aug 2017 17:50:51 +0000
Subject: [PATCH 411/868] bumped doc release to 2.4.41

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 0970e0b..f801ec8 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.26 2017/01/06 15:06:24 stroeder Exp $
+# $Id: conf.py,v 1.27 2017/08/01 17:50:51 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.27.0'
+release = '2.4.41.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From ecac3dbba0baed1fa1f98992d3bdf3241944cddd Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 3 Aug 2017 17:24:43 +0000
Subject: [PATCH 412/868] started 2.4.42

---
 CHANGES              | 10 +++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index d8e33b6..777193e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.42 2017-08-xx
+
+Changes since 2.4.41:
+
+Lib/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.41 2017-07-12
 
@@ -1460,4 +1468,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.452 2017/07/12 18:04:30 stroeder Exp $
+$Id: CHANGES,v 1.453 2017/08/03 17:24:43 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 4d78bb8..caf01e0 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.58 2017/07/12 17:30:12 stroeder Exp $
+$Id: dsml.py,v 1.59 2017/08/03 17:24:43 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.41'
+__version__ = '2.4.42'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 6be3ce6..3f126c4 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.119 2017/07/12 17:30:12 stroeder Exp $
+$Id: __init__.py,v 1.120 2017/08/03 17:24:43 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.41'
+__version__ = '2.4.42'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index ba0ea8a..d4e483e 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.94 2017/07/12 17:30:12 stroeder Exp $
+\$Id: ldapurl.py,v 1.95 2017/08/03 17:24:43 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.41'
+__version__ = '2.4.42'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index bfd0dc5..b0d296d 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.114 2017/07/12 17:30:12 stroeder Exp $
+$Id: ldif.py,v 1.115 2017/08/03 17:24:43 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.41'
+__version__ = '2.4.42'
 
 __all__ = [
   # constants

From a28837d7e9e9fdbb7ca5d8e2bce8e2747153e1a8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 3 Aug 2017 17:26:59 +0000
Subject: [PATCH 413/868] added new SlapdObject methods _ln_schema_files() and
 _create_sub_dirs()

---
 CHANGES          |  5 +++--
 Lib/slapdtest.py | 29 +++++++++++++++++++++++++++--
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 777193e..28aa7a9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.42 2017-08-xx
 Changes since 2.4.41:
 
 Lib/
-* 
+* added new SlapdObject methods _ln_schema_files() and
+  _create_sub_dirs()
 
 ----------------------------------------------------------------
 Released 2.4.41 2017-07-12
@@ -1468,4 +1469,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.453 2017/08/03 17:24:43 stroeder Exp $
+$Id: CHANGES,v 1.454 2017/08/03 17:26:59 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 26432cc..28ac86e 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.14 2017/07/12 17:30:12 stroeder Exp $
+$Id: slapdtest.py,v 1.15 2017/08/03 17:26:59 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.41'
+__version__ = '2.4.42'
 
 import os
 import socket
@@ -99,6 +99,10 @@ class SlapdObject(object):
     # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
     cli_sasl_external = True
     local_host = '127.0.0.1'
+    testrunsubdirs = (())
+    openldap_schema_files = (
+        'core.schema',
+    )
 
     TMPDIR = os.environ.get('TMP', os.getcwd())
     SBINDIR = os.environ.get('SBIN', '/usr/sbin')
@@ -133,6 +137,8 @@ def _setup_rundir(self):
         """
         os.mkdir(self.testrundir)
         os.mkdir(self._db_directory)
+        self._create_sub_dirs(self.testrunsubdirs)
+        self._ln_schema_files(self.openldap_schema_files, self.SCHEMADIR)
 
     def _cleanup_rundir(self):
         """
@@ -183,6 +189,25 @@ def _gen_config(self):
         }
         return self.slapd_conf_template % config_dict
 
+    def _create_sub_dirs(self, dir_names):
+        """
+        create sub-directories beneath self.testrundir
+        """
+        for dname in dir_names:
+            dir_name = os.path.join(self.testrundir, dname)
+            self._log.debug('Create directory %s', dir_name)
+            os.mkdir(dir_name)
+
+    def _ln_schema_files(self, file_names, source_dir):
+        """
+        write symbolic links to original schema files
+        """
+        for fname in file_names:
+            ln_source = os.path.join(source_dir, fname)
+            ln_target = os.path.join(self._schema_prefix, fname)
+            self._log.debug('Create symlink %s -> %s', ln_source, ln_target)
+            os.symlink(ln_source, ln_target)
+
     def _write_config(self):
         """Writes the slapd.conf file out, and returns the path to it."""
         self._log.debug('Writing config to %s', self._slapd_conf)

From e2bdb37aa2efee513f89feecab7577e846056bde Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 15 Aug 2017 15:18:35 +0000
Subject: [PATCH 414/868] moved pseudo test script from module ldap.cidict to
 separate test sub-module t_cidict.py

---
 Tests/t_cidict.py | 49 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 Tests/t_cidict.py

diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
new file mode 100644
index 0000000..8c34bc1
--- /dev/null
+++ b/Tests/t_cidict.py
@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for python-ldap's module ldap.cidict
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_cidict.py,v 1.1 2017/08/15 15:18:35 stroeder Exp $
+"""
+
+# from Python's standard lib
+import unittest
+
+# from python-ldap
+import ldap, ldap.cidict
+
+
+class TestCidict(unittest.TestCase):
+    """
+    test ldap.cidict.cidict
+    """
+
+    def test_cidict(self):
+        """
+        test function is_dn()
+        """
+        self.assertEquals(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
+        data = {
+            'AbCDeF':123,
+        }
+        cix = ldap.cidict.cidict(data)
+        self.assertEquals(cix["ABCDEF"], 123)
+        self.assertEquals(cix.get("ABCDEF", None), 123)
+        self.assertEquals(cix.get("not existent", None), None)
+        cix["xYZ"] = 987
+        self.assertEquals(cix["XyZ"], 987)
+        self.assertEquals(cix.get("xyz", None), 987)
+        cix_keys = cix.keys()
+        cix_keys.sort()
+        self.assertEquals(cix_keys, ['AbCDeF','xYZ'])
+        cix_items = cix.items()
+        cix_items.sort()
+        self.assertEquals(cix_items, [('AbCDeF',123), ('xYZ',987)])
+        del cix["abcdEF"]
+        self.assertEquals(cix._keys.has_key("abcdef"), False)
+        self.assertEquals(cix._keys.has_key("AbCDef"), False)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 09ec9c53c13fe9a67e6d070f91af101f0d10ed4d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 15 Aug 2017 16:14:04 +0000
Subject: [PATCH 415/868] removed pseudo test script from module ldap.cidict
 and added sub-module for testing class ldap.cidict.cidict

---
 CHANGES            |  6 +++++-
 Lib/ldap/cidict.py | 26 +++-----------------------
 Tests/__init__.py  |  5 +++--
 Tests/t_cidict.py  |  4 ++--
 4 files changed, 13 insertions(+), 28 deletions(-)

diff --git a/CHANGES b/CHANGES
index 28aa7a9..c1a397b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,10 @@ Changes since 2.4.41:
 Lib/
 * added new SlapdObject methods _ln_schema_files() and
   _create_sub_dirs()
+* removed pseudo test script from module ldap.cidict
+
+Tests/
+* added sub-module for testing class ldap.cidict.cidict
 
 ----------------------------------------------------------------
 Released 2.4.41 2017-07-12
@@ -1469,4 +1473,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.454 2017/08/03 17:26:59 stroeder Exp $
+$Id: CHANGES,v 1.455 2017/08/15 16:14:04 stroeder Exp $
diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index b0a0a85..e6db46d 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -3,12 +3,12 @@
 returned from LDAP servers containing attribute
 names of variable case.
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: cidict.py,v 1.13 2009/04/17 14:34:34 stroeder Exp $
+$Id: cidict.py,v 1.14 2017/08/15 16:14:04 stroeder Exp $
 """
 
-__version__ = """$Revision: 1.13 $"""
+__version__ = """$Revision: 1.14 $"""
 
 from UserDict import UserDict
 from string import lower
@@ -103,23 +103,3 @@ def strlist_union(a,b):
   for elt in b:
     temp[elt] = elt
   return temp.values()
-
-
-if __debug__ and __name__ == '__main__':
-  x = { 'AbCDeF' : 123 }
-  cix = cidict(x)
-  assert cix["ABCDEF"] == 123
-  assert cix.get("ABCDEF",None) == 123
-  assert cix.get("not existent",None) is None
-  cix["xYZ"] = 987
-  assert cix["XyZ"] == 987
-  assert cix.get("XyZ",None) == 987
-  cix_keys = cix.keys()
-  cix_keys.sort()
-  assert cix_keys==['AbCDeF','xYZ'],ValueError(repr(cix_keys))
-  cix_items = cix.items()
-  cix_items.sort()
-  assert cix_items==[('AbCDeF',123),('xYZ',987)],ValueError(repr(cix_items))
-  del cix["abcdEF"]
-  assert not cix._keys.has_key("abcdef")
-  assert not cix.has_key("AbCDef")
diff --git a/Tests/__init__.py b/Tests/__init__.py
index cd0b8d8..3c212f0 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -2,12 +2,13 @@
 """
 Automatic tests for python-ldap
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.5 2017/04/28 07:30:59 stroeder Exp $
+$Id: __init__.py,v 1.6 2017/08/15 16:17:29 stroeder Exp $
 """
 
 import t_cext
+import t_cidict
 import t_ldap_dn
 import t_ldap_filter
 import t_ldap_functions
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index 8c34bc1..8915ceb 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.cidict
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_cidict.py,v 1.1 2017/08/15 15:18:35 stroeder Exp $
+$Id: t_cidict.py,v 1.2 2017/08/15 16:14:04 stroeder Exp $
 """
 
 # from Python's standard lib

From 8afd4c047d57d64c64975a98ed23d0c28bc7a9c0 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 15 Aug 2017 16:21:58 +0000
Subject: [PATCH 416/868] FWIW: HTTPS everywhere

---
 Build/build-openbsd/Makefile      | 4 ++--
 Demo/pyasn1/noopsearch.py         | 2 +-
 Demo/pyasn1/ppolicy.py            | 2 +-
 Demo/pyasn1/psearch.py            | 4 ++--
 Demo/pyasn1/sessiontrack.py       | 4 ++--
 Lib/dsml.py                       | 4 ++--
 Lib/ldap/__init__.py              | 4 ++--
 Lib/ldap/async.py                 | 4 ++--
 Lib/ldap/controls/__init__.py     | 4 ++--
 Lib/ldap/controls/deref.py        | 4 ++--
 Lib/ldap/controls/libldap.py      | 4 ++--
 Lib/ldap/controls/openldap.py     | 4 ++--
 Lib/ldap/controls/pagedresults.py | 4 ++--
 Lib/ldap/controls/ppolicy.py      | 6 +++---
 Lib/ldap/controls/psearch.py      | 6 +++---
 Lib/ldap/controls/pwdpolicy.py    | 6 +++---
 Lib/ldap/controls/readentry.py    | 4 ++--
 Lib/ldap/controls/sessiontrack.py | 4 ++--
 Lib/ldap/controls/simple.py       | 4 ++--
 Lib/ldap/controls/sss.py          | 4 ++--
 Lib/ldap/controls/vlv.py          | 4 ++--
 Lib/ldap/dn.py                    | 4 ++--
 Lib/ldap/extop/__init__.py        | 4 ++--
 Lib/ldap/extop/dds.py             | 8 +++-----
 Lib/ldap/filter.py                | 4 ++--
 Lib/ldap/functions.py             | 4 ++--
 Lib/ldap/ldapobject.py            | 4 ++--
 Lib/ldap/modlist.py               | 4 ++--
 Lib/ldap/resiter.py               | 4 ++--
 Lib/ldap/sasl.py                  | 4 ++--
 Lib/ldap/schema/__init__.py       | 4 ++--
 Lib/ldap/schema/models.py         | 4 ++--
 Lib/ldap/schema/subentry.py       | 4 ++--
 Lib/ldap/schema/tokenizer.py      | 4 ++--
 Lib/ldap/syncrepl.py              | 4 ++--
 Lib/ldapurl.py                    | 4 ++--
 Lib/ldif.py                       | 4 ++--
 Lib/slapdtest.py                  | 4 ++--
 Modules/LDAPObject.c              | 4 ++--
 Modules/LDAPObject.h              | 4 ++--
 Modules/berval.c                  | 4 ++--
 Modules/berval.h                  | 4 ++--
 Modules/common.c                  | 4 ++--
 Modules/common.h                  | 4 ++--
 Modules/constants.c               | 4 ++--
 Modules/constants.h               | 4 ++--
 Modules/errors.c                  | 4 ++--
 Modules/errors.h                  | 4 ++--
 Modules/functions.c               | 4 ++--
 Modules/functions.h               | 6 +++---
 Modules/ldapcontrol.c             | 4 ++--
 Modules/ldapcontrol.h             | 4 ++--
 Modules/ldapmodule.c              | 4 ++--
 Modules/message.c                 | 4 ++--
 Modules/message.h                 | 4 ++--
 Modules/options.c                 | 4 ++--
 Modules/options.h                 | 4 ++--
 Modules/schema.c                  | 4 ++--
 Modules/schema.h                  | 4 ++--
 Modules/version.c                 | 4 ++--
 Modules/version.h                 | 4 ++--
 README                            | 6 +++---
 Tests/t_cext.py                   | 4 ++--
 Tests/t_ldap_dn.py                | 4 ++--
 Tests/t_ldap_filter.py            | 4 ++--
 Tests/t_ldap_functions.py         | 4 ++--
 Tests/t_ldap_modlist.py           | 4 ++--
 Tests/t_ldap_schema_subentry.py   | 4 ++--
 Tests/t_ldap_schema_tokenizer.py  | 4 ++--
 Tests/t_ldapobject.py             | 4 ++--
 Tests/t_ldapurl.py                | 4 ++--
 Tests/t_ldif.py                   | 4 ++--
 setup.py                          | 4 ++--
 73 files changed, 150 insertions(+), 152 deletions(-)

diff --git a/Build/build-openbsd/Makefile b/Build/build-openbsd/Makefile
index 6808edc..ca8e29b 100644
--- a/Build/build-openbsd/Makefile
+++ b/Build/build-openbsd/Makefile
@@ -1,4 +1,4 @@
-# $Id: Makefile,v 1.5 2014/11/18 08:28:48 stroeder Exp $
+# $Id: Makefile,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 
 WRKDIST=		${.CURDIR}/../..
 VERSION!=		sh ${WRKDIST}/Build/version.sh
@@ -7,7 +7,7 @@ PKGNAME=		python-ldap-${VERSION}
 RUN_DEPENDS=		python:lang/python
 CATEGORIES=		misc
 MAINTAINER=		leonard@users.sourceforge.net
-HOMEPAGE=		http://www.python-ldap.org/
+HOMEPAGE=		https://www.python-ldap.org/
 
 FAKE=			Yes
 CONFIGURE_STYLE=	gnu
diff --git a/Demo/pyasn1/noopsearch.py b/Demo/pyasn1/noopsearch.py
index e2846ce..08635de 100644
--- a/Demo/pyasn1/noopsearch.py
+++ b/Demo/pyasn1/noopsearch.py
@@ -2,7 +2,7 @@
 """
 Demo script for counting searching with OpenLDAP's no-op control
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 This needs the following software:
 Python
 pyasn1
diff --git a/Demo/pyasn1/ppolicy.py b/Demo/pyasn1/ppolicy.py
index 2bb24a2..8722356 100644
--- a/Demo/pyasn1/ppolicy.py
+++ b/Demo/pyasn1/ppolicy.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
 Demo script for Password Policy Controls
-(see http://tools.ietf.org/html/draft-behera-ldap-password-policy)
+(see https://tools.ietf.org/html/draft-behera-ldap-password-policy)
 
 This needs the following software:
 Python
diff --git a/Demo/pyasn1/psearch.py b/Demo/pyasn1/psearch.py
index 86bdb37..02852b1 100644
--- a/Demo/pyasn1/psearch.py
+++ b/Demo/pyasn1/psearch.py
@@ -1,9 +1,9 @@
 # -*- coding: utf-8 -*-
 """
 Demo script for Persistent Search Control
-(see http://tools.ietf.org/html/draft-ietf-ldapext-psearch)
+(see https://tools.ietf.org/html/draft-ietf-ldapext-psearch)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 This needs the following software:
 Python
 pyasn1
diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
index dd4797e..1a1eab1 100644
--- a/Demo/pyasn1/sessiontrack.py
+++ b/Demo/pyasn1/sessiontrack.py
@@ -3,9 +3,9 @@
 """
 demo_track_ldap_session.py
 
-Client-seitige Demo-Implementierung von Session Tracking Control
+Client-side demo implementation of Session Tracking Control
 
-http://tools.ietf.org/html/draft-wahl-ldap-session-03
+https://tools.ietf.org/html/draft-wahl-ldap-session-03
 """
 
 __version__ = '0.1'
diff --git a/Lib/dsml.py b/Lib/dsml.py
index caf01e0..201a340 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -2,9 +2,9 @@
 dsml - generate and parse DSMLv1 data
 (see http://www.oasis-open.org/committees/dsml/)
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.59 2017/08/03 17:24:43 stroeder Exp $
+$Id: dsml.py,v 1.60 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 3f126c4..939e5ff 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -1,9 +1,9 @@
 """
 ldap - base module
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.120 2017/08/03 17:24:43 stroeder Exp $
+$Id: __init__.py,v 1.121 2017/08/15 16:21:58 stroeder Exp $
 """
 
 # This is also the overall release version number
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 680cdc9..707b72d 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -1,9 +1,9 @@
 """
 ldap.async - handle async LDAP operations
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: async.py,v 1.34 2015/06/06 09:21:37 stroeder Exp $
+\$Id: async.py,v 1.35 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 Tested on Python 2.0+ but should run on Python 1.5.x.
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index 214d92c..90e49eb 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -2,9 +2,9 @@
 """
 controls.py - support classes for LDAP controls
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.10 2015/06/06 09:21:38 stroeder Exp $
+$Id: __init__.py,v 1.11 2017/08/15 16:21:58 stroeder Exp $
 
 Description:
 The ldap.controls module provides LDAPControl classes.
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index 504647e..a649d98 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -3,9 +3,9 @@
 ldap.controls.deref - classes for 
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: deref.py,v 1.3 2017/02/08 09:44:18 stroeder Exp $
+$Id: deref.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/libldap.py b/Lib/ldap/controls/libldap.py
index 142840e..66d8e51 100644
--- a/Lib/ldap/controls/libldap.py
+++ b/Lib/ldap/controls/libldap.py
@@ -3,9 +3,9 @@
 controls.libldap - LDAP controls wrapper classes with en-/decoding done
 by OpenLDAP functions
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: libldap.py,v 1.3 2015/06/06 09:21:38 stroeder Exp $
+$Id: libldap.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import _ldap,ldap
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 99c2baa..88facb6 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -2,9 +2,9 @@
 """
 ldap.controls.openldap - classes for OpenLDAP-specific controls
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: openldap.py,v 1.6 2015/10/24 16:21:56 stroeder Exp $
+$Id: openldap.py,v 1.7 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import ldap.controls
diff --git a/Lib/ldap/controls/pagedresults.py b/Lib/ldap/controls/pagedresults.py
index 54c0ddf..cfd38a6 100644
--- a/Lib/ldap/controls/pagedresults.py
+++ b/Lib/ldap/controls/pagedresults.py
@@ -3,9 +3,9 @@
 ldap.controls.paged - classes for Simple Paged control
 (see RFC 2696)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: pagedresults.py,v 1.2 2014/12/12 10:10:23 stroeder Exp $
+$Id: pagedresults.py,v 1.3 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index fa7df78..f6a7116 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -1,11 +1,11 @@
 # -*- coding: utf-8 -*-
 """
 ldap.controls.ppolicy - classes for Password Policy controls
-(see http://tools.ietf.org/html/draft-behera-ldap-password-policy)
+(see https://tools.ietf.org/html/draft-behera-ldap-password-policy)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: ppolicy.py,v 1.4 2015/06/06 09:21:38 stroeder Exp $
+$Id: ppolicy.py,v 1.5 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
index 243fb03..31c9286 100644
--- a/Lib/ldap/controls/psearch.py
+++ b/Lib/ldap/controls/psearch.py
@@ -1,11 +1,11 @@
 # -*- coding: utf-8 -*-
 """
 ldap.controls.psearch - classes for Persistent Search Control
-(see http://tools.ietf.org/html/draft-ietf-ldapext-psearch)
+(see https://tools.ietf.org/html/draft-ietf-ldapext-psearch)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: psearch.py,v 1.4 2011/07/22 13:47:47 stroeder Exp $
+$Id: psearch.py,v 1.5 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index dc013d4..38bdb79 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -1,11 +1,11 @@
 # -*- coding: utf-8 -*-
 """
 ldap.controls.pwdpolicy - classes for Password Policy controls
-(see http://tools.ietf.org/html/draft-vchu-ldap-pwd-policy)
+(see https://tools.ietf.org/html/draft-vchu-ldap-pwd-policy)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: pwdpolicy.py,v 1.5 2015/10/24 15:55:07 stroeder Exp $
+$Id: pwdpolicy.py,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/readentry.py b/Lib/ldap/controls/readentry.py
index 5ff8dca..cc411c3 100644
--- a/Lib/ldap/controls/readentry.py
+++ b/Lib/ldap/controls/readentry.py
@@ -3,9 +3,9 @@
 ldap.controls.readentry - classes for the Read Entry controls
 (see RFC 4527)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: readentry.py,v 1.5 2015/09/18 17:24:55 stroeder Exp $
+$Id: readentry.py,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import ldap
diff --git a/Lib/ldap/controls/sessiontrack.py b/Lib/ldap/controls/sessiontrack.py
index e3b7042..8dced44 100644
--- a/Lib/ldap/controls/sessiontrack.py
+++ b/Lib/ldap/controls/sessiontrack.py
@@ -3,9 +3,9 @@
 ldap.controls.sessiontrack - class for session tracking control
 (see draft-wahl-ldap-session)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: sessiontrack.py,v 1.5 2015/09/18 17:25:07 stroeder Exp $
+$Id: sessiontrack.py,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 """
 
 from ldap.controls import RequestControl
diff --git a/Lib/ldap/controls/simple.py b/Lib/ldap/controls/simple.py
index a84d906..5899315 100644
--- a/Lib/ldap/controls/simple.py
+++ b/Lib/ldap/controls/simple.py
@@ -2,9 +2,9 @@
 """
 ldap.controls.simple - classes for some very simple LDAP controls
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: simple.py,v 1.10 2015/06/06 09:21:38 stroeder Exp $
+$Id: simple.py,v 1.11 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import struct,ldap
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 71bef3d..c2c973c 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -3,9 +3,9 @@
 ldap.controls.sss - classes for Server Side Sorting
 (see RFC 2891)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: sss.py,v 1.3 2016/09/26 22:06:54 stroeder Exp $
+$Id: sss.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index afe0613..d8283d2 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -3,9 +3,9 @@
 ldap.controls.vlv - classes for Virtual List View
 (see draft-ietf-ldapext-ldapv3-vlv)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: vlv.py,v 1.3 2015/07/07 12:46:31 stroeder Exp $
+$Id: vlv.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 569b296..e8e8927 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -1,9 +1,9 @@
 """
 dn.py - misc stuff for handling distinguished names (see RFC 4514)
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.16 2016/07/24 15:58:26 stroeder Exp $
+\$Id: dn.py,v 1.17 2017/08/15 16:21:58 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
diff --git a/Lib/ldap/extop/__init__.py b/Lib/ldap/extop/__init__.py
index 2ab61c6..10ca8a1 100644
--- a/Lib/ldap/extop/__init__.py
+++ b/Lib/ldap/extop/__init__.py
@@ -1,9 +1,9 @@
 """
 controls.py - support classes for LDAPv3 extended operations
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: __init__.py,v 1.4 2011/07/22 13:27:02 stroeder Exp $
+\$Id: __init__.py,v 1.5 2017/08/15 16:21:58 stroeder Exp $
 
 Description:
 The ldap.extop module provides base classes for LDAPv3 extended operations.
diff --git a/Lib/ldap/extop/dds.py b/Lib/ldap/extop/dds.py
index 5844a61..ec71a02 100644
--- a/Lib/ldap/extop/dds.py
+++ b/Lib/ldap/extop/dds.py
@@ -3,11 +3,9 @@
 ldap.extop.dds - Classes for Dynamic Entries extended operations
 (see RFC 2589)
 
-This needs the following software:
-Python
-pyasn1
-pyasn1-modules
-python-ldap 2.4+
+See https://www.python-ldap.org/ for details.
+
+$Id: dds.py,v 1.3 2017/08/15 16:21:58 stroeder Exp $
 """
 
 from ldap.extop import ExtendedRequest,ExtendedResponse
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index 727c1f8..510f9ce 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -1,9 +1,9 @@
 """
 filters.py - misc stuff for handling LDAP filter strings (see RFC2254)
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: filter.py,v 1.11 2016/07/24 15:14:56 stroeder Exp $
+\$Id: filter.py,v 1.12 2017/08/15 16:21:58 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index b0af7ee..d56bc86 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -1,9 +1,9 @@
 """
 functions.py - wraps functions of module _ldap
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.33 2016/07/25 08:15:14 stroeder Exp $
+\$Id: functions.py,v 1.34 2017/08/15 16:21:58 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 40bb016..b6b39f2 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -1,9 +1,9 @@
 """
 ldapobject.py - wraps class _ldap.LDAPObject
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.163 2017/05/29 09:00:15 stroeder Exp $
+\$Id: ldapobject.py,v 1.164 2017/08/15 16:21:58 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index b0fe364..5a7f0e3 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -1,9 +1,9 @@
 """
 ldap.modlist - create add/modify modlist's
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: modlist.py,v 1.18 2011/06/06 13:07:38 stroeder Exp $
+$Id: modlist.py,v 1.19 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 This module is known to work with Python 2.0+ but should work
diff --git a/Lib/ldap/resiter.py b/Lib/ldap/resiter.py
index fdbbc3e..b86d0be 100644
--- a/Lib/ldap/resiter.py
+++ b/Lib/ldap/resiter.py
@@ -1,9 +1,9 @@
 """
 ldap.resiter - processing LDAP results with iterators
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: resiter.py,v 1.7 2015/09/18 20:20:32 stroeder Exp $
+\$Id: resiter.py,v 1.8 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 Requires Python 2.3+
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index 1158671..cce892a 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -1,9 +1,9 @@
 """
 sasl.py - support for SASL mechanism
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: sasl.py,v 1.17 2015/06/06 09:21:38 stroeder Exp $
+\$Id: sasl.py,v 1.18 2017/08/15 16:21:58 stroeder Exp $
 
 Description:
 The ldap.sasl module provides SASL authentication classes.
diff --git a/Lib/ldap/schema/__init__.py b/Lib/ldap/schema/__init__.py
index 641afa8..4346cd2 100644
--- a/Lib/ldap/schema/__init__.py
+++ b/Lib/ldap/schema/__init__.py
@@ -1,9 +1,9 @@
 """
 ldap.schema -  LDAPv3 schema handling
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: __init__.py,v 1.7 2009/07/26 11:09:58 stroeder Exp $
+\$Id: __init__.py,v 1.8 2017/08/15 16:21:58 stroeder Exp $
 """
 
 from ldap import __version__
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index a4b4bab..67b4f29 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -1,9 +1,9 @@
 """
 schema.py - support for subSchemaSubEntry information
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: models.py,v 1.49 2017/02/18 15:32:01 stroeder Exp $
+\$Id: models.py,v 1.50 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import UserDict,ldap.cidict
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 042e128..2eac52a 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -1,9 +1,9 @@
 """
 ldap.schema.subentry -  subschema subentry handling
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: subentry.py,v 1.36 2015/08/08 14:13:30 stroeder Exp $
+\$Id: subentry.py,v 1.37 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import ldap.cidict,ldap.schema
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index 2faeac5..724f0c5 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -1,9 +1,9 @@
 """
 ldap.schema.tokenizer - Low-level parsing functions for schema element strings
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: tokenizer.py,v 1.16 2017/02/22 20:25:21 stroeder Exp $
+\$Id: tokenizer.py,v 1.17 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import re
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index a6e0258..8156435 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -2,9 +2,9 @@
 """
 ldap.syncrepl - for implementing syncrepl consumer (see RFC 4533)
 
-See http://www.python-ldap.org/ for project details.
+See https://www.python-ldap.org/ for project details.
 
-$Id: syncrepl.py,v 1.7 2015/06/06 09:21:38 stroeder Exp $
+$Id: syncrepl.py,v 1.8 2017/08/15 16:21:58 stroeder Exp $
 """
 
 #__all__ = [
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index d4e483e..33fe5fa 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -1,9 +1,9 @@
 """
 ldapurl - handling of LDAP URLs as described in RFC 4516
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.95 2017/08/03 17:24:43 stroeder Exp $
+\$Id: ldapurl.py,v 1.96 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
diff --git a/Lib/ldif.py b/Lib/ldif.py
index b0d296d..48f9231 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -1,9 +1,9 @@
 """
 ldif - generate and parse LDIF data (see RFC 2849)
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.115 2017/08/03 17:24:43 stroeder Exp $
+$Id: ldif.py,v 1.116 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 28ac86e..4e011e9 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -2,9 +2,9 @@
 """
 slapdtest - module for spawning test instances of OpenLDAP's slapd server
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.15 2017/08/03 17:26:59 stroeder Exp $
+$Id: slapdtest.py,v 1.16 2017/08/15 16:21:58 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index a0ab8c6..5fa86dd 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.95 2017/01/25 19:41:31 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: LDAPObject.c,v 1.96 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index b0ffbbe..be6a01d 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: LDAPObject.h,v 1.10 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: LDAPObject.h,v 1.11 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_LDAPObject 
 #define __h_LDAPObject 
diff --git a/Modules/berval.c b/Modules/berval.c
index 1c71bb3..e196b2d 100644
--- a/Modules/berval.c
+++ b/Modules/berval.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: berval.c,v 1.1 2009/08/17 01:49:47 leonard Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: berval.c,v 1.2 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "berval.h"
diff --git a/Modules/berval.h b/Modules/berval.h
index 0b32438..c635dec 100644
--- a/Modules/berval.h
+++ b/Modules/berval.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: berval.h,v 1.1 2009/08/17 01:49:47 leonard Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: berval.h,v 1.2 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_berval 
 #define __h_berval 
diff --git a/Modules/common.c b/Modules/common.c
index ff471f1..61fb6f7 100644
--- a/Modules/common.c
+++ b/Modules/common.c
@@ -1,6 +1,6 @@
 /* Miscellaneous common routines
- * See http://www.python-ldap.org/ for details.
- * $Id: common.c,v 1.3 2009/04/17 12:19:09 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details.
+ * $Id: common.c,v 1.4 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 
diff --git a/Modules/common.h b/Modules/common.h
index a182a97..c1744df 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -1,6 +1,6 @@
 /* common utility macros
- * See http://www.python-ldap.org/ for details.
- * $Id: common.h,v 1.8 2009/04/17 12:19:09 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details.
+ * $Id: common.h,v 1.9 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_common 
 #define __h_common 
diff --git a/Modules/constants.c b/Modules/constants.c
index 58a8db5..b7f0757 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -1,6 +1,6 @@
 /* constants defined for LDAP
- * See http://www.python-ldap.org/ for details.
- * $Id: constants.c,v 1.59 2014/09/12 12:02:21 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details.
+ * $Id: constants.c,v 1.60 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "constants.h"
diff --git a/Modules/constants.h b/Modules/constants.h
index c77f269..7ff856d 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: constants.h,v 1.6 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: constants.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_constants_
 #define __h_constants_
diff --git a/Modules/errors.c b/Modules/errors.c
index 9dd78b6..765b830 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -1,8 +1,8 @@
 /*
  * errors that arise from ldap use
  * Most errors become their own exception
- * See http://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.30 2017/04/25 13:40:52 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details.
+ * $Id: errors.c,v 1.31 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
diff --git a/Modules/errors.h b/Modules/errors.h
index 9c672cd..a5c65f0 100644
--- a/Modules/errors.h
+++ b/Modules/errors.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: errors.h,v 1.6 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: errors.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_errors_
 #define __h_errors_
diff --git a/Modules/functions.c b/Modules/functions.c
index 8224cba..c25f34e 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: functions.c,v 1.27 2009/08/17 05:00:57 leonard Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: functions.c,v 1.28 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "functions.h"
diff --git a/Modules/functions.h b/Modules/functions.h
index 515af4d..0f9850e 100644
--- a/Modules/functions.h
+++ b/Modules/functions.h
@@ -1,10 +1,10 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: functions.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: functions.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_functions_
 #define __h_functions_
 
-/* $Id: functions.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+/* $Id: functions.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 extern void LDAPinit_functions( PyObject* );
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index a1097b3..96162e7 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: ldapcontrol.c,v 1.21 2017/06/23 18:09:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: ldapcontrol.c,v 1.22 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "LDAPObject.h"
diff --git a/Modules/ldapcontrol.h b/Modules/ldapcontrol.h
index f615858..0d5e8da 100644
--- a/Modules/ldapcontrol.h
+++ b/Modules/ldapcontrol.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: ldapcontrol.h,v 1.6 2009/08/04 05:39:10 leonard Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: ldapcontrol.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_ldapcontrol
 #define __h_ldapcontrol
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 77cd82b..60e4d33 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: ldapmodule.c,v 1.9 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: ldapmodule.c,v 1.10 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "version.h"
diff --git a/Modules/message.c b/Modules/message.c
index 7cc7072..e44c390 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: message.c,v 1.19 2011/10/26 18:38:06 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: message.c,v 1.20 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "message.h"
diff --git a/Modules/message.h b/Modules/message.h
index 88af31a..87d5523 100644
--- a/Modules/message.h
+++ b/Modules/message.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: message.h,v 1.6 2011/02/21 21:04:00 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: message.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_message 
 #define __h_message 
diff --git a/Modules/options.c b/Modules/options.c
index f7c97b1..740cda2 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: options.c,v 1.42 2014/09/12 12:02:21 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: options.c,v 1.43 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 #include "errors.h"
diff --git a/Modules/options.h b/Modules/options.h
index fb6e0a2..3223f2c 100644
--- a/Modules/options.h
+++ b/Modules/options.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: options.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: options.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
 
 int	LDAP_optionval_by_name(const char *name);
 int	LDAP_set_option(LDAPObject *self, int option, PyObject *value);
diff --git a/Modules/schema.c b/Modules/schema.c
index 5bfbfa4..d5818af 100644
--- a/Modules/schema.c
+++ b/Modules/schema.c
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: schema.c,v 1.8 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: schema.c,v 1.9 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 
diff --git a/Modules/schema.h b/Modules/schema.h
index 52492b3..7694afd 100644
--- a/Modules/schema.h
+++ b/Modules/schema.h
@@ -1,5 +1,5 @@
-/* See http://www.python-ldap.org/ for details.
- * $Id: schema.h,v 1.5 2009/04/17 12:19:09 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details.
+ * $Id: schema.h,v 1.6 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_schema_
 #define __h_schema_
diff --git a/Modules/version.c b/Modules/version.c
index 264a285..8e4e63c 100644
--- a/Modules/version.c
+++ b/Modules/version.c
@@ -1,6 +1,6 @@
 /* Set release version
- * See http://www.python-ldap.org/ for details.
- * $Id: version.c,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details.
+ * $Id: version.c,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
 
 #include "common.h"
 
diff --git a/Modules/version.h b/Modules/version.h
index d9a36d9..270b201 100644
--- a/Modules/version.h
+++ b/Modules/version.h
@@ -1,6 +1,6 @@
 /* Set release version
- * See http://www.python-ldap.org/ for details.
- * $Id: version.h,v 1.4 2009/04/17 12:19:09 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details.
+ * $Id: version.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
 
 #ifndef __h_version_
 #define __h_version_
diff --git a/README b/README
index 981f264..6d4b93c 100644
--- a/README
+++ b/README
@@ -19,7 +19,7 @@ See TODO for planned features. Contributors welcome.
 
 For module documentation, see:
 
-	http://www.python-ldap.org/
+	https://www.python-ldap.org/
 
 Quick usage example:
     import ldap
@@ -32,7 +32,7 @@ example code.
 
 Author(s) contact and documentation:
 
-   http://www.python-ldap.org/
+   https://www.python-ldap.org/
 
    If you are looking for help, please try the mailing list archives
    first, then send a question to the mailing list.
@@ -99,4 +99,4 @@ Acknowledgements:
    Thanks! We may have missed someone: please mail us if we have omitted
    your name.
 
-$Id: README,v 1.25 2011/10/26 18:43:21 stroeder Exp $
+$Id: README,v 1.26 2017/08/15 16:21:58 stroeder Exp $
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index cde242a..edb4adb 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's C wrapper module _ldap
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_cext.py,v 1.22 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_cext.py,v 1.23 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import os
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index df18f03..4a3f773 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.dn
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_dn.py,v 1.4 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldap_dn.py,v 1.5 2017/08/15 16:21:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index 60041cb..b5a38d9 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.filter
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_filter.py,v 1.3 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldap_filter.py,v 1.4 2017/08/15 16:21:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
index ac5f3b3..4416d57 100644
--- a/Tests/t_ldap_functions.py
+++ b/Tests/t_ldap_functions.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.functions
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_functions.py,v 1.2 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldap_functions.py,v 1.3 2017/08/15 16:21:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
index 04a913b..d7a9336 100644
--- a/Tests/t_ldap_modlist.py
+++ b/Tests/t_ldap_modlist.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.modlist
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_modlist.py,v 1.2 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldap_modlist.py,v 1.3 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 3131969..879d02e 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's class ldap.schema.SubSchema
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_schema_subentry.py,v 1.2 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldap_schema_subentry.py,v 1.3 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index 2ba50ab..72711f5 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.schema.tokenizer
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_schema_tokenizer.py,v 1.10 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldap_schema_tokenizer.py,v 1.11 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index fbd69d0..8f67bec 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldap.ldapobject
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldapobject.py,v 1.7 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldapobject.py,v 1.8 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import os
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 0e99244..1b0758e 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldapurl
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldapurl.py,v 1.12 2017/04/28 07:30:59 stroeder Exp $
+$Id: t_ldapurl.py,v 1.13 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 48f4467..00945a0 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -2,9 +2,9 @@
 """
 Automatic tests for python-ldap's module ldif
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.23 2017/07/12 18:05:27 stroeder Exp $
+$Id: t_ldif.py,v 1.24 2017/08/15 16:21:59 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/setup.py b/setup.py
index 7790f27..ec3a4be 100644
--- a/setup.py
+++ b/setup.py
@@ -1,9 +1,9 @@
 """
 setup.py - Setup package with the help Python's DistUtils
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 
-$Id: setup.py,v 1.79 2017/04/26 16:52:50 stroeder Exp $
+$Id: setup.py,v 1.80 2017/08/15 16:21:58 stroeder Exp $
 """
 
 has_setuptools = False

From d7cdb08b8b4f35df6d198e2764ca03a1b59606fc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 15 Aug 2017 16:39:26 +0000
Subject: [PATCH 417/868] SlapdObject.testrunsubdirs should at least contain
 'schema'

---
 Lib/slapdtest.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 4e011e9..3a41516 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.16 2017/08/15 16:21:58 stroeder Exp $
+$Id: slapdtest.py,v 1.17 2017/08/15 16:39:26 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -99,7 +99,9 @@ class SlapdObject(object):
     # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
     cli_sasl_external = True
     local_host = '127.0.0.1'
-    testrunsubdirs = (())
+    testrunsubdirs = (
+        'schema',
+    )
     openldap_schema_files = (
         'core.schema',
     )
@@ -125,6 +127,7 @@ def __init__(self):
         self._port = self._avail_tcp_port()
         self.server_id = self._port % 4096
         self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test-%d' % self._port)
+        self._schema_prefix = os.path.join(self.testrundir, 'schema')
         self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)

From 761c507a3558df2a4be36d078e01e0e9a1121e0f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 15 Aug 2017 17:18:54 +0000
Subject: [PATCH 418/868] always use a schema directory with symbolic links

---
 Lib/slapdtest.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 3a41516..7a02492 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.17 2017/08/15 16:39:26 stroeder Exp $
+$Id: slapdtest.py,v 1.18 2017/08/15 17:18:54 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -25,7 +25,7 @@
 SLAPD_CONF_TEMPLATE = r"""
 serverID %(serverid)s
 moduleload back_%(database)s
-include "%(schema_include)s"
+include "%(schema_prefix)s/core.schema"
 loglevel %(loglevel)s
 allow bind_v2
 
@@ -110,8 +110,6 @@ class SlapdObject(object):
     SBINDIR = os.environ.get('SBIN', '/usr/sbin')
     BINDIR = os.environ.get('BIN', '/usr/bin')
     SCHEMADIR = os.environ.get('SCHEMA', '/etc/openldap/schema')
-    INIT_SCHEMA_FILE = os.environ.get('SCHEMA_FILE', 'core.schema')
-    INIT_SCHEMA_PATH = os.environ.get('SCHEMA_PATH', os.path.join(SCHEMADIR, INIT_SCHEMA_FILE))
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
     PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
@@ -180,7 +178,7 @@ def _gen_config(self):
         """
         config_dict = {
             'serverid': hex(self.server_id),
-            'schema_include': self.INIT_SCHEMA_PATH,
+            'schema_prefix':self._schema_prefix,
             'loglevel': self.slapd_loglevel,
             'database': self.database,
             'directory': self._db_directory,

From bd897f294f176833988dcc4d8d922fbad02ab463 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 11:24:37 +0000
Subject: [PATCH 419/868] all autoclass:: with :members:

---
 Doc/ldapurl.rst | 5 ++++-
 Doc/ldif.rst    | 6 +++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/Doc/ldapurl.rst b/Doc/ldapurl.rst
index d1f8ede..7ea26eb 100644
--- a/Doc/ldapurl.rst
+++ b/Doc/ldapurl.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldapurl.rst,v 1.10 2016/07/24 15:47:46 stroeder Exp $
+.. % $Id: ldapurl.rst,v 1.11 2017/08/16 11:24:37 stroeder Exp $
 
 ###################################
 :py:mod:`ldapurl` LDAP URL handling
@@ -66,6 +66,7 @@ LDAP URLs
 A :py:class:`LDAPUrl` object represents a complete LDAP URL.
 
 .. autoclass:: ldapurl.LDAPUrl 
+   :members:
 
 
 LDAP URL extensions
@@ -78,10 +79,12 @@ whereas :py:class:`LDAPUrlExtensions` represents a list of LDAP URL extensions.
 .. _ldapurl-ldapurlextension:
 
 .. autoclass:: ldapurl.LDAPUrlExtension
+   :members:
 
 .. _ldapurl-ldapurlextensions:
 
 .. autoclass:: ldapurl.LDAPUrlExtensions
+   :members:
 
 
 .. _ldapurl-example:
diff --git a/Doc/ldif.rst b/Doc/ldif.rst
index 0bf28e1..0f6f77c 100644
--- a/Doc/ldif.rst
+++ b/Doc/ldif.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldif.rst,v 1.9 2016/07/24 15:47:46 stroeder Exp $
+.. % $Id: ldif.rst,v 1.10 2017/08/16 11:24:37 stroeder Exp $
 
 #####################################
 :mod:`ldif` LDIF parser and generator
@@ -31,12 +31,16 @@ Classes
 ^^^^^^^
 
 .. autoclass:: ldif.LDIFWriter
+   :members:
 
 .. autoclass:: ldif.LDIFParser
+   :members:
 
 .. autoclass:: LDIFRecordList
+   :members:
 
 .. autoclass:: LDIFCopy
+   :members:
 
 
 .. _ldif-example:

From 56d76daf29e295645687984a2f86014ae1b3a1b6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 11:25:07 +0000
Subject: [PATCH 420/868] slapdtest with autoclass::

---
 Doc/slapdtest.rst | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Doc/slapdtest.rst b/Doc/slapdtest.rst
index b353402..dc31527 100644
--- a/Doc/slapdtest.rst
+++ b/Doc/slapdtest.rst
@@ -1,4 +1,4 @@
-.. % $Id: slapdtest.rst,v 1.1 2017/08/01 17:50:24 stroeder Exp $
+.. % $Id: slapdtest.rst,v 1.2 2017/08/16 11:25:07 stroeder Exp $
 
 #####################################
 :mod:`slapdtest` Spawning test instances of OpenLDAP's slapd server
@@ -23,3 +23,8 @@ Functions
 Classes
 ^^^^^^^
 
+.. autoclass:: slapdtest.SlapdObject
+   :members:
+
+.. autoclass:: slapdtest.SlapdTestCase
+   :members:

From 268b9c33b4f8ebe50d6afd8b9913765f1100a7c6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 11:26:44 +0000
Subject: [PATCH 421/868] bumped doc release to 2.4.42

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index f801ec8..410f848 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.27 2017/08/01 17:50:51 stroeder Exp $
+# $Id: conf.py,v 1.28 2017/08/16 11:26:44 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.41.0'
+release = '2.4.42.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From 1e93f614109d2ff6b8ad7ecd2e30f79639113d52 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 11:34:47 +0000
Subject: [PATCH 422/868] better wording on lazy connect by ldap_initialize(3),
 added link to OpenLDAP man-page

---
 Doc/ldap.rst | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 7f7380e..8a23f51 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.34 2016/07/24 16:12:55 stroeder Exp $
+.. % $Id: ldap.rst,v 1.35 2017/08/16 11:34:47 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -37,11 +37,13 @@ This module defines the following functions:
    and return an LDAP object (see :ref:`ldap-objects`) used to perform operations
    on that server.  Parameter *uri* has to be a valid LDAP URL.
 
-   Note that the C wrapper function :py:func:_ldap.initialize() is called which calls
-   the OpenLDAP funtion ldap_initialize(). Calling this function just initializes
-   the LDAP connection struct in the C API - nothing else. The first call to
-   an operation method (bind, search etc.) then really opens the connection.
-   Before that nothing is sent on the wire.
+   Note that internally the OpenLDAP funtion
+   `ldap_initialize(3) <https://www.openldap.org/software/man.cgi?query=ldap_init&sektion=3>`_   
+   is called which just initializes the LDAP connection struct in the C API 
+   - nothing else. Therefore the first call to an operation method (bind, 
+   search etc.) then really opens the connection (lazy connect). Before 
+   that nothing is sent on the wire. The error handling in the calling 
+   application has to correctly handle this behaviour.
 
    The optional arguments are for generating debug log information:
    *trace_level* specifies the amount of information being logged,

From cba9079d068c6bec144b86f6b11f169327abcee6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 11:42:55 +0000
Subject: [PATCH 423/868] better wording for ldap.initialize() arguments, added
 ref to ldap.initialize() from LDAPObject.__init__() occurences

---
 Doc/ldap.rst | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 8a23f51..8fa5ec5 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.35 2017/08/16 11:34:47 stroeder Exp $
+.. % $Id: ldap.rst,v 1.36 2017/08/16 11:42:55 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -21,8 +21,8 @@ and errors appear as exceptions.
       `draft-ietf-ldapext-ldap-c-api <https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api>`_
 
 
-This documentation is current for the Python LDAP module, version  
-|release|.  Source and binaries are available from 
+This documentation is current for the Python LDAP module, version
+|release|.  Source and binaries are available from
 https://www.python-ldap.org/.
 
 
@@ -35,14 +35,19 @@ This module defines the following functions:
 
    Initializes a new connection object for accessing the given LDAP server,
    and return an LDAP object (see :ref:`ldap-objects`) used to perform operations
-   on that server.  Parameter *uri* has to be a valid LDAP URL.
+   on that server.
+
+   The *uri* parameter may be a comma- or whitespace-separated list of URIs
+   containing only the schema, the host, and the port fields. Note that
+   when using multiple URIs you cannot determine to which URI your client
+   gets connected.
 
    Note that internally the OpenLDAP funtion
-   `ldap_initialize(3) <https://www.openldap.org/software/man.cgi?query=ldap_init&sektion=3>`_   
-   is called which just initializes the LDAP connection struct in the C API 
-   - nothing else. Therefore the first call to an operation method (bind, 
-   search etc.) then really opens the connection (lazy connect). Before 
-   that nothing is sent on the wire. The error handling in the calling 
+   `ldap_initialize(3) <https://www.openldap.org/software/man.cgi?query=ldap_init&sektion=3>`_
+   is called which just initializes the LDAP connection struct in the C API
+   - nothing else. Therefore the first call to an operation method (bind,
+   search etc.) then really opens the connection (lazy connect). Before
+   that nothing is sent on the wire. The error handling in the calling
    application has to correctly handle this behaviour.
 
    The optional arguments are for generating debug log information:
@@ -566,9 +571,10 @@ LDAPObject classes
    and closed when the LDAP object is deleted. Internally :py:class:`LDAPObject`
    is set to :py:class:`SimpleLDAPObject` by default.
 
-
 .. py:class:: SimpleLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5]]])
 
+   The arguments are same like for function :py:func:`initialize()`.
+
    Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
    and :py:func:`open()` (deprecated). The connection is automatically unbound
    and closed  when the LDAP object is deleted.
@@ -580,6 +586,8 @@ LDAPObject classes
    reconnects when using the synchronous request methods (see below). This class
    also implements the pickle protocol.
 
+   The first arguments are same like for function :py:func:`initialize()`.
+
    For automatic reconnects it has additional arguments:
 
    *retry_max* specifies the number of reconnect attempts before
@@ -745,7 +753,7 @@ and wait for and return with the server's result, or with
 
    The *extreq* is an instance of class :py:class:`ldap.extop.ExtendedRequest`
    containing the parameters for the extended operation request.
-   
+
    If argument *extop_resp_class* is set to a sub-class of
    :py:class:`ldap.extop.ExtendedResponse` this class is used to return an
    object of this class instead of a raw BER value in respvalue.
@@ -925,7 +933,7 @@ and wait for and return with the server's result, or with
    The additional arguments are:
 
    *add_ctrls* (integer flag) specifies whether response controls are returned.
-   
+
    add_intermediates (integer flag) specifies whether response controls of
    intermediate search results are returned.
 

From 0094b338e288ea34b100723c26b23a25cdb508df Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 11:47:11 +0000
Subject: [PATCH 424/868] removed double text, better wording for
 SimpleLDAPObject

---
 Doc/ldap.rst | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 8fa5ec5..2478546 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.36 2017/08/16 11:42:55 stroeder Exp $
+.. % $Id: ldap.rst,v 1.37 2017/08/16 11:47:11 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -568,17 +568,16 @@ LDAPObject classes
 
    Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
    and :py:func:`open()` (deprecated). The connection is automatically unbound
-   and closed when the LDAP object is deleted. Internally :py:class:`LDAPObject`
-   is set to :py:class:`SimpleLDAPObject` by default.
+   and closed when the LDAP object is deleted.
+   
+   Internally :py:class:`LDAPObject` is set to :py:class:`SimpleLDAPObject` 
+   by default.
 
 .. py:class:: SimpleLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5]]])
 
-   The arguments are same like for function :py:func:`initialize()`.
-
-   Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
-   and :py:func:`open()` (deprecated). The connection is automatically unbound
-   and closed  when the LDAP object is deleted.
+   This basic class wraps all methods of the underlying C API object.
 
+   The arguments are same like for function :py:func:`initialize()`.
 
 .. py:class:: ReconnectLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5] [, retry_max=1 [, retry_delay=60.0]]]])
 

From dbe5d5e29f44eb92fa4040368e402c59e72db8f5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 12:00:39 +0000
Subject: [PATCH 425/868] correctly markup result types, link to OpenLDAP
 man-page ldap_str2dn(3)

---
 Doc/ldap-dn.rst | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index c6456e8..506449e 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-dn.rst,v 1.8 2016/07/24 15:52:26 stroeder Exp $
+.. % $Id: ldap-dn.rst,v 1.9 2017/08/16 12:00:39 stroeder Exp $
 
 
 :py:mod:`ldap.dn` LDAP Distinguished Name handling
@@ -27,48 +27,43 @@
 The :mod:`ldap.dn` module defines the following functions:
 
 
-.. function:: escape_dn_chars(s)
+.. function:: escape_dn_chars(s) -> string
 
    This function escapes characters in string *s* which  are special in LDAP
    distinguished names. You should use  this function when building LDAP DN strings
    from arbitrary input.
 
-   .. % -> string
 
-
-.. function:: str2dn(s [, flags=0])
+.. function:: str2dn(s [, flags=0]) -> list
 
    This function takes *s* and breaks it up into its component parts  down to AVA
    level. The optional parameter *flags* describes the DN format of s  (see
    :ref:`ldap-dn-flags`). Note that hex-encoded non-ASCII chars are decoded
    to the raw bytes.
 
-   .. % -> list
+   Internally this function is implemented by calling OpenLDAP C function
+   `ldap_str2dn(3) <https://www.openldap.org/software/man.cgi?query=ldap_str2dn&sektion=3>`_.
 
 
-.. function:: dn2str(dn)
+.. function:: dn2str(dn) -> string
 
    This function takes a decomposed DN in *dn* and returns  a single string. It's
    the inverse to :func:`str2dn`.  Special characters are escaped with the help of
    function :func:`escape_dn_chars`.
 
-   .. % -> string
-
 
-.. function:: explode_dn(dn [, notypes=0[, flags=0]])
+.. function:: explode_dn(dn [, notypes=0[, flags=0]]) -> list
 
    This function takes *dn* and breaks it up into its component parts.   Each part
    is known as an RDN (Relative Distinguished Name). The optional  *notypes*
    parameter is used to specify that only the RDN values be   returned and not
    their types. The optional parameter *flags*  describes the DN format of s (see
-   :ref:`ldap-dn-flags`).    This function is emulated by function
+   :ref:`ldap-dn-flags`). This function is emulated by function
    :func:`str2dn`  since the function ldap_explode_dn() in the C library is
    deprecated.
 
-   .. % -> list
-
 
-.. function:: explode_rdn(rdn [, notypes=0[, flags=0]])
+.. function:: explode_rdn(rdn [, notypes=0[, flags=0]]) -> list
 
    This function takes a (multi-valued) *rdn* and breaks it up  into a list of
    characteristic attributes. The optional  *notypes* parameter is used to specify
@@ -77,14 +72,12 @@ The :mod:`ldap.dn` module defines the following functions:
    function is emulated by function :func:`str2dn`  since the function
    ldap_explode_rdn() in the C library is deprecated.
 
-   .. % -> list
 
-.. function:: is_dn(dn[, flags=0])
+.. function:: is_dn(dn[, flags=0]) -> boolean
 
    This function checks whether *dn* is a valid LDAP distinguished name by 
    passing it to function :func:`str2dn`.
 
-   .. % -> boolean
 
 .. _ldap-dn-example:
 

From 1ca1ab8d5b6702c1f309ea2906730f0549715021 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 12:03:33 +0000
Subject: [PATCH 426/868] white-space cleaning

---
 Doc/ldap-dn.rst      |  4 ++--
 Doc/ldap-modlist.rst | 22 +++++++++++-----------
 Doc/ldap.rst         | 11 ++++-------
 Doc/ldapurl.rst      |  4 ++--
 Doc/ldif.rst         |  4 ++--
 Doc/slapdtest.rst    |  4 ++--
 6 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index 506449e..77db4a1 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-dn.rst,v 1.9 2017/08/16 12:00:39 stroeder Exp $
+.. % $Id: ldap-dn.rst,v 1.10 2017/08/16 12:03:33 stroeder Exp $
 
 
 :py:mod:`ldap.dn` LDAP Distinguished Name handling
@@ -75,7 +75,7 @@ The :mod:`ldap.dn` module defines the following functions:
 
 .. function:: is_dn(dn[, flags=0]) -> boolean
 
-   This function checks whether *dn* is a valid LDAP distinguished name by 
+   This function checks whether *dn* is a valid LDAP distinguished name by
    passing it to function :func:`str2dn`.
 
 
diff --git a/Doc/ldap-modlist.rst b/Doc/ldap-modlist.rst
index 0eb41c5..ad39a3a 100644
--- a/Doc/ldap-modlist.rst
+++ b/Doc/ldap-modlist.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-modlist.rst,v 1.5 2016/03/03 17:06:10 stroeder Exp $
+.. % $Id: ldap-modlist.rst,v 1.6 2017/08/16 12:03:33 stroeder Exp $
 
 
 :py:mod:`ldap.modlist` Generate modify lists
@@ -27,17 +27,17 @@ The :mod:`ldap.modlist` module defines the following functions:
 
    This function builds a list suitable for passing it directly as argument
    *modlist* to method :py:meth:`ldap.ldapobject.LDAPObject.modify` or
-   its synchronous counterpart :py:meth:`ldap.ldapobject.LDAPObject.modify_s`. 
-   
+   its synchronous counterpart :py:meth:`ldap.ldapobject.LDAPObject.modify_s`.
+
    Roughly when applying the resulting modify list to an entry
    holding  the data *old_entry* it will be modified in such a way that the entry
    holds *new_entry* after the modify operation. It is handy in situations when it
    is impossible to track user changes to an entry's data or for synchronizing
    operations.
-   
+
    *old_entry* and *new_entry* are dictionaries like returned when
    receiving search results.
-   
+
    *ignore_attr_types* is a list of attribute type
    names which shall be ignored completely. These attribute types will not appear
    in the result at all.
@@ -53,10 +53,10 @@ The :mod:`ldap.modlist` module defines the following functions:
    unnecessary changes (e.g. case of attribute type names in DNs).
 
    .. note::
-      Replacing attribute values is always done with a 
-      :py:const:`ldap.MOD_DELETE`/:py:const:`ldap.MOD_ADD` pair instead of 
-      :py:const:`ldap.MOD_REPLACE` to work-around potential issues with 
-      attributes for which no EQUALITY matching rule are defined in the 
-      server's subschema.  This works correctly in most situations but 
-      rarely fails with some LDAP servers implementing (schema) checks on 
+      Replacing attribute values is always done with a
+      :py:const:`ldap.MOD_DELETE`/:py:const:`ldap.MOD_ADD` pair instead of
+      :py:const:`ldap.MOD_REPLACE` to work-around potential issues with
+      attributes for which no EQUALITY matching rule are defined in the
+      server's subschema.  This works correctly in most situations but
+      rarely fails with some LDAP servers implementing (schema) checks on
       transient state entry during processing the modify operation.
diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 2478546..b017af5 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.37 2017/08/16 11:47:11 stroeder Exp $
+.. % $Id: ldap.rst,v 1.38 2017/08/16 12:03:33 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -261,9 +261,7 @@ This constants are used for DN-parsing functions found in
 sub-module :py:mod:`ldap.dn`.
 
 .. seealso::
-
-   :manpage:`ldap_str2dn{3}`
-
+   `ldap_str2dn(3) <https://www.openldap.org/software/man.cgi?query=ldap_str2dn&sektion=3>`_
 
 .. py:data:: DN_FORMAT_LDAP
 
@@ -569,8 +567,8 @@ LDAPObject classes
    Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
    and :py:func:`open()` (deprecated). The connection is automatically unbound
    and closed when the LDAP object is deleted.
-   
-   Internally :py:class:`LDAPObject` is set to :py:class:`SimpleLDAPObject` 
+
+   Internally :py:class:`LDAPObject` is set to :py:class:`SimpleLDAPObject`
    by default.
 
 .. py:class:: SimpleLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5]]])
@@ -1012,7 +1010,6 @@ and wait for and return with the server's result, or with
     :rfc:`2830` - Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security
 
 
-
 .. py:method:: LDAPObject.unbind() -> int
 
 .. py:method:: LDAPObject.unbind_s() -> None
diff --git a/Doc/ldapurl.rst b/Doc/ldapurl.rst
index 7ea26eb..e2a4dbd 100644
--- a/Doc/ldapurl.rst
+++ b/Doc/ldapurl.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldapurl.rst,v 1.11 2017/08/16 11:24:37 stroeder Exp $
+.. % $Id: ldapurl.rst,v 1.12 2017/08/16 12:03:33 stroeder Exp $
 
 ###################################
 :py:mod:`ldapurl` LDAP URL handling
@@ -65,7 +65,7 @@ LDAP URLs
 
 A :py:class:`LDAPUrl` object represents a complete LDAP URL.
 
-.. autoclass:: ldapurl.LDAPUrl 
+.. autoclass:: ldapurl.LDAPUrl
    :members:
 
 
diff --git a/Doc/ldif.rst b/Doc/ldif.rst
index 0f6f77c..8a8f6f3 100644
--- a/Doc/ldif.rst
+++ b/Doc/ldif.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldif.rst,v 1.10 2017/08/16 11:24:37 stroeder Exp $
+.. % $Id: ldif.rst,v 1.11 2017/08/16 12:03:33 stroeder Exp $
 
 #####################################
 :mod:`ldif` LDIF parser and generator
@@ -69,7 +69,7 @@ with :mod:`ldif` module, skip some entries and write the result to stdout. ::
    import sys
    from ldif import LDIFParser,LDIFWriter
 
-   SKIP_DN = ["uid=foo,ou=People,dc=example,dc=com", 
+   SKIP_DN = ["uid=foo,ou=People,dc=example,dc=com",
       "uid=bar,ou=People,dc=example,dc=com"]
 
    class MyLDIF(LDIFParser):
diff --git a/Doc/slapdtest.rst b/Doc/slapdtest.rst
index dc31527..1727bc4 100644
--- a/Doc/slapdtest.rst
+++ b/Doc/slapdtest.rst
@@ -1,4 +1,4 @@
-.. % $Id: slapdtest.rst,v 1.2 2017/08/16 11:25:07 stroeder Exp $
+.. % $Id: slapdtest.rst,v 1.3 2017/08/16 12:03:33 stroeder Exp $
 
 #####################################
 :mod:`slapdtest` Spawning test instances of OpenLDAP's slapd server
@@ -9,7 +9,7 @@
 .. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
 
 
-The module is used for testing python-ldap itself but can be used for 
+The module is used for testing python-ldap itself but can be used for
 automatically testing any OpenLDAP-based configuration setup.
 
 This module is pure Python and does not rely on any non-standard modules.

From 5545a9c7c2b804a9be0bee7420e7a9ace1bcdd04 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 12:17:18 +0000
Subject: [PATCH 427/868] added missing class name prefix

---
 Doc/ldap.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index b017af5..ac5e9d4 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.38 2017/08/16 12:03:33 stroeder Exp $
+.. % $Id: ldap.rst,v 1.39 2017/08/16 12:17:18 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -740,9 +740,9 @@ and wait for and return with the server's result, or with
    *serverctrls* and *clientctrls* like described above.
 
 
-.. py:method:: extop(extreq[,serverctrls=None[,clientctrls=None]]]) -> int
+.. py:method:: LDAPObject.extop(extreq[,serverctrls=None[,clientctrls=None]]]) -> int
 
-.. py:method:: extop_s(extreq[,serverctrls=None[,clientctrls=None[,extop_resp_class=None]]]]) -> (respoid,respvalue)
+.. py:method:: LDAPObject.extop_s(extreq[,serverctrls=None[,clientctrls=None[,extop_resp_class=None]]]]) -> (respoid,respvalue)
 
    Performs an LDAP extended operation. The asynchronous
    form returns the message id of the initiated request, and the
@@ -755,7 +755,7 @@ and wait for and return with the server's result, or with
    :py:class:`ldap.extop.ExtendedResponse` this class is used to return an
    object of this class instead of a raw BER value in respvalue.
 
-.. py:method:: extop_result(self,msgid=ldap.RES_ANY,all=1,timeout=None) -> (respoid,respvalue)
+.. py:method:: LDAPObject.extop_result(self,msgid=ldap.RES_ANY,all=1,timeout=None) -> (respoid,respvalue)
 
    Wrapper method around :py:meth:`result4()` just for retrieving
    the result of an extended operation sent before.

From 351452e74e74af2b7ecba92225425eeba746e8ec Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 12:17:56 +0000
Subject: [PATCH 428/868] Title overline length fixed

---
 Doc/slapdtest.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/slapdtest.rst b/Doc/slapdtest.rst
index 1727bc4..49d1403 100644
--- a/Doc/slapdtest.rst
+++ b/Doc/slapdtest.rst
@@ -1,8 +1,8 @@
-.. % $Id: slapdtest.rst,v 1.3 2017/08/16 12:03:33 stroeder Exp $
+.. % $Id: slapdtest.rst,v 1.4 2017/08/16 12:17:56 stroeder Exp $
 
-#####################################
+###################################################################
 :mod:`slapdtest` Spawning test instances of OpenLDAP's slapd server
-#####################################
+###################################################################
 
 .. py:module:: slapdtest
    :synopsis: Spawning test instances of OpenLDAP's slapd server

From cdc169aa9f1a3807c3861f2aafccd04957c1f350 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 16 Aug 2017 13:29:05 +0000
Subject: [PATCH 429/868] SlapdObject methods setup_rundir() and gen_config()
 are now "public" methods

---
 CHANGES          |  4 +++-
 Lib/slapdtest.py | 18 ++++++++++++------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index c1a397b..c59e69d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,8 @@ Changes since 2.4.41:
 Lib/
 * added new SlapdObject methods _ln_schema_files() and
   _create_sub_dirs()
+* SlapdObject methods setup_rundir() and gen_config()
+  are now "public" methods
 * removed pseudo test script from module ldap.cidict
 
 Tests/
@@ -1473,4 +1475,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.455 2017/08/15 16:14:04 stroeder Exp $
+$Id: CHANGES,v 1.456 2017/08/16 13:29:05 stroeder Exp $
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 7a02492..c3502d1 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.18 2017/08/15 17:18:54 stroeder Exp $
+$Id: slapdtest.py,v 1.19 2017/08/16 13:29:06 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
@@ -83,7 +83,7 @@ class SlapdObject(object):
     Controller class for a slapd instance, OpenLDAP's server.
 
     This class creates a temporary data store for slapd, runs it
-    on a private port, and initialises it with a top-level dc and
+    listening on a private Unix domain socket and TCP port, and initialises it with a top-level entry and
     the root user.
 
     When a reference to an instance of this class is lost, the slapd
@@ -132,9 +132,12 @@ def __init__(self):
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % urllib.quote_plus(ldapi_path)
 
-    def _setup_rundir(self):
+    def setup_rundir(self):
         """
         creates rundir structure
+
+        for setting up a custom directory structure you have to override
+        this method
         """
         os.mkdir(self.testrundir)
         os.mkdir(self._db_directory)
@@ -172,9 +175,12 @@ def _avail_tcp_port(self):
         self._log.info('Found available port %d', port)
         return port
 
-    def _gen_config(self):
+    def gen_config(self):
         """
         generates a slapd.conf and returns it as one string
+
+        for generating specific static configuration files you have to
+        override this method
         """
         config_dict = {
             'serverid': hex(self.server_id),
@@ -213,7 +219,7 @@ def _write_config(self):
         """Writes the slapd.conf file out, and returns the path to it."""
         self._log.debug('Writing config to %s', self._slapd_conf)
         config_file = file(self._slapd_conf, 'wb')
-        config_file.write(self._gen_config())
+        config_file.write(self.gen_config())
         config_file.close()
         self._log.info('Wrote config to %s', self._slapd_conf)
 
@@ -271,7 +277,7 @@ def start(self):
         if self._proc is None:
             # prepare directory structure
             self._cleanup_rundir()
-            self._setup_rundir()
+            self.setup_rundir()
             self._write_config()
             self._test_config()
             self._start_slapd()

From c6d61e2f60469e0e2c86b0a35c03dad2e53e096c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 07:47:29 +0000
Subject: [PATCH 430/868] avoid deprecated method alias
 unittest.TestCase.assertEquals

---
 CHANGES                   |   3 +-
 Tests/t_cext.py           | 218 +++++++++++++++++++-------------------
 Tests/t_cidict.py         |  22 ++--
 Tests/t_ldap_dn.py        |  16 +--
 Tests/t_ldap_filter.py    |  12 +--
 Tests/t_ldap_functions.py |  18 ++--
 Tests/t_ldapobject.py     |   8 +-
 Tests/t_ldapurl.py        | 154 +++++++++++++--------------
 8 files changed, 226 insertions(+), 225 deletions(-)

diff --git a/CHANGES b/CHANGES
index c59e69d..0cb3cf0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,7 @@ Lib/
 
 Tests/
 * added sub-module for testing class ldap.cidict.cidict
+* avoid deprecated method alias unittest.TestCase.assertEquals
 
 ----------------------------------------------------------------
 Released 2.4.41 2017-07-12
@@ -1475,4 +1476,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.456 2017/08/16 13:29:05 stroeder Exp $
+$Id: CHANGES,v 1.457 2017/09/04 07:47:29 stroeder Exp $
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index edb4adb..6ced288 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_cext.py,v 1.23 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_cext.py,v 1.24 2017/09/04 07:47:29 stroeder Exp $
 """
 
 import os
@@ -77,23 +77,23 @@ def test_constants(self):
         """
         Test whether all libldap-derived constants are correct
         """
-        self.assertEquals(_ldap.PORT, 389)
-        self.assertEquals(_ldap.VERSION1, 1)
-        self.assertEquals(_ldap.VERSION2, 2)
-        self.assertEquals(_ldap.VERSION3, 3)
+        self.assertEqual(_ldap.PORT, 389)
+        self.assertEqual(_ldap.VERSION1, 1)
+        self.assertEqual(_ldap.VERSION2, 2)
+        self.assertEqual(_ldap.VERSION3, 3)
 
         # constants for result4()
-        self.assertEquals(_ldap.RES_BIND, 0x61)
-        self.assertEquals(_ldap.RES_SEARCH_ENTRY, 0x64)
-        self.assertEquals(_ldap.RES_SEARCH_RESULT, 0x65)
-        self.assertEquals(_ldap.RES_MODIFY, 0x67)
-        self.assertEquals(_ldap.RES_ADD, 0x69)
-        self.assertEquals(_ldap.RES_DELETE, 0x6b)
-        self.assertEquals(_ldap.RES_MODRDN, 0x6d)
-        self.assertEquals(_ldap.RES_COMPARE, 0x6f)
-        self.assertEquals(_ldap.RES_SEARCH_REFERENCE, 0x73) # v3
-        self.assertEquals(_ldap.RES_EXTENDED, 0x78)         # v3
-        #self.assertEquals(_ldap.RES_INTERMEDIATE, 0x79)     # v3
+        self.assertEqual(_ldap.RES_BIND, 0x61)
+        self.assertEqual(_ldap.RES_SEARCH_ENTRY, 0x64)
+        self.assertEqual(_ldap.RES_SEARCH_RESULT, 0x65)
+        self.assertEqual(_ldap.RES_MODIFY, 0x67)
+        self.assertEqual(_ldap.RES_ADD, 0x69)
+        self.assertEqual(_ldap.RES_DELETE, 0x6b)
+        self.assertEqual(_ldap.RES_MODRDN, 0x6d)
+        self.assertEqual(_ldap.RES_COMPARE, 0x6f)
+        self.assertEqual(_ldap.RES_SEARCH_REFERENCE, 0x73) # v3
+        self.assertEqual(_ldap.RES_EXTENDED, 0x78)         # v3
+        #self.assertEqual(_ldap.RES_INTERMEDIATE, 0x79)     # v3
         self.assertNotNone(_ldap.RES_ANY)
         self.assertNotNone(_ldap.RES_UNSOLICITED)
 
@@ -170,8 +170,8 @@ def test_constants(self):
         self.assertNotNone(_ldap.AVA_NONPRINTABLE)
 
         # these two constants are pointless? XXX
-        self.assertEquals(_ldap.OPT_ON, 1)
-        self.assertEquals(_ldap.OPT_OFF, 0)
+        self.assertEqual(_ldap.OPT_ON, 1)
+        self.assertEqual(_ldap.OPT_OFF, 0)
 
         # these constants useless after ldap_url_parse() was dropped XXX
         self.assertNotNone(_ldap.URL_ERR_BADSCOPE)
@@ -186,9 +186,9 @@ def test_simple_anonymous_bind(self):
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertTrue(result, _ldap.RES_BIND)
-        self.assertEquals(msgid, m)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(ctrls, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(ctrls, [])
 
     def test_anon_rootdse_search(self):
         l = self._open_conn(bind=False)
@@ -201,15 +201,15 @@ def test_anon_rootdse_search(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(pmsg[0][0], "") # rootDSE has no dn
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(pmsg[0][0], "") # rootDSE has no dn
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
         root_dse = pmsg[0][1]
         self.assertTrue('objectClass' in root_dse)
         self.assertTrue('OpenLDAProotDSE' in root_dse['objectClass'])
         self.assertTrue('namingContexts' in root_dse)
-        self.assertEquals(root_dse['namingContexts'], [self.server.suffix])
+        self.assertEqual(root_dse['namingContexts'], [self.server.suffix])
 
     def test_unbind(self):
         l = self._open_conn()
@@ -232,21 +232,21 @@ def test_search_ext_individual(self):
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
         # Expect to get just one object
-        self.assertEquals(result, _ldap.RES_SEARCH_ENTRY)
-        self.assertEquals(len(pmsg), 1)
-        self.assertEquals(len(pmsg[0]), 2)
-        self.assertEquals(pmsg[0][0], self.server.suffix)
-        self.assertEquals(pmsg[0][0], self.server.suffix)
+        self.assertEqual(result, _ldap.RES_SEARCH_ENTRY)
+        self.assertEqual(len(pmsg), 1)
+        self.assertEqual(len(pmsg[0]), 2)
+        self.assertEqual(pmsg[0][0], self.server.suffix)
+        self.assertEqual(pmsg[0][0], self.server.suffix)
         self.assertTrue('dcObject' in pmsg[0][1]['objectClass'])
         self.assertTrue('organization' in pmsg[0][1]['objectClass'])
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
 
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
 
     def test_abandon(self):
         l = self._open_conn()
@@ -267,10 +267,10 @@ def test_search_ext_all(self):
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         # Expect to get some objects
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
         self.assertTrue(len(pmsg) >= 2)
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
 
     def test_add(self):
         """
@@ -287,19 +287,19 @@ def test_add(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_ADD)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
         # search for it back
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         # Expect to get the objects
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(len(pmsg), 1)
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
-        self.assertEquals(
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(len(pmsg), 1)
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
+        self.assertEqual(
             pmsg[0],
             (
                 'cn=Foo,'+self.server.suffix,
@@ -329,7 +329,7 @@ def test_compare(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
         # try a false compare
         m = l.compare_ext(dn, "userPassword", "bad_string")
         try:
@@ -381,14 +381,14 @@ def test_delete(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
 
         m = l.delete_ext(dn)
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_DELETE)
-        self.assertEquals(msgid, m)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_DELETE)
+        self.assertEqual(msgid, m)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(ctrls, [])
 
     def test_modify_no_such_object(self):
         l = self._open_conn()
@@ -444,7 +444,7 @@ def test_modify(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
 
         m = l.modify_ext(
             dn,
@@ -453,22 +453,22 @@ def test_modify(self):
             ]
         )
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_MODIFY)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_MODIFY)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
         # search for it back
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         # Expect to get the objects
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(len(pmsg), 1)
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
-        self.assertEquals(pmsg[0][0], dn)
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(len(pmsg), 1)
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
+        self.assertEqual(pmsg[0][0], dn)
         d = list(pmsg[0][1]['description'])
         d.sort()
-        self.assertEquals(d, ['a description', 'b desc', 'c desc'])
+        self.assertEqual(d, ['a description', 'b desc', 'c desc'])
 
     def test_rename(self):
         l = self._open_conn()
@@ -482,34 +482,34 @@ def test_rename(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
 
         # do the rename with same parent
         m = l.rename(dn, "cn=IAmRenamed")
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_MODRDN)
-        self.assertEquals(msgid, m)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_MODRDN)
+        self.assertEqual(msgid, m)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(ctrls, [])
 
         # make sure the old one is gone
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(len(pmsg), 0) # expect no results
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(len(pmsg), 0) # expect no results
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
 
         # check that the new one looks right
         dn2 = "cn=IAmRenamed,"+self.server.suffix
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
-        self.assertEquals(len(pmsg), 1)
-        self.assertEquals(pmsg[0][0], dn2)
-        self.assertEquals(pmsg[0][1]['cn'], ['IAmRenamed'])
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
+        self.assertEqual(len(pmsg), 1)
+        self.assertEqual(pmsg[0][0], dn2)
+        self.assertEqual(pmsg[0][1]['cn'], ['IAmRenamed'])
 
         # create the container
         containerDn = "ou=RenameContainer,"+self.server.suffix
@@ -521,7 +521,7 @@ def test_rename(self):
             ]
         )
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
 
         # WORKAROUND bug in slapd. (Without an existing child,
         # renames into a container object do not work for the ldif backend,
@@ -535,7 +535,7 @@ def test_rename(self):
             ]
         )
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
 
         # now rename from dn2 to the conater
         dn3 = "cn=IAmRenamedAgain," + containerDn
@@ -543,18 +543,18 @@ def test_rename(self):
         # Now try renaming dn2 across container (simultaneous name change)
         m = l.rename(dn2, "cn=IAmRenamedAgain", containerDn)
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_MODRDN)
-        self.assertEquals(msgid, m)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_MODRDN)
+        self.assertEqual(msgid, m)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(ctrls, [])
 
         # make sure dn2 is gone
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(len(pmsg), 0) # expect no results
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(len(pmsg), 0) # expect no results
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
 
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
@@ -562,24 +562,24 @@ def test_rename(self):
         # make sure dn3 is there
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_SEARCH_RESULT)
-        self.assertEquals(msgid, m)
-        self.assertEquals(ctrls, [])
-        self.assertEquals(len(pmsg), 1)
-        self.assertEquals(pmsg[0][0], dn3)
-        self.assertEquals(pmsg[0][1]['cn'], ['IAmRenamedAgain'])
+        self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
+        self.assertEqual(msgid, m)
+        self.assertEqual(ctrls, [])
+        self.assertEqual(len(pmsg), 1)
+        self.assertEqual(pmsg[0][0], dn3)
+        self.assertEqual(pmsg[0][1]['cn'], ['IAmRenamedAgain'])
 
 
     def test_whoami(self):
         l = self._open_conn()
         r = l.whoami_s()
-        self.assertEquals("dn:" + self.server.root_dn, r)
+        self.assertEqual("dn:" + self.server.root_dn, r)
 
     def test_whoami_unbound(self):
         l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
         r = l.whoami_s()
-        self.assertEquals("", r)
+        self.assertEqual("", r)
 
     def test_whoami_anonymous(self):
         l = self._open_conn(bind=False)
@@ -590,7 +590,7 @@ def test_whoami_anonymous(self):
         self.assertTrue(result, _ldap.RES_BIND)
         # check with Who Am I? extended operation
         r = l.whoami_s()
-        self.assertEquals("", r)
+        self.assertEqual("", r)
 
     def test_passwd(self):
         l = self._open_conn()
@@ -607,7 +607,7 @@ def test_passwd(self):
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(result, _ldap.RES_ADD)
+        self.assertEqual(result, _ldap.RES_ADD)
         # try changing password with a wrong old-pw
         m = l.passwd(dn, "bogus", "ignored")
         self.assertEqual(type(m), type(0))
@@ -620,10 +620,10 @@ def test_passwd(self):
         # try changing password with a correct old-pw
         m = l.passwd(dn, "initial", "changed")
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEquals(msgid, m)
-        self.assertEquals(pmsg, [])
-        self.assertEquals(result, _ldap.RES_EXTENDED)
-        self.assertEquals(ctrls, [])
+        self.assertEqual(msgid, m)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(result, _ldap.RES_EXTENDED)
+        self.assertEqual(ctrls, [])
 
     def test_options(self):
         oldval = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
@@ -638,10 +638,10 @@ def test_options(self):
 
             _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION2)
             v = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
-            self.assertEquals(v, _ldap.VERSION2)
+            self.assertEqual(v, _ldap.VERSION2)
             _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
             v = _ldap.get_option(_ldap.OPT_PROTOCOL_VERSION)
-            self.assertEquals(v, _ldap.VERSION3)
+            self.assertEqual(v, _ldap.VERSION3)
         finally:
             _ldap.set_option(_ldap.OPT_PROTOCOL_VERSION, oldval)
 
@@ -651,11 +651,11 @@ def test_options(self):
 
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION2)
         v = l.get_option(_ldap.OPT_PROTOCOL_VERSION)
-        self.assertEquals(v, _ldap.VERSION2)
+        self.assertEqual(v, _ldap.VERSION2)
 
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
         v = l.get_option(_ldap.OPT_PROTOCOL_VERSION)
-        self.assertEquals(v, _ldap.VERSION3)
+        self.assertEqual(v, _ldap.VERSION3)
 
         # Try setting options that will yield a known error.
         try:
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index 8915ceb..ab79b28 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_cidict.py,v 1.2 2017/08/15 16:14:04 stroeder Exp $
+$Id: t_cidict.py,v 1.3 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -23,26 +23,26 @@ def test_cidict(self):
         """
         test function is_dn()
         """
-        self.assertEquals(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
+        self.assertEqual(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
         data = {
             'AbCDeF':123,
         }
         cix = ldap.cidict.cidict(data)
-        self.assertEquals(cix["ABCDEF"], 123)
-        self.assertEquals(cix.get("ABCDEF", None), 123)
-        self.assertEquals(cix.get("not existent", None), None)
+        self.assertEqual(cix["ABCDEF"], 123)
+        self.assertEqual(cix.get("ABCDEF", None), 123)
+        self.assertEqual(cix.get("not existent", None), None)
         cix["xYZ"] = 987
-        self.assertEquals(cix["XyZ"], 987)
-        self.assertEquals(cix.get("xyz", None), 987)
+        self.assertEqual(cix["XyZ"], 987)
+        self.assertEqual(cix.get("xyz", None), 987)
         cix_keys = cix.keys()
         cix_keys.sort()
-        self.assertEquals(cix_keys, ['AbCDeF','xYZ'])
+        self.assertEqual(cix_keys, ['AbCDeF','xYZ'])
         cix_items = cix.items()
         cix_items.sort()
-        self.assertEquals(cix_items, [('AbCDeF',123), ('xYZ',987)])
+        self.assertEqual(cix_items, [('AbCDeF',123), ('xYZ',987)])
         del cix["abcdEF"]
-        self.assertEquals(cix._keys.has_key("abcdef"), False)
-        self.assertEquals(cix._keys.has_key("AbCDef"), False)
+        self.assertEqual(cix._keys.has_key("abcdef"), False)
+        self.assertEqual(cix._keys.has_key("AbCDef"), False)
 
 
 if __name__ == '__main__':
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 4a3f773..1507d2e 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_dn.py,v 1.5 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_ldap_dn.py,v 1.6 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -23,13 +23,13 @@ def test_is_dn(self):
         """
         test function is_dn()
         """
-        self.assertEquals(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
-        self.assertEquals(ldap.dn.is_dn('-cn=foobar,ou=ae-dir'), False)
-        self.assertEquals(ldap.dn.is_dn(';cn=foobar,ou=ae-dir'), False)
-        self.assertEquals(ldap.dn.is_dn(',cn=foobar,ou=ae-dir'), False)
-        self.assertEquals(ldap.dn.is_dn('cn=foobar,ou=ae-dir,'), False)
-        self.assertEquals(ldap.dn.is_dn('uid=xkcd,cn=foobar,ou=ae-dir'), True)
-        self.assertEquals(
+        self.assertEqual(ldap.dn.is_dn('foobar,ou=ae-dir'), False)
+        self.assertEqual(ldap.dn.is_dn('-cn=foobar,ou=ae-dir'), False)
+        self.assertEqual(ldap.dn.is_dn(';cn=foobar,ou=ae-dir'), False)
+        self.assertEqual(ldap.dn.is_dn(',cn=foobar,ou=ae-dir'), False)
+        self.assertEqual(ldap.dn.is_dn('cn=foobar,ou=ae-dir,'), False)
+        self.assertEqual(ldap.dn.is_dn('uid=xkcd,cn=foobar,ou=ae-dir'), True)
+        self.assertEqual(
             ldap.dn.is_dn(
                 'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c.o=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f'
             ),
diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index b5a38d9..f50a217 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_filter.py,v 1.4 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_ldap_filter.py,v 1.5 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -23,15 +23,15 @@ def test_escape_filter_chars_mode0(self):
         """
         test function escape_filter_chars() with escape_mode=0
         """
-        self.assertEquals(
+        self.assertEqual(
             escape_filter_chars(r'foobar'),
             'foobar'
         )
-        self.assertEquals(
+        self.assertEqual(
             escape_filter_chars(r'foo\bar'),
             r'foo\5cbar'
         )
-        self.assertEquals(
+        self.assertEqual(
             escape_filter_chars(
                 r'foo\bar',
                 escape_mode=0
@@ -43,7 +43,7 @@ def test_escape_filter_chars_mode1(self):
         """
         test function escape_filter_chars() with escape_mode=1
         """
-        self.assertEquals(
+        self.assertEqual(
             escape_filter_chars(
                 '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f',
                 escape_mode=1
@@ -55,7 +55,7 @@ def test_escape_filter_chars_mode2(self):
         """
         test function escape_filter_chars() with escape_mode=2
         """
-        self.assertEquals(
+        self.assertEqual(
             escape_filter_chars(
                 'foobar',
                 escape_mode=2
diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
index 4416d57..1928c67 100644
--- a/Tests/t_ldap_functions.py
+++ b/Tests/t_ldap_functions.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldap_functions.py,v 1.3 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_ldap_functions.py,v 1.4 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -25,21 +25,21 @@ def test_ldap_strf_secs(self):
         """
         test function ldap_strf_secs()
         """
-        self.assertEquals(ldap.strf_secs(0), '19700101000000Z')
-        self.assertEquals(ldap.strf_secs(1466947067), '20160626131747Z')
+        self.assertEqual(ldap.strf_secs(0), '19700101000000Z')
+        self.assertEqual(ldap.strf_secs(1466947067), '20160626131747Z')
 
     def test_ldap_strp_secs(self):
         """
         test function ldap_strp_secs()
         """
-        self.assertEquals(ldap.strp_secs('19700101000000Z'), 0)
-        self.assertEquals(ldap.strp_secs('20160626131747Z'), 1466947067)
+        self.assertEqual(ldap.strp_secs('19700101000000Z'), 0)
+        self.assertEqual(ldap.strp_secs('20160626131747Z'), 1466947067)
 
     def test_escape_str(self):
         """
         test function escape_string_tmpl()
         """
-        self.assertEquals(
+        self.assertEqual(
             ldap.escape_str(
                 escape_filter_chars,
                 '(&(objectClass=aeUser)(uid=%s))',
@@ -47,7 +47,7 @@ def test_escape_str(self):
             ),
             '(&(objectClass=aeUser)(uid=foo))'
         )
-        self.assertEquals(
+        self.assertEqual(
             ldap.escape_str(
                 escape_filter_chars,
                 '(&(objectClass=aeUser)(uid=%s))',
@@ -55,7 +55,7 @@ def test_escape_str(self):
             ),
             '(&(objectClass=aeUser)(uid=foo\\29bar))'
         )
-        self.assertEquals(
+        self.assertEqual(
             ldap.escape_str(
                 escape_dn_chars,
                 'uid=%s',
@@ -63,7 +63,7 @@ def test_escape_str(self):
             ),
             'uid=foo\\=bar'
         )
-        self.assertEquals(
+        self.assertEqual(
             ldap.escape_str(
                 escape_dn_chars,
                 'uid=%s,cn=%s,cn=%s,dc=example,dc=com',
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 8f67bec..e9df53c 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldapobject.py,v 1.8 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_ldapobject.py,v 1.9 2017/09/04 07:47:29 stroeder Exp $
 """
 
 import os
@@ -88,7 +88,7 @@ def test_search_subtree(self):
             attrlist=['*'],
         )
         result.sort()
-        self.assertEquals(
+        self.assertEqual(
             result,
             [
                 (
@@ -118,7 +118,7 @@ def test_search_onelevel(self):
             ['*'],
         )
         result.sort()
-        self.assertEquals(
+        self.assertEqual(
             result,
             [
                 (
@@ -144,7 +144,7 @@ def test_search_oneattr(self):
             ['cn'],
         )
         result.sort()
-        self.assertEquals(
+        self.assertEqual(
             result,
             [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': ['Foo4']})]
         )
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 1b0758e..161e99c 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldapurl.py,v 1.13 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_ldapurl.py,v 1.14 2017/09/04 07:47:29 stroeder Exp $
 """
 
 import unittest
@@ -192,29 +192,29 @@ def test_combo(self):
             + ",X-BINDPW=" + urllib.quote("???")
             + ",trace=8"
         )
-        self.assertEquals(u.urlscheme, "ldap")
-        self.assertEquals(u.hostport, "127.0.0.1:1234")
-        self.assertEquals(u.dn, "dc=example,dc=com")
-        self.assertEquals(u.attrs, ["attr1","attr2","attr3"])
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
-        self.assertEquals(u.filterstr, "(objectClass=*)")
-        self.assertEquals(len(u.extensions), 3)
-        self.assertEquals(u.who, "cn=d,c=au")
-        self.assertEquals(u.cred, "???")
-        self.assertEquals(u.trace_level, "8")
+        self.assertEqual(u.urlscheme, "ldap")
+        self.assertEqual(u.hostport, "127.0.0.1:1234")
+        self.assertEqual(u.dn, "dc=example,dc=com")
+        self.assertEqual(u.attrs, ["attr1","attr2","attr3"])
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
+        self.assertEqual(u.filterstr, "(objectClass=*)")
+        self.assertEqual(len(u.extensions), 3)
+        self.assertEqual(u.who, "cn=d,c=au")
+        self.assertEqual(u.cred, "???")
+        self.assertEqual(u.trace_level, "8")
 
     def test_parse_default_hostport(self):
         u = LDAPUrl("ldap://")
-        self.assertEquals(u.urlscheme, "ldap")
-        self.assertEquals(u.hostport, "")
+        self.assertEqual(u.urlscheme, "ldap")
+        self.assertEqual(u.hostport, "")
 
     def test_parse_empty_dn(self):
         u = LDAPUrl("ldap://")
-        self.assertEquals(u.dn, "")
+        self.assertEqual(u.dn, "")
         u = LDAPUrl("ldap:///")
-        self.assertEquals(u.dn, "")
+        self.assertEqual(u.dn, "")
         u = LDAPUrl("ldap:///?")
-        self.assertEquals(u.dn, "")
+        self.assertEqual(u.dn, "")
 
     def test_parse_default_attrs(self):
         u = LDAPUrl("ldap://")
@@ -230,71 +230,71 @@ def test_parse_default_filter(self):
 
     def test_parse_default_extensions(self):
         u = LDAPUrl("ldap://")
-        self.assertEquals(len(u.extensions), 0)
+        self.assertEqual(len(u.extensions), 0)
 
     def test_parse_schemes(self):
         u = LDAPUrl("ldap://")
-        self.assertEquals(u.urlscheme, "ldap")
+        self.assertEqual(u.urlscheme, "ldap")
         u = LDAPUrl("ldapi://")
-        self.assertEquals(u.urlscheme, "ldapi")
+        self.assertEqual(u.urlscheme, "ldapi")
         u = LDAPUrl("ldaps://")
-        self.assertEquals(u.urlscheme, "ldaps")
+        self.assertEqual(u.urlscheme, "ldaps")
 
     def test_parse_hostport(self):
         u = LDAPUrl("ldap://a")
-        self.assertEquals(u.hostport, "a")
+        self.assertEqual(u.hostport, "a")
         u = LDAPUrl("ldap://a.b")
-        self.assertEquals(u.hostport, "a.b")
+        self.assertEqual(u.hostport, "a.b")
         u = LDAPUrl("ldap://a.")
-        self.assertEquals(u.hostport, "a.")
+        self.assertEqual(u.hostport, "a.")
         u = LDAPUrl("ldap://%61%62:%32/")
-        self.assertEquals(u.hostport, "ab:2")
+        self.assertEqual(u.hostport, "ab:2")
         u = LDAPUrl("ldap://[::1]/")
-        self.assertEquals(u.hostport, "[::1]")
+        self.assertEqual(u.hostport, "[::1]")
         u = LDAPUrl("ldap://[::1]")
-        self.assertEquals(u.hostport, "[::1]")
+        self.assertEqual(u.hostport, "[::1]")
         u = LDAPUrl("ldap://[::1]:123/")
-        self.assertEquals(u.hostport, "[::1]:123")
+        self.assertEqual(u.hostport, "[::1]:123")
         u = LDAPUrl("ldap://[::1]:123")
-        self.assertEquals(u.hostport, "[::1]:123")
+        self.assertEqual(u.hostport, "[::1]:123")
 
     def test_parse_dn(self):
         u = LDAPUrl("ldap:///")
-        self.assertEquals(u.dn, "")
+        self.assertEqual(u.dn, "")
         u = LDAPUrl("ldap:///dn=foo")
-        self.assertEquals(u.dn, "dn=foo")
+        self.assertEqual(u.dn, "dn=foo")
         u = LDAPUrl("ldap:///dn=foo%2cdc=bar")
-        self.assertEquals(u.dn, "dn=foo,dc=bar")
+        self.assertEqual(u.dn, "dn=foo,dc=bar")
         u = LDAPUrl("ldap:///dn=foo%20bar")
-        self.assertEquals(u.dn, "dn=foo bar")
+        self.assertEqual(u.dn, "dn=foo bar")
         u = LDAPUrl("ldap:///dn=foo%2fbar")
-        self.assertEquals(u.dn, "dn=foo/bar")
+        self.assertEqual(u.dn, "dn=foo/bar")
         u = LDAPUrl("ldap:///dn=foo%2fbar?")
-        self.assertEquals(u.dn, "dn=foo/bar")
+        self.assertEqual(u.dn, "dn=foo/bar")
         u = LDAPUrl("ldap:///dn=foo%3f?")
-        self.assertEquals(u.dn, "dn=foo?")
+        self.assertEqual(u.dn, "dn=foo?")
         u = LDAPUrl("ldap:///dn=foo%3f")
-        self.assertEquals(u.dn, "dn=foo?")
+        self.assertEqual(u.dn, "dn=foo?")
         u = LDAPUrl("ldap:///dn=str%c3%b6der.com")
-        self.assertEquals(u.dn, "dn=str\xc3\xb6der.com")
+        self.assertEqual(u.dn, "dn=str\xc3\xb6der.com")
 
     def test_parse_attrs(self):
         u = LDAPUrl("ldap:///?")
-        self.assertEquals(u.attrs, None)
+        self.assertEqual(u.attrs, None)
         u = LDAPUrl("ldap:///??")
-        self.assertEquals(u.attrs, None)
+        self.assertEqual(u.attrs, None)
         u = LDAPUrl("ldap:///?*?")
-        self.assertEquals(u.attrs, ['*'])
+        self.assertEqual(u.attrs, ['*'])
         u = LDAPUrl("ldap:///?*,*?")
-        self.assertEquals(u.attrs, ['*','*'])
+        self.assertEqual(u.attrs, ['*','*'])
         u = LDAPUrl("ldap:///?a")
-        self.assertEquals(u.attrs, ['a'])
+        self.assertEqual(u.attrs, ['a'])
         u = LDAPUrl("ldap:///?%61")
-        self.assertEquals(u.attrs, ['a'])
+        self.assertEqual(u.attrs, ['a'])
         u = LDAPUrl("ldap:///?a,b")
-        self.assertEquals(u.attrs, ['a','b'])
+        self.assertEqual(u.attrs, ['a','b'])
         u = LDAPUrl("ldap:///?a%3fb")
-        self.assertEquals(u.attrs, ['a?b'])
+        self.assertEqual(u.attrs, ['a?b'])
 
     def test_parse_scope_default(self):
         u = LDAPUrl("ldap:///??")
@@ -304,77 +304,77 @@ def test_parse_scope_default(self):
 
     def test_parse_scope(self):
         u = LDAPUrl("ldap:///??sub")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
         u = LDAPUrl("ldap:///??sub?")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_SUBTREE)
         u = LDAPUrl("ldap:///??base")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_BASE)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_BASE)
         u = LDAPUrl("ldap:///??base?")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_BASE)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_BASE)
         u = LDAPUrl("ldap:///??one")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_ONELEVEL)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_ONELEVEL)
         u = LDAPUrl("ldap:///??one?")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_ONELEVEL)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_ONELEVEL)
         u = LDAPUrl("ldap:///??subordinates")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBORDINATES)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_SUBORDINATES)
         u = LDAPUrl("ldap:///??subordinates?")
-        self.assertEquals(u.scope, ldapurl.LDAP_SCOPE_SUBORDINATES)
+        self.assertEqual(u.scope, ldapurl.LDAP_SCOPE_SUBORDINATES)
 
     def test_parse_filter(self):
         u = LDAPUrl("ldap:///???(cn=Bob)")
-        self.assertEquals(u.filterstr, "(cn=Bob)")
+        self.assertEqual(u.filterstr, "(cn=Bob)")
         u = LDAPUrl("ldap:///???(cn=Bob)?")
-        self.assertEquals(u.filterstr, "(cn=Bob)")
+        self.assertEqual(u.filterstr, "(cn=Bob)")
         u = LDAPUrl("ldap:///???(cn=Bob%20Smith)?")
-        self.assertEquals(u.filterstr, "(cn=Bob Smith)")
+        self.assertEqual(u.filterstr, "(cn=Bob Smith)")
         u = LDAPUrl("ldap:///???(cn=Bob/Smith)?")
-        self.assertEquals(u.filterstr, "(cn=Bob/Smith)")
+        self.assertEqual(u.filterstr, "(cn=Bob/Smith)")
         u = LDAPUrl("ldap:///???(cn=Bob:Smith)?")
-        self.assertEquals(u.filterstr, "(cn=Bob:Smith)")
+        self.assertEqual(u.filterstr, "(cn=Bob:Smith)")
         u = LDAPUrl("ldap:///???&(cn=Bob)(objectClass=user)?")
-        self.assertEquals(u.filterstr, "&(cn=Bob)(objectClass=user)")
+        self.assertEqual(u.filterstr, "&(cn=Bob)(objectClass=user)")
         u = LDAPUrl("ldap:///???|(cn=Bob)(objectClass=user)?")
-        self.assertEquals(u.filterstr, "|(cn=Bob)(objectClass=user)")
+        self.assertEqual(u.filterstr, "|(cn=Bob)(objectClass=user)")
         u = LDAPUrl("ldap:///???(cn=Q%3f)?")
-        self.assertEquals(u.filterstr, "(cn=Q?)")
+        self.assertEqual(u.filterstr, "(cn=Q?)")
         u = LDAPUrl("ldap:///???(cn=Q%3f)")
-        self.assertEquals(u.filterstr, "(cn=Q?)")
+        self.assertEqual(u.filterstr, "(cn=Q?)")
         u = LDAPUrl("ldap:///???(sn=Str%c3%b6der)") # (possibly bad?)
-        self.assertEquals(u.filterstr, "(sn=Str\xc3\xb6der)")
+        self.assertEqual(u.filterstr, "(sn=Str\xc3\xb6der)")
         u = LDAPUrl("ldap:///???(sn=Str\\c3\\b6der)")
-        self.assertEquals(u.filterstr, "(sn=Str\\c3\\b6der)") # (recommended)
+        self.assertEqual(u.filterstr, "(sn=Str\\c3\\b6der)") # (recommended)
         u = LDAPUrl("ldap:///???(cn=*\\2a*)")
-        self.assertEquals(u.filterstr, "(cn=*\\2a*)")
+        self.assertEqual(u.filterstr, "(cn=*\\2a*)")
         u = LDAPUrl("ldap:///???(cn=*%5c2a*)")
-        self.assertEquals(u.filterstr, "(cn=*\\2a*)")
+        self.assertEqual(u.filterstr, "(cn=*\\2a*)")
 
     def test_parse_extensions(self):
         u = LDAPUrl("ldap:///????")
         self.assertNone(u.extensions)
         self.assertNone(u.who)
         u = LDAPUrl("ldap:///????bindname=cn=root")
-        self.assertEquals(len(u.extensions), 1)
-        self.assertEquals(u.who, "cn=root")
+        self.assertEqual(len(u.extensions), 1)
+        self.assertEqual(u.who, "cn=root")
         u = LDAPUrl("ldap:///????!bindname=cn=root")
-        self.assertEquals(len(u.extensions), 1)
-        self.assertEquals(u.who, "cn=root")
+        self.assertEqual(len(u.extensions), 1)
+        self.assertEqual(u.who, "cn=root")
         u = LDAPUrl("ldap:///????bindname=%3f,X-BINDPW=%2c")
-        self.assertEquals(len(u.extensions), 2)
-        self.assertEquals(u.who, "?")
-        self.assertEquals(u.cred, ",")
+        self.assertEqual(len(u.extensions), 2)
+        self.assertEqual(u.who, "?")
+        self.assertEqual(u.cred, ",")
 
     def test_parse_extensions_nulls(self):
         u = LDAPUrl("ldap:///????bindname=%00name")
-        self.assertEquals(u.who, "\0name")
+        self.assertEqual(u.who, "\0name")
 
     def test_parse_extensions_5questions(self):
         u = LDAPUrl("ldap:///????bindname=?")
-        self.assertEquals(len(u.extensions), 1)
-        self.assertEquals(u.who, "?")
+        self.assertEqual(len(u.extensions), 1)
+        self.assertEqual(u.who, "?")
 
     def test_parse_extensions_novalue(self):
         u = LDAPUrl("ldap:///????bindname")
-        self.assertEquals(len(u.extensions), 1)
+        self.assertEqual(len(u.extensions), 1)
         self.assertNone(u.who)
 
     @unittest.expectedFailure

From ce562246ef54d2fc2f910e843409cd8d76c4d45a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 08:54:36 +0000
Subject: [PATCH 431/868] prepare release 2.4.42

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 0cb3cf0..a375f29 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.42 2017-08-xx
+Released 2.4.42 2017-09-04
 
 Changes since 2.4.41:
 
@@ -1476,4 +1476,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.457 2017/09/04 07:47:29 stroeder Exp $
+$Id: CHANGES,v 1.458 2017/09/04 08:54:36 stroeder Exp $

From 8047d01160d0ac4c7694c0d00353a4a4a299602f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 14:56:11 +0000
Subject: [PATCH 432/868] started 2.4.43

---
 CHANGES              | 13 ++++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 Lib/slapdtest.py     |  4 ++--
 6 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index a375f29..bd831d2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+----------------------------------------------------------------
+Released 2.4.43 2017-09-xx
+
+Changes since 2.4.42:
+
+Lib/
+* 
+
+Tests/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.42 2017-09-04
 
@@ -1476,4 +1487,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.458 2017/09/04 08:54:36 stroeder Exp $
+$Id: CHANGES,v 1.459 2017/09/04 14:56:11 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 201a340..5c98f06 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.60 2017/08/15 16:21:58 stroeder Exp $
+$Id: dsml.py,v 1.61 2017/09/04 14:56:11 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.42'
+__version__ = '2.4.43'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 939e5ff..1cc2ffd 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.121 2017/08/15 16:21:58 stroeder Exp $
+$Id: __init__.py,v 1.122 2017/09/04 14:56:11 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.42'
+__version__ = '2.4.43'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 33fe5fa..9ca24d5 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.96 2017/08/15 16:21:58 stroeder Exp $
+\$Id: ldapurl.py,v 1.97 2017/09/04 14:56:11 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.42'
+__version__ = '2.4.43'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 48f9231..4a97679 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.116 2017/08/15 16:21:58 stroeder Exp $
+$Id: ldif.py,v 1.117 2017/09/04 14:56:11 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.42'
+__version__ = '2.4.43'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index c3502d1..7cee378 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.19 2017/08/16 13:29:06 stroeder Exp $
+$Id: slapdtest.py,v 1.20 2017/09/04 14:56:11 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.42'
+__version__ = '2.4.43'
 
 import os
 import socket

From 4ec237854992d2b26fce87a15f9d16522028b8a1 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 14:59:12 +0000
Subject: [PATCH 433/868] fixed passing all arguments from
 LDAPObject.sasl_non_interactive_bind_s() to
 LDAPObject.sasl_interactive_bind_s()

---
 CHANGES                |  5 +++--
 Lib/ldap/ldapobject.py | 12 +++++-------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index bd831d2..5384a13 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.43 2017-09-xx
 Changes since 2.4.42:
 
 Lib/
-* 
+* fixed passing all arguments from LDAPObject.sasl_non_interactive_bind_s()
+  to LDAPObject.sasl_interactive_bind_s()
 
 Tests/
 * 
@@ -1487,4 +1488,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.459 2017/09/04 14:56:11 stroeder Exp $
+$Id: CHANGES,v 1.460 2017/09/04 14:59:12 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index b6b39f2..1289914 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.164 2017/08/15 16:21:58 stroeder Exp $
+\$Id: ldapobject.py,v 1.165 2017/09/04 14:59:12 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -253,13 +253,11 @@ def sasl_non_interactive_bind_s(self,sasl_mech,serverctrls=None,clientctrls=None
     """
     Send a SASL bind request using a non-interactive SASL method (e.g. GSSAPI, EXTERNAL)
     """
-    self.sasl_interactive_bind_s(
-      '',
-      ldap.sasl.sasl(
-        {ldap.sasl.CB_USER:authz_id},
-        sasl_mech
-      )
+    auth = ldap.sasl.sasl(
+      {ldap.sasl.CB_USER:authz_id},
+      sasl_mech
     )
+    self.sasl_interactive_bind_s('',auth,serverctrls,clientctrls,sasl_flags)
 
   def sasl_external_bind_s(self,serverctrls=None,clientctrls=None,sasl_flags=ldap.SASL_QUIET,authz_id=''):
     """

From 1bc1c6c93f9ddf378189a4bae6a263e1f1669bdf Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 14:59:57 +0000
Subject: [PATCH 434/868] added test for LDAPObject.sasl_external_bind_s()

---
 CHANGES               |  4 ++--
 Tests/t_ldapobject.py | 11 ++++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5384a13..197967f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,7 +8,7 @@ Lib/
   to LDAPObject.sasl_interactive_bind_s()
 
 Tests/
-* 
+* added test for LDAPObject.sasl_external_bind_s()
 
 ----------------------------------------------------------------
 Released 2.4.42 2017-09-04
@@ -1488,4 +1488,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.460 2017/09/04 14:59:12 stroeder Exp $
+$Id: CHANGES,v 1.461 2017/09/04 14:59:57 stroeder Exp $
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index e9df53c..e8fe6ac 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldapobject.py,v 1.9 2017/09/04 07:47:29 stroeder Exp $
+$Id: t_ldapobject.py,v 1.10 2017/09/04 14:59:57 stroeder Exp $
 """
 
 import os
@@ -175,6 +175,15 @@ def test_invalid_credentials(self):
         else:
             self.fail("expected INVALID_CREDENTIALS, got %r" % r)
 
+    def test_sasl_extenal_bind_s(self):
+        l = self.ldap_object_class(self.server.ldapi_uri)
+        l.sasl_external_bind_s()
+        self.assertEqual(l.whoami_s(), 'dn:'+self.server.root_dn.lower())
+        authz_id = 'dn:cn=Foo2,%s' % (self.server.suffix)
+        l = self.ldap_object_class(self.server.ldapi_uri)
+        l.sasl_external_bind_s(authz_id=authz_id)
+        self.assertEqual(l.whoami_s(), authz_id.lower())
+        
 
 class Test02_ReconnectLDAPObject(Test01_SimpleLDAPObject):
     """

From f6ab8c006eb36c82a8185941e32e910e389f5770 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 15:01:25 +0000
Subject: [PATCH 435/868] bumped doc release to 2.4.43

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 410f848..b5978c8 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.28 2017/08/16 11:26:44 stroeder Exp $
+# $Id: conf.py,v 1.29 2017/09/04 15:01:25 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.42.0'
+release = '2.4.43.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From a5ff99383139a7a26a2e82bb515f36450ebd8173 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 4 Sep 2017 15:02:29 +0000
Subject: [PATCH 436/868] added missing docs for SASL bind convenience
 LDAPObject methods

---
 Doc/ldap.rst | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index ac5e9d4..37afc63 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.39 2017/08/16 12:17:18 stroeder Exp $
+.. % $Id: ldap.rst,v 1.40 2017/09/04 15:02:29 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -678,11 +678,26 @@ and wait for and return with the server's result, or with
    be :py:const:`AUTH_SIMPLE`.
 
 
-.. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth) -> None
+.. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET]]]) -> None
 
    This call is used to bind to the directory with a SASL bind request.
 
 
+.. py:method:: LDAPObject.sasl_non_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request.
+
+
+.. py:method:: LDAPObject.sasl_external_bind_s([serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request with mechanism EXTERNAL.
+
+
+.. py:method:: LDAPObject.sasl_gssapi_bind_s([serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request with mechanism GSSAPI.
+
+
 .. py:method:: LDAPObject.cancel( cancelid, [, serverctrls=None [, clientctrls=None]]) -> None
 
    Send cancels extended operation for an LDAP operation specified by *cancelid*.

From c12868458d106a2754edb6d667f4842da0b03e6c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 5 Sep 2017 07:23:36 +0000
Subject: [PATCH 437/868] more on SASL binds and extended controls

---
 Doc/ldap.rst | 110 ++++++++++++++++++++++++++++++---------------------
 1 file changed, 65 insertions(+), 45 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 37afc63..10abf2a 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.40 2017/09/04 15:02:29 stroeder Exp $
+.. % $Id: ldap.rst,v 1.41 2017/09/05 07:23:36 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -593,6 +593,8 @@ LDAPObject classes
    *retry_delay* specifies the time in seconds between reconnect attempts.
 
 
+.. _ldap-controls:
+
 Arguments for LDAPv3 controls
 -----------------------------
 
@@ -638,7 +640,7 @@ and wait for and return with the server's result, or with
    The caller can expect that the result of an abandoned operation will not be
    returned from a future call to :py:meth:`result()`.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
 
 .. py:method:: LDAPObject.add(dn, modlist) -> int
@@ -658,46 +660,13 @@ and wait for and return with the server's result, or with
    The asynchronous methods :py:meth:`add()` and :py:meth:`add_ext()`
    return the message ID of the initiated request.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
 
 .. py:method:: LDAPObject.bind(who, cred, method) -> int
 
 .. py:method:: LDAPObject.bind_s(who, cred, method) -> None
 
-.. py:method:: LDAPObject.simple_bind([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> int
-
-.. py:method:: LDAPObject.simple_bind_s([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> None
-
-   After an LDAP object is created, and before any other operations can be
-   attempted over the connection, a bind operation must be performed.
-
-   This method attempts to bind with the LDAP server using
-   either simple authentication, or Kerberos (if available).
-   The first and most general method, :py:meth:`bind()`,
-   takes a third parameter, *method* which can currently solely
-   be :py:const:`AUTH_SIMPLE`.
-
-
-.. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET]]]) -> None
-
-   This call is used to bind to the directory with a SASL bind request.
-
-
-.. py:method:: LDAPObject.sasl_non_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
-
-   This call is used to bind to the directory with a SASL bind request.
-
-
-.. py:method:: LDAPObject.sasl_external_bind_s([serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
-
-   This call is used to bind to the directory with a SASL bind request with mechanism EXTERNAL.
-
-
-.. py:method:: LDAPObject.sasl_gssapi_bind_s([serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
-
-   This call is used to bind to the directory with a SASL bind request with mechanism GSSAPI.
-
-
 .. py:method:: LDAPObject.cancel( cancelid, [, serverctrls=None [, clientctrls=None]]) -> None
 
    Send cancels extended operation for an LDAP operation specified by *cancelid*.
@@ -708,7 +677,7 @@ and wait for and return with the server's result, or with
    In opposite to :py:meth:`abandon()` this extended operation gets an result from
    the server and thus should be preferred if the server supports it.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    :rfc:`3909` - Lightweight Directory Access Protocol (LDAP): Cancel Operation
 
@@ -732,7 +701,7 @@ and wait for and return with the server's result, or with
    by raising the exception objects :py:exc:`ldap.COMPARE_TRUE` or
    :py:exc:`ldap.COMPARE_FALSE`.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    .. note::
 
@@ -752,7 +721,7 @@ and wait for and return with the server's result, or with
    returns the message id of the initiated request, and the result can be obtained
    from a subsequent call to :py:meth:`result()`.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
 
 .. py:method:: LDAPObject.extop(extreq[,serverctrls=None[,clientctrls=None]]]) -> int
@@ -766,6 +735,8 @@ and wait for and return with the server's result, or with
    The *extreq* is an instance of class :py:class:`ldap.extop.ExtendedRequest`
    containing the parameters for the extended operation request.
 
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
    If argument *extop_resp_class* is set to a sub-class of
    :py:class:`ldap.extop.ExtendedResponse` this class is used to return an
    object of this class instead of a raw BER value in respvalue.
@@ -797,7 +768,7 @@ and wait for and return with the server's result, or with
    delete or replace respectively.  For the delete operation, *mod_vals*
    may be :py:const:`None` indicating that all attributes are to be deleted.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    The asynchronous methods :py:meth:`modify()` and :py:meth:`modify_ext()`
    return the message ID of the initiated request.
@@ -835,7 +806,7 @@ and wait for and return with the server's result, or with
    of the specified *user* which is sometimes used when a user changes
    his own password.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    The asynchronous version returns the initiated message id.
 
@@ -858,7 +829,8 @@ and wait for and return with the server's result, or with
    The optional parameter *delold* is used to specify
    whether the old RDN should be kept as an attribute of the entry or not.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
 
 .. py:method:: LDAPObject.result([msgid=RES_ANY [, all=1 [, timeout=None]]]) -> 2-tuple
 
@@ -960,6 +932,54 @@ and wait for and return with the server's result, or with
    If :py:const:`None` the global dictionary :py:data:`ldap.controls.KNOWN_RESPONSE_CONTROLS`
    is used instead.
 
+.. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request.
+
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
+
+.. py:method:: LDAPObject.sasl_non_interactive_bind_s(sasl_mech[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request with
+   non-interactive SASL mechanism defined with argument *sasl_mech* and
+   internally calls :py:meth:`sasl_interactive_bind_s()`.
+
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
+
+.. py:method:: LDAPObject.sasl_external_bind_s([serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request with
+   mechanism EXTERNAL and internally calls :py:meth:`sasl_non_interactive_bind_s()`.
+
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
+
+.. py:method:: LDAPObject.sasl_gssapi_bind_s([serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET [, authz_id='']]]]) -> None
+
+   This call is used to bind to the directory with a SASL bind request with
+   mechanism GSSAPI and internally calls :py:meth:`sasl_non_interactive_bind_s()`.
+
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
+
+.. py:method:: LDAPObject.simple_bind([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> int
+
+.. py:method:: LDAPObject.simple_bind_s([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> None
+
+   After an LDAP object is created, and before any other operations can be
+   attempted over the connection, a bind operation must be performed.
+
+   This method attempts to bind with the LDAP server using
+   either simple authentication, or Kerberos (if available).
+   The first and most general method, :py:meth:`bind()`,
+   takes a third parameter, *method* which can currently solely
+   be :py:const:`AUTH_SIMPLE`.
+
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
+
+
 .. py:method:: LDAPObject.search(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->int
 
 .. py:method:: LDAPObject.search_s(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->list|None
@@ -1000,7 +1020,7 @@ and wait for and return with the server's result, or with
    The retrieved attributes can be limited with the *attrlist* parameter.
    If *attrlist* is :py:const:`None`, all the attributes of each entry are returned.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    The synchronous form with timeout, :py:meth:`search_st()` or :py:meth:`search_ext_s()`,
    will block for at most *timeout* seconds (or indefinitely if *timeout*
@@ -1038,7 +1058,7 @@ and wait for and return with the server's result, or with
    LDAP server is closed and the LDAP object is marked invalid.
    Further invocation of methods on the object will yield exceptions.
 
-   *serverctrls* and *clientctrls* like described above.
+   *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    These methods are all synchronous in nature.
 

From 0bd7f6bb562ba8d7cb22d3e38af9eca98aebb7f6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 5 Sep 2017 07:38:45 +0000
Subject: [PATCH 438/868] more docs on SASL binds

---
 Doc/ldap-sasl.rst | 12 +++++++++++-
 Doc/ldap.rst      |  4 +++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/Doc/ldap-sasl.rst b/Doc/ldap-sasl.rst
index 6bc9afe..8436b73 100644
--- a/Doc/ldap-sasl.rst
+++ b/Doc/ldap-sasl.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap-sasl.rst,v 1.4 2017/08/01 17:48:00 stroeder Exp $
+.. % $Id: ldap-sasl.rst,v 1.5 2017/09/05 07:38:45 stroeder Exp $
 
 
 ***********************************************
@@ -38,19 +38,29 @@ Classes
 
 .. autoclass:: ldap.sasl.sasl
    :members:
+   
+   This class is used with :py:meth:`ldap.LDAPObject.sasl_interactive_bind_s()`.
+
 
 .. autoclass:: ldap.sasl.cram_md5
    :members:
 
+
 .. autoclass:: ldap.sasl.digest_md5
    :members:
 
+
 .. autoclass:: ldap.sasl.gssapi
    :members:
 
+   You might consider using convenience method :py:meth:`ldap.LDAPObject.sasl_gssapi_bind_s()`.
+
+
 .. autoclass:: ldap.sasl.external
    :members:
 
+   You might consider using convenience method :py:meth:`ldap.LDAPObject.sasl_external_bind_s()`.
+
 
 .. _ldap.sasl-example:
 
diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 10abf2a..64573d6 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,4 +1,4 @@
-.. % $Id: ldap.rst,v 1.41 2017/09/05 07:23:36 stroeder Exp $
+.. % $Id: ldap.rst,v 1.42 2017/09/05 07:38:46 stroeder Exp $
 
 ********************************************
 :py:mod:`ldap` LDAP library interface module
@@ -935,6 +935,8 @@ and wait for and return with the server's result, or with
 .. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET]]]) -> None
 
    This call is used to bind to the directory with a SASL bind request.
+   
+   *auth* is an :py:class:`ldap.sasl.sasl()` instance.
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 

From 4676dcec06fa2e7f0e41021118b9b21c5b98aac6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 5 Sep 2017 08:59:54 +0000
Subject: [PATCH 439/868] announce Doc/ changes

---
 CHANGES | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 197967f..27dad9c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,11 @@ Lib/
 Tests/
 * added test for LDAPObject.sasl_external_bind_s()
 
+Doc/
+* added docs for SASL bind methods
+* more references
+* better sorting of LDAPObject methods
+
 ----------------------------------------------------------------
 Released 2.4.42 2017-09-04
 
@@ -1488,4 +1493,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.461 2017/09/04 14:59:57 stroeder Exp $
+$Id: CHANGES,v 1.462 2017/09/05 08:59:54 stroeder Exp $

From dcd62fb71407c34faee672af0e43ae8f2f579493 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Wed, 6 Sep 2017 08:04:05 +0000
Subject: [PATCH 440/868] prepare release 2.4.43

---
 CHANGES | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 27dad9c..ef91087 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.43 2017-09-xx
+Released 2.4.43 2017-09-06
 
 Changes since 2.4.42:
 
@@ -1493,4 +1493,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.462 2017/09/05 08:59:54 stroeder Exp $
+$Id: CHANGES,v 1.463 2017/09/06 08:04:05 stroeder Exp $

From fae60383d9d93d49a06daf0d6fa4d88c132f7af9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 7 Sep 2017 09:01:01 +0000
Subject: [PATCH 441/868] started 2.4.44

---
 CHANGES              | 19 ++++++++++++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 Lib/slapdtest.py     |  4 ++--
 6 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index ef91087..cbeb389 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,20 @@
+----------------------------------------------------------------
+Released 2.4.44 2017-09-xx
+
+Changes since 2.4.43:
+
+Modules/
+* 
+
+Lib/
+* 
+
+Tests/
+* 
+
+Doc/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.43 2017-09-06
 
@@ -1493,4 +1510,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.463 2017/09/06 08:04:05 stroeder Exp $
+$Id: CHANGES,v 1.464 2017/09/07 09:01:01 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 5c98f06..2477489 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.61 2017/09/04 14:56:11 stroeder Exp $
+$Id: dsml.py,v 1.62 2017/09/07 09:01:01 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.43'
+__version__ = '2.4.44'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 1cc2ffd..2f870a6 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.122 2017/09/04 14:56:11 stroeder Exp $
+$Id: __init__.py,v 1.123 2017/09/07 09:01:01 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.43'
+__version__ = '2.4.44'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 9ca24d5..7b215aa 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.97 2017/09/04 14:56:11 stroeder Exp $
+\$Id: ldapurl.py,v 1.98 2017/09/07 09:01:01 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.43'
+__version__ = '2.4.44'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 4a97679..ccc2a5d 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.117 2017/09/04 14:56:11 stroeder Exp $
+$Id: ldif.py,v 1.118 2017/09/07 09:01:01 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.43'
+__version__ = '2.4.44'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 7cee378..8da5509 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.20 2017/09/04 14:56:11 stroeder Exp $
+$Id: slapdtest.py,v 1.21 2017/09/07 09:01:01 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.43'
+__version__ = '2.4.44'
 
 import os
 import socket

From c469bb7056bc754e0832a3c984a833a77415c0ee Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 7 Sep 2017 09:03:00 +0000
Subject: [PATCH 442/868] more fine-grained GIL releasing in function
 l_ldap_result4()

---
 CHANGES              |  4 ++--
 Modules/LDAPObject.c | 10 +++++++---
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index cbeb389..3d5530c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,7 @@ Released 2.4.44 2017-09-xx
 Changes since 2.4.43:
 
 Modules/
-* 
+* more fine-grained GIL releasing in function l_ldap_result4()
 
 Lib/
 * 
@@ -1510,4 +1510,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.464 2017/09/07 09:01:01 stroeder Exp $
+$Id: CHANGES,v 1.465 2017/09/07 09:03:00 stroeder Exp $
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 5fa86dd..2a67c91 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See https://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.96 2017/08/15 16:21:59 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.97 2017/09/07 09:03:00 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -1024,7 +1024,6 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     int result = LDAP_SUCCESS;
     char **refs = NULL;
     LDAPControl **serverctrls = 0;
-    LDAP_BEGIN_ALLOW_THREADS( self );
     if (res_type == LDAP_RES_SEARCH_ENTRY) {
         /* LDAPmessage_to_python will parse entries and read the controls for each entry */
     } else if (res_type == LDAP_RES_SEARCH_REFERENCE) {
@@ -1035,7 +1034,9 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
         int rc;
         if (res_type == LDAP_RES_EXTENDED) {
             struct berval *retdata = 0;
+            LDAP_BEGIN_ALLOW_THREADS( self );
             rc = ldap_parse_extended_result( self->ldap, msg, &retoid, &retdata, 0 );
+            LDAP_END_ALLOW_THREADS( self );
             /* handle error rc!=0 here? */
             if (rc == LDAP_SUCCESS) {
                 valuestr = LDAPberval_to_object(retdata);
@@ -1043,10 +1044,11 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
             ber_bvfree( retdata );
         }
             
+        LDAP_BEGIN_ALLOW_THREADS( self );
         rc = ldap_parse_result( self->ldap, msg, &result, NULL, NULL, &refs,
                                 &serverctrls, 0 );
+        LDAP_END_ALLOW_THREADS( self );
     }
-    LDAP_END_ALLOW_THREADS( self );
 
     if (result != LDAP_SUCCESS) {               /* result error */
         char *e, err[1024];
@@ -1061,7 +1063,9 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
 
     if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
         int err = LDAP_NO_MEMORY;
+        LDAP_BEGIN_ALLOW_THREADS( self );
         ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &err);
+        LDAP_END_ALLOW_THREADS( self );
         ldap_msgfree(msg);
         return LDAPerror(self->ldap, "LDAPControls_to_List");
     }

From 8c7f8dbb786c8c334b1aafb3a85ad874a93e1163 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 7 Sep 2017 22:22:08 +0000
Subject: [PATCH 443/868] prepare release 2.4.44

---
 CHANGES | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 3d5530c..5fbfffb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,20 +1,11 @@
 ----------------------------------------------------------------
-Released 2.4.44 2017-09-xx
+Released 2.4.44 2017-09-08
 
 Changes since 2.4.43:
 
 Modules/
 * more fine-grained GIL releasing in function l_ldap_result4()
 
-Lib/
-* 
-
-Tests/
-* 
-
-Doc/
-* 
-
 ----------------------------------------------------------------
 Released 2.4.43 2017-09-06
 
@@ -1510,4 +1501,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.465 2017/09/07 09:03:00 stroeder Exp $
+$Id: CHANGES,v 1.466 2017/09/07 22:22:08 stroeder Exp $

From b1a16eefb5940c6e6cbcb24766d3cbc973c8b803 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 26 Sep 2017 09:40:26 +0000
Subject: [PATCH 444/868] started 2.4.45

---
 CHANGES              | 10 +++++++++-
 Lib/dsml.py          |  4 ++--
 Lib/ldap/__init__.py |  4 ++--
 Lib/ldapurl.py       |  4 ++--
 Lib/ldif.py          |  4 ++--
 Lib/slapdtest.py     |  4 ++--
 6 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5fbfffb..ad48e28 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+----------------------------------------------------------------
+Released 2.4.45 2017-09-xx
+
+Changes since 2.4.44:
+
+Lib/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.44 2017-09-08
 
@@ -1501,4 +1509,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.466 2017/09/07 22:22:08 stroeder Exp $
+$Id: CHANGES,v 1.467 2017/09/26 09:40:26 stroeder Exp $
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 2477489..1cd204d 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,13 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.62 2017/09/07 09:01:01 stroeder Exp $
+$Id: dsml.py,v 1.63 2017/09/26 09:40:26 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.44'
+__version__ = '2.4.45'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 2f870a6..6aa9eac 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -3,12 +3,12 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.123 2017/09/07 09:01:01 stroeder Exp $
+$Id: __init__.py,v 1.124 2017/09/26 09:40:26 stroeder Exp $
 """
 
 # This is also the overall release version number
 
-__version__ = '2.4.44'
+__version__ = '2.4.45'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7b215aa..bd1f42c 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,7 +3,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.98 2017/09/07 09:01:01 stroeder Exp $
+\$Id: ldapurl.py,v 1.99 2017/09/26 09:40:26 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.0+ since
@@ -11,7 +11,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.44'
+__version__ = '2.4.45'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index ccc2a5d..f38e150 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,13 +3,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.118 2017/09/07 09:01:01 stroeder Exp $
+$Id: ldif.py,v 1.119 2017/09/26 09:40:26 stroeder Exp $
 
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.44'
+__version__ = '2.4.45'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 8da5509..e2fceb1 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,13 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.21 2017/09/07 09:01:01 stroeder Exp $
+$Id: slapdtest.py,v 1.22 2017/09/26 09:40:26 stroeder Exp $
 
 Python compability note:
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.44'
+__version__ = '2.4.45'
 
 import os
 import socket

From a9410f4a55a94a3f6062fac2062418fa2cd04238 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 13:25:58 +0000
Subject: [PATCH 445/868] updated pyasn1 URLs

---
 Demo/pyasn1/README                | 6 +++---
 Demo/pyasn1/derefcontrol.py       | 2 --
 Demo/pyasn1/readentrycontrol.py   | 2 --
 Demo/pyasn1/sss_highest_number.py | 2 --
 Doc/installing.rst                | 4 ++--
 5 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/Demo/pyasn1/README b/Demo/pyasn1/README
index a96d6cd..b5fc28f 100644
--- a/Demo/pyasn1/README
+++ b/Demo/pyasn1/README
@@ -1,6 +1,6 @@
 The sample modules/scripts herein require modules pyasn1 and pyasn1-modules.
 
-http://pyasn1.sourceforge.net/
+https://github.com/etingof/pyasn1
 
-http://pypi.python.org/pypi/pyasn1
-http://pypi.python.org/pypi/pyasn1-modules
+https://pypi.python.org/pypi/pyasn1
+https://pypi.python.org/pypi/pyasn1-modules
diff --git a/Demo/pyasn1/derefcontrol.py b/Demo/pyasn1/derefcontrol.py
index 4ac5155..1098529 100644
--- a/Demo/pyasn1/derefcontrol.py
+++ b/Demo/pyasn1/derefcontrol.py
@@ -2,8 +2,6 @@
 """
 This sample script demonstrates the use of the dereference control
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
-
-Requires module pyasn1 (see http://pyasn1.sourceforge.net/)
 """
 
 import pprint,ldap,ldap.modlist,ldap.resiter
diff --git a/Demo/pyasn1/readentrycontrol.py b/Demo/pyasn1/readentrycontrol.py
index 077fe6c..b52ea91 100644
--- a/Demo/pyasn1/readentrycontrol.py
+++ b/Demo/pyasn1/readentrycontrol.py
@@ -3,8 +3,6 @@
 This sample script demonstrates the use of the pre-read control (see RFC 4527).
 
 Originally contributed by Andreas Hasenack <ahasenack@terra.com.br>
-
-Requires module pyasn1 (see http://pyasn1.sourceforge.net/)
 """
 
 import pprint,ldap,ldap.modlist
diff --git a/Demo/pyasn1/sss_highest_number.py b/Demo/pyasn1/sss_highest_number.py
index fb19fdd..5f5bdc5 100644
--- a/Demo/pyasn1/sss_highest_number.py
+++ b/Demo/pyasn1/sss_highest_number.py
@@ -2,8 +2,6 @@
 """
 This sample script demonstrates the use of the server-side-sorting control
 (see RFC 2891)
-
-Requires module pyasn1 (see http://pyasn1.sourceforge.net/)
 """
 
 import pprint,ldap
diff --git a/Doc/installing.rst b/Doc/installing.rst
index ace20b4..bcf4b60 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,4 +1,4 @@
-.. % $Id: installing.rst,v 1.16 2015/12/09 17:56:38 stroeder Exp $
+.. % $Id: installing.rst,v 1.17 2017/10/09 13:30:43 stroeder Exp $
 
 ***********************
 Building and installing
@@ -33,7 +33,7 @@ on the local system when building python-ldap:
 Furthermore some sub-modules of :py:mod:`ldap.controls` and :py:mod:`ldap.extop`
 require :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed.
 
-  http://pyasn1.sf.net
+  https://github.com/etingof/pyasn1
 
 
 setup.cfg

From c5d6404ef30e4a4eeba59853fddb036503766e2e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 13:27:42 +0000
Subject: [PATCH 446/868] don't reference SF tracker anymore

---
 Tests/t_ldif.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 00945a0..551d7ae 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_ldif.py,v 1.24 2017/08/15 16:21:59 stroeder Exp $
+$Id: t_ldif.py,v 1.25 2017/10/09 13:27:42 stroeder Exp $
 """
 
 # from Python's standard lib
@@ -457,7 +457,7 @@ def test_weird_empty_lines(self):
 
     def test_multiple_empty_lines(self):
         """
-        see http://sourceforge.net/p/python-ldap/feature-requests/18/
+        test malformed LDIF with multiple empty lines
         """
         self.check_records(
             """

From 0e21ab48cec28df46aa688c1d8930831ab40663b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 13:42:31 +0000
Subject: [PATCH 447/868] bumped Doc/ version to 2.4.44.0

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index b5978c8..4bb47bc 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.29 2017/09/04 15:01:25 stroeder Exp $
+# $Id: conf.py,v 1.30 2017/10/09 13:42:31 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.43.0'
+release = '2.4.44.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From 0130c22dfd6ca57b3c989b7ab49c8339dd810d41 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 13:44:09 +0000
Subject: [PATCH 448/868] HTTPS link to 2.7 Distutils

---
 Doc/installing.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index bcf4b60..1e47cea 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,4 +1,4 @@
-.. % $Id: installing.rst,v 1.17 2017/10/09 13:30:43 stroeder Exp $
+.. % $Id: installing.rst,v 1.18 2017/10/09 13:44:09 stroeder Exp $
 
 ***********************
 Building and installing
@@ -15,7 +15,7 @@ along with your Python installation:
 If you have more than one Python interpreter installed locally you should
 use the same one you plan to use python-ldap with.
 
-See further instructions for using DistUtils here: http://docs.python.org/install/index.html
+See further instructions for using DistUtils here: https://docs.python.org/2.7/install/index.html
 
 Prerequisites
 =============

From eaffed865956eb409e1aef7f6227ccede436420c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 13:48:41 +0000
Subject: [PATCH 449/868] HTTPS links to prerequisite web sites

---
 Doc/installing.rst | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 1e47cea..d948a16 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,4 +1,4 @@
-.. % $Id: installing.rst,v 1.18 2017/10/09 13:44:09 stroeder Exp $
+.. % $Id: installing.rst,v 1.19 2017/10/09 13:48:41 stroeder Exp $
 
 ***********************
 Building and installing
@@ -23,11 +23,11 @@ Prerequisites
 The following software packages are required to be installed
 on the local system when building python-ldap:
 
-- Python version 2.3 or later including its development files: http://www.python.org/
-- OpenLDAP client libs version 2.4.11 or later: http://www.openldap.org/
+- Python version 2.3 or later including its development files: https://www.python.org/
+- OpenLDAP client libs version 2.4.11 or later: https://www.openldap.org/
   It is not possible and not supported to build with prior versions.
-- OpenSSL (optional): http://www.openssl.org/
-- cyrus-sasl (optional): http://www.cyrussasl.org
+- OpenSSL (optional): https://www.openssl.org/
+- cyrus-sasl (optional): https://www.cyrusimap.org/sasl/
 - Kerberos libs, MIT or heimdal (optional)
 
 Furthermore some sub-modules of :py:mod:`ldap.controls` and :py:mod:`ldap.extop`

From d70a73510d28312706072a3fda0b5ca7ec6a495c Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 13:51:45 +0000
Subject: [PATCH 450/868] removed obsolete comments

---
 Modules/LDAPObject.c | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 2a67c91..5c69cc3 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,5 @@
 /* See https://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.97 2017/09/07 09:03:00 stroeder Exp $ */
+ * $Id: LDAPObject.c,v 1.98 2017/10/09 13:51:45 stroeder Exp $ */
 
 #include "common.h"
 #include "patchlevel.h"
@@ -529,27 +529,6 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
      defresult) has to return a string (or maybe None). The id
      argument specifies, which information should be passed back to
      the SASL lib (see SASL_CB_xxx in sasl.h)
-
-
-   A nice "Howto get LDAPv3 up and running with Kerberos and SSL" can
-   be found at http://www.bayour.com/LDAPv3-HOWTO.html.  Instead of
-   MIT Kerberos, I used Heimdal for my tests (since it is included
-   with SuSE Linux).
-
-   Todo:
-   
-   * Find a better interface than the python callback. This is 
-     really ugly. Perhaps one could make use of a sasl class, like
-     in the perl ldap module.
-
-   * Thread safety?
-
-   * Memory Management?
-   
-   * Write more docs
-
-   * ...
-
 */
 static int interaction ( unsigned flags, 
                          sasl_interact_t *interact,

From 206a10beaf5562a7a3a61aeea023c2d707be9ffe Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 14:40:48 +0000
Subject: [PATCH 451/868] removed work-around in t_cext.py

---
 CHANGES         |  6 ++++--
 Tests/t_cext.py | 16 +---------------
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/CHANGES b/CHANGES
index ad48e28..9e82153 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,9 @@ Released 2.4.45 2017-09-xx
 Changes since 2.4.44:
 
 Lib/
-* 
+
+Tests/
+* removed work-around in t_cext.py
 
 ----------------------------------------------------------------
 Released 2.4.44 2017-09-08
@@ -1509,4 +1511,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.467 2017/09/26 09:40:26 stroeder Exp $
+$Id: CHANGES,v 1.468 2017/10/09 14:40:48 stroeder Exp $
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 6ced288..ee1fd60 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -4,7 +4,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: t_cext.py,v 1.24 2017/09/04 07:47:29 stroeder Exp $
+$Id: t_cext.py,v 1.25 2017/10/09 14:40:48 stroeder Exp $
 """
 
 import os
@@ -523,20 +523,6 @@ def test_rename(self):
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEqual(result, _ldap.RES_ADD)
 
-        # WORKAROUND bug in slapd. (Without an existing child,
-        # renames into a container object do not work for the ldif backend,
-        # the renamed object appears to be deleted, not moved.)
-        # see http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5408
-        m = l.add_ext(
-            "cn=Bogus," + containerDn,
-            [
-                ('objectClass', 'organizationalRole'),
-                ('cn', 'Bogus'),
-            ]
-        )
-        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertEqual(result, _ldap.RES_ADD)
-
         # now rename from dn2 to the conater
         dn3 = "cn=IAmRenamedAgain," + containerDn
 

From ec9703b74948ff53586ce9b3dbae69499e6e14f5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 14:54:10 +0000
Subject: [PATCH 452/868] Fixed reraising of wrong exception in
 SimpleLDAPObject._ldap_call()

---
 CHANGES                | 4 +++-
 Lib/ldap/ldapobject.py | 5 +++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9e82153..2e740c0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,8 @@ Released 2.4.45 2017-09-xx
 Changes since 2.4.44:
 
 Lib/
+* Fixed reraising of wrong exception in SimpleLDAPObject._ldap_call()
+  (thanks to Aigars Grins)
 
 Tests/
 * removed work-around in t_cext.py
@@ -1511,4 +1513,4 @@ Released 2.0.0pre02 2002-02-01
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
 
-$Id: CHANGES,v 1.468 2017/10/09 14:40:48 stroeder Exp $
+$Id: CHANGES,v 1.469 2017/10/09 14:54:10 stroeder Exp $
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 1289914..6a39fa3 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,7 +3,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.165 2017/09/04 14:59:12 stroeder Exp $
+\$Id: ldapobject.py,v 1.166 2017/10/09 14:54:10 stroeder Exp $
 
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
@@ -112,6 +112,7 @@ def _ldap_call(self,func,*args,**kwargs):
       finally:
         self._ldap_object_lock.release()
     except LDAPError, e:
+      exc_type,exc_value,exc_traceback = sys.exc_info()
       try:
         if not e.args[0].has_key('info') and e.args[0].has_key('errno'):
           e.args[0]['info'] = strerror(e.args[0]['errno'])
@@ -119,7 +120,7 @@ def _ldap_call(self,func,*args,**kwargs):
         pass
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
-      raise
+      raise exc_type,exc_value,exc_traceback
     else:
       if __debug__ and self._trace_level>=2:
         if not diagnostic_message_success is None:

From 49022ab26a6975bccc5a8537c7957582ea428e79 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 15:03:58 +0000
Subject: [PATCH 453/868] bumped Doc/ version to 2.4.45.0

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 4bb47bc..f967586 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -11,7 +11,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 #
-# $Id: conf.py,v 1.30 2017/10/09 13:42:31 stroeder Exp $
+# $Id: conf.py,v 1.31 2017/10/09 15:03:58 stroeder Exp $
 
 import sys
 
@@ -44,7 +44,7 @@
 # The short X.Y version.
 version = '2.4'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.44.0'
+release = '2.4.45.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From 26d066bde58ab172d9d9a1df4a4b9046f1c45139 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 15:09:27 +0000
Subject: [PATCH 454/868] removed CVS-Id lines

---
 Build/build-openbsd/Makefile      | 2 --
 Build/setup.cfg.mingw             | 2 --
 Build/setup.cfg.suse-linux        | 1 -
 CHANGES                           | 2 --
 Demo/Lib/ldap/async/ldifwriter.py | 2 --
 Demo/Lib/ldap/async/sizelimit.py  | 2 --
 Demo/Lib/ldif/ldifcopy.py         | 2 --
 Demo/resiter.py                   | 2 --
 Doc/conf.py                       | 2 --
 Doc/dsml.rst                      | 2 --
 Doc/index.rst                     | 2 --
 Doc/installing.rst                | 2 --
 Doc/ldap-async.rst                | 3 ---
 Doc/ldap-controls.rst             | 3 ---
 Doc/ldap-dn.rst                   | 3 ---
 Doc/ldap-extop.rst                | 2 --
 Doc/ldap-filter.rst               | 3 ---
 Doc/ldap-modlist.rst              | 3 ---
 Doc/ldap-resiter.rst              | 3 ---
 Doc/ldap-sasl.rst                 | 3 ---
 Doc/ldap-schema.rst               | 3 ---
 Doc/ldap-syncrepl.rst             | 2 --
 Doc/ldap.rst                      | 2 --
 Doc/ldapurl.rst                   | 2 --
 Doc/ldif.rst                      | 2 --
 Doc/slapdtest.rst                 | 2 --
 INSTALL                           | 2 --
 LICENCE                           | 3 ++-
 Lib/dsml.py                       | 2 --
 Lib/ldap/__init__.py              | 2 --
 Lib/ldap/async.py                 | 2 --
 Lib/ldap/cidict.py                | 4 +---
 Lib/ldap/controls/__init__.py     | 2 --
 Lib/ldap/controls/deref.py        | 2 --
 Lib/ldap/controls/libldap.py      | 2 --
 Lib/ldap/controls/openldap.py     | 2 --
 Lib/ldap/controls/pagedresults.py | 2 --
 Lib/ldap/controls/ppolicy.py      | 2 --
 Lib/ldap/controls/psearch.py      | 2 --
 Lib/ldap/controls/pwdpolicy.py    | 2 --
 Lib/ldap/controls/readentry.py    | 2 --
 Lib/ldap/controls/sessiontrack.py | 2 --
 Lib/ldap/controls/simple.py       | 2 --
 Lib/ldap/controls/sss.py          | 2 --
 Lib/ldap/controls/vlv.py          | 2 --
 Lib/ldap/dn.py                    | 2 --
 Lib/ldap/extop/__init__.py        | 2 --
 Lib/ldap/extop/dds.py             | 2 --
 Lib/ldap/filter.py                | 2 --
 Lib/ldap/functions.py             | 2 --
 Lib/ldap/ldapobject.py            | 2 --
 Lib/ldap/modlist.py               | 2 --
 Lib/ldap/resiter.py               | 2 --
 Lib/ldap/sasl.py                  | 2 --
 Lib/ldap/schema/__init__.py       | 2 --
 Lib/ldap/schema/models.py         | 2 --
 Lib/ldap/schema/subentry.py       | 2 --
 Lib/ldap/schema/tokenizer.py      | 2 --
 Lib/ldap/syncrepl.py              | 2 --
 Lib/ldapurl.py                    | 2 --
 Lib/ldif.py                       | 2 --
 Lib/slapdtest.py                  | 2 --
 Modules/LDAPObject.c              | 3 +--
 Modules/LDAPObject.h              | 3 +--
 Modules/berval.c                  | 3 +--
 Modules/berval.h                  | 3 +--
 Modules/common.c                  | 3 +--
 Modules/common.h                  | 3 +--
 Modules/constants.c               | 3 +--
 Modules/constants.h               | 3 +--
 Modules/errors.c                  | 3 +--
 Modules/errors.h                  | 3 +--
 Modules/functions.c               | 3 +--
 Modules/functions.h               | 5 +----
 Modules/ldapcontrol.c             | 3 +--
 Modules/ldapcontrol.h             | 3 +--
 Modules/ldapmodule.c              | 3 +--
 Modules/message.c                 | 3 +--
 Modules/message.h                 | 3 +--
 Modules/options.c                 | 3 +--
 Modules/options.h                 | 3 +--
 Modules/schema.c                  | 3 +--
 Modules/schema.h                  | 3 +--
 Modules/version.c                 | 3 +--
 Modules/version.h                 | 3 +--
 README                            | 2 --
 TODO                              | 3 ---
 Tests/__init__.py                 | 2 --
 Tests/t_cext.py                   | 2 --
 Tests/t_cidict.py                 | 2 --
 Tests/t_ldap_dn.py                | 2 --
 Tests/t_ldap_filter.py            | 2 --
 Tests/t_ldap_functions.py         | 2 --
 Tests/t_ldap_modlist.py           | 2 --
 Tests/t_ldap_schema_subentry.py   | 2 --
 Tests/t_ldap_schema_tokenizer.py  | 2 --
 Tests/t_ldapobject.py             | 2 --
 Tests/t_ldapurl.py                | 2 --
 Tests/t_ldif.py                   | 2 --
 setup.cfg                         | 2 --
 setup.py                          | 2 --
 101 files changed, 26 insertions(+), 212 deletions(-)

diff --git a/Build/build-openbsd/Makefile b/Build/build-openbsd/Makefile
index ca8e29b..ce91faf 100644
--- a/Build/build-openbsd/Makefile
+++ b/Build/build-openbsd/Makefile
@@ -1,5 +1,3 @@
-# $Id: Makefile,v 1.6 2017/08/15 16:21:58 stroeder Exp $
-
 WRKDIST=		${.CURDIR}/../..
 VERSION!=		sh ${WRKDIST}/Build/version.sh
 
diff --git a/Build/setup.cfg.mingw b/Build/setup.cfg.mingw
index b3ef5e0..16ab57f 100644
--- a/Build/setup.cfg.mingw
+++ b/Build/setup.cfg.mingw
@@ -1,7 +1,5 @@
 # Win32 setup.cfg
 # You have to edit this file to reflect your system configuration
-#
-# $Id: setup.cfg.mingw,v 1.1 2005/01/25 18:54:46 stroeder Exp $
 
 # Section for compiling the C extension module
 # for wrapping OpenLDAP 2 libs
diff --git a/Build/setup.cfg.suse-linux b/Build/setup.cfg.suse-linux
index 884e57a..3ea064d 100644
--- a/Build/setup.cfg.suse-linux
+++ b/Build/setup.cfg.suse-linux
@@ -1,6 +1,5 @@
 # Example for setup.cfg
 # You have to edit this file to reflect your system configuation
-# $Id: setup.cfg.suse-linux,v 1.1 2003/08/20 10:04:34 stroeder Exp $
 
 [_ldap]
 # Section for compiling the C extension module
diff --git a/CHANGES b/CHANGES
index 2e740c0..e40996f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1512,5 +1512,3 @@ Released 2.0.0pre02 2002-02-01
 
 ----------------------------------------------------------------
 Released 1.10alpha3 2000-09-19
-
-$Id: CHANGES,v 1.469 2017/10/09 14:54:10 stroeder Exp $
diff --git a/Demo/Lib/ldap/async/ldifwriter.py b/Demo/Lib/ldap/async/ldifwriter.py
index f919cd9..8cc4aa5 100644
--- a/Demo/Lib/ldap/async/ldifwriter.py
+++ b/Demo/Lib/ldap/async/ldifwriter.py
@@ -4,8 +4,6 @@
 
 Written by Michael Stroeder <michael@stroeder.com>
 
-$Id: ldifwriter.py,v 1.4 2006/03/26 12:23:07 stroeder Exp $
-
 This example translates the naming context of data read from
 input, sanitizes some attributes, maps/removes object classes,
 maps/removes attributes., etc. It's far from being complete though.
diff --git a/Demo/Lib/ldap/async/sizelimit.py b/Demo/Lib/ldap/async/sizelimit.py
index 9915909..05e439b 100644
--- a/Demo/Lib/ldap/async/sizelimit.py
+++ b/Demo/Lib/ldap/async/sizelimit.py
@@ -5,8 +5,6 @@
 
 Written by Michael Stroeder <michael@stroeder.com>
 
-$Id: sizelimit.py,v 1.4 2006/03/26 12:23:07 stroeder Exp $
-
 This example translates the naming context of data read from
 input, sanitizes some attributes, maps/removes object classes,
 maps/removes attributes., etc. It's far from being complete though.
diff --git a/Demo/Lib/ldif/ldifcopy.py b/Demo/Lib/ldif/ldifcopy.py
index 28c8e6e..498b857 100644
--- a/Demo/Lib/ldif/ldifcopy.py
+++ b/Demo/Lib/ldif/ldifcopy.py
@@ -4,8 +4,6 @@
 
 Written by Michael Stroeder <michael@stroeder.com>
 
-$Id: ldifcopy.py,v 1.2 2001/12/12 22:04:49 stroeder Exp $
-
 This example translates the naming context of data read from
 input, sanitizes some attributes, maps/removes object classes,
 maps/removes attributes., etc. It's far from being complete though.
diff --git a/Demo/resiter.py b/Demo/resiter.py
index 9577d2c..3394524 100644
--- a/Demo/resiter.py
+++ b/Demo/resiter.py
@@ -4,8 +4,6 @@
 
 See http://www.python-ldap.org for details.
 
-\$Id: resiter.py,v 1.2 2014/11/18 08:27:22 stroeder Exp $
-
 Python compability note:
 Requires Python 2.3+
 """
diff --git a/Doc/conf.py b/Doc/conf.py
index f967586..c52b01d 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -10,8 +10,6 @@
 #
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
-#
-# $Id: conf.py,v 1.31 2017/10/09 15:03:58 stroeder Exp $
 
 import sys
 
diff --git a/Doc/dsml.rst b/Doc/dsml.rst
index a3225c8..8b9a460 100644
--- a/Doc/dsml.rst
+++ b/Doc/dsml.rst
@@ -1,5 +1,3 @@
-.. % $Id: dsml.rst,v 1.6 2016/07/24 15:47:46 stroeder Exp $
-
 ***************************************
 :mod:`dsml` DSMLv1 parser and generator
 ***************************************
diff --git a/Doc/index.rst b/Doc/index.rst
index 592bb26..b93e9c1 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -2,8 +2,6 @@
 python-ldap Documentation
 ##########################
 
-.. % $Id: index.rst,v 1.10 2017/08/01 17:50:24 stroeder Exp $
-
 .. topic:: Abstract
 
    This document describes the package python-ldap with its various modules.
diff --git a/Doc/installing.rst b/Doc/installing.rst
index d948a16..116ba6f 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,5 +1,3 @@
-.. % $Id: installing.rst,v 1.19 2017/10/09 13:48:41 stroeder Exp $
-
 ***********************
 Building and installing
 ***********************
diff --git a/Doc/ldap-async.rst b/Doc/ldap-async.rst
index 7652ebb..d1c8087 100644
--- a/Doc/ldap-async.rst
+++ b/Doc/ldap-async.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-async.rst,v 1.4 2011/07/28 08:52:01 stroeder Exp $
-
-
 **************************************************************
 :py:mod:`ldap.async` Stream-processing of large search results
 **************************************************************
diff --git a/Doc/ldap-controls.rst b/Doc/ldap-controls.rst
index fb9cbce..1520b24 100644
--- a/Doc/ldap-controls.rst
+++ b/Doc/ldap-controls.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-controls.rst,v 1.13 2016/07/24 15:47:46 stroeder Exp $
-
-
 *********************************************************************
 :py:mod:`ldap.controls` High-level access to LDAPv3 extended controls
 *********************************************************************
diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index 77db4a1..d78f070 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-dn.rst,v 1.10 2017/08/16 12:03:33 stroeder Exp $
-
-
 :py:mod:`ldap.dn` LDAP Distinguished Name handling
 ====================================================
 
diff --git a/Doc/ldap-extop.rst b/Doc/ldap-extop.rst
index 10a9c12..607f3f0 100644
--- a/Doc/ldap-extop.rst
+++ b/Doc/ldap-extop.rst
@@ -1,5 +1,3 @@
-.. % $Id: ldap-extop.rst,v 1.4 2011/07/22 17:28:46 stroeder Exp $
-
 ********************************************************************
 :py:mod:`ldap.extop` High-level access to LDAPv3 extended operations
 ********************************************************************
diff --git a/Doc/ldap-filter.rst b/Doc/ldap-filter.rst
index bb484a8..577befb 100644
--- a/Doc/ldap-filter.rst
+++ b/Doc/ldap-filter.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-filter.rst,v 1.5 2016/07/24 15:47:46 stroeder Exp $
-
-
 :py:mod:`ldap.filter` LDAP filter handling
 ============================================
 
diff --git a/Doc/ldap-modlist.rst b/Doc/ldap-modlist.rst
index ad39a3a..64bf578 100644
--- a/Doc/ldap-modlist.rst
+++ b/Doc/ldap-modlist.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-modlist.rst,v 1.6 2017/08/16 12:03:33 stroeder Exp $
-
-
 :py:mod:`ldap.modlist` Generate modify lists
 ==============================================
 
diff --git a/Doc/ldap-resiter.rst b/Doc/ldap-resiter.rst
index 4c854fa..0beabb8 100644
--- a/Doc/ldap-resiter.rst
+++ b/Doc/ldap-resiter.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-resiter.rst,v 1.6 2016/07/24 15:47:46 stroeder Exp $
-
-
 :py:mod:`ldap.resiter` Generator for stream-processing of large search results
 ==============================================================================
 
diff --git a/Doc/ldap-sasl.rst b/Doc/ldap-sasl.rst
index 8436b73..96f13aa 100644
--- a/Doc/ldap-sasl.rst
+++ b/Doc/ldap-sasl.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-sasl.rst,v 1.5 2017/09/05 07:38:45 stroeder Exp $
-
-
 ***********************************************
 :py:mod:`ldap.sasl` SASL Authentication Methods
 ***********************************************
diff --git a/Doc/ldap-schema.rst b/Doc/ldap-schema.rst
index 81c4236..904c243 100644
--- a/Doc/ldap-schema.rst
+++ b/Doc/ldap-schema.rst
@@ -1,6 +1,3 @@
-.. % $Id: ldap-schema.rst,v 1.4 2011/07/22 17:46:07 stroeder Exp $
-
-
 ********************************************
 :py:mod:`ldap.schema` Handling LDAPv3 schema
 ********************************************
diff --git a/Doc/ldap-syncrepl.rst b/Doc/ldap-syncrepl.rst
index 388526e..d3717df 100644
--- a/Doc/ldap-syncrepl.rst
+++ b/Doc/ldap-syncrepl.rst
@@ -1,5 +1,3 @@
-.. % $Id: ldap-syncrepl.rst,v 1.1 2011/10/26 19:41:27 stroeder Exp $
-
 ********************************************************************
 :py:mod:`ldap.syncrepl` Implementation of a syncrepl consumer
 ********************************************************************
diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 64573d6..e983f64 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1,5 +1,3 @@
-.. % $Id: ldap.rst,v 1.42 2017/09/05 07:38:46 stroeder Exp $
-
 ********************************************
 :py:mod:`ldap` LDAP library interface module
 ********************************************
diff --git a/Doc/ldapurl.rst b/Doc/ldapurl.rst
index e2a4dbd..c13061c 100644
--- a/Doc/ldapurl.rst
+++ b/Doc/ldapurl.rst
@@ -1,5 +1,3 @@
-.. % $Id: ldapurl.rst,v 1.12 2017/08/16 12:03:33 stroeder Exp $
-
 ###################################
 :py:mod:`ldapurl` LDAP URL handling
 ###################################
diff --git a/Doc/ldif.rst b/Doc/ldif.rst
index 8a8f6f3..1a9eabc 100644
--- a/Doc/ldif.rst
+++ b/Doc/ldif.rst
@@ -1,5 +1,3 @@
-.. % $Id: ldif.rst,v 1.11 2017/08/16 12:03:33 stroeder Exp $
-
 #####################################
 :mod:`ldif` LDIF parser and generator
 #####################################
diff --git a/Doc/slapdtest.rst b/Doc/slapdtest.rst
index 49d1403..bd54bb6 100644
--- a/Doc/slapdtest.rst
+++ b/Doc/slapdtest.rst
@@ -1,5 +1,3 @@
-.. % $Id: slapdtest.rst,v 1.4 2017/08/16 12:17:56 stroeder Exp $
-
 ###################################################################
 :mod:`slapdtest` Spawning test instances of OpenLDAP's slapd server
 ###################################################################
diff --git a/INSTALL b/INSTALL
index 71bbcef..98dd40c 100644
--- a/INSTALL
+++ b/INSTALL
@@ -24,5 +24,3 @@ Quick build instructions:
     edit setup.cfg (see Build/ for platform-specific examples)
     python setup.py build
     python setup.py install
-
-$Id: INSTALL,v 1.10 2011/04/02 22:30:55 stroeder Exp $
diff --git a/LICENCE b/LICENCE
index a98c010..1338962 100644
--- a/LICENCE
+++ b/LICENCE
@@ -1,4 +1,5 @@
-The pyldap package is distributed under Python-style license.
+
+The python-ldap package is distributed under Python-style license.
 
 Standard disclaimer:
    This software is made available by the author(s) to the public for free
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 1cd204d..9a93b94 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -4,8 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: dsml.py,v 1.63 2017/09/26 09:40:26 stroeder Exp $
-
 Python compability note:
 Tested with Python 2.0+.
 """
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 6aa9eac..30c0010 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -2,8 +2,6 @@
 ldap - base module
 
 See https://www.python-ldap.org/ for details.
-
-$Id: __init__.py,v 1.124 2017/09/26 09:40:26 stroeder Exp $
 """
 
 # This is also the overall release version number
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 707b72d..2cbb488 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: async.py,v 1.35 2017/08/15 16:21:58 stroeder Exp $
-
 Python compability note:
 Tested on Python 2.0+ but should run on Python 1.5.x.
 """
diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index e6db46d..a1f8fc5 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -4,11 +4,9 @@
 names of variable case.
 
 See https://www.python-ldap.org/ for details.
-
-$Id: cidict.py,v 1.14 2017/08/15 16:14:04 stroeder Exp $
 """
 
-__version__ = """$Revision: 1.14 $"""
+__version__ = """$Revision: 1.15 $"""
 
 from UserDict import UserDict
 from string import lower
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index 90e49eb..d504d49 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -4,8 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: __init__.py,v 1.11 2017/08/15 16:21:58 stroeder Exp $
-
 Description:
 The ldap.controls module provides LDAPControl classes.
 Each class provides support for a certain control.
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index a649d98..d1b5ce9 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -4,8 +4,6 @@
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: deref.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/libldap.py b/Lib/ldap/controls/libldap.py
index 66d8e51..53a02a4 100644
--- a/Lib/ldap/controls/libldap.py
+++ b/Lib/ldap/controls/libldap.py
@@ -4,8 +4,6 @@
 by OpenLDAP functions
 
 See https://www.python-ldap.org/ for details.
-
-$Id: libldap.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import _ldap,ldap
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 88facb6..ee7b575 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -3,8 +3,6 @@
 ldap.controls.openldap - classes for OpenLDAP-specific controls
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: openldap.py,v 1.7 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import ldap.controls
diff --git a/Lib/ldap/controls/pagedresults.py b/Lib/ldap/controls/pagedresults.py
index cfd38a6..fcdff36 100644
--- a/Lib/ldap/controls/pagedresults.py
+++ b/Lib/ldap/controls/pagedresults.py
@@ -4,8 +4,6 @@
 (see RFC 2696)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: pagedresults.py,v 1.3 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index f6a7116..a0fa176 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -4,8 +4,6 @@
 (see https://tools.ietf.org/html/draft-behera-ldap-password-policy)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: ppolicy.py,v 1.5 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
index 31c9286..e639ed8 100644
--- a/Lib/ldap/controls/psearch.py
+++ b/Lib/ldap/controls/psearch.py
@@ -4,8 +4,6 @@
 (see https://tools.ietf.org/html/draft-ietf-ldapext-psearch)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: psearch.py,v 1.5 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index 38bdb79..cf9c197 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -4,8 +4,6 @@
 (see https://tools.ietf.org/html/draft-vchu-ldap-pwd-policy)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: pwdpolicy.py,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/readentry.py b/Lib/ldap/controls/readentry.py
index cc411c3..57cefef 100644
--- a/Lib/ldap/controls/readentry.py
+++ b/Lib/ldap/controls/readentry.py
@@ -4,8 +4,6 @@
 (see RFC 4527)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: readentry.py,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import ldap
diff --git a/Lib/ldap/controls/sessiontrack.py b/Lib/ldap/controls/sessiontrack.py
index 8dced44..9c8a057 100644
--- a/Lib/ldap/controls/sessiontrack.py
+++ b/Lib/ldap/controls/sessiontrack.py
@@ -4,8 +4,6 @@
 (see draft-wahl-ldap-session)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: sessiontrack.py,v 1.6 2017/08/15 16:21:58 stroeder Exp $
 """
 
 from ldap.controls import RequestControl
diff --git a/Lib/ldap/controls/simple.py b/Lib/ldap/controls/simple.py
index 5899315..d413034 100644
--- a/Lib/ldap/controls/simple.py
+++ b/Lib/ldap/controls/simple.py
@@ -3,8 +3,6 @@
 ldap.controls.simple - classes for some very simple LDAP controls
 
 See https://www.python-ldap.org/ for details.
-
-$Id: simple.py,v 1.11 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import struct,ldap
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index c2c973c..bf2773b 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -4,8 +4,6 @@
 (see RFC 2891)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: sss.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index d8283d2..d5b0f89 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -4,8 +4,6 @@
 (see draft-ietf-ldapext-ldapv3-vlv)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: vlv.py,v 1.4 2017/08/15 16:21:58 stroeder Exp $
 """
 
 __all__ = [
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index e8e8927..75465ed 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: dn.py,v 1.17 2017/08/15 16:21:58 stroeder Exp $
-
 Compability:
 - Tested with Python 2.0+
 """
diff --git a/Lib/ldap/extop/__init__.py b/Lib/ldap/extop/__init__.py
index 10ca8a1..d18c682 100644
--- a/Lib/ldap/extop/__init__.py
+++ b/Lib/ldap/extop/__init__.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: __init__.py,v 1.5 2017/08/15 16:21:58 stroeder Exp $
-
 Description:
 The ldap.extop module provides base classes for LDAPv3 extended operations.
 Each class provides support for a certain extended operation request and
diff --git a/Lib/ldap/extop/dds.py b/Lib/ldap/extop/dds.py
index ec71a02..4d156e8 100644
--- a/Lib/ldap/extop/dds.py
+++ b/Lib/ldap/extop/dds.py
@@ -4,8 +4,6 @@
 (see RFC 2589)
 
 See https://www.python-ldap.org/ for details.
-
-$Id: dds.py,v 1.3 2017/08/15 16:21:58 stroeder Exp $
 """
 
 from ldap.extop import ExtendedRequest,ExtendedResponse
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index 510f9ce..f5d9278 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: filter.py,v 1.12 2017/08/15 16:21:58 stroeder Exp $
-
 Compability:
 - Tested with Python 2.0+
 """
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index d56bc86..ea763fa 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: functions.py,v 1.34 2017/08/15 16:21:58 stroeder Exp $
-
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
 - functions should behave exactly the same like in _ldap
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 6a39fa3..70ecec7 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapobject.py,v 1.166 2017/10/09 14:54:10 stroeder Exp $
-
 Compability:
 - Tested with Python 2.0+ but should work with Python 1.5.x
 - LDAPObject class should be exactly the same like _ldap.LDAPObject
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 5a7f0e3..0d1ac40 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: modlist.py,v 1.19 2017/08/15 16:21:58 stroeder Exp $
-
 Python compability note:
 This module is known to work with Python 2.0+ but should work
 with Python 1.5.2 as well.
diff --git a/Lib/ldap/resiter.py b/Lib/ldap/resiter.py
index b86d0be..d8c1368 100644
--- a/Lib/ldap/resiter.py
+++ b/Lib/ldap/resiter.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: resiter.py,v 1.8 2017/08/15 16:21:58 stroeder Exp $
-
 Python compability note:
 Requires Python 2.3+
 """
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index cce892a..81438cc 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: sasl.py,v 1.18 2017/08/15 16:21:58 stroeder Exp $
-
 Description:
 The ldap.sasl module provides SASL authentication classes.
 Each class provides support for one SASL mechanism. This is done by
diff --git a/Lib/ldap/schema/__init__.py b/Lib/ldap/schema/__init__.py
index 4346cd2..2349ae2 100644
--- a/Lib/ldap/schema/__init__.py
+++ b/Lib/ldap/schema/__init__.py
@@ -2,8 +2,6 @@
 ldap.schema -  LDAPv3 schema handling
 
 See https://www.python-ldap.org/ for details.
-
-\$Id: __init__.py,v 1.8 2017/08/15 16:21:58 stroeder Exp $
 """
 
 from ldap import __version__
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 67b4f29..383705c 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -2,8 +2,6 @@
 schema.py - support for subSchemaSubEntry information
 
 See https://www.python-ldap.org/ for details.
-
-\$Id: models.py,v 1.50 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import UserDict,ldap.cidict
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 2eac52a..a80f238 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -2,8 +2,6 @@
 ldap.schema.subentry -  subschema subentry handling
 
 See https://www.python-ldap.org/ for details.
-
-\$Id: subentry.py,v 1.37 2017/08/15 16:21:58 stroeder Exp $
 """
 
 import ldap.cidict,ldap.schema
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index 724f0c5..ede7e21 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -2,8 +2,6 @@
 ldap.schema.tokenizer - Low-level parsing functions for schema element strings
 
 See https://www.python-ldap.org/ for details.
-
-\$Id: tokenizer.py,v 1.17 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import re
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 8156435..3401c0d 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -3,8 +3,6 @@
 ldap.syncrepl - for implementing syncrepl consumer (see RFC 4533)
 
 See https://www.python-ldap.org/ for project details.
-
-$Id: syncrepl.py,v 1.8 2017/08/15 16:21:58 stroeder Exp $
 """
 
 #__all__ = [
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index bd1f42c..c760b33 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-\$Id: ldapurl.py,v 1.99 2017/09/26 09:40:26 stroeder Exp $
-
 Python compability note:
 This module only works with Python 2.0+ since
 1. string methods are used instead of module string and
diff --git a/Lib/ldif.py b/Lib/ldif.py
index f38e150..bd5801c 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: ldif.py,v 1.119 2017/09/26 09:40:26 stroeder Exp $
-
 Python compability note:
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index e2fceb1..a09e9e6 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -4,8 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 
-$Id: slapdtest.py,v 1.22 2017/09/26 09:40:26 stroeder Exp $
-
 Python compability note:
 This module only works with Python 2.7.x since
 """
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 5c69cc3..3291379 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: LDAPObject.c,v 1.98 2017/10/09 13:51:45 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "patchlevel.h"
diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index be6a01d..4223735 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: LDAPObject.h,v 1.11 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_LDAPObject 
 #define __h_LDAPObject 
diff --git a/Modules/berval.c b/Modules/berval.c
index e196b2d..b118669 100644
--- a/Modules/berval.c
+++ b/Modules/berval.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: berval.c,v 1.2 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "berval.h"
diff --git a/Modules/berval.h b/Modules/berval.h
index c635dec..514e9f9 100644
--- a/Modules/berval.h
+++ b/Modules/berval.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: berval.h,v 1.2 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_berval 
 #define __h_berval 
diff --git a/Modules/common.c b/Modules/common.c
index 61fb6f7..7d3ac8b 100644
--- a/Modules/common.c
+++ b/Modules/common.c
@@ -1,6 +1,5 @@
 /* Miscellaneous common routines
- * See https://www.python-ldap.org/ for details.
- * $Id: common.c,v 1.4 2017/08/15 16:21:59 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 
diff --git a/Modules/common.h b/Modules/common.h
index c1744df..e29e20d 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -1,6 +1,5 @@
 /* common utility macros
- * See https://www.python-ldap.org/ for details.
- * $Id: common.h,v 1.9 2017/08/15 16:21:59 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_common 
 #define __h_common 
diff --git a/Modules/constants.c b/Modules/constants.c
index b7f0757..2c0ec1d 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -1,6 +1,5 @@
 /* constants defined for LDAP
- * See https://www.python-ldap.org/ for details.
- * $Id: constants.c,v 1.60 2017/08/15 16:21:59 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "constants.h"
diff --git a/Modules/constants.h b/Modules/constants.h
index 7ff856d..eb76612 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: constants.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_constants_
 #define __h_constants_
diff --git a/Modules/errors.c b/Modules/errors.c
index 765b830..3731965 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -1,8 +1,7 @@
 /*
  * errors that arise from ldap use
  * Most errors become their own exception
- * See https://www.python-ldap.org/ for details.
- * $Id: errors.c,v 1.31 2017/08/15 16:21:59 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "errors.h"
diff --git a/Modules/errors.h b/Modules/errors.h
index a5c65f0..32aebff 100644
--- a/Modules/errors.h
+++ b/Modules/errors.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: errors.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_errors_
 #define __h_errors_
diff --git a/Modules/functions.c b/Modules/functions.c
index c25f34e..b2dbf83 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: functions.c,v 1.28 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "functions.h"
diff --git a/Modules/functions.h b/Modules/functions.h
index 0f9850e..854a940 100644
--- a/Modules/functions.h
+++ b/Modules/functions.h
@@ -1,11 +1,8 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: functions.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_functions_
 #define __h_functions_
 
-/* $Id: functions.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
-
 #include "common.h"
 extern void LDAPinit_functions( PyObject* );
 
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 96162e7..0bf86a1 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: ldapcontrol.c,v 1.22 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "LDAPObject.h"
diff --git a/Modules/ldapcontrol.h b/Modules/ldapcontrol.h
index 0d5e8da..1c09d95 100644
--- a/Modules/ldapcontrol.h
+++ b/Modules/ldapcontrol.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: ldapcontrol.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_ldapcontrol
 #define __h_ldapcontrol
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 60e4d33..7d8ed2f 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: ldapmodule.c,v 1.10 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "version.h"
diff --git a/Modules/message.c b/Modules/message.c
index e44c390..33127b6 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: message.c,v 1.20 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "message.h"
diff --git a/Modules/message.h b/Modules/message.h
index 87d5523..b4f60eb 100644
--- a/Modules/message.h
+++ b/Modules/message.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: message.h,v 1.7 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_message 
 #define __h_message 
diff --git a/Modules/options.c b/Modules/options.c
index 740cda2..a437ca4 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: options.c,v 1.43 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 #include "errors.h"
diff --git a/Modules/options.h b/Modules/options.h
index 3223f2c..dd61320 100644
--- a/Modules/options.h
+++ b/Modules/options.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: options.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 int	LDAP_optionval_by_name(const char *name);
 int	LDAP_set_option(LDAPObject *self, int option, PyObject *value);
diff --git a/Modules/schema.c b/Modules/schema.c
index d5818af..fb38b0a 100644
--- a/Modules/schema.c
+++ b/Modules/schema.c
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: schema.c,v 1.9 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 
diff --git a/Modules/schema.h b/Modules/schema.h
index 7694afd..eee00a3 100644
--- a/Modules/schema.h
+++ b/Modules/schema.h
@@ -1,5 +1,4 @@
-/* See https://www.python-ldap.org/ for details.
- * $Id: schema.h,v 1.6 2017/08/15 16:21:59 stroeder Exp $ */
+/* See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_schema_
 #define __h_schema_
diff --git a/Modules/version.c b/Modules/version.c
index 8e4e63c..b706b8e 100644
--- a/Modules/version.c
+++ b/Modules/version.c
@@ -1,6 +1,5 @@
 /* Set release version
- * See https://www.python-ldap.org/ for details.
- * $Id: version.c,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
 
diff --git a/Modules/version.h b/Modules/version.h
index 270b201..4d76b34 100644
--- a/Modules/version.h
+++ b/Modules/version.h
@@ -1,6 +1,5 @@
 /* Set release version
- * See https://www.python-ldap.org/ for details.
- * $Id: version.h,v 1.5 2017/08/15 16:21:59 stroeder Exp $ */
+ * See https://www.python-ldap.org/ for details. */
 
 #ifndef __h_version_
 #define __h_version_
diff --git a/README b/README
index 6d4b93c..d8e88bb 100644
--- a/README
+++ b/README
@@ -98,5 +98,3 @@ Acknowledgements:
 
    Thanks! We may have missed someone: please mail us if we have omitted
    your name.
-
-$Id: README,v 1.26 2017/08/15 16:21:58 stroeder Exp $
diff --git a/TODO b/TODO
index fdee89e..456cfea 100644
--- a/TODO
+++ b/TODO
@@ -26,6 +26,3 @@ Tests/
 - Clean up and finish the mess of small test scripts started.
 - Create a test script that exercises everything with a server
   holding the BLITS test data set
-
-------------------------------------------------------------------
-$Id: TODO,v 1.39 2015/01/10 16:58:52 stroeder Exp $
diff --git a/Tests/__init__.py b/Tests/__init__.py
index 3c212f0..b7b5378 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap
 
 See https://www.python-ldap.org/ for details.
-
-$Id: __init__.py,v 1.6 2017/08/15 16:17:29 stroeder Exp $
 """
 
 import t_cext
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index ee1fd60..6add784 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's C wrapper module _ldap
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_cext.py,v 1.25 2017/10/09 14:40:48 stroeder Exp $
 """
 
 import os
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index ab79b28..3f9e8e4 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.cidict
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_cidict.py,v 1.3 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 1507d2e..043cc70 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.dn
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldap_dn.py,v 1.6 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index f50a217..5eda05d 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.filter
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldap_filter.py,v 1.5 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
index 1928c67..cdd2ffb 100644
--- a/Tests/t_ldap_functions.py
+++ b/Tests/t_ldap_functions.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.functions
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldap_functions.py,v 1.4 2017/09/04 07:47:29 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
index d7a9336..a206cde 100644
--- a/Tests/t_ldap_modlist.py
+++ b/Tests/t_ldap_modlist.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.modlist
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldap_modlist.py,v 1.3 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 879d02e..de6421a 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's class ldap.schema.SubSchema
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldap_schema_subentry.py,v 1.3 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index 72711f5..d676e8a 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.schema.tokenizer
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldap_schema_tokenizer.py,v 1.11 2017/08/15 16:21:59 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index e8fe6ac..60e9bdb 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.ldapobject
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldapobject.py,v 1.10 2017/09/04 14:59:57 stroeder Exp $
 """
 
 import os
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 161e99c..c87b752 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldapurl
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldapurl.py,v 1.14 2017/09/04 07:47:29 stroeder Exp $
 """
 
 import unittest
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 551d7ae..4898f76 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldif
 
 See https://www.python-ldap.org/ for details.
-
-$Id: t_ldif.py,v 1.25 2017/10/09 13:27:42 stroeder Exp $
 """
 
 # from Python's standard lib
diff --git a/setup.cfg b/setup.cfg
index aa23527..10dafc9 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,7 +1,5 @@
 # Example for setup.cfg
 # You have to edit this file to reflect your system configuation
-#
-# $Id: setup.cfg,v 1.32 2015/06/21 17:50:43 stroeder Exp $
 
 # Section for compiling the C extension module
 # for wrapping OpenLDAP 2 libs
diff --git a/setup.py b/setup.py
index ec3a4be..7318c41 100644
--- a/setup.py
+++ b/setup.py
@@ -2,8 +2,6 @@
 setup.py - Setup package with the help Python's DistUtils
 
 See https://www.python-ldap.org/ for details.
-
-$Id: setup.py,v 1.80 2017/08/15 16:21:58 stroeder Exp $
 """
 
 has_setuptools = False

From d5bed1cb3c003a76d842a53ef264c51c2235165a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 9 Oct 2017 15:11:00 +0000
Subject: [PATCH 455/868] prepare release 2.4.45

---
 CHANGES | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index e40996f..4d879e4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.45 2017-09-xx
+Released 2.4.45 2017-10-09
 
 Changes since 2.4.44:
 

From e9aeb1107328ca450f3b62d1377a14ab58ecd25e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 7 Nov 2017 21:08:45 +0000
Subject: [PATCH 456/868] started 2.4.46

---
 CHANGES              | 11 +++++++++++
 Lib/dsml.py          |  2 +-
 Lib/ldap/__init__.py |  2 +-
 Lib/ldapurl.py       |  2 +-
 Lib/ldif.py          |  2 +-
 Lib/slapdtest.py     |  2 +-
 6 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4d879e4..2906006 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+----------------------------------------------------------------
+Released 2.4.46 2017-11-xx
+
+Changes since 2.4.45:
+
+Lib/
+* 
+
+Tests/
+* 
+
 ----------------------------------------------------------------
 Released 2.4.45 2017-10-09
 
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 9a93b94..56b7dd3 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -8,7 +8,7 @@
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.45'
+__version__ = '2.4.46'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 30c0010..95e408a 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -6,7 +6,7 @@
 
 # This is also the overall release version number
 
-__version__ = '2.4.45'
+__version__ = '2.4.46'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index c760b33..0432f92 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -9,7 +9,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.45'
+__version__ = '2.4.46'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index bd5801c..51bb3bd 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -7,7 +7,7 @@
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.45'
+__version__ = '2.4.46'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index a09e9e6..8346040 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -8,7 +8,7 @@
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.45'
+__version__ = '2.4.46'
 
 import os
 import socket

From 0829d5230ee148aa266fbc3d5e0d816a11ae176a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 7 Nov 2017 21:10:52 +0000
Subject: [PATCH 457/868] slapdtest.SlapdObject.restart() just restarts slapd
 without cleaning any data

---
 CHANGES          |  3 ++-
 Lib/slapdtest.py | 14 ++++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2906006..f687fcd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@ Released 2.4.46 2017-11-xx
 Changes since 2.4.45:
 
 Lib/
-* 
+* slapdtest.SlapdObject.restart() just restarts slapd
+  without cleaning any data
 
 Tests/
 * 
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 8346040..5c4a83f 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -285,7 +285,9 @@ def start(self):
             )
 
     def stop(self):
-        """Stops the slapd server, and waits for it to terminate"""
+        """
+        Stops the slapd server, and waits for it to terminate and cleans up
+        """
         if self._proc is not None:
             self._log.debug('stopping slapd with pid %d', self._proc.pid)
             self._proc.terminate()
@@ -294,11 +296,11 @@ def stop(self):
 
     def restart(self):
         """
-        Restarts the slapd server; ERASING previous content.
-        Starts the server even it if isn't already running.
+        Restarts the slapd server with same data
         """
-        self.stop()
-        self.start()
+        self._proc.terminate()
+        self.wait()
+        self._start_slapd()
 
     def wait(self):
         """Waits for the slapd process to terminate by itself."""
@@ -309,7 +311,7 @@ def wait(self):
     def _stopped(self):
         """Called when the slapd server is known to have terminated"""
         if self._proc is not None:
-            self._log.info('slapd terminated')
+            self._log.info('slapd[%d] terminated', self._proc.pid)
             self._proc = None
 
     def _cli_auth_args(self):

From d534a46ba5a1690c5dd35fd5bfbd3cf123d35e3e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Tue, 7 Nov 2017 21:12:25 +0000
Subject: [PATCH 458/868] added explicit reconnect tests for
 ReconnectLDAPObject

---
 CHANGES               |  2 +-
 Tests/t_ldapobject.py | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index f687fcd..8e33207 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,7 +8,7 @@ Lib/
   without cleaning any data
 
 Tests/
-* 
+* added explicit reconnect tests for ReconnectLDAPObject
 
 ----------------------------------------------------------------
 Released 2.4.45 2017-10-09
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 60e9bdb..b783677 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -27,6 +27,12 @@
 cn: %(rootcn)s
 userPassword: %(rootpw)s
 
+dn: cn=user1,%(suffix)s
+objectClass: applicationProcess
+objectClass: simpleSecurityObject
+cn: user1
+userPassword: user1_pw
+
 dn: cn=Foo1,%(suffix)s
 objectClass: organizationalRole
 cn: Foo1
@@ -190,6 +196,22 @@ class Test02_ReconnectLDAPObject(Test01_SimpleLDAPObject):
 
     ldap_object_class = ReconnectLDAPObject
 
+    def test_reconnect_sasl_external(self):
+        l = self.ldap_object_class(self.server.ldapi_uri)
+        l.sasl_external_bind_s()
+        authz_id = l.whoami_s()
+        self.assertEqual(authz_id, 'dn:'+self.server.root_dn.lower())
+        self.server.restart()
+        self.assertEqual(l.whoami_s(), authz_id)
+
+    def test_reconnect_simple_bind(self):
+        l = self.ldap_object_class(self.server.ldapi_uri)
+        bind_dn = 'cn=user1,'+self.server.suffix
+        l.simple_bind_s(bind_dn, 'user1_pw')
+        self.assertEqual(l.whoami_s(), 'dn:'+bind_dn)
+        self.server.restart()
+        self.assertEqual(l.whoami_s(), 'dn:'+bind_dn)
+
 
 if __name__ == '__main__':
     unittest.main()

From cd3d83bc1caf3b47c65e56511949d1f07677ce7f Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 11 Nov 2017 19:32:14 +0000
Subject: [PATCH 459/868] started 2.5.0 (instead of 2.4.46)

---
 CHANGES              | 2 +-
 Lib/dsml.py          | 2 +-
 Lib/ldap/__init__.py | 2 +-
 Lib/ldapurl.py       | 2 +-
 Lib/ldif.py          | 2 +-
 Lib/slapdtest.py     | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8e33207..c4d0283 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.4.46 2017-11-xx
+Released 2.5.0 2017-11-xx
 
 Changes since 2.4.45:
 
diff --git a/Lib/dsml.py b/Lib/dsml.py
index 56b7dd3..bf58c36 100644
--- a/Lib/dsml.py
+++ b/Lib/dsml.py
@@ -8,7 +8,7 @@
 Tested with Python 2.0+.
 """
 
-__version__ = '2.4.46'
+__version__ = '2.5.0'
 
 import string,base64
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 95e408a..af83b6c 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -6,7 +6,7 @@
 
 # This is also the overall release version number
 
-__version__ = '2.4.46'
+__version__ = '2.5.0'
 
 import sys
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 0432f92..07a6863 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -9,7 +9,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.4.46'
+__version__ = '2.5.0'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 51bb3bd..2de5650 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -7,7 +7,7 @@
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.4.46'
+__version__ = '2.5.0'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 5c4a83f..d5e6a82 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -8,7 +8,7 @@
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.4.46'
+__version__ = '2.5.0'
 
 import os
 import socket

From dab08dffcadd6b16cfa0e37a9cf08bc0aeb51419 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 11 Nov 2017 20:24:34 +0000
Subject: [PATCH 460/868] Compability changes for pyasn1 0.3.x or newer

---
 CHANGES                      |  4 ++++
 Lib/ldap/controls/ppolicy.py | 12 ++++++------
 Lib/ldap/controls/psearch.py | 20 +++++++++-----------
 Lib/ldap/controls/sss.py     |  6 +++++-
 Lib/ldap/controls/vlv.py     | 12 +++++++-----
 Lib/ldap/syncrepl.py         | 28 +++++++++++++++++-----------
 6 files changed, 48 insertions(+), 34 deletions(-)

diff --git a/CHANGES b/CHANGES
index c4d0283..960919e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,9 +3,13 @@ Released 2.5.0 2017-11-xx
 
 Changes since 2.4.45:
 
+This release requires pyasn1 0.3.x or newer!
+
 Lib/
 * slapdtest.SlapdObject.restart() just restarts slapd
   without cleaning any data
+* Compability changes for pyasn1 0.3.x or newer
+  (thanks to Ilya Etingof and Christian Heimes)
 
 Tests/
 * added explicit reconnect tests for ReconnectLDAPObject
diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index a0fa176..aa761f3 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -71,24 +71,24 @@ def __init__(self,criticality=False):
   def decodeControlValue(self,encodedControlValue):
     ppolicyValue,_ = decoder.decode(encodedControlValue,asn1Spec=PasswordPolicyResponseValue())
     warning = ppolicyValue.getComponentByName('warning')
-    if warning is None:
+    if not warning.hasValue():
       self.timeBeforeExpiration,self.graceAuthNsRemaining = None,None
     else:
       timeBeforeExpiration = warning.getComponentByName('timeBeforeExpiration')
-      if timeBeforeExpiration!=None:
+      if timeBeforeExpiration.hasValue():
         self.timeBeforeExpiration = int(timeBeforeExpiration)
       else:
         self.timeBeforeExpiration = None
       graceAuthNsRemaining = warning.getComponentByName('graceAuthNsRemaining')
-      if graceAuthNsRemaining!=None:
+      if graceAuthNsRemaining.hasValue():
         self.graceAuthNsRemaining = int(graceAuthNsRemaining)
       else:
         self.graceAuthNsRemaining = None
     error = ppolicyValue.getComponentByName('error')
-    if error is None:
-      self.error = None
-    else:
+    if error.hasValue():
       self.error = int(error)
+    else:
+      self.error = None
 
 
 KNOWN_RESPONSE_CONTROLS[PasswordPolicyControl.controlType] = PasswordPolicyControl
diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
index e639ed8..91a5c24 100644
--- a/Lib/ldap/controls/psearch.py
+++ b/Lib/ldap/controls/psearch.py
@@ -115,18 +115,16 @@ class EntryChangeNotificationControl(ResponseControl):
   def decodeControlValue(self,encodedControlValue):
     ecncValue,_ = decoder.decode(encodedControlValue,asn1Spec=EntryChangeNotificationValue())
     self.changeType = int(ecncValue.getComponentByName('changeType'))
-    if len(ecncValue)==3:
-      self.previousDN = str(ecncValue.getComponentByName('previousDN'))
-      self.changeNumber = int(ecncValue.getComponentByName('changeNumber'))
-    elif len(ecncValue)==2:
-      if self.changeType==8:
-        self.previousDN = str(ecncValue.getComponentByName('previousDN'))
-        self.changeNumber = None
-      else:
-        self.previousDN = None
-        self.changeNumber = int(ecncValue.getComponentByName('changeNumber'))
+    previousDN = ecncValue.getComponentByName('previousDN')
+    if previousDN.hasValue():
+      self.previousDN = str(previousDN)
     else:
-      self.previousDN,self.changeNumber = None,None
+      self.previousDN = None
+    changeNumber = ecncValue.getComponentByName('changeNumber')
+    if changeNumber.hasValue():
+      self.changeNumber = int(changeNumber)
+    else:
+      self.changeNumber = None
     return (self.changeType,self.previousDN,self.changeNumber)
 
 KNOWN_RESPONSE_CONTROLS[EntryChangeNotificationControl.controlType] = EntryChangeNotificationControl
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index bf2773b..20697fa 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -121,7 +121,11 @@ def decodeControlValue(self, encoded):
         assert not rest, 'all data could not be decoded'
         self.result = int(p.getComponentByName('sortResult'))
         self.result_code = p.getComponentByName('sortResult').prettyOut(self.result)
-        self.attribute_type_error = p.getComponentByName('attributeType')
+        attribute_type_error = p.getComponentByName('attributeType')
+        if attribute_type_error.hasValue():
+            self.attribute_type_error = attribute_type_error
+        else:
+            self.attribute_type_error = None
 
 
 KNOWN_RESPONSE_CONTROLS[SSSRequestControl.controlType] = SSSRequestControl
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index d5b0f89..980b77b 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -128,10 +128,12 @@ def decodeControlValue(self,encoded):
         self.target_position = int(p.getComponentByName('targetPosition'))
         self.content_count = int(p.getComponentByName('contentCount'))
         self.result = int(p.getComponentByName('virtualListViewResult'))
-        self.result_code = p.getComponentByName('virtualListViewResult') \
-                .prettyOut(self.result)
-        self.context_id = p.getComponentByName('contextID')
-        if self.context_id:
-            self.context_id = str(self.context_id)
+        self.result_code = p.getComponentByName('virtualListViewResult').prettyOut(self.result)
+        context_id = p.getComponentByName('contextID')
+        if context_id.hasValue():
+            self.context_id = str(context_id)
+        else:
+            self.context_id = None
+
 
 KNOWN_RESPONSE_CONTROLS[VLVResponseControl.controlType] = VLVResponseControl
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 3401c0d..94a7217 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -131,11 +131,13 @@ def decodeControlValue(self, encodedControlValue):
         d = decoder.decode(encodedControlValue, asn1Spec = syncStateValue())
         state = d[0].getComponentByName('state')
         uuid = UUID(bytes=d[0].getComponentByName('entryUUID'))
-        self.cookie = d[0].getComponentByName('cookie')
+        cookie = d[0].getComponentByName('cookie')
+        if cookie.hasValue():
+            self.cookie = str(self.cookie)
+        else:
+            self.cookie = None
         self.state = self.__class__.opnames[int(state)]
         self.entryUUID = str(uuid)
-        if self.cookie is not None:
-            self.cookie = str(self.cookie)
 
 KNOWN_RESPONSE_CONTROLS[SyncStateControl.controlType] = SyncStateControl
 
@@ -165,12 +167,16 @@ class SyncDoneControl(ResponseControl):
 
     def decodeControlValue(self, encodedControlValue):
         d = decoder.decode(encodedControlValue, asn1Spec = syncDoneValue())
-        self.cookie = d[0].getComponentByName('cookie')
-        self.refreshDeletes = d[0].getComponentByName('refreshDeletes')
-        if self.cookie is not None:
-            self.cookie = str(self.cookie)
-        if self.refreshDeletes is not None:
-            self.refreshDeletes = bool(self.refreshDeletes)
+        cookie = d[0].getComponentByName('cookie')
+        if cookie.hasValue():
+            self.cookie = str(cookie)
+        else:
+            self.cookie = None
+        refresh_deletes = d[0].getComponentByName('refreshDeletes')
+        if refresh_deletes.hasValue():
+            self.refreshDeletes = bool(refresh_deletes)
+        else:
+            self.refreshDeletes = None
 
 KNOWN_RESPONSE_CONTROLS[SyncDoneControl.controlType] = SyncDoneControl
 
@@ -263,7 +269,7 @@ def __init__(self, encodedMessage):
         for attr in [ 'newcookie', 'refreshDelete', 'refreshPresent', 'syncIdSet']:
             comp = d[0].getComponentByName(attr)
 
-            if comp is not None:
+            if comp.hasValue():
 
                 if attr == 'newcookie':
                     self.newcookie = str(comp)
@@ -272,7 +278,7 @@ def __init__(self, encodedMessage):
                 val = dict()
 
                 cookie = comp.getComponentByName('cookie')
-                if cookie is not None:
+                if cookie.hasValue():
                     val['cookie'] = str(cookie)
 
                 if attr.startswith('refresh'):

From 5bb74dbb9dd173d7a9620897c07a8d50bddc89d6 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 11 Nov 2017 23:39:13 +0000
Subject: [PATCH 461/868] announce pyasn1* modules as Installation
 prerequisites, do not index C lib names

---
 Doc/installing.rst | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 116ba6f..bcc41be 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -15,8 +15,8 @@ use the same one you plan to use python-ldap with.
 
 See further instructions for using DistUtils here: https://docs.python.org/2.7/install/index.html
 
-Prerequisites
-=============
+Build prerequisites
+===================
 
 The following software packages are required to be installed
 on the local system when building python-ldap:
@@ -28,11 +28,18 @@ on the local system when building python-ldap:
 - cyrus-sasl (optional): https://www.cyrusimap.org/sasl/
 - Kerberos libs, MIT or heimdal (optional)
 
-Furthermore some sub-modules of :py:mod:`ldap.controls` and :py:mod:`ldap.extop`
-require :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed.
+Installation prerequisites
+==========================
+
+Furthermore it is required that modules
+:py:mod:`pyasn1` and :py:mod:`pyasn1_modules`
+are installed.
 
   https://github.com/etingof/pyasn1
 
+  https://pypi.python.org/pypi/pyasn1
+
+  https://pypi.python.org/pypi/pyasn1-modules
 
 setup.cfg
 =========
@@ -66,25 +73,25 @@ documentation of Python's DistUtils.
 Libs used
 ---------
 
-.. data:: ldap
-.. data:: ldap_r
+.. data:noindex: ldap
+.. data:noindex: ldap_r
 
    The LDAP protocol library of OpenLDAP. ldap_r is the reentrant version
    and should be preferred.
 
-.. data:: lber
+.. data:noindex: lber
 
    The BER encoder/decoder library of OpenLDAP.
 
-.. data:: sasl2
+.. data:noindex: sasl2
 
    The Cyrus-SASL library if needed and present during build
 
-.. data:: ssl
+.. data:noindex: ssl
 
    The SSL/TLS library of OpenSSL if needed and present during build
 
-.. data:: crypto
+.. data:noindex: crypto
 
    The basic cryptographic library of OpenSSL if needed and present during build
 

From 2ffd389aaa2fed3430eb935368f90fef7443f5a7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 10:35:57 +0000
Subject: [PATCH 462/868] bumped Doc/ version to 2.5

---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index c52b01d..4e603c4 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -40,9 +40,9 @@
 # other places throughout the built documents.
 #
 # The short X.Y version.
-version = '2.4'
+version = '2.5'
 # The full version, including alpha/beta/rc tags.
-release = '2.4.45.0'
+release = '2.5.0.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From c0485fb13fee2367404092ba92d6c8377f6cdbcc Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 12:57:47 +0000
Subject: [PATCH 463/868] added requirements.txt, pyasn1>=0.3.7 and
 pyasn1_modules>=0.1.5 now mandatory for python-ldap 2.5.0+

---
 CHANGES          | 4 +++-
 requirements.txt | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 requirements.txt

diff --git a/CHANGES b/CHANGES
index 960919e..53fab22 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,7 +3,9 @@ Released 2.5.0 2017-11-xx
 
 Changes since 2.4.45:
 
-This release requires pyasn1 0.3.x or newer!
+This release now strictly requires
+pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
+as installation prerequisites.
 
 Lib/
 * slapdtest.SlapdObject.restart() just restarts slapd
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..465a037
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,3 @@
+pyasn1>=0.3.7
+pyasn1_modules>=0.1.5
+

From 5913883c3b9b43be2239d6906e64aa2dc6aa6d93 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:03:07 +0000
Subject: [PATCH 464/868] removed stand-alone module dsml

---
 Doc/index.rst     |  1 -
 Lib/ldap/async.py | 28 ----------------------------
 setup.py          |  1 -
 3 files changed, 30 deletions(-)

diff --git a/Doc/index.rst b/Doc/index.rst
index b93e9c1..14992a6 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -31,7 +31,6 @@ Contents
    ldap-sasl.rst
    ldif.rst
    ldapurl.rst
-   dsml.rst
    slapdtest.rst
 
 
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 2cbb488..81824e4 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -285,31 +285,3 @@ def _processSingleResult(self,resultType,resultItem):
       # Search continuations are ignored
       dn,entry = resultItem
       self._ldif_writer.unparse(dn,entry)
-
-
-class DSMLWriter(FileWriter):
-  """
-  Class for writing a stream LDAP search results to a DSML file
-
-  Arguments:
-
-  l
-    LDAPObject instance
-  writer_obj
-    Either a file-like object or a dsml.DSMLWriter instance used for output
-  """
-
-  def __init__(self,l,writer_obj,headerStr='',footerStr=''):
-    import dsml
-    if isinstance(writer_obj,dsml.DSMLWriter):
-      self._dsml_writer = writer_obj
-    else:
-      self._dsml_writer = dsml.DSMLWriter(writer_obj)
-    FileWriter.__init__(self,l,self._dsml_writer._output_file,headerStr,footerStr)
-
-  def _processSingleResult(self,resultType,resultItem):
-    if _entryResultTypes.has_key(resultType):
-      # Search continuations are ignored
-      dn,entry = resultItem
-      self._dsml_writer.unparse(dn,entry)
-
diff --git a/setup.py b/setup.py
index 7318c41..b75b7d1 100644
--- a/setup.py
+++ b/setup.py
@@ -145,7 +145,6 @@ class OpenLDAP2:
   py_modules = [
     'ldapurl',
     'ldif',
-    'dsml',
     'ldap',
     'slapdtest',
     'ldap.async',

From 9de7162d78b488820a9bcffa8b5747437c3865e4 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:20:23 +0000
Subject: [PATCH 465/868] module dsml was removed => docs obsolete

---
 Doc/dsml.rst | 26 --------------------------
 1 file changed, 26 deletions(-)
 delete mode 100644 Doc/dsml.rst

diff --git a/Doc/dsml.rst b/Doc/dsml.rst
deleted file mode 100644
index 8b9a460..0000000
--- a/Doc/dsml.rst
+++ /dev/null
@@ -1,26 +0,0 @@
-***************************************
-:mod:`dsml` DSMLv1 parser and generator
-***************************************
-
-.. :py:module:: dsml
-   :synopsis: Parses and generates DSMLv1 files
-.. moduleauthor:: python-ldap project (see https://www.python-ldap.org/)
-
-
-This module parses and generates LDAP data in the format DSMLv1. It is
-implemented in pure Python and does not rely on any non-standard modules.
-Therefore it can be used stand-alone without the rest of the python-ldap
-package.
-
-
-.. autoclass:: dsml.DSMLWriter
-   :members:
-
-.. autoclass:: dsml.DSMLParser
-   :members:
-
-
-.. _dsml-example:
-
-Example
-=======

From b8d12d63fade159dfd3becc25929c8604976076e Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:21:06 +0000
Subject: [PATCH 466/868] remove stand-alone module dsml

---
 Lib/dsml.py | 295 ----------------------------------------------------
 1 file changed, 295 deletions(-)
 delete mode 100644 Lib/dsml.py

diff --git a/Lib/dsml.py b/Lib/dsml.py
deleted file mode 100644
index bf58c36..0000000
--- a/Lib/dsml.py
+++ /dev/null
@@ -1,295 +0,0 @@
-"""
-dsml - generate and parse DSMLv1 data
-(see http://www.oasis-open.org/committees/dsml/)
-
-See https://www.python-ldap.org/ for details.
-
-Python compability note:
-Tested with Python 2.0+.
-"""
-
-__version__ = '2.5.0'
-
-import string,base64
-
-
-special_entities = (
-  ('&','&amp;'),
-  ('<','&lt;'),
-  ('"','&quot;'),
-  ("'",'&apos;'),
-)
-
-
-def replace_char(s):
-  for char,entity in special_entities:
-    s = string.replace(s,char,entity)
-  return s
-
-
-class DSMLWriter:
-  """
-  Class for writing LDAP entry records to a DSMLv1 file.
-
-  Arguments:
-
-  f
-      File object for output.
-  base64_attrs
-      Attribute types to be base64-encoded.
-  dsml_comment
-      Text placed in comment lines behind <dsml:dsml>.
-  indent
-      String used for indentiation of next nested level.
-  """
-
-  def __init__(
-    self,f,base64_attrs=[],dsml_comment='',indent='    '
-  ):
-    self._output_file = f
-    self._base64_attrs = {}.fromkeys(map(string.lower,base64_attrs))
-    self._dsml_comment = dsml_comment
-    self._indent = indent
-
-  def _needs_base64_encoding(self,attr_type,attr_value):
-    if self._base64_attrs:
-      return self._base64_attrs.has_key(string.lower(attr_type))
-    else:
-      try:
-        unicode(attr_value,'utf-8')
-      except UnicodeError:
-        return 1
-      else:
-        return 0
-
-  def writeHeader(self):
-    """
-    Write the header
-    """
-    self._output_file.write('\n'.join([
-        '<?xml version="1.0" encoding="UTF-8"?>',
-        '<!DOCTYPE root PUBLIC "dsml.dtd" "http://www.dsml.org/1.0/dsml.dtd">',
-        '<dsml:dsml xmlns:dsml="http://www.dsml.org/DSML">',
-        '%s<dsml:directory-entries>\n' % (self._indent),
-      ])
-    )
-    if self._dsml_comment:
-      self._output_file.write('%s<!--\n' % (self._indent))
-      self._output_file.write('%s%s\n' % (self._indent,self._dsml_comment))
-      self._output_file.write('%s-->\n' % (self._indent))
-
-  def writeFooter(self):
-    """
-    Write the footer
-    """
-    self._output_file.write('%s</dsml:directory-entries>\n' % (self._indent))
-    self._output_file.write('</dsml:dsml>\n')
-
-  def unparse(self,dn,entry):
-    return self.writeRecord(dn,entry)
-
-  def writeRecord(self,dn,entry):
-    """
-    dn
-          string-representation of distinguished name
-    entry
-          dictionary holding the LDAP entry {attr:data}
-    """
-
-    # Write line dn: first
-    self._output_file.write(
-      '%s<dsml:entry dn="%s">\n' % (
-        self._indent*2,replace_char(dn)
-      )
-    )
-
-    objectclasses = entry.get('objectclass',entry.get('objectClass',[]))
-
-    self._output_file.write('%s<dsml:objectclass>\n' % (self._indent*3))
-    for oc in objectclasses:
-      self._output_file.write('%s<dsml:oc-value>%s</dsml:oc-value>\n' % (self._indent*4,oc))
-    self._output_file.write('%s</dsml:objectclass>\n' % (self._indent*3))
-
-    attr_types = entry.keys()[:]
-    try:
-      attr_types.remove('objectclass')
-      attr_types.remove('objectClass')
-    except ValueError:
-      pass
-    attr_types.sort()
-    for attr_type in attr_types:
-      self._output_file.write('%s<dsml:attr name="%s">\n' % (self._indent*3,attr_type))
-      for attr_value_item in entry[attr_type]:
-        needs_base64_encoding = self._needs_base64_encoding(
-          attr_type,attr_value_item
-        )
-        if needs_base64_encoding:
-          attr_value_item = base64.encodestring(attr_value_item)
-        else:
-          attr_value_item = replace_char(attr_value_item)
-        self._output_file.write('%s<dsml:value%s>\n' % (
-            self._indent*4,
-            ' encoding="base64"'*needs_base64_encoding
-          )
-        )
-        self._output_file.write('%s%s\n' % (
-            self._indent*5,
-            attr_value_item
-          )
-        )
-        self._output_file.write('%s</dsml:value>\n' % (
-            self._indent*4,
-          )
-        )
-      self._output_file.write('%s</dsml:attr>\n' % (self._indent*3))
-    self._output_file.write('%s</dsml:entry>\n' % (self._indent*2))
-    return
-
-
-try:
-
-  import xml.sax,xml.sax.handler
-
-except ImportError:
-  pass
-
-else:
-
-  class DSMLv1Handler(xml.sax.handler.ContentHandler):
-    """
-    Content handler class for DSMLv1
-    """
-
-    def __init__(self,parser_instance):
-      self._parser_instance = parser_instance
-      xml.sax.handler.ContentHandler.__init__(self)
-
-    def startDocument(self):
-      pass
-
-    def endDocument(self):
-      pass
-
-    def startElement(self,raw_name,attrs):
-      assert raw_name.startswith(''),'Illegal name'
-      name = raw_name[5:]
-      if name=='dsml':
-        pass
-      elif name=='directory-entries':
-        self._parsing_entries = 1
-      elif name=='entry':
-        self._dn = attrs['dn']
-        self._entry = {}
-      elif name=='attr':
-        self._attr_type = attrs['name'].encode('utf-8')
-        self._attr_values = []
-      elif name=='value':
-        self._attr_value = ''
-        self._base64_encoding = attrs.get('encoding','').lower()=='base64'
-      # Handle object class tags
-      elif name=='objectclass':
-        self._object_classes = []
-      elif name=='oc-value':
-        self._oc_value = ''
-      # Unhandled tags
-      else:
-        raise ValueError,'Unknown tag %s' % (raw_name)
-
-    def endElement(self,raw_name):
-      assert raw_name.startswith('dsml:'),'Illegal name'
-      name = raw_name[5:]
-      if name=='dsml':
-        pass
-      elif name=='directory-entries':
-        self._parsing_entries = 0
-      elif name=='entry':
-        self._parser_instance.handle(self._dn,self._entry)
-        del self._dn
-        del self._entry
-      elif name=='attr':
-        self._entry[self._attr_type] = self._attr_values
-        del self._attr_type
-        del self._attr_values
-      elif name=='value':
-        if self._base64_encoding:
-          attr_value = base64.decodestring(self._attr_value.strip())
-        else:
-          attr_value = self._attr_value.strip().encode('utf-8')
-        self._attr_values.append(attr_value)
-        del attr_value
-        del self._attr_value
-        del self._base64_encoding
-      # Handle object class tags
-      elif name=='objectclass':
-        self._entry['objectClass'] = self._object_classes
-        del self._object_classes
-      elif name=='oc-value':
-        self._object_classes.append(self._oc_value.strip().encode('utf-8'))
-        del self._oc_value
-      # Unhandled tags
-      else:
-        raise ValueError,'Unknown tag %s' % (raw_name)
-
-    def characters(self,ch):
-      if self.__dict__.has_key('_oc_value'):
-        self._oc_value = self._oc_value + ch
-      elif self.__dict__.has_key('_attr_value'):
-        self._attr_value = self._attr_value + ch
-      else:
-        pass
-
-
-  class DSMLParser:
-    """
-    Base class for a DSMLv1 parser. Applications should sub-class this
-    class and override method handle() to implement something meaningful.
-
-    Public class attributes:
-
-    records_read
-        Counter for records processed so far
-
-    Arguments:
-
-    input_file
-        File-object to read the DSMLv1 input from
-    ignored_attr_types
-        Attributes with these attribute type names will be ignored.
-    max_entries
-        If non-zero specifies the maximum number of entries to be
-        read from f.
-    line_sep
-        String used as line separator
-    """
-
-    def __init__(
-      self,
-      input_file,
-      ContentHandlerClass,
-      ignored_attr_types=None,
-      max_entries=0,
-    ):
-      self._input_file = input_file
-      self._max_entries = max_entries
-      self._ignored_attr_types = {}.fromkeys(map(string.lower,(ignored_attr_types or [])))
-      self._current_record = None,None
-      self.records_read = 0
-      self._parser = xml.sax.make_parser()
-      self._parser.setFeature(xml.sax.handler.feature_namespaces,0)
-      content_handler = ContentHandlerClass(self)
-      self._parser.setContentHandler(content_handler)
-
-    def handle(self,*args,**kwargs):
-      """
-      Process a single DSMLv1 entry record. This method should be
-      implemented by applications using DSMLParser.
-      """
-      import pprint
-      pprint.pprint(args)
-      pprint.pprint(kwargs)
-
-    def parse(self):
-      """
-      Continously read and parse DSML records
-      """
-      self._parser.parse(self._input_file)

From a90c0374667ba9611fd9461165370e2e853531a7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:23:35 +0000
Subject: [PATCH 467/868] there will never be DSMLv2 support

---
 TODO | 1 -
 1 file changed, 1 deletion(-)

diff --git a/TODO b/TODO
index 456cfea..b728424 100644
--- a/TODO
+++ b/TODO
@@ -20,7 +20,6 @@ Lib/
 (Everybody asking for the latter should check the mailing list archive first.)
 - Caching of search requests for each LDAPObject instance
 - LDIF parser for replication logs and change records
-- DSMLv2 support
 
 Tests/
 - Clean up and finish the mess of small test scripts started.

From c4a612aa035089b05295e75eeaed8f7a1132d87b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:24:17 +0000
Subject: [PATCH 468/868] class ldap.async.DSMLWriter removed too

---
 Doc/ldap-async.rst | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/Doc/ldap-async.rst b/Doc/ldap-async.rst
index d1c8087..59a34f4 100644
--- a/Doc/ldap-async.rst
+++ b/Doc/ldap-async.rst
@@ -27,9 +27,6 @@ Classes
 .. autoclass:: ldap.async.LDIFWriter
    :members:
 
-.. autoclass:: ldap.async.DSMLWriter
-   :members:
-
 .. _ldap.async-example:
 
 Examples

From 7f76d8c45b3331e8536ab3c3768eef73a701bc23 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:24:51 +0000
Subject: [PATCH 469/868] removed stand-alone module dsml

---
 CHANGES | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGES b/CHANGES
index 53fab22..f43da52 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
 as installation prerequisites.
 
 Lib/
+* removed stand-alone module dsml
 * slapdtest.SlapdObject.restart() just restarts slapd
   without cleaning any data
 * Compability changes for pyasn1 0.3.x or newer

From 26c44435c85de3b281f90eeee1d9e6c6b54f4258 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:29:00 +0000
Subject: [PATCH 470/868] removed unused code schema.c

---
 CHANGES | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGES b/CHANGES
index f43da52..708a7e4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,9 @@ This release now strictly requires
 pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
 as installation prerequisites.
 
+Modules/
+* removed unused code schema.c
+
 Lib/
 * removed stand-alone module dsml
 * slapdtest.SlapdObject.restart() just restarts slapd

From af29cbaa18707298e49b2b4c1240f7ee7382ed16 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:40:31 +0000
Subject: [PATCH 471/868] removed unused code schema.c

---
 setup.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup.py b/setup.py
index b75b7d1..9e625ff 100644
--- a/setup.py
+++ b/setup.py
@@ -120,7 +120,6 @@ class OpenLDAP2:
         'Modules/constants.c',
         'Modules/errors.c',
         'Modules/functions.c',
-        'Modules/schema.c',
         'Modules/ldapmodule.c',
         'Modules/message.c',
         'Modules/version.c',

From 47bbbcf6ef2be92438d89eddd32014ced511a296 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:44:49 +0000
Subject: [PATCH 472/868] removed schema.h and LDAPinit_schema

---
 Modules/ldapmodule.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 7d8ed2f..25ea3fe 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -39,7 +39,6 @@ init_ldap()
 	LDAPinit_constants(d);
 	LDAPinit_errors(d);
 	LDAPinit_functions(d);
-	LDAPinit_schema(d);
 	LDAPinit_control(d);
 
 	/* Check for errors */

From 03e5e7a133f77f19a480df29ae92c19d3efae2b9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:45:12 +0000
Subject: [PATCH 473/868] removed schema.h and LDAPinit_schema

---
 Modules/ldapmodule.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 25ea3fe..a570220 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -5,7 +5,6 @@
 #include "constants.h"
 #include "errors.h"
 #include "functions.h"
-#include "schema.h"
 #include "ldapcontrol.h"
 
 #include "LDAPObject.h"

From c0a269f60f5612dc8245a396068ff0dc949dcf3d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 13:46:13 +0000
Subject: [PATCH 474/868] added distclean.sh

---
 distclean.sh | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100755 distclean.sh

diff --git a/distclean.sh b/distclean.sh
new file mode 100755
index 0000000..2585116
--- /dev/null
+++ b/distclean.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+python setup.py clean
+rm -r MANIFEST dist/* build/* Lib/*.egg-info .tox 
+rm Lib/_ldap.so Lib/*.py? Lib/ldap/*.py? Lib/ldap/*/*.py? Tests/*.py? *.py?

From e01cd1686f54e5534fa8e90cb383bca4a08204d5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 14:08:13 +0000
Subject: [PATCH 475/868] ldap.__version__, ldap.__author__ and
 ldap.__license__ now imported from new sub-module ldap.pkginfo also to
 setup.py

---
 CHANGES              |  2 ++
 Lib/ldap/__init__.py |  2 +-
 Lib/ldap/pkginfo.py  |  7 +++++++
 setup.py             | 24 ++++++------------------
 4 files changed, 16 insertions(+), 19 deletions(-)
 create mode 100644 Lib/ldap/pkginfo.py

diff --git a/CHANGES b/CHANGES
index 708a7e4..dbdc048 100644
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,8 @@ Modules/
 * removed unused code schema.c
 
 Lib/
+* ldap.__version__, ldap.__author__ and ldap.__license__ now
+  imported from new sub-module ldap.pkginfo also to setup.py
 * removed stand-alone module dsml
 * slapdtest.SlapdObject.restart() just restarts slapd
   without cleaning any data
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index af83b6c..e679de5 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -6,7 +6,7 @@
 
 # This is also the overall release version number
 
-__version__ = '2.5.0'
+from pkginfo import __version__, __author__, __license__
 
 import sys
 
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
new file mode 100644
index 0000000..6218b9d
--- /dev/null
+++ b/Lib/ldap/pkginfo.py
@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+"""
+meta attributes for packaging which does not import any dependencies
+"""
+__version__ = '2.5.0'
+__author__ = u'python-ldap project'
+__license__ = 'Python style'
diff --git a/setup.py b/setup.py
index 9e625ff..329de0c 100644
--- a/setup.py
+++ b/setup.py
@@ -14,20 +14,8 @@
 from ConfigParser import ConfigParser
 import sys,os,string,time
 
-##################################################################
-# Weird Hack to grab release version of python-ldap from local dir
-##################################################################
-exec_startdir = os.path.dirname(os.path.abspath(sys.argv[0]))
-package_init_file_name = reduce(os.path.join,[exec_startdir,'Lib','ldap','__init__.py'])
-f = open(package_init_file_name,'r')
-s = f.readline()
-while s:
-  s = string.strip(s)
-  if s[0:11]=='__version__':
-    version = eval(string.split(s,'=')[1])
-    break
-  s = f.readline()
-f.close()
+sys.path.insert(0, os.path.join(os.getcwd(), 'Lib/ldap'))
+import pkginfo
 
 #-- A class describing the features and requirements of OpenLDAP 2.0
 class OpenLDAP2:
@@ -78,7 +66,8 @@ class OpenLDAP2:
 setup(
   #-- Package description
   name = name,
-  version = version,
+  license=pkginfo.__license__,
+  version=pkginfo.__version__,
   description = 'Python modules for implementing LDAP clients',
   long_description = """python-ldap:
   python-ldap provides an object-oriented API to access LDAP directory servers
@@ -87,7 +76,7 @@ class OpenLDAP2:
   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations
   and controls, etc.). 
   """,
-  author = 'python-ldap project',
+  author = pkginfo.__author__,
   author_email = 'python-ldap@python.org',
   url = 'https://www.python-ldap.org/',
   download_url = 'https://pypi.python.org/pypi/python-ldap/',
@@ -108,7 +97,6 @@ class OpenLDAP2:
     'Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP',
     'License :: OSI Approved :: Python Software Foundation License',
   ],
-  license = 'Python style',
   #-- C extension modules
   ext_modules = [
     Extension(
@@ -137,7 +125,7 @@ class OpenLDAP2:
         ('ldap_r' in LDAP_CLASS.libs or 'oldap_r' in LDAP_CLASS.libs)*[('HAVE_LIBLDAP_R',None)] + \
         ('sasl' in LDAP_CLASS.libs or 'sasl2' in LDAP_CLASS.libs or 'libsasl' in LDAP_CLASS.libs)*[('HAVE_SASL',None)] + \
         ('ssl' in LDAP_CLASS.libs and 'crypto' in LDAP_CLASS.libs)*[('HAVE_TLS',None)] + \
-        [('LDAPMODULE_VERSION', version)]
+        [('LDAPMODULE_VERSION', pkginfo.__version__)]
     ),
   ],
   #-- Python "stand alone" modules

From c9390f8e30b00fc91034fae741135cca8d36a837 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 14:11:41 +0000
Subject: [PATCH 476/868] removed schema.c and schema.h

---
 Modules/schema.c | 282 -----------------------------------------------
 Modules/schema.h |  13 ---
 2 files changed, 295 deletions(-)
 delete mode 100644 Modules/schema.c
 delete mode 100644 Modules/schema.h

diff --git a/Modules/schema.c b/Modules/schema.c
deleted file mode 100644
index fb38b0a..0000000
--- a/Modules/schema.c
+++ /dev/null
@@ -1,282 +0,0 @@
-/* See https://www.python-ldap.org/ for details. */
-
-#include "common.h"
-
-#include "schema.h"
-#include "ldap_schema.h"
-
-/* 
-   This utility function takes a null delimited C array of (null
-   delimited) C strings, creates its python equivalent and returns a
-   new reference to it. If the array is empty or the pointer to it is
-   NULL, an empty python array is returned. 
-*/
-PyObject* c_string_array_to_python(char **string_array)
-{
-  Py_ssize_t count = 0;
-  char **s;
-  PyObject *py_list;
-  if (string_array) {
-    for (s=string_array; *s != 0; s++) count++;
-    py_list = PyList_New(count);
-    count = 0;
-    for (s=string_array; *s != 0; s++){
-      PyList_SetItem(py_list, count, PyString_FromString(*s));
-      count++;
-    }
-  } else py_list=PyList_New(0);
-  return py_list;
-}
-
-
-/*
-  This function returns a list of tuples. The first entry of each
-  tuple is a string (lsei_name), and the second is a lists built from
-  lsei_values.
-
-  Probably the C data structure is modeled along the lines of a
-  mapping "lsei_name -> (list of lsei_values)". However, there seems
-  to be no guarantee that a lsei_name is unique, so I dare not use a
-  python mapping for this beast...
- */
-PyObject* schema_extension_to_python(LDAPSchemaExtensionItem **extensions)
-{
-  Py_ssize_t count = 0;
-  LDAPSchemaExtensionItem **e;
-  PyObject *py_list, *item_tuple;
-  if (extensions) {
-    for (e = extensions; *e !=0; e++) count++;
-    py_list = PyList_New(count);
-    count = 0;
-    for (e = extensions; *e !=0; e++) {
-      item_tuple = PyTuple_New(2);
-      PyTuple_SetItem(item_tuple, 0, 
-		      PyString_FromString((*e)->lsei_name));
-      PyTuple_SetItem(item_tuple, 1, 
-		      c_string_array_to_python((*e)->lsei_values));
-      PyList_SetItem(py_list, count, item_tuple);
-      count++;
-      }
-    }
-  else py_list=PyList_New(0);
-  return py_list;
-}
-
-
-/*
-  The following four functions do the boring job: they take a python
-  string, feed it into the respective parser functions provided by
-  openldap, and build a python list from the data structure returned
-  by the C function.
- */
-
-static char doc_ldap_str2objectclass[] = 
-"";
-
-static PyObject*
-l_ldap_str2objectclass(PyObject* self, PyObject *args)
-{
-  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
-  char *oc_string;
-  const char *errp;
-  LDAPObjectClass *o;
-  PyObject *oc_names, *oc_sup_oids, *oc_at_oids_must, 
-    *oc_at_oids_may, *py_ret;
- 
-
-  if (!PyArg_ParseTuple(args, "si", &oc_string, &flag))
-	return NULL;
-  o = ldap_str2objectclass( oc_string, &ret, &errp, flag);
-  if (ret) {
-    py_ret = PyInt_FromLong(ret);
-    return py_ret;
-  }
-
-  oc_sup_oids     = c_string_array_to_python(o->oc_sup_oids);
-  oc_names        = c_string_array_to_python(o->oc_names);
-  oc_at_oids_must = c_string_array_to_python(o->oc_at_oids_must);
-  oc_at_oids_may  = c_string_array_to_python(o->oc_at_oids_may);
-  py_ret = PyList_New(9);
-  PyList_SetItem(py_ret, 0, PyString_FromString(o->oc_oid));
-  PyList_SetItem(py_ret, 1, oc_names);
-  if (o->oc_desc) {
-    PyList_SetItem(py_ret, 2, PyString_FromString(o->oc_desc)); 
-  } else {
-    PyList_SetItem(py_ret, 2, PyString_FromString(""));
-  }
-  PyList_SetItem(py_ret, 3, PyInt_FromLong(o->oc_obsolete));
-  PyList_SetItem(py_ret, 4, oc_sup_oids);
-  PyList_SetItem(py_ret, 5, PyInt_FromLong(o->oc_kind));
-  PyList_SetItem(py_ret, 6, oc_at_oids_must);
-  PyList_SetItem(py_ret, 7, oc_at_oids_may);
-
-  PyList_SetItem(py_ret, 8, 
-		 schema_extension_to_python(o->oc_extensions));
-
-  ldap_objectclass_free(o);
-  return py_ret;
-}
-
-
-static char doc_ldap_str2attributetype[] = 
-"";
-
-static PyObject*
-l_ldap_str2attributetype(PyObject* self, PyObject *args)
-{
-  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
-  char *at_string;
-  const char *errp;
-  LDAPAttributeType *a;
-  PyObject *py_ret;
-  PyObject *at_names;
-  
-  if (!PyArg_ParseTuple(args, "si", &at_string,&flag))
-    return NULL;
-  a = ldap_str2attributetype( at_string, &ret, &errp, flag);
-  if (ret) {
-    py_ret = PyInt_FromLong(ret);
-    return py_ret;
-  }
-  
-  py_ret = PyList_New(15);
-  PyList_SetItem(py_ret, 0, PyString_FromString(a->at_oid));
-  at_names = c_string_array_to_python(a->at_names);
-  PyList_SetItem(py_ret, 1, at_names);
-  if (a->at_desc) {
-    PyList_SetItem(py_ret, 2, PyString_FromString(a->at_desc)); 
-  } else {
-    PyList_SetItem(py_ret, 2, PyString_FromString(""));
-  }
-  PyList_SetItem(py_ret, 3, PyInt_FromLong(a->at_obsolete));
-  if (a->at_sup_oid) {
-    PyList_SetItem(py_ret, 4, PyString_FromString(a->at_sup_oid)); 
-  } else {
-    PyList_SetItem(py_ret, 4, PyString_FromString(""));
-  }
-  if (a->at_equality_oid) {
-    PyList_SetItem(py_ret, 5, PyString_FromString(a->at_equality_oid)); 
-  } else {
-    PyList_SetItem(py_ret, 5, PyString_FromString(""));
-  }
-  if (a->at_ordering_oid) {
-    PyList_SetItem(py_ret, 6, PyString_FromString(a->at_ordering_oid)); 
-  } else {
-    PyList_SetItem(py_ret, 6, PyString_FromString(""));
-  }
-  if (a->at_substr_oid) {
-    PyList_SetItem(py_ret, 7, PyString_FromString(a->at_substr_oid)); 
-  } else {
-    PyList_SetItem(py_ret, 7, PyString_FromString(""));
-  }
-  if (a->at_syntax_oid) {
-    PyList_SetItem(py_ret, 8, PyString_FromString(a->at_syntax_oid)); 
-  } else {
-    PyList_SetItem(py_ret, 8, PyString_FromString(""));
-  }
-  PyList_SetItem(py_ret, 9, PyInt_FromLong(a->at_syntax_len));
-  PyList_SetItem(py_ret,10, PyInt_FromLong(a->at_single_value));
-  PyList_SetItem(py_ret,11, PyInt_FromLong(a->at_collective));
-  PyList_SetItem(py_ret,12, PyInt_FromLong(a->at_no_user_mod));
-  PyList_SetItem(py_ret,13, PyInt_FromLong(a->at_usage));
-  
-  PyList_SetItem(py_ret, 14, 
-		 schema_extension_to_python(a->at_extensions));
-  ldap_attributetype_free(a);
-  return py_ret;
-}
-
-static char doc_ldap_str2syntax[] = 
-"";
-
-
-static PyObject*
-l_ldap_str2syntax(PyObject* self, PyObject *args)
-{
-  LDAPSyntax *s;
-  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
-  const char *errp;
-  char *syn_string;
-  PyObject *py_ret, *syn_names;
-  
-  if (!PyArg_ParseTuple(args, "si", &syn_string,&flag))
-    return NULL;
-  s = ldap_str2syntax(syn_string, &ret, &errp, flag);
-  if (ret) {
-    py_ret = PyInt_FromLong(ret);
-    return py_ret;
-  }
-  py_ret = PyList_New(4);
-  PyList_SetItem(py_ret, 0, PyString_FromString(s->syn_oid));
-  syn_names = c_string_array_to_python(s->syn_names);
-  PyList_SetItem(py_ret, 1, syn_names);
-  if (s->syn_desc) {
-    PyList_SetItem(py_ret, 2, PyString_FromString(s->syn_desc)); 
-  } else {
-    PyList_SetItem(py_ret, 2, PyString_FromString(""));
-  }
-  PyList_SetItem(py_ret, 3, 
-		 schema_extension_to_python(s->syn_extensions));
-  ldap_syntax_free(s);
-  return py_ret;
-}
-
-static char doc_ldap_str2matchingrule[] = 
-"";
-
-static PyObject*
-l_ldap_str2matchingrule(PyObject* self, PyObject *args)
-{
-  LDAPMatchingRule *m;
-  int ret=0, flag = LDAP_SCHEMA_ALLOW_NONE;
-  const char *errp;
-  char *mr_string;
-  PyObject *py_ret, *mr_names;
-  
-  if (!PyArg_ParseTuple(args, "si", &mr_string,&flag))
-    return NULL;
-  m = ldap_str2matchingrule(mr_string, &ret, &errp, flag);
-  if (ret) {
-    py_ret = PyInt_FromLong(ret);
-    return py_ret;
-  }
-  py_ret = PyList_New(6);
-  PyList_SetItem(py_ret, 0, PyString_FromString(m->mr_oid));
-  mr_names = c_string_array_to_python(m->mr_names);
-  PyList_SetItem(py_ret, 1, mr_names);
-  if (m->mr_desc) {
-    PyList_SetItem(py_ret, 2, PyString_FromString(m->mr_desc)); 
-  } else {
-    PyList_SetItem(py_ret, 2, PyString_FromString(""));
-  }
-  PyList_SetItem(py_ret, 3, PyInt_FromLong(m->mr_obsolete));
-  if (m->mr_syntax_oid) {
-    PyList_SetItem(py_ret, 4, PyString_FromString(m->mr_syntax_oid)); 
-  } else {
-    PyList_SetItem(py_ret, 4, PyString_FromString(""));
-  }  
-  PyList_SetItem(py_ret, 5, 
-		 schema_extension_to_python(m->mr_extensions));
-  ldap_matchingrule_free(m);
-  return py_ret;
-}
-
-/* methods */
-
-static PyMethodDef methods[] = {
-    { "str2objectclass", (PyCFunction)l_ldap_str2objectclass,	METH_VARARGS,
-    	doc_ldap_str2objectclass },
-    { "str2attributetype", (PyCFunction)l_ldap_str2attributetype,	
-      METH_VARARGS, doc_ldap_str2attributetype },
-    { "str2syntax", (PyCFunction)l_ldap_str2syntax, 
-      METH_VARARGS, doc_ldap_str2syntax },
-    { "str2matchingrule", (PyCFunction)l_ldap_str2matchingrule, 
-      METH_VARARGS, doc_ldap_str2matchingrule },
-    { NULL, NULL }
-};
-
-
-void
-LDAPinit_schema( PyObject* d ) {
-    LDAPadd_methods( d, methods );
-}
diff --git a/Modules/schema.h b/Modules/schema.h
deleted file mode 100644
index eee00a3..0000000
--- a/Modules/schema.h
+++ /dev/null
@@ -1,13 +0,0 @@
-/* See https://www.python-ldap.org/ for details. */
-
-#ifndef __h_schema_
-#define __h_schema_
-
-
-
-#include "common.h"
-extern void LDAPinit_schema( PyObject* );
-
-
-#endif /* __h_schema_ */
-

From 79cc6976ba2c0cea598da5b27663c9eb1330a42b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 14:21:14 +0000
Subject: [PATCH 477/868] For 2.5.x mandatory prerequisites are: Python 2.7.x,
 pyasn1 0.3.7+ and pyasn1_modules 0.1.5+

---
 CHANGES | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index dbdc048..ed9eb14 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,9 +3,9 @@ Released 2.5.0 2017-11-xx
 
 Changes since 2.4.45:
 
-This release now strictly requires
-pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
-as installation prerequisites.
+Mandatory prerequisites:
+- Python 2.7.x
+- pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
 
 Modules/
 * removed unused code schema.c

From 0f8e8ba00c4e003324271bfe6cf293315f54b1ee Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 15:47:48 +0000
Subject: [PATCH 478/868] corrected Test02_ReconnectLDAPObject.__doc__

---
 Tests/t_ldapobject.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index b783677..e03ca1e 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -191,7 +191,7 @@ def test_sasl_extenal_bind_s(self):
 
 class Test02_ReconnectLDAPObject(Test01_SimpleLDAPObject):
     """
-    test LDAP search operations
+    test ReconnectLDAPObject by restarting slapd
     """
 
     ldap_object_class = ReconnectLDAPObject

From 072f5cf1e184551425ab96c781d1c6af72c63bd3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 16:30:27 +0000
Subject: [PATCH 479/868] Added safety assertion when importing _ldap:
 ldap.pkginfo.__version__ must match _ldap.__version__

---
 CHANGES                       |  2 ++
 Lib/ldap/__init__.py          |  4 ++++
 Lib/ldap/controls/__init__.py | 21 +++++++++++++--------
 Lib/ldap/controls/libldap.py  |  9 ++++++++-
 Lib/ldap/dn.py                |  5 +++--
 5 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index ed9eb14..b64b782 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,8 @@ Modules/
 Lib/
 * ldap.__version__, ldap.__author__ and ldap.__license__ now
   imported from new sub-module ldap.pkginfo also to setup.py
+* Added safety assertion when importing _ldap:
+  ldap.pkginfo.__version__ must match _ldap.__version__
 * removed stand-alone module dsml
 * slapdtest.SlapdObject.restart() just restarts slapd
   without cleaning any data
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index e679de5..c1c5ef1 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -17,7 +17,11 @@
   _trace_file = sys.stderr
   _trace_stack_limit = None
 
+from ldap.pkginfo import __version__
+
 import _ldap
+assert _ldap.__version__==__version__, \
+       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
 from _ldap import *
 
 OPT_NAMES_DICT = {}
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index d504d49..56d611b 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -9,7 +9,19 @@
 Each class provides support for a certain control.
 """
 
-from ldap import __version__
+from ldap.pkginfo import __version__
+
+import _ldap
+assert _ldap.__version__==__version__, \
+       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
+
+import ldap
+
+try:
+  from pyasn1.error import PyAsn1Error
+except ImportError:
+  PyAsn1Error = None
+
 
 __all__ = [
   'KNOWN_RESPONSE_CONTROLS',
@@ -32,13 +44,6 @@
 # response control OID to class registry
 KNOWN_RESPONSE_CONTROLS = {}
 
-import _ldap,ldap
-
-try:
-  from pyasn1.error import PyAsn1Error
-except ImportError:
-  PyAsn1Error = None
-
 
 class RequestControl:
   """
diff --git a/Lib/ldap/controls/libldap.py b/Lib/ldap/controls/libldap.py
index 53a02a4..f6ea42c 100644
--- a/Lib/ldap/controls/libldap.py
+++ b/Lib/ldap/controls/libldap.py
@@ -6,7 +6,14 @@
 See https://www.python-ldap.org/ for details.
 """
 
-import _ldap,ldap
+from ldap.pkginfo import __version__
+
+import _ldap
+assert _ldap.__version__==__version__, \
+       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
+
+import ldap
+
 from ldap.controls import RequestControl,LDAPControl,KNOWN_RESPONSE_CONTROLS
 
 
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 75465ed..daab8ab 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -7,10 +7,11 @@
 - Tested with Python 2.0+
 """
 
-from ldap import __version__
-
+from ldap.pkginfo import __version__
 
 import _ldap
+assert _ldap.__version__==__version__, \
+       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
 
 import ldap.functions
 

From 65e9271db26bc2e3e4ddeed91c3089f221946baa Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 17:17:48 +0000
Subject: [PATCH 480/868] * The methods SSSResponseControl.decodeControlValue()
 and   VLVResponseControl.decodeControlValue() now follow the coding  
 convention to use camel-cased ASN.1 name as class attribute name.   The old
 class names are still set for back-ward compability   but should not be used
 in new code because they might be removed   in a later release. * removed
 SSSRequestControl from ldap.controls.KNOWN_RESPONSE_CONTROLS

---
 CHANGES                  |  7 +++++++
 Lib/ldap/controls/sss.py | 19 +++++++++++--------
 Lib/ldap/controls/vlv.py | 20 +++++++++++++-------
 3 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/CHANGES b/CHANGES
index b64b782..e41032b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -20,6 +20,13 @@ Lib/
   without cleaning any data
 * Compability changes for pyasn1 0.3.x or newer
   (thanks to Ilya Etingof and Christian Heimes)
+* The methods SSSResponseControl.decodeControlValue() and
+  VLVResponseControl.decodeControlValue() now follow the coding
+  convention to use camel-cased ASN.1 name as class attribute name.
+  The old class names are still set for back-ward compability
+  but should not be used in new code because they might be removed
+  in a later release.
+* removed SSSRequestControl from ldap.controls.KNOWN_RESPONSE_CONTROLS
 
 Tests/
 * added explicit reconnect tests for ReconnectLDAPObject
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 20697fa..7899f04 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -119,14 +119,17 @@ def __init__(self,criticality=False):
     def decodeControlValue(self, encoded):
         p, rest = decoder.decode(encoded, asn1Spec=SortResultType())
         assert not rest, 'all data could not be decoded'
-        self.result = int(p.getComponentByName('sortResult'))
-        self.result_code = p.getComponentByName('sortResult').prettyOut(self.result)
-        attribute_type_error = p.getComponentByName('attributeType')
-        if attribute_type_error.hasValue():
-            self.attribute_type_error = attribute_type_error
+        sort_result = p.getComponentByName('sortResult')
+        self.sortResult = int(sort_result)
+        attribute_type = p.getComponentByName('attributeType')
+        if attribute_type.hasValue():
+            self.attributeType = attribute_type
         else:
-            self.attribute_type_error = None
+            self.attributeType = None
+        # backward compability class attributes
+        self.result = self.sortResult
+        self.attribute_type_error = self.attributeType
+        # not sure whether to keep this
+        self.result_code = sort_result.prettyPrint()
 
-
-KNOWN_RESPONSE_CONTROLS[SSSRequestControl.controlType] = SSSRequestControl
 KNOWN_RESPONSE_CONTROLS[SSSResponseControl.controlType] = SSSResponseControl
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index 980b77b..4b3d931 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -125,15 +125,21 @@ def __init__(self,criticality=False):
     def decodeControlValue(self,encoded):
         p, rest = decoder.decode(encoded, asn1Spec=VirtualListViewResponseType())
         assert not rest, 'all data could not be decoded'
-        self.target_position = int(p.getComponentByName('targetPosition'))
-        self.content_count = int(p.getComponentByName('contentCount'))
-        self.result = int(p.getComponentByName('virtualListViewResult'))
-        self.result_code = p.getComponentByName('virtualListViewResult').prettyOut(self.result)
+        self.targetPosition = int(p.getComponentByName('targetPosition'))
+        self.contentCount = int(p.getComponentByName('contentCount'))
+        virtual_list_view_result = p.getComponentByName('virtualListViewResult')
+        self.virtualListViewResult = int(virtual_list_view_result)
         context_id = p.getComponentByName('contextID')
         if context_id.hasValue():
-            self.context_id = str(context_id)
+            self.contextID = str(context_id)
         else:
-            self.context_id = None
-
+            self.contextID = None
+        # backward compability class attributes
+        self.target_position = self.targetPosition
+        self.content_count = self.contentCount
+        self.result = self.virtualListViewResult
+        self.context_id = self.contextID
+        # not sure whether to keep this
+        self.result_code = virtual_list_view_result.prettyPrint()
 
 KNOWN_RESPONSE_CONTROLS[VLVResponseControl.controlType] = VLVResponseControl

From 58e1f26ffe23f0258f6fbb6533c8a726451cfb24 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 17:31:36 +0000
Subject: [PATCH 481/868] added missing ldap.pkginfo in setup.py

---
 setup.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/setup.py b/setup.py
index 329de0c..962d763 100644
--- a/setup.py
+++ b/setup.py
@@ -155,6 +155,7 @@ class OpenLDAP2:
     'ldap.ldapobject',
     'ldap.logger',
     'ldap.modlist',
+    'ldap.pkginfo',
     'ldap.resiter',
     'ldap.sasl',
     'ldap.schema',

From 6b1063e45754baa6e24e7b2b40869f29bfb5f170 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 12 Nov 2017 17:34:22 +0000
Subject: [PATCH 482/868] prepare release 2.5.1

---
 CHANGES             | 2 +-
 Doc/conf.py         | 2 +-
 Lib/ldap/pkginfo.py | 2 +-
 Lib/ldapurl.py      | 2 +-
 Lib/ldif.py         | 2 +-
 Lib/slapdtest.py    | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGES b/CHANGES
index e41032b..b706563 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.5.0 2017-11-xx
+Released 2.5.1 2017-11-12
 
 Changes since 2.4.45:
 
diff --git a/Doc/conf.py b/Doc/conf.py
index 4e603c4..ab7c509 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -42,7 +42,7 @@
 # The short X.Y version.
 version = '2.5'
 # The full version, including alpha/beta/rc tags.
-release = '2.5.0.0'
+release = '2.5.1.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index 6218b9d..39a572b 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '2.5.0'
+__version__ = '2.5.1'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 07a6863..9b6f252 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -9,7 +9,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.5.0'
+__version__ = '2.5.1'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 2de5650..d00042c 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -7,7 +7,7 @@
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.5.0'
+__version__ = '2.5.1'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index d5e6a82..5b438ba 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -8,7 +8,7 @@
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.5.0'
+__version__ = '2.5.1'
 
 import os
 import socket

From 26c2564a6a1feb75a12a3a268013010fd8153d29 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 16 Nov 2017 16:08:57 +0000
Subject: [PATCH 483/868] started 2.5.2

---
 CHANGES             | 10 ++++++++++
 Lib/ldap/pkginfo.py |  2 +-
 Lib/ldapurl.py      |  2 +-
 Lib/ldif.py         |  2 +-
 Lib/slapdtest.py    |  2 +-
 5 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index b706563..9534aeb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,13 @@
+----------------------------------------------------------------
+Released 2.5.2 2017-11-xx
+
+Changes since 2.5.1:
+
+Lib/
+
+Tests/
+* 
+
 ----------------------------------------------------------------
 Released 2.5.1 2017-11-12
 
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index 39a572b..da891b3 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '2.5.1'
+__version__ = '2.5.2'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 9b6f252..fa072c9 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -9,7 +9,7 @@
 2. list comprehensions are used.
 """
 
-__version__ = '2.5.1'
+__version__ = '2.5.2'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index d00042c..c4ac4e8 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -7,7 +7,7 @@
 Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
-__version__ = '2.5.1'
+__version__ = '2.5.2'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 5b438ba..4381ae0 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -8,7 +8,7 @@
 This module only works with Python 2.7.x since
 """
 
-__version__ = '2.5.1'
+__version__ = '2.5.2'
 
 import os
 import socket

From 6c65d12bf870759cffb91d66544adcb6a716e208 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Thu, 16 Nov 2017 16:10:35 +0000
Subject: [PATCH 484/868] Tests/ scripts do not directly call
 SlapdTestCase.setUpClass() anymore

---
 CHANGES               | 2 +-
 Tests/t_cext.py       | 2 +-
 Tests/t_ldapobject.py | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9534aeb..32b1c7c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,7 +6,7 @@ Changes since 2.5.1:
 Lib/
 
 Tests/
-* 
+* scripts do not directly call SlapdTestCase.setUpClass() anymore
 
 ----------------------------------------------------------------
 Released 2.5.1 2017-11-12
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 6add784..e1d79d3 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -26,7 +26,7 @@ class TestLdapCExtension(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        SlapdTestCase.setUpClass()
+        super(TestLdapCExtension, cls).setUpClass()
         # add two initial objects after server was started and is still empty
         suffix_dc = cls.server.suffix.split(',')[0][3:]
         cls.server._log.debug(
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index e03ca1e..af83e46 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -65,7 +65,7 @@ class Test01_SimpleLDAPObject(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        SlapdTestCase.setUpClass()
+        super(Test01_SimpleLDAPObject, cls).setUpClass()
         # insert some Foo* objects via ldapadd
         cls.server.ldapadd(
             LDIF_TEMPLATE % {

From 20ca4e8bce043e138594af51b6210b226bdfdbb5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 12:09:56 +0000
Subject: [PATCH 485/868] only use _ldap when setting LIBLDAP_API_INFO

---
 Lib/ldap/__init__.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index c1c5ef1..c8a1b12 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -23,6 +23,8 @@
 assert _ldap.__version__==__version__, \
        ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
 from _ldap import *
+# call into libldap to initialize it right now
+LIBLDAP_API_INFO = _ldap.get_option(_ldap.OPT_API_INFO)
 
 OPT_NAMES_DICT = {}
 for k,v in vars(_ldap).items():

From 9eff3672f68f55d8c19f17c69162c6b5eb550b3a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 12:12:53 +0000
Subject: [PATCH 486/868] moved code from version.c to ldapmodule.c and removed
 version.[ch]

---
 Modules/version.c | 19 -------------------
 Modules/version.h | 11 -----------
 setup.py          |  1 -
 3 files changed, 31 deletions(-)
 delete mode 100644 Modules/version.c
 delete mode 100644 Modules/version.h

diff --git a/Modules/version.c b/Modules/version.c
deleted file mode 100644
index b706b8e..0000000
--- a/Modules/version.c
+++ /dev/null
@@ -1,19 +0,0 @@
-/* Set release version
- * See https://www.python-ldap.org/ for details. */
-
-#include "common.h"
-
-#define _STR(x)	#x
-#define STR(x)	_STR(x)
-
-static char version_str[] = STR(LDAPMODULE_VERSION);
-
-void
-LDAPinit_version( PyObject* d ) 
-{
-	PyObject *version;
-
-	version = PyString_FromString(version_str);
-	PyDict_SetItemString( d, "__version__", version );
-	Py_DECREF(version);
-}
diff --git a/Modules/version.h b/Modules/version.h
deleted file mode 100644
index 4d76b34..0000000
--- a/Modules/version.h
+++ /dev/null
@@ -1,11 +0,0 @@
-/* Set release version
- * See https://www.python-ldap.org/ for details. */
-
-#ifndef __h_version_
-#define __h_version_
-
-
-#include "common.h"
-extern void LDAPinit_version( PyObject* d );
-
-#endif /* __h_version_ */
diff --git a/setup.py b/setup.py
index 962d763..808d4eb 100644
--- a/setup.py
+++ b/setup.py
@@ -110,7 +110,6 @@ class OpenLDAP2:
         'Modules/functions.c',
         'Modules/ldapmodule.c',
         'Modules/message.c',
-        'Modules/version.c',
         'Modules/options.c',
         'Modules/berval.c',
       ],

From 1721df193a64f77933dfcc5144ee2460fc5bbb83 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 12:23:12 +0000
Subject: [PATCH 487/868] removed obsolete back-ward compability constants from
 common.h

---
 Modules/common.h | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/Modules/common.h b/Modules/common.h
index e29e20d..1ec232c 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -20,13 +20,6 @@
 #include <sys/types.h>
 #endif
 
-/* Backwards compability with Python prior 2.5 */
-#if PY_VERSION_HEX < 0x02050000
-typedef int Py_ssize_t;
-#define PY_SSIZE_T_MAX INT_MAX
-#define PY_SSIZE_T_MIN INT_MIN
-#endif
-
 #include <string.h>
 #define streq( a, b ) \
 	( (*(a)==*(b)) && 0==strcmp(a,b) )

From aedfdd1e15633eb850e7dc316afe6318161204db Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 22 Nov 2017 13:28:47 +0100
Subject: [PATCH 488/868] Add _ldap.__version__

Cherry-picked from: b837b54 stripped trailing spaces from C source files
---
 Modules/ldapmodule.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index a570220..c11bf72 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -1,7 +1,6 @@
 /* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
-#include "version.h"
 #include "constants.h"
 #include "errors.h"
 #include "functions.h"
@@ -9,6 +8,21 @@
 
 #include "LDAPObject.h"
 
+#define _STR(x)        #x
+#define STR(x) _STR(x)
+
+static char version_str[] = STR(LDAPMODULE_VERSION);
+
+void
+LDAPinit_version( PyObject* d )
+{
+       PyObject *version;
+
+       version = PyString_FromString(version_str);
+       PyDict_SetItemString( d, "__version__", version );
+       Py_DECREF(version);
+}
+
 DL_EXPORT(void) init_ldap(void);
 
 /* dummy module methods */

From 98181dedfa3e23f4cf5ad5065e0eee2baac27a19 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 12:47:38 +0000
Subject: [PATCH 489/868] build checks whether LDAP_API_VERSION is OpenLDAP
 2.4.x

---
 Modules/LDAPObject.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index 4223735..a0adc3f 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -7,8 +7,8 @@
 
 #include "lber.h"
 #include "ldap.h"
-#if LDAP_API_VERSION < 2000
-#error Current python-ldap requires OpenLDAP 2.x
+#if LDAP_API_VERSION < 2040
+#error Current python-ldap requires OpenLDAP 2.4.x
 #endif
 
 #if PYTHON_API_VERSION < 1007

From b1485d689a88b0bbf790ac5ee55e59dfc138b721 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 13:14:35 +0000
Subject: [PATCH 490/868] setup.py: added ldap.controls.vlv to py_modules

---
 setup.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/setup.py b/setup.py
index 808d4eb..7ce8d9d 100644
--- a/setup.py
+++ b/setup.py
@@ -145,6 +145,7 @@ class OpenLDAP2:
     'ldap.controls.sessiontrack',
     'ldap.controls.simple',
     'ldap.controls.sss',
+    'ldap.controls.vlv',
     'ldap.cidict',
     'ldap.dn',
     'ldap.extop',

From f9a910d69661fa4715046966d5e45d12634038d9 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 13:15:57 +0000
Subject: [PATCH 491/868] removed setting class attribute result_code in
 SSSResponseControl.decodeControlValue() and
 VLVResponseControl.decodeControlValue

---
 Lib/ldap/controls/sss.py | 2 --
 Lib/ldap/controls/vlv.py | 2 --
 2 files changed, 4 deletions(-)

diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 7899f04..5d4955d 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -129,7 +129,5 @@ def decodeControlValue(self, encoded):
         # backward compability class attributes
         self.result = self.sortResult
         self.attribute_type_error = self.attributeType
-        # not sure whether to keep this
-        self.result_code = sort_result.prettyPrint()
 
 KNOWN_RESPONSE_CONTROLS[SSSResponseControl.controlType] = SSSResponseControl
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index 4b3d931..74d107b 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -139,7 +139,5 @@ def decodeControlValue(self,encoded):
         self.content_count = self.contentCount
         self.result = self.virtualListViewResult
         self.context_id = self.contextID
-        # not sure whether to keep this
-        self.result_code = virtual_list_view_result.prettyPrint()
 
 KNOWN_RESPONSE_CONTROLS[VLVResponseControl.controlType] = VLVResponseControl

From 25f8e6c9f51473ca68197cf7a148cfb671a48f44 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 13:53:11 +0000
Subject: [PATCH 492/868] announce minor changes for 2.5.2 in Modules/ and Lib/

---
 CHANGES | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/CHANGES b/CHANGES
index 32b1c7c..8c6dde4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,7 +3,16 @@ Released 2.5.2 2017-11-xx
 
 Changes since 2.5.1:
 
+Modules/
+* moved code from version.c to ldapmodule.c
+* removed obsolete back-ward compability constants from common.h
+* build checks whether LDAP_API_VERSION is OpenLDAP 2.4.x
+
 Lib/
+* new global constant ldap.LIBLDAP_API_INFO
+* right after importing _ldap there is a call into libldap to initialize it
+* method .decodeControlValue() of SSSResponseControl and VLVResponseControl
+  does not set class attribute result_code anymore
 
 Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore

From c25fe474fd4e06a2833e0685904055fa5df2e3c5 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 13:53:46 +0000
Subject: [PATCH 493/868] white-space cleaning

---
 Modules/message.h | 1 -
 Modules/options.h | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/Modules/message.h b/Modules/message.h
index b4f60eb..c3522ac 100644
--- a/Modules/message.h
+++ b/Modules/message.h
@@ -10,4 +10,3 @@
 extern PyObject* LDAPmessage_to_python( LDAP*ld, LDAPMessage*m, int add_ctrls, int add_intermediates );
 
 #endif /* __h_message_ */
-
diff --git a/Modules/options.h b/Modules/options.h
index dd61320..570fdc1 100644
--- a/Modules/options.h
+++ b/Modules/options.h
@@ -1,7 +1,7 @@
 /* See https://www.python-ldap.org/ for details. */
 
-int	LDAP_optionval_by_name(const char *name);
-int	LDAP_set_option(LDAPObject *self, int option, PyObject *value);
+int LDAP_optionval_by_name(const char *name);
+int LDAP_set_option(LDAPObject *self, int option, PyObject *value);
 PyObject *LDAP_get_option(LDAPObject *self, int option);
 
 void set_timeval_from_double( struct timeval *tv, double d );

From 707744c21e241e71f79518dc77763b4ce62e4c90 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 14:23:48 +0000
Subject: [PATCH 494/868] always use bytes() for UUID() constructor in
 ldap.syncrepl

---
 CHANGES              | 1 +
 Lib/ldap/syncrepl.py | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 8c6dde4..f4be1fc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,7 @@ Lib/
 * right after importing _ldap there is a call into libldap to initialize it
 * method .decodeControlValue() of SSSResponseControl and VLVResponseControl
   does not set class attribute result_code anymore
+* always use bytes() for UUID() constructor in ldap.syncrepl
 
 Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 94a7217..93a3a2a 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -130,7 +130,7 @@ class SyncStateControl(ResponseControl):
     def decodeControlValue(self, encodedControlValue):
         d = decoder.decode(encodedControlValue, asn1Spec = syncStateValue())
         state = d[0].getComponentByName('state')
-        uuid = UUID(bytes=d[0].getComponentByName('entryUUID'))
+        uuid = UUID(bytes=bytes(d[0].getComponentByName('entryUUID')))
         cookie = d[0].getComponentByName('cookie')
         if cookie.hasValue():
             self.cookie = str(self.cookie)
@@ -287,7 +287,7 @@ def __init__(self, encodedMessage):
                     uuids = []
                     ids = comp.getComponentByName('syncUUIDs')
                     for i in range(len(ids)):
-                        uuid = UUID(bytes=str(ids.getComponentByPosition(i)))
+                        uuid = UUID(bytes=bytes(ids.getComponentByPosition(i)))
                         uuids.append(str(uuid))
                     val['syncUUIDs'] = uuids
                     val['refreshDeletes'] = bool(comp.getComponentByName('refreshDeletes'))

From 5b35eef635596af20438b546d924a06a7c159895 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 14:58:05 +0000
Subject: [PATCH 495/868] C module _ldap now also gets __author__ and
 __license__ set from ldap.pkginfo same like __version__

---
 CHANGES              |  1 +
 Modules/constants.c  |  6 ------
 Modules/ldapmodule.c | 25 +++++++++++++++++++------
 setup.py             |  6 +++++-
 4 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/CHANGES b/CHANGES
index f4be1fc..32550b6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,7 @@ Modules/
 * moved code from version.c to ldapmodule.c
 * removed obsolete back-ward compability constants from common.h
 * build checks whether LDAP_API_VERSION is OpenLDAP 2.4.x
+* _ldap.__author__ and _ldap.__license__ also set from ldap.pkginfo
 
 Lib/
 * new global constant ldap.LIBLDAP_API_INFO
diff --git a/Modules/constants.c b/Modules/constants.c
index 2c0ec1d..06c249a 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -280,12 +280,6 @@ LDAPinit_constants( PyObject* d )
   add_int(d,URL_ERR_BADSCOPE);
   add_int(d,URL_ERR_MEM);
 
-  /* author */
-
-  author = PyString_FromString("python-ldap Project");
-  PyDict_SetItemString(d, "__author__", author);
-  Py_DECREF(author);
-
   /* add_int(d,LIBLDAP_R); */
 #ifdef HAVE_LIBLDAP_R
   obj = PyInt_FromLong(1);
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index c11bf72..dc954d4 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -12,15 +12,28 @@
 #define STR(x) _STR(x)
 
 static char version_str[] = STR(LDAPMODULE_VERSION);
+static char author_str[] = STR(LDAPMODULE_AUTHOR);
+static char license_str[] = STR(LDAPMODULE_LICENSE);
 
 void
-LDAPinit_version( PyObject* d )
+init_pkginfo( PyObject* d )
 {
-       PyObject *version;
+	PyObject *version;
+	PyObject *author;
+	PyObject *license;
+
+	version = PyString_FromString(version_str);
+	PyDict_SetItemString( d, "__version__", version );
+	Py_DECREF(version);
+
+  author = PyString_FromString(author_str);
+  PyDict_SetItemString(d, "__author__", author);
+  Py_DECREF(author);
+
+  license = PyString_FromString(license_str);
+  PyDict_SetItemString(d, "__license__", license);
+  Py_DECREF(license);
 
-       version = PyString_FromString(version_str);
-       PyDict_SetItemString( d, "__version__", version );
-       Py_DECREF(version);
 }
 
 DL_EXPORT(void) init_ldap(void);
@@ -48,7 +61,7 @@ init_ldap()
 	/* Add some symbolic constants to the module */
 	d = PyModule_GetDict(m);
 
-	LDAPinit_version(d);
+	init_pkginfo(d);
 	LDAPinit_constants(d);
 	LDAPinit_errors(d);
 	LDAPinit_functions(d);
diff --git a/setup.py b/setup.py
index 7ce8d9d..841ee55 100644
--- a/setup.py
+++ b/setup.py
@@ -124,7 +124,11 @@ class OpenLDAP2:
         ('ldap_r' in LDAP_CLASS.libs or 'oldap_r' in LDAP_CLASS.libs)*[('HAVE_LIBLDAP_R',None)] + \
         ('sasl' in LDAP_CLASS.libs or 'sasl2' in LDAP_CLASS.libs or 'libsasl' in LDAP_CLASS.libs)*[('HAVE_SASL',None)] + \
         ('ssl' in LDAP_CLASS.libs and 'crypto' in LDAP_CLASS.libs)*[('HAVE_TLS',None)] + \
-        [('LDAPMODULE_VERSION', pkginfo.__version__)]
+        [
+          ('LDAPMODULE_VERSION', pkginfo.__version__),
+          ('LDAPMODULE_AUTHOR', pkginfo.__author__),
+          ('LDAPMODULE_LICENSE', pkginfo.__license__),
+        ]
     ),
   ],
   #-- Python "stand alone" modules

From 082490a0b129619f873bfcadb17bf0bef244bf89 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 15:32:36 +0000
Subject: [PATCH 496/868] stick to naming convention with LDAPinit_pkginfo()

---
 Modules/ldapmodule.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index dc954d4..a788ae1 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -16,24 +16,23 @@ static char author_str[] = STR(LDAPMODULE_AUTHOR);
 static char license_str[] = STR(LDAPMODULE_LICENSE);
 
 void
-init_pkginfo( PyObject* d )
+LDAPinit_pkginfo( PyObject* d )
 {
 	PyObject *version;
 	PyObject *author;
 	PyObject *license;
 
 	version = PyString_FromString(version_str);
-	PyDict_SetItemString( d, "__version__", version );
-	Py_DECREF(version);
-
-  author = PyString_FromString(author_str);
-  PyDict_SetItemString(d, "__author__", author);
-  Py_DECREF(author);
+	author = PyString_FromString(author_str);
+	license = PyString_FromString(license_str);
 
-  license = PyString_FromString(license_str);
-  PyDict_SetItemString(d, "__license__", license);
-  Py_DECREF(license);
+	PyDict_SetItemString( d, "__version__", version );
+	PyDict_SetItemString(d, "__author__", author);
+	PyDict_SetItemString(d, "__license__", license);
 
+	Py_DECREF(version);
+	Py_DECREF(author);
+	Py_DECREF(license);
 }
 
 DL_EXPORT(void) init_ldap(void);
@@ -61,7 +60,7 @@ init_ldap()
 	/* Add some symbolic constants to the module */
 	d = PyModule_GetDict(m);
 
-	init_pkginfo(d);
+	LDAPinit_pkginfo(d);
 	LDAPinit_constants(d);
 	LDAPinit_errors(d);
 	LDAPinit_functions(d);

From 862221709799d9f27b31e55e9dc2b0bd79ce2f14 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 16:30:49 +0000
Subject: [PATCH 497/868] removed almost all assert statements in
 ldap.schema.models, removed importing of types module

---
 Lib/ldap/schema/models.py | 54 ++-------------------------------------
 1 file changed, 2 insertions(+), 52 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 383705c..2e84f48 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -8,14 +8,6 @@
 
 from ldap.schema.tokenizer import split_tokens,extract_tokens
 
-if __debug__:
-  from types import TupleType,StringType,IntType
-  try:
-    from types import BooleanType
-  except ImportError:
-    BooleanType = IntType
-
-
 NOT_HUMAN_READABLE_LDAP_SYNTAXES = {
   '1.3.6.1.4.1.1466.115.121.1.4':None,  # Audio
   '1.3.6.1.4.1.1466.115.121.1.5':None,  # Binary
@@ -68,7 +60,7 @@ def get_id(self):
     return self.oid
 
   def key_attr(self,key,value,quoted=0):
-    assert value is None or type(value)==StringType,TypeError("value has to be of StringType, was %s" % repr(value))
+    assert value is None or type(value)==str,TypeError("value has to be of str, was %r" % value)
     if value:
       if quoted:
         return " %s '%s'" % (key,value.replace("'","\\'"))
@@ -78,7 +70,7 @@ def key_attr(self,key,value,quoted=0):
       return ""
 
   def key_list(self,key,values,sep=' ',quoted=0):
-    assert type(values)==TupleType,TypeError("values has to be of ListType")
+    assert type(values)==tuple,TypeError("values has to be a tuple, was %r" % values)
     if not values:
       return ''
     if quoted:
@@ -159,13 +151,6 @@ def _set_attrs(self,l,d):
       self.sup = ('top',)
     else:
       self.sup = d['SUP']
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert type(self.sup)==TupleType
-    assert type(self.kind)==IntType
-    assert type(self.must)==TupleType
-    assert type(self.may)==TupleType
     return
 
   def __str__(self):
@@ -286,14 +271,6 @@ def _set_attrs(self,l,d):
     self.collective = d['COLLECTIVE']!=None
     self.no_user_mod = d['NO-USER-MODIFICATION']!=None
     self.usage = AttributeUsage.get(d['USAGE'][0],0)
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.sup)==TupleType,'attribute sup has type %s' % (type(self.sup))
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert type(self.single_value)==BooleanType and (self.single_value==0 or self.single_value==1)
-    assert type(self.no_user_mod)==BooleanType and (self.no_user_mod==0 or self.no_user_mod==1)
-    assert self.syntax is None or type(self.syntax)==StringType
-    assert self.syntax_len is None or type(self.syntax_len)==type(0L)
     return
 
   def __str__(self):
@@ -351,7 +328,6 @@ def _set_attrs(self,l,d):
       NOT_HUMAN_READABLE_LDAP_SYNTAXES.has_key(self.oid) or \
       d['X-NOT-HUMAN-READABLE'][0]=='TRUE'
     self.x_binary_transfer_required = d['X-BINARY-TRANSFER-REQUIRED'][0]=='TRUE'
-    assert self.desc is None or type(self.desc)==StringType
     return
 
   def __str__(self):
@@ -398,10 +374,6 @@ def _set_attrs(self,l,d):
     self.desc = d['DESC'][0]
     self.obsolete = d['OBSOLETE']!=None
     self.syntax = d['SYNTAX'][0]
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert self.syntax is None or type(self.syntax)==StringType
     return
 
   def __str__(self):
@@ -448,10 +420,6 @@ def _set_attrs(self,l,d):
     self.desc = d['DESC'][0]
     self.obsolete = d['OBSOLETE']!=None
     self.applies = d['APPLIES']
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert type(self.applies)==TupleType
     return
 
   def __str__(self):
@@ -515,13 +483,6 @@ def _set_attrs(self,l,d):
     self.must = d['MUST']
     self.may = d['MAY']
     self.nots = d['NOT']
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert type(self.aux)==TupleType
-    assert type(self.must)==TupleType
-    assert type(self.may)==TupleType
-    assert type(self.nots)==TupleType
     return
 
   def __str__(self):
@@ -582,11 +543,6 @@ def _set_attrs(self,l,d):
     self.obsolete = d['OBSOLETE']!=None
     self.form = d['FORM'][0]
     self.sup = d['SUP']
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert type(self.form)==StringType
-    assert type(self.sup)==TupleType
     return
 
   def __str__(self):
@@ -646,12 +602,6 @@ def _set_attrs(self,l,d):
     self.oc = d['OC'][0]
     self.must = d['MUST']
     self.may = d['MAY']
-    assert type(self.names)==TupleType
-    assert self.desc is None or type(self.desc)==StringType
-    assert type(self.obsolete)==BooleanType and (self.obsolete==0 or self.obsolete==1)
-    assert type(self.oc)==StringType
-    assert type(self.must)==TupleType
-    assert type(self.may)==TupleType
     return
 
   def __str__(self):

From db60bf1238d187726c6d8c75fa6f9d36ed535cca Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 17:26:34 +0000
Subject: [PATCH 498/868] removed all dependencies on modules string and types

---
 CHANGES              |  1 +
 Demo/simplebrowse.py |  5 ++---
 Lib/ldap/modlist.py  | 14 +++++++-------
 Lib/ldif.py          |  6 +++---
 setup.py             |  9 ++++-----
 5 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/CHANGES b/CHANGES
index 32550b6..15c4d0e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,7 @@ Modules/
 * _ldap.__author__ and _ldap.__license__ also set from ldap.pkginfo
 
 Lib/
+* removed all dependencies on modules string and types
 * new global constant ldap.LIBLDAP_API_INFO
 * right after importing _ldap there is a call into libldap to initialize it
 * method .decodeControlValue() of SSSResponseControl and VLVResponseControl
diff --git a/Demo/simplebrowse.py b/Demo/simplebrowse.py
index f8e7182..804d12f 100644
--- a/Demo/simplebrowse.py
+++ b/Demo/simplebrowse.py
@@ -5,7 +5,6 @@
 #
 
 import ldap
-import string
 from traceback import print_exc
 
 url = "ldap://ldap.openldap.org/"
@@ -71,8 +70,8 @@
 		if arg == '-':
 			lastdn,dn = dn,lastdn
 		elif arg == '..':
-			dn = string.join(ldap.explode_dn(dn)[1:], ",")
-			dn = string.strip(dn)
+			dn = ldap.explode_dn(dn)[1:].join(",")
+			dn = dn.strip()
                 else:
 		        try:
 			        i = int(arg)
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 0d1ac40..9aff147 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -10,7 +10,7 @@
 
 from ldap import __version__
 
-import string,ldap,ldap.cidict
+import ldap,ldap.cidict
 
 
 def list_dict(l,case_insensitive=0):
@@ -31,10 +31,10 @@ def list_dict(l,case_insensitive=0):
 
 def addModlist(entry,ignore_attr_types=None):
   """Build modify list for call of method LDAPObject.add()"""
-  ignore_attr_types = list_dict(map(string.lower,(ignore_attr_types or [])))
+  ignore_attr_types = list_dict(map(str.lower,(ignore_attr_types or [])))
   modlist = []
   for attrtype in entry.keys():
-    if ignore_attr_types.has_key(string.lower(attrtype)):
+    if ignore_attr_types.has_key(str.lower(attrtype)):
       # This attribute type is ignored
       continue
     # Eliminate empty attr value strings in list
@@ -66,14 +66,14 @@ def modifyModlist(
       List of attribute type names for which comparison will be made
       case-insensitive
   """
-  ignore_attr_types = list_dict(map(string.lower,(ignore_attr_types or [])))
-  case_ignore_attr_types = list_dict(map(string.lower,(case_ignore_attr_types or [])))
+  ignore_attr_types = list_dict(map(str.lower,(ignore_attr_types or [])))
+  case_ignore_attr_types = list_dict(map(str.lower,(case_ignore_attr_types or [])))
   modlist = []
   attrtype_lower_map = {}
   for a in old_entry.keys():
-    attrtype_lower_map[string.lower(a)]=a
+    attrtype_lower_map[str.lower(a)]=a
   for attrtype in new_entry.keys():
-    attrtype_lower = string.lower(attrtype)
+    attrtype_lower = str.lower(attrtype)
     if ignore_attr_types.has_key(attrtype_lower):
       # This attribute type is ignored
       continue
diff --git a/Lib/ldif.py b/Lib/ldif.py
index c4ac4e8..8b1cd28 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -21,7 +21,7 @@
   'LDIFCopy',
 ]
 
-import urlparse,urllib,base64,re,types
+import urlparse,urllib,base64,re
 
 try:
   from cStringIO import StringIO
@@ -193,9 +193,9 @@ def unparse(self,dn,record):
     # Start with line containing the distinguished name
     self._unparseAttrTypeandValue('dn',dn)
     # Dispatch to record type specific writers
-    if isinstance(record,types.DictType):
+    if isinstance(record,dict):
       self._unparseEntryRecord(record)
-    elif isinstance(record,types.ListType):
+    elif isinstance(record,list):
       self._unparseChangeRecord(record)
     else:
       raise ValueError('Argument record must be dictionary or list instead of %s' % (repr(record)))
diff --git a/setup.py b/setup.py
index 841ee55..6bbf595 100644
--- a/setup.py
+++ b/setup.py
@@ -12,7 +12,7 @@
   from distutils.core import setup, Extension
 
 from ConfigParser import ConfigParser
-import sys,os,string,time
+import sys,os,time
 
 sys.path.insert(0, os.path.join(os.getcwd(), 'Lib/ldap'))
 import pkginfo
@@ -36,15 +36,14 @@ class OpenLDAP2:
 if cfg.has_section('_ldap'):
   for name in dir(LDAP_CLASS):
     if cfg.has_option('_ldap', name):
-      print name + ': ' + cfg.get('_ldap', name)
-      setattr(LDAP_CLASS, name, string.split(cfg.get('_ldap', name)))
+      setattr(LDAP_CLASS, name, cfg.get('_ldap', name).split())
 
 for i in range(len(LDAP_CLASS.defines)):
   LDAP_CLASS.defines[i]=((LDAP_CLASS.defines[i],None))
 
 for i in range(len(LDAP_CLASS.extra_files)):
-  destdir, origfiles = string.split(LDAP_CLASS.extra_files[i], ':')
-  origfileslist = string.split(origfiles, ',')
+  destdir, origfiles = LDAP_CLASS.extra_files[i].split(':')
+  origfileslist = origfiles.split(',')
   LDAP_CLASS.extra_files[i]=(destdir, origfileslist)
 
 #-- Let distutils/setuptools do the rest

From 839a5ec93a570d48708c6e01165f3adad074ea7d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 17:41:18 +0000
Subject: [PATCH 499/868] fixed var usage when failing in
 test_bad_change_records()

---
 Tests/t_ldif.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 4898f76..4dd1e02 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -641,7 +641,7 @@ def test_bad_change_records(self):
             except ValueError, value_error:
                 pass
             else:
-                self.fail("should have raised ValueError: %r" % ldif_str)
+                self.fail("should have raised ValueError: %r" % bad_ldif_string)
 
     def test_mod_increment(self):
         self.check_records(

From 45efe4f81084da45b3787029ab0239f34f778957 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 18:25:30 +0000
Subject: [PATCH 500/868] use new-style classes in ldapurl

---
 Lib/ldapurl.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index fa072c9..dc81dd9 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -68,8 +68,7 @@ def ldapUrlEscape(s):
   """Returns URL encoding of string s"""
   return quote(s).replace(',','%2C').replace('/','%2F')
 
-
-class LDAPUrlExtension:
+class LDAPUrlExtension(object):
   """
   Class for parsing and unparsing LDAP URL extensions
   as described in RFC 4516.
@@ -192,7 +191,7 @@ def unparse(self):
     return ','.join([ v.unparse() for v in self.values() ])
 
 
-class LDAPUrl:
+class LDAPUrl(object):
   """
   Class for parsing and unparsing LDAP URLs
   as described in RFC 4516.

From e61079ac49b007774ace209136b1909a8a7ef10a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 18:44:55 +0000
Subject: [PATCH 501/868] added LDIF test with line-folded, base64-encoded
 attribute

---
 CHANGES         |  1 +
 Tests/t_ldif.py | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/CHANGES b/CHANGES
index 15c4d0e..c5c3320 100644
--- a/CHANGES
+++ b/CHANGES
@@ -19,6 +19,7 @@ Lib/
 
 Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
+* added LDIF test with folded, base64-encoded attribute
 
 ----------------------------------------------------------------
 Released 2.5.1 2017-11-12
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 4dd1e02..3da213f 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -248,6 +248,30 @@ def test_binary2(self):
             ]
         )
 
+    def test_big_binary(self):
+        self.check_records(
+            """
+            dn: cn=x,cn=y,cn=z
+            attrib:: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+             =
+
+            """,
+            [
+                (
+                    'cn=x,cn=y,cn=z',
+                    {'attrib': [500*b'\0']},
+                ),
+            ]
+        )
+
     def test_unicode(self):
         self.check_records(
             """

From 270519e645c18f14ab628070806bf543bb199131 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 18:47:21 +0000
Subject: [PATCH 502/868] module ldif now uses functions b64encode() and
 b64decode()

---
 CHANGES     |  1 +
 Lib/ldif.py | 11 +++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index c5c3320..aad549c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -16,6 +16,7 @@ Lib/
 * method .decodeControlValue() of SSSResponseControl and VLVResponseControl
   does not set class attribute result_code anymore
 * always use bytes() for UUID() constructor in ldap.syncrepl
+* module ldif now uses functions b64encode() and b64decode()
 
 Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 8b1cd28..e06cbd3 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -21,7 +21,10 @@
   'LDIFCopy',
 ]
 
-import urlparse,urllib,base64,re
+import urlparse
+import urllib
+import re
+from base64 import b64encode, b64decode
 
 try:
   from cStringIO import StringIO
@@ -139,7 +142,7 @@ def _unparseAttrTypeandValue(self,attr_type,attr_value):
     """
     if self._needs_base64_encoding(attr_type,attr_value):
       # Encode with base64
-      self._unfold_lines(':: '.join([attr_type,base64.encodestring(attr_value).replace('\n','')]))
+      self._unfold_lines(':: '.join([attr_type, b64encode(attr_value).replace('\n','')]))
     else:
       self._unfold_lines(': '.join([attr_type,attr_value]))
     return # _unparseAttrTypeandValue()
@@ -277,7 +280,7 @@ def __init__(
     self.records_read = 0
     self.changetype_counter = {}.fromkeys(CHANGE_TYPES,0)
     # Store some symbols for better performance
-    self._base64_decodestring = base64.decodestring
+    self._b64decode = b64decode
     # Read very first line
     try:
       self._last_line = self._readline()
@@ -346,7 +349,7 @@ def _next_key_and_value(self):
       attr_value = unfolded_line[colon_pos+2:].lstrip()
     elif value_spec=='::':
       # attribute value needs base64-decoding
-      attr_value = self._base64_decodestring(unfolded_line[colon_pos+2:])
+      attr_value = self._b64decode(unfolded_line[colon_pos+2:])
     elif value_spec==':<':
       # fetch attribute value from URL
       url = unfolded_line[colon_pos+2:].strip()

From 4904fbf5a5df6ee6d8b4aecdd6b25d6d48320a76 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 18:48:39 +0000
Subject: [PATCH 503/868] docstring cosmetics

---
 Lib/slapdtest.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 4381ae0..3586643 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -81,8 +81,8 @@ class SlapdObject(object):
     Controller class for a slapd instance, OpenLDAP's server.
 
     This class creates a temporary data store for slapd, runs it
-    listening on a private Unix domain socket and TCP port, and initialises it with a top-level entry and
-    the root user.
+    listening on a private Unix domain socket and TCP port,
+    and initialises it with a top-level entry and the root user.
 
     When a reference to an instance of this class is lost, the slapd
     server is shut down.

From 00c2b9b378e53348e6e08d77a99fa3e59b93c523 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:03:16 +0000
Subject: [PATCH 504/868] ldapurl: eliminated use of .has_key()

---
 Lib/ldapurl.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index dc81dd9..1fa9b1c 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -398,10 +398,10 @@ def __repr__(self):
     )
 
   def __getattr__(self,name):
-    if self.attr2extype.has_key(name):
+    if name in self.attr2extype:
       extype = self.attr2extype[name]
       if self.extensions and \
-         self.extensions.has_key(extype) and \
+         extype in self.extensions and \
          not self.extensions[extype].exvalue is None:
         result = unquote(self.extensions[extype].exvalue)
       else:
@@ -413,7 +413,7 @@ def __getattr__(self,name):
     return result # __getattr__()
 
   def __setattr__(self,name,value):
-    if self.attr2extype.has_key(name):
+    if name in self.attr2extype:
       extype = self.attr2extype[name]
       if value is None:
         # A value of None means that extension is deleted
@@ -427,7 +427,7 @@ def __setattr__(self,name,value):
       self.__dict__[name] = value
 
   def __delattr__(self,name):
-    if self.attr2extype.has_key(name):
+    if name in self.attr2extype:
       extype = self.attr2extype[name]
       if self.extensions:
         try:

From 1e54be25bda876bdffd5013658774a008e66dcfe Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:31:13 +0000
Subject: [PATCH 505/868] ldap.modlist: removed use of .has_key() and use set
 for attribute value set comparison

---
 Lib/ldap/modlist.py | 51 +++++++++++++--------------------------------
 1 file changed, 14 insertions(+), 37 deletions(-)

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 9aff147..c2cca5d 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -13,28 +13,12 @@
 import ldap,ldap.cidict
 
 
-def list_dict(l,case_insensitive=0):
-  """
-  return a dictionary with all items of l being the keys of the dictionary
-
-  If argument case_insensitive is non-zero ldap.cidict.cidict will be
-  used for case-insensitive string keys
-  """
-  if case_insensitive:
-    d = ldap.cidict.cidict()
-  else:
-    d = {}
-  for i in l:
-    d[i]=None
-  return d
-
-
 def addModlist(entry,ignore_attr_types=None):
   """Build modify list for call of method LDAPObject.add()"""
-  ignore_attr_types = list_dict(map(str.lower,(ignore_attr_types or [])))
+  ignore_attr_types = set(map(str.lower,ignore_attr_types or []))
   modlist = []
   for attrtype in entry.keys():
-    if ignore_attr_types.has_key(str.lower(attrtype)):
+    if attrtype.lower() in ignore_attr_types:
       # This attribute type is ignored
       continue
     # Eliminate empty attr value strings in list
@@ -66,20 +50,20 @@ def modifyModlist(
       List of attribute type names for which comparison will be made
       case-insensitive
   """
-  ignore_attr_types = list_dict(map(str.lower,(ignore_attr_types or [])))
-  case_ignore_attr_types = list_dict(map(str.lower,(case_ignore_attr_types or [])))
+  ignore_attr_types = set(map(str.lower,ignore_attr_types or []))
+  case_ignore_attr_types = set(map(str.lower,case_ignore_attr_types or []))
   modlist = []
   attrtype_lower_map = {}
   for a in old_entry.keys():
     attrtype_lower_map[str.lower(a)]=a
   for attrtype in new_entry.keys():
     attrtype_lower = str.lower(attrtype)
-    if ignore_attr_types.has_key(attrtype_lower):
+    if attrtype_lower in ignore_attr_types:
       # This attribute type is ignored
       continue
     # Filter away null-strings
     new_value = filter(lambda x:x!=None,new_entry[attrtype])
-    if attrtype_lower_map.has_key(attrtype_lower):
+    if attrtype_lower in attrtype_lower_map:
       old_value = old_entry.get(attrtype_lower_map[attrtype_lower],[])
       old_value = filter(lambda x:x!=None,old_value)
       del attrtype_lower_map[attrtype_lower]
@@ -92,20 +76,13 @@ def modifyModlist(
       # Replace existing attribute
       replace_attr_value = len(old_value)!=len(new_value)
       if not replace_attr_value:
-        case_insensitive = case_ignore_attr_types.has_key(attrtype_lower)
-        old_value_dict=list_dict(old_value,case_insensitive)
-        new_value_dict=list_dict(new_value,case_insensitive)
-        delete_values = []
-        for v in old_value:
-          if not new_value_dict.has_key(v):
-            replace_attr_value = 1
-            break
-        add_values = []
-        if not replace_attr_value:
-          for v in new_value:
-            if not old_value_dict.has_key(v):
-              replace_attr_value = 1
-              break
+        if attrtype_lower in case_ignore_attr_types:
+          norm_func = str.lower
+        else:
+          norm_func = None
+        old_value_set=set(map(norm_func,old_value))
+        new_value_set=set(map(norm_func,new_value))
+        replace_attr_value = new_value_set != old_value_set
       if replace_attr_value:
         modlist.append((ldap.MOD_DELETE,attrtype,None))
         modlist.append((ldap.MOD_ADD,attrtype,new_value))
@@ -116,7 +93,7 @@ def modifyModlist(
     # Remove all attributes of old_entry which are not present
     # in new_entry at all
     for a in attrtype_lower_map.keys():
-      if ignore_attr_types.has_key(a):
+      if a in ignore_attr_types:
         # This attribute type is ignored
         continue
       attrtype = attrtype_lower_map[a]

From 92d40af46392cf9664bb510aa6615f1558582d86 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:32:16 +0000
Subject: [PATCH 506/868] ldap.schema.tokenizer: removed use of .has_key()

---
 Lib/ldap/schema/tokenizer.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index ede7e21..20958c0 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -52,16 +52,15 @@ def extract_tokens(l,known_tokens):
   """
   assert l[0].strip()=="(" and l[-1].strip()==")",ValueError(l)
   result = {}
-  result_has_key = result.has_key
   result.update(known_tokens)
   i = 0
   l_len = len(l)
   while i<l_len:
-    if result_has_key(l[i]):
+    if l[i] in result:
       token = l[i]
       i += 1 # Consume token
       if i<l_len:
-        if result_has_key(l[i]):
+        if l[i] in result:
           # non-valued
           result[token] = (())
         elif l[i]=="(":

From b22750fe1cd3bd589f164998414e64123d9f075b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:33:04 +0000
Subject: [PATCH 507/868] minor code-cleaning in ldif

---
 Lib/ldif.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index e06cbd3..f68838e 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -152,9 +152,7 @@ def _unparseEntryRecord(self,entry):
     entry
         dictionary holding an entry
     """
-    attr_types = entry.keys()[:]
-    attr_types.sort()
-    for attr_type in attr_types:
+    for attr_type in sorted(entry.keys()):
       for attr_value in entry[attr_type]:
         self._unparseAttrTypeandValue(attr_type,attr_value)
 

From 591ec60ffd521422b901945070e402cfea53c81a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:34:51 +0000
Subject: [PATCH 508/868] removed unneeded import for UserDict from
 ldap.schema.subentry

---
 Lib/ldap/schema/subentry.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index a80f238..b5e04c2 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -8,8 +8,6 @@
 
 from ldap.schema.models import *
 
-from UserDict import UserDict
-
 SCHEMA_CLASS_MAPPING = ldap.cidict.cidict()
 SCHEMA_ATTR_MAPPING = {}
 

From 08ff14e277500012ebab8c705cd5c275c11f9b21 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:40:25 +0000
Subject: [PATCH 509/868] use IterableUserDict in ldap.cidict

---
 Lib/ldap/cidict.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index a1f8fc5..68ac6f9 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -6,19 +6,19 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = """$Revision: 1.15 $"""
+__version__ = """$Revision: 1.16 $"""
 
-from UserDict import UserDict
+from UserDict import IterableUserDict
 from string import lower
 
-class cidict(UserDict):
+class cidict(IterableUserDict):
   """
   Case-insensitive but case-respecting dictionary.
   """
 
   def __init__(self,default=None):
     self._keys = {}
-    UserDict.__init__(self,{})
+    IterableUserDict.__init__(self,{})
     self.update(default or {})
 
   def __getitem__(self,key):
@@ -39,7 +39,7 @@ def update(self,dict):
       self[key] = dict[key]
 
   def has_key(self,key):
-    return UserDict.has_key(self,lower(key))
+    return IterableUserDict.has_key(self,lower(key))
 
   def __contains__(self,key):
     return self.has_key(key)

From 0cd22c7cc5c23aa0c097cca97b2b1351be8ea580 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:40:47 +0000
Subject: [PATCH 510/868] avoid use of .has_key()

---
 Tests/t_cidict.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index 3f9e8e4..ac56fd3 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -39,8 +39,8 @@ def test_cidict(self):
         cix_items.sort()
         self.assertEqual(cix_items, [('AbCDeF',123), ('xYZ',987)])
         del cix["abcdEF"]
-        self.assertEqual(cix._keys.has_key("abcdef"), False)
-        self.assertEqual(cix._keys.has_key("AbCDef"), False)
+        self.assertEqual("abcdef" in cix, False)
+        self.assertEqual("AbCDef" in cix._keys, False)
 
 
 if __name__ == '__main__':

From f6586aae8ba8b1fc5cd5b9ddd5ac6e435dc73bcb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:53:10 +0000
Subject: [PATCH 511/868] ldap.cidict: more nits around .has_key()

---
 Lib/ldap/cidict.py | 14 +++++++-------
 Tests/t_cidict.py  |  1 +
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 68ac6f9..a9e6dee 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -6,10 +6,10 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = """$Revision: 1.16 $"""
+__version__ = """$Revision: 1.17 $"""
 
 from UserDict import IterableUserDict
-from string import lower
+
 
 class cidict(IterableUserDict):
   """
@@ -22,15 +22,15 @@ def __init__(self,default=None):
     self.update(default or {})
 
   def __getitem__(self,key):
-    return self.data[lower(key)]
+    return self.data[key.lower()]
 
   def __setitem__(self,key,value):
-    lower_key = lower(key)
+    lower_key = key.lower()
     self._keys[lower_key] = key
     self.data[lower_key] = value
 
   def __delitem__(self,key):
-    lower_key = lower(key)
+    lower_key = key.lower()
     del self._keys[lower_key]
     del self.data[lower_key]
 
@@ -39,10 +39,10 @@ def update(self,dict):
       self[key] = dict[key]
 
   def has_key(self,key):
-    return IterableUserDict.has_key(self,lower(key))
+    return key in self
 
   def __contains__(self,key):
-    return self.has_key(key)
+    return IterableUserDict.__contains__(self, key.lower())
 
   def get(self,key,failobj=None):
     try:
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index ac56fd3..c8812f2 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -41,6 +41,7 @@ def test_cidict(self):
         del cix["abcdEF"]
         self.assertEqual("abcdef" in cix, False)
         self.assertEqual("AbCDef" in cix._keys, False)
+        self.assertEqual(cix.has_key("abcdef"), False)
 
 
 if __name__ == '__main__':

From efee495f2e6f02d0aabed0558becbce54d493609 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:56:58 +0000
Subject: [PATCH 512/868] ldap.cidict.__version__ imported from package

---
 Lib/ldap/cidict.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index a9e6dee..d36f8c3 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -6,7 +6,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = """$Revision: 1.17 $"""
+from ldap import __version__
 
 from UserDict import IterableUserDict
 

From 7791f9543e98a5a9017eedc8bd75ff0856252626 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 19:57:57 +0000
Subject: [PATCH 513/868] ldap.schema: avoid .has_key(),
 NOT_HUMAN_READABLE_LDAP_SYNTAXES is not set()

---
 Lib/ldap/schema/models.py   | 30 +++++++++++++++---------------
 Lib/ldap/schema/subentry.py |  6 +++---
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 2e84f48..208fe40 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -8,17 +8,17 @@
 
 from ldap.schema.tokenizer import split_tokens,extract_tokens
 
-NOT_HUMAN_READABLE_LDAP_SYNTAXES = {
-  '1.3.6.1.4.1.1466.115.121.1.4':None,  # Audio
-  '1.3.6.1.4.1.1466.115.121.1.5':None,  # Binary
-  '1.3.6.1.4.1.1466.115.121.1.8':None,  # Certificate
-  '1.3.6.1.4.1.1466.115.121.1.9':None,  # Certificate List
-  '1.3.6.1.4.1.1466.115.121.1.10':None, # Certificate Pair
-  '1.3.6.1.4.1.1466.115.121.1.23':None, # G3 FAX
-  '1.3.6.1.4.1.1466.115.121.1.28':None, # JPEG
-  '1.3.6.1.4.1.1466.115.121.1.40':None, # Octet String
-  '1.3.6.1.4.1.1466.115.121.1.49':None, # Supported Algorithm
-}
+NOT_HUMAN_READABLE_LDAP_SYNTAXES = set([
+  '1.3.6.1.4.1.1466.115.121.1.4',  # Audio
+  '1.3.6.1.4.1.1466.115.121.1.5',  # Binary
+  '1.3.6.1.4.1.1466.115.121.1.8',  # Certificate
+  '1.3.6.1.4.1.1466.115.121.1.9',  # Certificate List
+  '1.3.6.1.4.1.1466.115.121.1.10', # Certificate Pair
+  '1.3.6.1.4.1.1466.115.121.1.23', # G3 FAX
+  '1.3.6.1.4.1.1466.115.121.1.28', # JPEG
+  '1.3.6.1.4.1.1466.115.121.1.40', # Octet String
+  '1.3.6.1.4.1.1466.115.121.1.49', # Supported Algorithm
+])
 
 
 class SchemaElement:
@@ -325,7 +325,7 @@ def _set_attrs(self,l,d):
     self.desc = d['DESC'][0]
     self.x_subst = d['X-SUBST'][0]
     self.not_human_readable = \
-      NOT_HUMAN_READABLE_LDAP_SYNTAXES.has_key(self.oid) or \
+      self.oid in NOT_HUMAN_READABLE_LDAP_SYNTAXES or \
       d['X-NOT-HUMAN-READABLE'][0]=='TRUE'
     self.x_binary_transfer_required = d['X-BINARY-TRANSFER-REQUIRED'][0]=='TRUE'
     return
@@ -615,7 +615,7 @@ def __str__(self):
     return '( %s )' % ''.join(result)
 
 
-class Entry(UserDict.UserDict):
+class Entry(UserDict.IterableUserDict):
   """
   Schema-aware implementation of an LDAP entry class.
 
@@ -653,7 +653,7 @@ def update(self,dict):
       self[key] = dict[key]
 
   def __contains__(self,key):
-    return self.has_key(key)
+    return key in self
 
   def __getitem__(self,nameoroid):
     return self.data[self._at2key(nameoroid)]
@@ -671,7 +671,7 @@ def __delitem__(self,nameoroid):
 
   def has_key(self,nameoroid):
     k = self._at2key(nameoroid)
-    return self.data.has_key(k)
+    return k in self.data
 
   def get(self,nameoroid,failobj):
     try:
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index b5e04c2..99a0dc4 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -298,7 +298,7 @@ def get_structural_oc(self,oc_list):
     while struct_oc_list:
       oid = struct_oc_list.pop()
       for child_oid in oc_tree[oid]:
-        if struct_ocs.has_key(self.getoid(ObjectClass,child_oid)):
+        if self.getoid(ObjectClass,child_oid) in struct_ocs:
           break
       else:
         result = oid
@@ -365,7 +365,7 @@ def attribute_types(
       object_class_oid = object_class_oids.pop(0)
       # Check whether the objectClass with this OID
       # has already been processed
-      if oid_cache.has_key(object_class_oid):
+      if object_class_oid in oid_cache:
         continue
       # Cache this OID as already being processed
       oid_cache[object_class_oid] = None
@@ -418,7 +418,7 @@ def attribute_types(
     # Remove all mandantory attribute types from
     # optional attribute type list
     for a in r_may.keys():
-      if r_must.has_key(a):
+      if a in r_must:
         del r_may[a]
 
     # Apply attr_type_filter to results

From 1514852193ceb0db66f5290d3953873bd26f80f7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 20:08:02 +0000
Subject: [PATCH 514/868] ldap.async: avoid using .has_key() and check result
 types against set() instances

---
 Lib/ldap/async.py | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 81824e4..7f3d7c3 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -11,17 +11,16 @@
 
 from ldap import __version__
 
+SEARCH_RESULT_TYPES = set([
+  ldap.RES_SEARCH_ENTRY,
+  ldap.RES_SEARCH_RESULT,
+  ldap.RES_SEARCH_REFERENCE,
+])
 
-_searchResultTypes={
-  ldap.RES_SEARCH_ENTRY:None,
-  ldap.RES_SEARCH_RESULT:None,
-  ldap.RES_SEARCH_REFERENCE:None,
-}
-
-_entryResultTypes={
-  ldap.RES_SEARCH_ENTRY:None,
-  ldap.RES_SEARCH_RESULT:None,
-}
+ENTRY_RESULT_TYPES = set([
+  ldap.RES_SEARCH_ENTRY,
+  ldap.RES_SEARCH_RESULT,
+])
 
 
 class WrongResultType(Exception):
@@ -137,8 +136,8 @@ def processResults(self,ignoreResultsNumber=0,processResultsCount=0,timeout=-1):
             self._afterFirstResult = 0
         if not result_list:
           break
-        if not _searchResultTypes.has_key(result_type):
-          raise WrongResultType(result_type,_searchResultTypes.keys())
+        if result_type not in SEARCH_RESULT_TYPES:
+          raise WrongResultType(result_type,SEARCH_RESULT_TYPES)
         # Loop over list of search results
         for result_item in result_list:
           if result_counter<ignoreResultsNumber:
@@ -197,7 +196,7 @@ def __init__(self,l):
     self.allEntries = {}
 
   def _processSingleResult(self,resultType,resultItem):
-    if _entryResultTypes.has_key(resultType):
+    if resultType in ENTRY_RESULT_TYPES:
       # Search continuations are ignored
       dn,entry = resultItem
       self.allEntries[dn] = entry
@@ -215,12 +214,12 @@ def __init__(self,l,indexed_attrs=None):
     self.index = {}.fromkeys(self.indexed_attrs,{})
 
   def _processSingleResult(self,resultType,resultItem):
-    if _entryResultTypes.has_key(resultType):
+    if resultType in ENTRY_RESULT_TYPES:
       # Search continuations are ignored
       dn,entry = resultItem
       self.allEntries[dn] = entry
       for a in self.indexed_attrs:
-        if entry.has_key(a):
+        if a in entry:
           for v in entry[a]:
             try:
               self.index[a][v].append(dn)
@@ -281,7 +280,7 @@ def __init__(self,l,writer_obj,headerStr='',footerStr=''):
     FileWriter.__init__(self,l,self._ldif_writer._output_file,headerStr,footerStr)
 
   def _processSingleResult(self,resultType,resultItem):
-    if _entryResultTypes.has_key(resultType):
+    if resultType in ENTRY_RESULT_TYPES:
       # Search continuations are ignored
       dn,entry = resultItem
       self._ldif_writer.unparse(dn,entry)

From 3e0ef819ea23df0572058a9baf0d0eb30c6e0e2a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 20:08:47 +0000
Subject: [PATCH 515/868] ldap.ldapobject: avoid using .has_key()

---
 Lib/ldap/ldapobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 70ecec7..33ce36a 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -127,13 +127,13 @@ def _ldap_call(self,func,*args,**kwargs):
     return result
 
   def __setattr__(self,name,value):
-    if self.CLASSATTR_OPTION_MAPPING.has_key(name):
+    if name in self.CLASSATTR_OPTION_MAPPING:
       self.set_option(self.CLASSATTR_OPTION_MAPPING[name],value)
     else:
       self.__dict__[name] = value
 
   def __getattr__(self,name):
-    if self.CLASSATTR_OPTION_MAPPING.has_key(name):
+    if name in self.CLASSATTR_OPTION_MAPPING:
       return self.get_option(self.CLASSATTR_OPTION_MAPPING[name])
     elif self.__dict__.has_key(name):
       return self.__dict__[name]

From 63fd67efd7fb19969eae228ff01ac8c373a37242 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 21:03:31 +0000
Subject: [PATCH 516/868] fixed ldap.schema.models.Entry.__contains__()

---
 Lib/ldap/schema/models.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 208fe40..8471954 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -652,8 +652,8 @@ def update(self,dict):
     for key in dict.keys():
       self[key] = dict[key]
 
-  def __contains__(self,key):
-    return key in self
+  def __contains__(self,nameoroid):
+    return self._at2key(nameoroid) in self.data
 
   def __getitem__(self,nameoroid):
     return self.data[self._at2key(nameoroid)]

From 99912eae70333ac4a5834d9ce912e938fb88f1ee Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 21:09:31 +0000
Subject: [PATCH 517/868] ldap.modlist does not need ldap.cidict anymore

---
 Lib/ldap/modlist.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index c2cca5d..1c9c1dc 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -10,7 +10,7 @@
 
 from ldap import __version__
 
-import ldap,ldap.cidict
+import ldap
 
 
 def addModlist(entry,ignore_attr_types=None):

From 6b15de53e2b3b9f9b61b13e7fa871271c3d40b02 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 21:17:18 +0000
Subject: [PATCH 518/868] removed obsolete Python compability note from modules
 docstrings and demo scripts

---
 Demo/Lib/ldap/async/ldifwriter.py |  3 ---
 Demo/Lib/ldap/async/sizelimit.py  |  3 ---
 Demo/Lib/ldif/ldifcopy.py         |  3 ---
 Demo/resiter.py                   |  3 ---
 Lib/ldap/async.py                 |  3 ---
 Lib/ldap/ldapobject.py            | 12 ------------
 Lib/ldap/modlist.py               |  4 ----
 Lib/ldap/resiter.py               |  3 ---
 Lib/ldapurl.py                    |  5 -----
 Lib/ldif.py                       |  3 ---
 Lib/slapdtest.py                  |  3 ---
 11 files changed, 45 deletions(-)

diff --git a/Demo/Lib/ldap/async/ldifwriter.py b/Demo/Lib/ldap/async/ldifwriter.py
index 8cc4aa5..9671762 100644
--- a/Demo/Lib/ldap/async/ldifwriter.py
+++ b/Demo/Lib/ldap/async/ldifwriter.py
@@ -7,9 +7,6 @@
 This example translates the naming context of data read from
 input, sanitizes some attributes, maps/removes object classes,
 maps/removes attributes., etc. It's far from being complete though.
-
-Python compability note:
-Tested on Python 2.0+, should run on Python 1.5.x.
 """
 
 import sys,ldap,ldap.async
diff --git a/Demo/Lib/ldap/async/sizelimit.py b/Demo/Lib/ldap/async/sizelimit.py
index 05e439b..11ed7b6 100644
--- a/Demo/Lib/ldap/async/sizelimit.py
+++ b/Demo/Lib/ldap/async/sizelimit.py
@@ -8,9 +8,6 @@
 This example translates the naming context of data read from
 input, sanitizes some attributes, maps/removes object classes,
 maps/removes attributes., etc. It's far from being complete though.
-
-Python compability note:
-Tested on Python 2.0+, should run on Python 1.5.x.
 """
 
 import sys,ldap,ldap.async
diff --git a/Demo/Lib/ldif/ldifcopy.py b/Demo/Lib/ldif/ldifcopy.py
index 498b857..62cb391 100644
--- a/Demo/Lib/ldif/ldifcopy.py
+++ b/Demo/Lib/ldif/ldifcopy.py
@@ -7,9 +7,6 @@
 This example translates the naming context of data read from
 input, sanitizes some attributes, maps/removes object classes,
 maps/removes attributes., etc. It's far from being complete though.
-
-Python compability note:
-Tested on Python 2.0+, should run on Python 1.5.x.
 """
 
 import sys,ldif
diff --git a/Demo/resiter.py b/Demo/resiter.py
index 3394524..ff9fe5a 100644
--- a/Demo/resiter.py
+++ b/Demo/resiter.py
@@ -3,9 +3,6 @@
 written by Michael Stroeder <michael@stroeder.com>
 
 See http://www.python-ldap.org for details.
-
-Python compability note:
-Requires Python 2.3+
 """
 
 import ldap,ldap.resiter
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 7f3d7c3..0dd4940 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -2,9 +2,6 @@
 ldap.async - handle async LDAP operations
 
 See https://www.python-ldap.org/ for details.
-
-Python compability note:
-Tested on Python 2.0+ but should run on Python 1.5.x.
 """
 
 import ldap
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 33ce36a..f4e61da 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -2,18 +2,6 @@
 ldapobject.py - wraps class _ldap.LDAPObject
 
 See https://www.python-ldap.org/ for details.
-
-Compability:
-- Tested with Python 2.0+ but should work with Python 1.5.x
-- LDAPObject class should be exactly the same like _ldap.LDAPObject
-
-Usage:
-Directly imported by ldap/__init__.py. The symbols of _ldap are
-overridden.
-
-Thread-lock:
-Basically calls into the LDAP lib are serialized by the module-wide
-lock self._ldap_object_lock.
 """
 
 from os import strerror
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 1c9c1dc..99e4a18 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -2,10 +2,6 @@
 ldap.modlist - create add/modify modlist's
 
 See https://www.python-ldap.org/ for details.
-
-Python compability note:
-This module is known to work with Python 2.0+ but should work
-with Python 1.5.2 as well.
 """
 
 from ldap import __version__
diff --git a/Lib/ldap/resiter.py b/Lib/ldap/resiter.py
index d8c1368..bb72618 100644
--- a/Lib/ldap/resiter.py
+++ b/Lib/ldap/resiter.py
@@ -2,9 +2,6 @@
 ldap.resiter - processing LDAP results with iterators
 
 See https://www.python-ldap.org/ for details.
-
-Python compability note:
-Requires Python 2.3+
 """
 
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 1fa9b1c..bbd6929 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -2,11 +2,6 @@
 ldapurl - handling of LDAP URLs as described in RFC 4516
 
 See https://www.python-ldap.org/ for details.
-
-Python compability note:
-This module only works with Python 2.0+ since
-1. string methods are used instead of module string and
-2. list comprehensions are used.
 """
 
 __version__ = '2.5.2'
diff --git a/Lib/ldif.py b/Lib/ldif.py
index f68838e..86b8ac9 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -2,9 +2,6 @@
 ldif - generate and parse LDIF data (see RFC 2849)
 
 See https://www.python-ldap.org/ for details.
-
-Python compability note:
-Tested with Python 2.0+, but should work with Python 1.5.2+.
 """
 
 __version__ = '2.5.2'
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 3586643..2f98672 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -3,9 +3,6 @@
 slapdtest - module for spawning test instances of OpenLDAP's slapd server
 
 See https://www.python-ldap.org/ for details.
-
-Python compability note:
-This module only works with Python 2.7.x since
 """
 
 __version__ = '2.5.2'

From eeb4daadfc84985d75756f57011554533903f3e8 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 22:29:18 +0000
Subject: [PATCH 519/868] added
 Test02_ReconnectLDAPObject.test_reconnect_get_state

---
 Tests/t_ldapobject.py | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index af83e46..ec32b16 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -7,6 +7,7 @@
 
 import os
 import unittest
+import pickle
 from slapdtest import SlapdTestCase
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
@@ -212,6 +213,31 @@ def test_reconnect_simple_bind(self):
         self.server.restart()
         self.assertEqual(l.whoami_s(), 'dn:'+bind_dn)
 
+    def test_reconnect_get_state(self):
+        l1 = self.ldap_object_class(self.server.ldapi_uri)
+        bind_dn = 'cn=user1,'+self.server.suffix
+        l1.simple_bind_s(bind_dn, 'user1_pw')
+        self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
+        self.assertEqual(
+            l1.__getstate__(),
+            {
+                '_last_bind': (
+                    SimpleLDAPObject.simple_bind_s,
+                    ('cn=user1,dc=slapd-test,dc=python-ldap,dc=org', 'user1_pw'),
+                    {}
+                ),
+                '_options': [(17, 3)],
+                '_reconnects_done': 0L,
+                '_retry_delay': 60.0,
+                '_retry_max': 1,
+                '_start_tls': 0,
+                '_trace_level': 0,
+                '_trace_stack_limit': 5,
+                '_uri': self.server.ldapi_uri,
+                'timeout': -1,
+            },
+        )
+
 
 if __name__ == '__main__':
     unittest.main()

From da2d43dd9af9cbcf38a1e3cf037fd0929af62516 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 22:29:39 +0000
Subject: [PATCH 520/868] added
 Test02_ReconnectLDAPObject.test_reconnect_get_state

---
 Tests/t_ldapobject.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index ec32b16..dc3221e 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -223,7 +223,7 @@ def test_reconnect_get_state(self):
             {
                 '_last_bind': (
                     SimpleLDAPObject.simple_bind_s,
-                    ('cn=user1,dc=slapd-test,dc=python-ldap,dc=org', 'user1_pw'),
+                    (bind_dn, 'user1_pw'),
                     {}
                 ),
                 '_options': [(17, 3)],

From 657ea2b47c958c98f3f591c1bcbe931f514a351d Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 22:34:22 +0000
Subject: [PATCH 521/868] (re)numbered test classes and methods

---
 Tests/t_ldapobject.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index dc3221e..9defe7c 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -57,7 +57,7 @@
 """
 
 
-class Test01_SimpleLDAPObject(SlapdTestCase):
+class Test00_SimpleLDAPObject(SlapdTestCase):
     """
     test LDAP search operations
     """
@@ -66,7 +66,7 @@ class Test01_SimpleLDAPObject(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        super(Test01_SimpleLDAPObject, cls).setUpClass()
+        super(Test00_SimpleLDAPObject, cls).setUpClass()
         # insert some Foo* objects via ldapadd
         cls.server.ldapadd(
             LDIF_TEMPLATE % {
@@ -85,7 +85,7 @@ def setUp(self):
             # open local LDAP connection
             self._ldap_conn = self._open_ldap_conn()
 
-    def test_search_subtree(self):
+    def test001_search_subtree(self):
         result = self._ldap_conn.search_s(
             self.server.suffix,
             ldap.SCOPE_SUBTREE,
@@ -115,7 +115,7 @@ def test_search_subtree(self):
             ]
         )
 
-    def test_search_onelevel(self):
+    def test002_search_onelevel(self):
         result = self._ldap_conn.search_s(
             self.server.suffix,
             ldap.SCOPE_ONELEVEL,
@@ -141,7 +141,7 @@ def test_search_onelevel(self):
             ]
         )
 
-    def test_search_oneattr(self):
+    def test003_search_oneattr(self):
         result = self._ldap_conn.search_s(
             self.server.suffix,
             ldap.SCOPE_SUBTREE,
@@ -154,7 +154,7 @@ def test_search_oneattr(self):
             [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': ['Foo4']})]
         )
 
-    def test_errno107(self):
+    def test004_errno107(self):
         l = self.ldap_object_class('ldap://127.0.0.1:42')
         try:
             m = l.simple_bind_s("", "")
@@ -169,7 +169,7 @@ def test_errno107(self):
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 
-    def test_invalid_credentials(self):
+    def test005_invalid_credentials(self):
         l = self.ldap_object_class(self.server.ldap_uri)
         # search with invalid filter
         try:
@@ -180,7 +180,7 @@ def test_invalid_credentials(self):
         else:
             self.fail("expected INVALID_CREDENTIALS, got %r" % r)
 
-    def test_sasl_extenal_bind_s(self):
+    def test006_sasl_extenal_bind_s(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s()
         self.assertEqual(l.whoami_s(), 'dn:'+self.server.root_dn.lower())
@@ -190,14 +190,14 @@ def test_sasl_extenal_bind_s(self):
         self.assertEqual(l.whoami_s(), authz_id.lower())
         
 
-class Test02_ReconnectLDAPObject(Test01_SimpleLDAPObject):
+class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """
     test ReconnectLDAPObject by restarting slapd
     """
 
     ldap_object_class = ReconnectLDAPObject
 
-    def test_reconnect_sasl_external(self):
+    def test101_reconnect_sasl_external(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s()
         authz_id = l.whoami_s()
@@ -205,7 +205,7 @@ def test_reconnect_sasl_external(self):
         self.server.restart()
         self.assertEqual(l.whoami_s(), authz_id)
 
-    def test_reconnect_simple_bind(self):
+    def test102_reconnect_simple_bind(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         bind_dn = 'cn=user1,'+self.server.suffix
         l.simple_bind_s(bind_dn, 'user1_pw')
@@ -213,7 +213,7 @@ def test_reconnect_simple_bind(self):
         self.server.restart()
         self.assertEqual(l.whoami_s(), 'dn:'+bind_dn)
 
-    def test_reconnect_get_state(self):
+    def test103_reconnect_get_state(self):
         l1 = self.ldap_object_class(self.server.ldapi_uri)
         bind_dn = 'cn=user1,'+self.server.suffix
         l1.simple_bind_s(bind_dn, 'user1_pw')

From be191b1ff4e53a827349f5f90443d7fb34d76352 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 23:00:18 +0000
Subject: [PATCH 522/868] added
 Test01_ReconnectLDAPObject.test104_reconnect_restore()

---
 Tests/t_ldapobject.py | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 9defe7c..dfe2412 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -222,7 +222,7 @@ def test103_reconnect_get_state(self):
             l1.__getstate__(),
             {
                 '_last_bind': (
-                    SimpleLDAPObject.simple_bind_s,
+                    'simple_bind_s',
                     (bind_dn, 'user1_pw'),
                     {}
                 ),
@@ -238,6 +238,16 @@ def test103_reconnect_get_state(self):
             },
         )
 
+    def test104_reconnect_restore(self):
+        l1 = self.ldap_object_class(self.server.ldapi_uri)
+        bind_dn = 'cn=user1,'+self.server.suffix
+        l1.simple_bind_s(bind_dn, 'user1_pw')
+        self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
+        l1_state = pickle.dumps(l1)
+        del l1
+        l2 = pickle.loads(l1_state)
+        self.assertEqual(l2.whoami_s(), 'dn:'+bind_dn)
+
 
 if __name__ == '__main__':
     unittest.main()

From cdd3a41d8512a480613d95aeac945b6f8a39b238 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 23:01:50 +0000
Subject: [PATCH 523/868] fixed pickling and restoring of ReconnectLDAPObject,
 avoid .has_key() in ldap.ldapobject

---
 CHANGES                |  3 +++
 Lib/ldap/ldapobject.py | 32 ++++++++++++++++++--------------
 2 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/CHANGES b/CHANGES
index aad549c..2c280ac 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,7 @@ Released 2.5.2 2017-11-xx
 Changes since 2.5.1:
 
 Modules/
+* PyBytes_ instead of PyString_ and added PyInt_FromLong compat macro
 * moved code from version.c to ldapmodule.c
 * removed obsolete back-ward compability constants from common.h
 * build checks whether LDAP_API_VERSION is OpenLDAP 2.4.x
@@ -11,12 +12,14 @@ Modules/
 
 Lib/
 * removed all dependencies on modules string and types
+* removed use of .has_key()
 * new global constant ldap.LIBLDAP_API_INFO
 * right after importing _ldap there is a call into libldap to initialize it
 * method .decodeControlValue() of SSSResponseControl and VLVResponseControl
   does not set class attribute result_code anymore
 * always use bytes() for UUID() constructor in ldap.syncrepl
 * module ldif now uses functions b64encode() and b64decode()
+* fixed pickling and restoring of ReconnectLDAPObject
 
 Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index f4e61da..e374858 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -100,7 +100,7 @@ def _ldap_call(self,func,*args,**kwargs):
     except LDAPError, e:
       exc_type,exc_value,exc_traceback = sys.exc_info()
       try:
-        if not e.args[0].has_key('info') and e.args[0].has_key('errno'):
+        if 'info' not in e.args[0] and 'errno' in e.args[0]:
           e.args[0]['info'] = strerror(e.args[0]['errno'])
       except IndexError:
         pass
@@ -123,7 +123,7 @@ def __setattr__(self,name,value):
   def __getattr__(self,name):
     if name in self.CLASSATTR_OPTION_MAPPING:
       return self.get_option(self.CLASSATTR_OPTION_MAPPING[name])
-    elif self.__dict__.has_key(name):
+    elif name in self.__dict__:
       return self.__dict__[name]
     else:
       raise AttributeError,'%s has no attribute %s' % (
@@ -807,12 +807,13 @@ class ReconnectLDAPObject(SimpleLDAPObject):
   application.
   """
 
-  __transient_attrs__ = {
-    '_l':None,
-    '_ldap_object_lock':None,
-    '_trace_file':None,
-    '_reconnect_lock':None,
-  }
+  __transient_attrs__ = set([
+    '_l',
+    '_ldap_object_lock',
+    '_trace_file',
+    '_reconnect_lock',
+    '_last_bind',
+  ])
 
   def __init__(
     self,uri,
@@ -840,15 +841,18 @@ def __init__(
 
   def __getstate__(self):
     """return data representation for pickled object"""
-    d = {}
-    for k,v in self.__dict__.items():
-      if not self.__transient_attrs__.has_key(k):
-        d[k] = v
-    return d
+    state = dict([
+        (k,v)
+        for k,v in self.__dict__.items()
+        if k not in self.__transient_attrs__
+    ])
+    state['_last_bind'] = self._last_bind[0].__name__, self._last_bind[1], self._last_bind[2]
+    return state
 
   def __setstate__(self,d):
     """set up the object from pickled data"""
     self.__dict__.update(d)
+    self._last_bind = getattr(SimpleLDAPObject, self._last_bind[0]), self._last_bind[1], self._last_bind[2]
     self._ldap_object_lock = self._ldap_lock()
     self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
     self._trace_file = sys.stdout
@@ -918,7 +922,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
     return # reconnect()
 
   def _apply_method_s(self,func,*args,**kwargs):
-    if not self.__dict__.has_key('_l'):
+    if not hasattr(self,'_l'):
       self.reconnect(self._uri,retry_max=self._retry_max,retry_delay=self._retry_delay)
     try:
       return func(self,*args,**kwargs)

From 8bded9cfd8a0fc1750c9d56a8f7abc083a47adb2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 23:06:52 +0000
Subject: [PATCH 524/868] ldap.cidict: avoid using .has_key()

---
 Lib/ldap/cidict.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index d36f8c3..07832ef 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -71,7 +71,7 @@ def strlist_minus(a,b):
   result = [
     elt
     for elt in a
-    if not temp.has_key(elt)
+    if elt not in temp
   ]
   return result
 
@@ -86,7 +86,7 @@ def strlist_intersection(a,b):
   result = [
     temp[elt]
     for elt in b
-    if temp.has_key(elt)
+    if elt in temp
   ]
   return result
 

From 6615bb1b7d9441a976ad6f0f79f0e5755b51c336 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 23:33:16 +0000
Subject: [PATCH 525/868] modifyModlist(): avoid map(None, ...)

---
 Lib/ldap/modlist.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 99e4a18..6f4bf1e 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -74,10 +74,11 @@ def modifyModlist(
       if not replace_attr_value:
         if attrtype_lower in case_ignore_attr_types:
           norm_func = str.lower
+          old_value_set = set(map(str.lower,old_value))
+          new_value_set = set(map(str.lower,new_value))
         else:
-          norm_func = None
-        old_value_set=set(map(norm_func,old_value))
-        new_value_set=set(map(norm_func,new_value))
+          old_value_set = set(old_value)
+          new_value_set = set(new_value)
         replace_attr_value = new_value_set != old_value_set
       if replace_attr_value:
         modlist.append((ldap.MOD_DELETE,attrtype,None))

From 3597f2a2fcb13ecd1a774a5cfcb534f437d437de Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sat, 18 Nov 2017 23:57:01 +0000
Subject: [PATCH 526/868] a bit of PEP-8 for ldap.logger

---
 Lib/ldap/logger.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/Lib/ldap/logger.py b/Lib/ldap/logger.py
index d955c2e..4db961e 100644
--- a/Lib/ldap/logger.py
+++ b/Lib/ldap/logger.py
@@ -5,15 +5,15 @@
 
 import logging
 
-class logging_file_class:
+class logging_file_class(object):
 
-  def __init__(self,logging_level):
-    self._logging_level = logging_level
+    def __init__(self, logging_level):
+        self._logging_level = logging_level
 
-  def write(self,msg):
-    logging.log(self._logging_level,msg[:-1])
+    def write(self, msg):
+        logging.log(self._logging_level, msg[:-1])
 
-  def flush(self):
-    return
+    def flush(self):
+        return
 
 logging_file_obj = logging_file_class(logging.DEBUG)

From 4944d9980d34db889a74f842d4897fe276849649 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 00:01:13 +0000
Subject: [PATCH 527/868] more obsolete docstring content removed

---
 Lib/ldap/dn.py        |  3 ---
 Lib/ldap/functions.py | 12 ------------
 Lib/ldap/sasl.py      |  3 ---
 3 files changed, 18 deletions(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index daab8ab..1d70058 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -2,9 +2,6 @@
 dn.py - misc stuff for handling distinguished names (see RFC 4514)
 
 See https://www.python-ldap.org/ for details.
-
-Compability:
-- Tested with Python 2.0+
 """
 
 from ldap.pkginfo import __version__
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index ea763fa..6ddab54 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -2,18 +2,6 @@
 functions.py - wraps functions of module _ldap
 
 See https://www.python-ldap.org/ for details.
-
-Compability:
-- Tested with Python 2.0+ but should work with Python 1.5.x
-- functions should behave exactly the same like in _ldap
-
-Usage:
-Directly imported by ldap/__init__.py. The symbols of _ldap are
-overridden.
-
-Thread-lock:
-Basically calls into the LDAP lib are serialized by the module-wide
-lock _ldapmodule_lock.
 """
 
 from ldap import __version__
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index 81438cc..77d8ee2 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -10,9 +10,6 @@
 LDAPObject's sasl_bind_s() method
 Implementing support for new sasl mechanism is very easy --- see
 the examples of digest_md5 and gssapi.
-
-Compability:
-- Tested with Python 2.0+ but should work with Python 1.5.x
 """
 
 from ldap import __version__

From e8eb3eeb9cd48a0be785fa53d7d1e2a91a3b5935 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 00:10:42 +0000
Subject: [PATCH 528/868] a bit of PEP-8 for ldap.sasl

---
 Lib/ldap/sasl.py | 71 +++++++++++++++++++++++++++---------------------
 1 file changed, 40 insertions(+), 31 deletions(-)

diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index 77d8ee2..d67153d 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -15,18 +15,19 @@
 from ldap import __version__
 
 if __debug__:
-  # Tracing is only supported in debugging mode
-  import traceback
-  from ldap import _trace_level,_trace_file,_trace_stack_limit
+    # Tracing is only supported in debugging mode
+    from ldap import _trace_level, _trace_file
+
 
 # These are the SASL callback id's , as defined in sasl.h
-CB_USER        = 0x4001
-CB_AUTHNAME    = 0x4002
-CB_LANGUAGE    = 0x4003
-CB_PASS        = 0x4004
-CB_ECHOPROMPT  = 0x4005
-CB_NOECHOPROMPT= 0x4006
-CB_GETREALM    = 0x4008
+CB_USER = 0x4001
+CB_AUTHNAME = 0x4002
+CB_LANGUAGE = 0x4003
+CB_PASS = 0x4004
+CB_ECHOPROMPT = 0x4005
+CB_NOECHOPROMPT = 0x4006
+CB_GETREALM = 0x4008
+
 
 class sasl:
     """This class handles SASL interactions for authentication.
@@ -35,7 +36,7 @@ class sasl:
     specific SASL authentication mechanisms, this method can be
     overridden"""
 
-    def __init__(self,cb_value_dict,mech):
+    def __init__(self, cb_value_dict, mech):
         """ The (generic) base class takes a cb_value_dictionary of
         question-answer pairs. Questions are specified by the respective
         SASL callback id's. The mech argument is a string that specifies
@@ -43,7 +44,7 @@ def __init__(self,cb_value_dict,mech):
         self.cb_value_dict = cb_value_dict or {}
         self.mech = mech
 
-    def callback(self,cb_id,challenge,prompt,defresult):
+    def callback(self, cb_id, challenge, prompt, defresult):
         """ The callback method will be called by the sasl_bind_s()
         method several times. Each time it will provide the id, which
         tells us what kind of information is requested (the CB_ ...
@@ -61,46 +62,54 @@ def callback(self,cb_id,challenge,prompt,defresult):
 
         # The following print command might be useful for debugging
         # new sasl mechanisms. So it is left here
-        cb_result = self.cb_value_dict.get(cb_id,defresult) or ''
+        cb_result = self.cb_value_dict.get(cb_id, defresult) or ''
         if __debug__:
-          if _trace_level>=1:
-            _trace_file.write("*** id=%d, challenge=%s, prompt=%s, defresult=%s\n-> %s\n" % (
-                cb_id, challenge, prompt, repr(defresult), repr(self.cb_value_dict.get(cb_result))
-              ))
+            if _trace_level >= 1:
+                _trace_file.write("*** id=%d, challenge=%s, prompt=%s, defresult=%s\n-> %s\n" % (
+                    cb_id,
+                    challenge,
+                    prompt,
+                    repr(defresult),
+                    repr(self.cb_value_dict.get(cb_result))
+                ))
         return cb_result
 
 
 class cram_md5(sasl):
     """This class handles SASL CRAM-MD5 authentication."""
 
-    def __init__(self,authc_id, password, authz_id=""):
-        auth_dict = {CB_AUTHNAME:authc_id, CB_PASS:password,
-                     CB_USER:authz_id}
-        sasl.__init__(self,auth_dict,"CRAM-MD5")
+    def __init__(self, authc_id, password, authz_id=""):
+        auth_dict = {
+            CB_AUTHNAME: authc_id,
+            CB_PASS: password,
+            CB_USER: authz_id,
+        }
+        sasl.__init__(self, auth_dict, "CRAM-MD5")
 
 
 class digest_md5(sasl):
     """This class handles SASL DIGEST-MD5 authentication."""
 
-    def __init__(self,authc_id, password, authz_id=""):
-        auth_dict = {CB_AUTHNAME:authc_id, CB_PASS:password,
-                     CB_USER:authz_id}
-        sasl.__init__(self,auth_dict,"DIGEST-MD5")
+    def __init__(self, authc_id, password, authz_id=""):
+        auth_dict = {
+            CB_AUTHNAME: authc_id,
+            CB_PASS: password,
+            CB_USER: authz_id,
+        }
+        sasl.__init__(self, auth_dict, "DIGEST-MD5")
 
 
 class gssapi(sasl):
     """This class handles SASL GSSAPI (i.e. Kerberos V)
     authentication."""
 
-    def __init__(self,authz_id=""):
-        sasl.__init__(self, {CB_USER:authz_id},"GSSAPI")
+    def __init__(self, authz_id=""):
+        sasl.__init__(self, {CB_USER: authz_id}, "GSSAPI")
 
 
 class external(sasl):
     """This class handles SASL EXTERNAL authentication
     (i.e. X.509 client certificate)"""
 
-    def __init__(self,authz_id=""):
-        sasl.__init__(self, {CB_USER:authz_id},"EXTERNAL")
-
-
+    def __init__(self, authz_id=""):
+        sasl.__init__(self, {CB_USER: authz_id}, "EXTERNAL")

From 1c23992b1b8721f4922611bb266ca8ea11ecf331 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 00:12:30 +0000
Subject: [PATCH 529/868] docstring line-wrapping

---
 Lib/ldap/sasl.py | 37 +++++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index d67153d..34d4cb0 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -30,22 +30,27 @@
 
 
 class sasl:
-    """This class handles SASL interactions for authentication.
+    """
+    This class handles SASL interactions for authentication.
     If an instance of this class is passed to ldap's sasl_bind_s()
     method, the library will call its callback() method. For
     specific SASL authentication mechanisms, this method can be
-    overridden"""
+    overridden
+    """
 
     def __init__(self, cb_value_dict, mech):
-        """ The (generic) base class takes a cb_value_dictionary of
+        """
+        The (generic) base class takes a cb_value_dictionary of
         question-answer pairs. Questions are specified by the respective
         SASL callback id's. The mech argument is a string that specifies
-        the SASL mechaninsm to be uesd."""
+        the SASL mechaninsm to be uesd.
+        """
         self.cb_value_dict = cb_value_dict or {}
         self.mech = mech
 
     def callback(self, cb_id, challenge, prompt, defresult):
-        """ The callback method will be called by the sasl_bind_s()
+        """
+        The callback method will be called by the sasl_bind_s()
         method several times. Each time it will provide the id, which
         tells us what kind of information is requested (the CB_ ...
         constants above). The challenge might be a short (english) text
@@ -58,7 +63,8 @@ def callback(self, cb_id, challenge, prompt, defresult):
         cb_value_dictionary. Note that the current callback interface is not very
         useful for writing generic sasl GUIs, which would need to know all
         the questions to ask, before the answers are returned to the sasl
-        lib (in contrast to one question at a time)."""
+        lib (in contrast to one question at a time).
+        """
 
         # The following print command might be useful for debugging
         # new sasl mechanisms. So it is left here
@@ -76,7 +82,9 @@ def callback(self, cb_id, challenge, prompt, defresult):
 
 
 class cram_md5(sasl):
-    """This class handles SASL CRAM-MD5 authentication."""
+    """
+    This class handles SASL CRAM-MD5 authentication.
+    """
 
     def __init__(self, authc_id, password, authz_id=""):
         auth_dict = {
@@ -88,7 +96,9 @@ def __init__(self, authc_id, password, authz_id=""):
 
 
 class digest_md5(sasl):
-    """This class handles SASL DIGEST-MD5 authentication."""
+    """
+    This class handles SASL DIGEST-MD5 authentication.
+    """
 
     def __init__(self, authc_id, password, authz_id=""):
         auth_dict = {
@@ -100,16 +110,19 @@ def __init__(self, authc_id, password, authz_id=""):
 
 
 class gssapi(sasl):
-    """This class handles SASL GSSAPI (i.e. Kerberos V)
-    authentication."""
+    """
+    This class handles SASL GSSAPI (i.e. Kerberos V) authentication.
+    """
 
     def __init__(self, authz_id=""):
         sasl.__init__(self, {CB_USER: authz_id}, "GSSAPI")
 
 
 class external(sasl):
-    """This class handles SASL EXTERNAL authentication
-    (i.e. X.509 client certificate)"""
+    """
+    This class handles SASL EXTERNAL authentication
+    (i.e. X.509 client certificate)
+    """
 
     def __init__(self, authz_id=""):
         sasl.__init__(self, {CB_USER: authz_id}, "EXTERNAL")

From 9935cb8504964ee1d6bcb4b6dd9ed85335d3453a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 13:52:04 +0000
Subject: [PATCH 530/868] added more tests for sub-module ldap.dn

---
 CHANGES            |   1 +
 Tests/t_ldap_dn.py | 201 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 202 insertions(+)

diff --git a/CHANGES b/CHANGES
index 2c280ac..7aaef0f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -24,6 +24,7 @@ Lib/
 Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
 * added LDIF test with folded, base64-encoded attribute
+* added more tests for sub-module ldap.dn
 
 ----------------------------------------------------------------
 Released 2.5.1 2017-11-12
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 043cc70..9a3c54a 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -34,5 +34,206 @@ def test_is_dn(self):
             True
         )
 
+    def test_escape_dn_chars(self):
+        """
+        test function escape_dn_chars()
+        """
+        self.assertEqual(ldap.dn.escape_dn_chars('foobar'), 'foobar')
+        self.assertEqual(ldap.dn.escape_dn_chars('foo,bar'), 'foo\\,bar')
+        self.assertEqual(ldap.dn.escape_dn_chars('foo=bar'), 'foo\\=bar')
+        self.assertEqual(ldap.dn.escape_dn_chars('foo#bar'), 'foo#bar')
+        self.assertEqual(ldap.dn.escape_dn_chars('#foobar'), '\\#foobar')
+        self.assertEqual(ldap.dn.escape_dn_chars('foo bar'), 'foo bar')
+        self.assertEqual(ldap.dn.escape_dn_chars(' foobar'), '\\ foobar')
+
+    def test_str2dn(self):
+        """
+        test function str2dn()
+        """
+        self.assertEqual(ldap.dn.str2dn(''), [])
+        self.assertEqual(
+            ldap.dn.str2dn('uid=test42,ou=Testing,dc=example,dc=com'),
+            [
+                [('uid', 'test42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
+        self.assertEqual(
+            ldap.dn.str2dn('uid=test42+uidNumber=42,ou=Testing,dc=example,dc=com'),
+            [
+                [('uid', 'test42', 1), ('uidNumber', '42', 1) ],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
+        self.assertEqual(
+            ldap.dn.str2dn('uid=test42,ou=Testing,dc=example,dc=com', flags=0),
+            [
+                [('uid', 'test42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
+        self.assertEqual(
+            ldap.dn.str2dn('uid=test\\, 42,ou=Testing,dc=example,dc=com', flags=0),
+            [
+                [('uid', 'test, 42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
+        self.assertEqual(
+            ldap.dn.str2dn('cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com', flags=0),
+            [
+                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
+        self.assertEqual(
+            ldap.dn.str2dn('cn=\\c3\\a4\\c3\\b6\\c3\\bc\\c3\\84\\c3\\96\\c3\\9c\\c3\\9f,dc=example,dc=com', flags=0),
+            [
+                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
+
+    def test_dn2str(self):
+        """
+        test function dn2str()
+        """
+        self.assertEqual(ldap.dn.str2dn(''), [])
+        self.assertEqual(
+            ldap.dn.dn2str([
+                [('uid', 'test42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]),
+            'uid=test42,ou=Testing,dc=example,dc=com',
+        )
+        self.assertEqual(
+            ldap.dn.dn2str([
+                [('uid', 'test42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]),
+            'uid=test42,ou=Testing,dc=example,dc=com'
+        )
+        self.assertEqual(
+            ldap.dn.dn2str([
+                [('uid', 'test42', 1), ('uidNumber', '42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]),
+            'uid=test42+uidNumber=42,ou=Testing,dc=example,dc=com'
+        )
+        self.assertEqual(
+            ldap.dn.dn2str([
+                [('uid', 'test, 42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]),
+            'uid=test\\, 42,ou=Testing,dc=example,dc=com'
+        )
+        self.assertEqual(
+            ldap.dn.dn2str([
+                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]),
+            'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com'
+        )
+        self.assertEqual(
+            ldap.dn.dn2str([
+                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]),
+            'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com'
+        )
+
+    def test_explode_dn(self):
+        """
+        test function explode_dn()
+        """
+        self.assertEqual(ldap.dn.explode_dn(''), [])
+        self.assertEqual(
+            ldap.dn.explode_dn('uid=test42,ou=Testing,dc=example,dc=com'),
+            ['uid=test42', 'ou=Testing', 'dc=example', 'dc=com']
+        )
+        self.assertEqual(
+            ldap.dn.explode_dn('uid=test42,ou=Testing,dc=example,dc=com', flags=0),
+            ['uid=test42', 'ou=Testing', 'dc=example', 'dc=com']
+        )
+        self.assertEqual(
+            ldap.dn.explode_dn('uid=test42,ou=Testing,dc=example,dc=com', notypes=True),
+            ['test42', 'Testing', 'example', 'com']
+        )
+        self.assertEqual(
+            ldap.dn.explode_dn('uid=test\\, 42,ou=Testing,dc=example,dc=com', flags=0),
+            ['uid=test\\, 42', 'ou=Testing', 'dc=example', 'dc=com']
+        )
+        self.assertEqual(
+            ldap.dn.explode_dn('cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com', flags=0),
+            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 'dc=example', 'dc=com']
+        )
+        self.assertEqual(
+            ldap.dn.explode_dn('cn=\\c3\\a4\\c3\\b6\\c3\\bc\\c3\\84\\c3\\96\\c3\\9c\\c3\\9f,dc=example,dc=com', flags=0),
+            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 'dc=example', 'dc=com']
+        )
+
+    def test_explode_rdn(self):
+        """
+        test function explode_rdn()
+        """
+        self.assertEqual(ldap.dn.explode_rdn(''), [])
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test42'),
+            ['uid=test42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test42', notypes=False, flags=0),
+            ['uid=test42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test42', notypes=0, flags=0),
+            ['uid=test42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test42+uidNumber=42', flags=0),
+            ['uid=test42', 'uidNumber=42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test42', notypes=True),
+            ['test42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test42', notypes=1),
+            ['test42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('uid=test\\+ 42', flags=0),
+            ['uid=test\\+ 42']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', flags=0),
+            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f']
+        )
+        self.assertEqual(
+            ldap.dn.explode_rdn('cn=\\c3\\a4\\c3\\b6\\c3\\bc\\c3\\84\\c3\\96\\c3\\9c\\c3\\9f', flags=0),
+            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f']
+        )
+
+
 if __name__ == '__main__':
     unittest.main()

From 389725160295b4a8844dabf833996f4ae3bbde4a Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 15:52:43 +0000
Subject: [PATCH 531/868] ldap.dn: use Boolean for notypes

---
 Doc/ldap-dn.rst | 4 ++--
 Lib/ldap/dn.py  | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index d78f070..d896e4c 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -49,7 +49,7 @@ The :mod:`ldap.dn` module defines the following functions:
    function :func:`escape_dn_chars`.
 
 
-.. function:: explode_dn(dn [, notypes=0[, flags=0]]) -> list
+.. function:: explode_dn(dn [, notypes=False[, flags=0]]) -> list
 
    This function takes *dn* and breaks it up into its component parts.   Each part
    is known as an RDN (Relative Distinguished Name). The optional  *notypes*
@@ -60,7 +60,7 @@ The :mod:`ldap.dn` module defines the following functions:
    deprecated.
 
 
-.. function:: explode_rdn(rdn [, notypes=0[, flags=0]]) -> list
+.. function:: explode_rdn(rdn [, notypes=False[, flags=0]]) -> list
 
    This function takes a (multi-valued) *rdn* and breaks it up  into a list of
    characteristic attributes. The optional  *notypes* parameter is used to specify
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 1d70058..3298551 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -62,9 +62,9 @@ def dn2str(dn):
     for rdn in dn
   ])
 
-def explode_dn(dn,notypes=0,flags=0):
+def explode_dn(dn, notypes=False, flags=0):
   """
-  explode_dn(dn [, notypes=0]) -> list
+  explode_dn(dn [, notypes=False [, flags=0]]) -> list
 
   This function takes a DN and breaks it up into its component parts.
   The notypes parameter is used to specify that only the component's
@@ -88,9 +88,9 @@ def explode_dn(dn,notypes=0,flags=0):
   return rdn_list
 
 
-def explode_rdn(rdn,notypes=0,flags=0):
+def explode_rdn(rdn, notypes=False, flags=0):
   """
-  explode_rdn(rdn [, notypes=0]) -> list
+  explode_rdn(rdn [, notypes=0 [, flags=0]]) -> list
 
   This function takes a RDN and breaks it up into its component parts
   if it is a multi-valued RDN.

From 5bdd161747ca2be71c1cea8a78d13a1f3a381e81 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 16:39:55 +0000
Subject: [PATCH 532/868] use example.com in examples and tests

---
 Doc/ldap-dn.rst | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/Doc/ldap-dn.rst b/Doc/ldap-dn.rst
index d896e4c..c22a64c 100644
--- a/Doc/ldap-dn.rst
+++ b/Doc/ldap-dn.rst
@@ -85,26 +85,26 @@ Splitting a LDAPv3 DN to AVA level. Note that both examples have the same result
 but in the first example the non-ASCII chars are passed as is (byte buffer string)
 whereas in the second example the hex-encoded DN representation are passed to the function.
 
->>> ldap.dn.str2dn('cn=Michael Str\xc3\xb6der,dc=stroeder,dc=com',flags=ldap.DN_FORMAT_LDAPV3)
-[[('cn', 'Michael Str\xc3\xb6der', 4)], [('dc', 'stroeder', 1)], [('dc', 'com', 1)]]
->>> ldap.dn.str2dn('cn=Michael Str\C3\B6der,dc=stroeder,dc=com',flags=ldap.DN_FORMAT_LDAPV3)
-[[('cn', 'Michael Str\xc3\xb6der', 4)], [('dc', 'stroeder', 1)], [('dc', 'com', 1)]]
+>>> ldap.dn.str2dn('cn=Michael Str\xc3\xb6der,dc=example,dc=com',flags=ldap.DN_FORMAT_LDAPV3)
+[[('cn', 'Michael Str\xc3\xb6der', 4)], [('dc', 'example', 1)], [('dc', 'com', 1)]]
+>>> ldap.dn.str2dn('cn=Michael Str\C3\B6der,dc=example,dc=com',flags=ldap.DN_FORMAT_LDAPV3)
+[[('cn', 'Michael Str\xc3\xb6der', 4)], [('dc', 'example', 1)], [('dc', 'com', 1)]]
 
 
 Splitting a LDAPv2 DN into RDN parts:
 
->>> ldap.dn.explode_dn('cn=Michael Stroeder;dc=stroeder;dc=com',flags=ldap.DN_FORMAT_LDAPV2)
-['cn=Michael Stroeder', 'dc=stroeder', 'dc=com']
+>>> ldap.dn.explode_dn('cn=John Doe;dc=example;dc=com',flags=ldap.DN_FORMAT_LDAPV2)
+['cn=John Doe', 'dc=example', 'dc=com']
 
 
 Splitting a multi-valued RDN:
 
->>> ldap.dn.explode_rdn('cn=Michael Stroeder+mail=michael@stroeder.com',flags=ldap.DN_FORMAT_LDAPV2)
-['cn=Michael Stroeder', 'mail=michael@stroeder.com']
+>>> ldap.dn.explode_rdn('cn=John Doe+mail=john.doe@example.com',flags=ldap.DN_FORMAT_LDAPV2)
+['cn=John Doe', 'mail=john.doe@example.com']
 
 Splitting a LDAPv3 DN with a multi-valued RDN into its AVA parts:
 
 
->>> ldap.dn.str2dn('cn=Michael Stroeder+mail=michael@stroeder.com,dc=stroeder,dc=com')
-[[('cn', 'Michael Stroeder', 1), ('mail', 'michael@stroeder.com', 1)], [('dc', 'stroeder', 1)], [('dc', 'com', 1)]]
+>>> ldap.dn.str2dn('cn=John Doe+mail=john.doe@example.com,dc=example,dc=com')
+[[('cn', 'John Doe', 1), ('mail', 'john.doe@example.com', 1)], [('dc', 'example', 1)], [('dc', 'com', 1)]]
 

From 4a9591ca1ef4f93bcd2a3d4429969d24c766d428 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 16:50:18 +0000
Subject: [PATCH 533/868] removed class ldap.ldapobject.NonblockingLDAPObject

---
 CHANGES                |  1 +
 Lib/ldap/ldapobject.py | 37 +------------------------------------
 2 files changed, 2 insertions(+), 36 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7aaef0f..1d3bba0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,7 @@ Modules/
 Lib/
 * removed all dependencies on modules string and types
 * removed use of .has_key()
+* removed class ldap.ldapobject.NonblockingLDAPObject
 * new global constant ldap.LIBLDAP_API_INFO
 * right after importing _ldap there is a call into libldap to initialize it
 * method .decodeControlValue() of SSSResponseControl and VLVResponseControl
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index e374858..855dabf 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -6,12 +6,11 @@
 
 from os import strerror
 
-from ldap import __version__
+from ldap.pkginfo import __version__, __author__, __license__
 
 __all__ = [
   'LDAPObject',
   'SimpleLDAPObject',
-  'NonblockingLDAPObject',
   'ReconnectLDAPObject',
 ]
 
@@ -760,40 +759,6 @@ def get_naming_contexts(self):
     ).get('namingContexts', [])
 
 
-class NonblockingLDAPObject(SimpleLDAPObject):
-
-  def __init__(self,uri,trace_level=0,trace_file=None,result_timeout=-1):
-    self._result_timeout = result_timeout
-    SimpleLDAPObject.__init__(self,uri,trace_level,trace_file)
-
-  def result(self,msgid=ldap.RES_ANY,all=1,timeout=-1):
-    """
-    """
-    ldap_result = self._ldap_call(self._l.result,msgid,0,self._result_timeout)
-    if not all:
-      return ldap_result
-    start_time = time.time()
-    all_results = []
-    while all:
-      while ldap_result[0] is None:
-        if (timeout>=0) and (time.time()-start_time>timeout):
-          self._ldap_call(self._l.abandon,msgid)
-          raise ldap.TIMEOUT(
-            "LDAP time limit (%d secs) exceeded." % (timeout)
-          )
-        time.sleep(0.00001)
-        ldap_result = self._ldap_call(self._l.result,msgid,0,self._result_timeout)
-      if ldap_result[1] is None:
-        break
-      all_results.extend(ldap_result[1])
-      ldap_result = None,None
-    return all_results
-
-  def search_st(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,timeout=-1):
-    msgid = self.search(base,scope,filterstr,attrlist,attrsonly)
-    return self.result(msgid,all=1,timeout=timeout)
-
-
 class ReconnectLDAPObject(SimpleLDAPObject):
   """
   In case of server failure (ldap.SERVER_DOWN) the implementations

From 0a1e520048db007b31515de0941c26fd0673abed Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 18:00:49 +0000
Subject: [PATCH 534/868] added ldap.dn tests with ldap.DN_FORMAT_LDAPV2

---
 Tests/t_ldap_dn.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 9a3c54a..97274f3 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -78,6 +78,15 @@ def test_str2dn(self):
                 [('dc', 'com', 1)]
             ]
         )
+        self.assertEqual(
+            ldap.dn.str2dn('uid=test42; ou=Testing; dc=example; dc=com', flags=ldap.DN_FORMAT_LDAPV2),
+            [
+                [('uid', 'test42', 1)],
+                [('ou', 'Testing', 1)],
+                [('dc', 'example', 1)],
+                [('dc', 'com', 1)]
+            ]
+        )
         self.assertEqual(
             ldap.dn.str2dn('uid=test\\, 42,ou=Testing,dc=example,dc=com', flags=0),
             [
@@ -175,6 +184,10 @@ def test_explode_dn(self):
             ldap.dn.explode_dn('uid=test42,ou=Testing,dc=example,dc=com', flags=0),
             ['uid=test42', 'ou=Testing', 'dc=example', 'dc=com']
         )
+        self.assertEqual(
+            ldap.dn.explode_dn('uid=test42; ou=Testing; dc=example; dc=com', flags=ldap.DN_FORMAT_LDAPV2),
+            ['uid=test42', 'ou=Testing', 'dc=example', 'dc=com']
+        )
         self.assertEqual(
             ldap.dn.explode_dn('uid=test42,ou=Testing,dc=example,dc=com', notypes=True),
             ['test42', 'Testing', 'example', 'com']

From 101d2e21fe7144b517f3232b3a33239d00517bf3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 18:02:05 +0000
Subject: [PATCH 535/868] bumped Doc version to 2.5.2.0

---
 Doc/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index ab7c509..9c322de 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -42,7 +42,7 @@
 # The short X.Y version.
 version = '2.5'
 # The full version, including alpha/beta/rc tags.
-release = '2.5.1.0'
+release = '2.5.2.0'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From a0e459fc3231dbdf8f3cd2db6e89b373e7cecdd2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 18:54:28 +0000
Subject: [PATCH 536/868] ldap.resiter: PEP-8 and a small fix

---
 Lib/ldap/resiter.py | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/Lib/ldap/resiter.py b/Lib/ldap/resiter.py
index bb72618..dc912eb 100644
--- a/Lib/ldap/resiter.py
+++ b/Lib/ldap/resiter.py
@@ -4,21 +4,38 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from ldap.pkginfo import __version__, __author__, __license__
 
-class ResultProcessor:
-  """
-  Mix-in class used with ldap.ldapopbject.LDAPObject or derived classes.
-  """
 
-  def allresults(self,msgid,timeout=-1,add_ctrls=0):
+class ResultProcessor:
     """
-    Generator function which returns an iterator for processing all LDAP operation
-    results of the given msgid retrieved with LDAPObject.result3() -> 4-tuple
+    Mix-in class used with ldap.ldapopbject.LDAPObject or derived classes.
     """
-    result_type,result_list,result_msgid,result_serverctrls,_,_ = self.result4(msgid,0,timeout,add_ctrls=add_ctrls)
-    while result_type and result_list:
-      # Loop over list of search results
-      for result_item in result_list:
-        yield (result_type,result_list,result_msgid,result_serverctrls)
-      result_type,result_list,result_msgid,result_serverctrls,_,_ = self.result4(msgid,0,timeout,add_ctrls=add_ctrls)
-    return # allresults()
+
+    def allresults(self, msgid, timeout=-1, add_ctrls=0):
+        """
+        Generator function which returns an iterator for processing all LDAP operation
+        results of the given msgid like retrieved with LDAPObject.result3() -> 4-tuple
+        """
+        result_type, result_list, result_msgid, result_serverctrls, _, _ = \
+            self.result4(
+                msgid,
+                0,
+                timeout,
+                add_ctrls=add_ctrls
+            )
+        while result_type and result_list:
+            yield (
+                result_type,
+                result_list,
+                result_msgid,
+                result_serverctrls
+            )
+            result_type, result_list, result_msgid, result_serverctrls, _, _ = \
+                self.result4(
+                    msgid,
+                    0,
+                    timeout,
+                    add_ctrls=add_ctrls
+                )
+        return # allresults()

From 5bf5f3cbb966214ed6f71335210654bc3d06e6c7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 20:23:51 +0000
Subject: [PATCH 537/868] some code cosmetics in ldap.syncrepl and also a small
 fix

---
 Lib/ldap/syncrepl.py | 361 ++++++++++++++++++++++++-------------------
 1 file changed, 204 insertions(+), 157 deletions(-)

diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 93a3a2a..8442726 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -5,70 +5,79 @@
 See https://www.python-ldap.org/ for project details.
 """
 
-#__all__ = [
-#  '',
-#  '',
-#]
-
 from uuid import UUID
 
-# Imports from python-ldap 2.4+
-import ldap.ldapobject
-from ldap.controls import RequestControl,ResponseControl,KNOWN_RESPONSE_CONTROLS
-
 # Imports from pyasn1
-from pyasn1.type import tag,namedtype,namedval,univ,constraint
-from pyasn1.codec.ber import encoder,decoder
-
-__all__ = [ 'SyncreplConsumer' ]
-
-# RFC 4533:
-#
-#       syncUUID ::= OCTET STRING (SIZE(16))
-#       syncCookie ::= OCTET STRING
-
-class syncUUID(univ.OctetString):
-    subtypeSpec = constraint.ValueSizeConstraint(16,16)
-
-class syncCookie(univ.OctetString):
-    pass
-
-# 2.2.  Sync Request Control
-#
-#    The Sync Request Control is an LDAP Control [RFC4511] where the
-#    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.1 and the
-#    controlValue, an OCTET STRING, contains a BER-encoded
-#    syncRequestValue.  The criticality field is either TRUE or FALSE.
-#
-#       syncRequestValue ::= SEQUENCE {
-#           mode ENUMERATED {
-#               -- 0 unused
-#               refreshOnly       (1),
-#               -- 2 reserved
-#               refreshAndPersist (3)
-#           },
-#           cookie     syncCookie OPTIONAL,
-#           reloadHint BOOLEAN DEFAULT FALSE
-#       }
-#
-#    The Sync Request Control is only applicable to the SearchRequest
-#    Message.
-
-class syncRequestMode(univ.Enumerated):
+from pyasn1.type import tag, namedtype, namedval, univ, constraint
+from pyasn1.codec.ber import encoder, decoder
+
+from ldap.pkginfo import __version__, __author__, __license__
+from ldap.controls import RequestControl, ResponseControl, KNOWN_RESPONSE_CONTROLS
+
+__all__ = [
+    'SyncreplConsumer',
+]
+
+
+class SyncUUID(univ.OctetString):
+    """
+    syncUUID ::= OCTET STRING (SIZE(16))
+    """
+    subtypeSpec = constraint.ValueSizeConstraint(16, 16)
+
+
+class SyncCookie(univ.OctetString):
+    """
+    syncCookie ::= OCTET STRING
+    """
+
+
+class SyncRequestMode(univ.Enumerated):
+    """
+           mode ENUMERATED {
+               -- 0 unused
+               refreshOnly       (1),
+               -- 2 reserved
+               refreshAndPersist (3)
+           },
+    """
     namedValues = namedval.NamedValues(
         ('refreshOnly', 1),
         ('refreshAndPersist', 3)
     )
-    subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(1,3)
+    subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(1, 3)
 
-class syncRequestValue(univ.Sequence):
+
+class SyncRequestValue(univ.Sequence):
+    """
+       syncRequestValue ::= SEQUENCE {
+           mode ENUMERATED {
+               -- 0 unused
+               refreshOnly       (1),
+               -- 2 reserved
+               refreshAndPersist (3)
+           },
+           cookie     syncCookie OPTIONAL,
+           reloadHint BOOLEAN DEFAULT FALSE
+       }
+    """
     componentType = namedtype.NamedTypes(
-        namedtype.NamedType('mode', syncRequestMode()),
-        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.NamedType('mode', SyncRequestMode()),
+        namedtype.OptionalNamedType('cookie', SyncCookie()),
         namedtype.DefaultedNamedType('reloadHint', univ.Boolean(False))
     )
 
+
 class SyncRequestControl(RequestControl):
+    """
+    The Sync Request Control is an LDAP Control [RFC4511] where the
+    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.1 and the
+    controlValue, an OCTET STRING, contains a BER-encoded
+    syncRequestValue.  The criticality field is either TRUE or FALSE.
+    [..]
+    The Sync Request Control is only applicable to the SearchRequest
+    Message.
+    """
     controlType = '1.3.6.1.4.1.4203.1.9.1.1'
 
     def __init__(self, criticality=1, cookie=None, mode='refreshOnly', reloadHint=False):
@@ -78,62 +87,73 @@ def __init__(self, criticality=1, cookie=None, mode='refreshOnly', reloadHint=Fa
         self.reloadHint = reloadHint
 
     def encodeControlValue(self):
-        r = syncRequestValue()
-        r.setComponentByName('mode', syncRequestMode(self.mode))
+        rcv = SyncRequestValue()
+        rcv.setComponentByName('mode', SyncRequestMode(self.mode))
         if self.cookie is not None:
-            r.setComponentByName('cookie', syncCookie(self.cookie))
+            rcv.setComponentByName('cookie', SyncCookie(self.cookie))
         if self.reloadHint:
-            r.setComponentbyName('reloadHint', univ.Boolean(self.reloadHint))
-        return encoder.encode(r)
-
-# 2.3.  Sync State Control
-#
-#    The Sync State Control is an LDAP Control [RFC4511] where the
-#    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.2 and the
-#    controlValue, an OCTET STRING, contains a BER-encoded syncStateValue.
-#    The criticality is FALSE.
-#
-#       syncStateValue ::= SEQUENCE {
-#           state ENUMERATED {
-#               present (0),
-#               add (1),
-#               modify (2),
-#               delete (3)
-#           },
-#           entryUUID syncUUID,
-#           cookie    syncCookie OPTIONAL
-#       }
-#
-#    The Sync State Control is only applicable to SearchResultEntry and
-#    SearchResultReference Messages.
-
-class syncStateOp(univ.Enumerated):
+            rcv.setComponentByName('reloadHint', univ.Boolean(self.reloadHint))
+        return encoder.encode(rcv)
+
+
+class SyncStateOp(univ.Enumerated):
+    """
+           state ENUMERATED {
+               present (0),
+               add (1),
+               modify (2),
+               delete (3)
+           },
+    """
     namedValues = namedval.NamedValues(
         ('present', 0),
         ('add', 1),
         ('modify', 2),
         ('delete', 3)
     )
-    subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(0,1,2,3)
+    subtypeSpec = univ.Enumerated.subtypeSpec + constraint.SingleValueConstraint(0, 1, 2, 3)
 
-class syncStateValue(univ.Sequence):
+
+class SyncStateValue(univ.Sequence):
+    """
+       syncStateValue ::= SEQUENCE {
+           state ENUMERATED {
+               present (0),
+               add (1),
+               modify (2),
+               delete (3)
+           },
+           entryUUID syncUUID,
+           cookie    syncCookie OPTIONAL
+       }
+    """
     componentType = namedtype.NamedTypes(
-        namedtype.NamedType('state', syncStateOp()),
-        namedtype.NamedType('entryUUID', syncUUID()),
-        namedtype.OptionalNamedType('cookie', syncCookie())
+        namedtype.NamedType('state', SyncStateOp()),
+        namedtype.NamedType('entryUUID', SyncUUID()),
+        namedtype.OptionalNamedType('cookie', SyncCookie())
     )
 
+
 class SyncStateControl(ResponseControl):
+    """
+    The Sync State Control is an LDAP Control [RFC4511] where the
+    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.2 and the
+    controlValue, an OCTET STRING, contains a BER-encoded SyncStateValue.
+    The criticality is FALSE.
+    [..]
+    The Sync State Control is only applicable to SearchResultEntry and
+    SearchResultReference Messages.
+    """
     controlType = '1.3.6.1.4.1.4203.1.9.1.2'
-    opnames = ( 'present', 'add', 'modify', 'delete' )
+    opnames = ('present', 'add', 'modify', 'delete')
 
     def decodeControlValue(self, encodedControlValue):
-        d = decoder.decode(encodedControlValue, asn1Spec = syncStateValue())
+        d = decoder.decode(encodedControlValue, asn1Spec=SyncStateValue())
         state = d[0].getComponentByName('state')
         uuid = UUID(bytes=bytes(d[0].getComponentByName('entryUUID')))
         cookie = d[0].getComponentByName('cookie')
-        if cookie.hasValue():
-            self.cookie = str(self.cookie)
+        if cookie is not None and cookie.hasValue():
+            self.cookie = str(cookie)
         else:
             self.cookie = None
         self.state = self.__class__.opnames[int(state)]
@@ -141,32 +161,34 @@ def decodeControlValue(self, encodedControlValue):
 
 KNOWN_RESPONSE_CONTROLS[SyncStateControl.controlType] = SyncStateControl
 
-# 2.4.  Sync Done Control
-#
-#    The Sync Done Control is an LDAP Control [RFC4511] where the
-#    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.3 and the
-#    controlValue contains a BER-encoded syncDoneValue.  The criticality
-#    is FALSE (and hence absent).
-#
-#       syncDoneValue ::= SEQUENCE {
-#           cookie          syncCookie OPTIONAL,
-#           refreshDeletes  BOOLEAN DEFAULT FALSE
-#       }
-#
-#    The Sync Done Control is only applicable to the SearchResultDone
-#    Message.
-
-class syncDoneValue(univ.Sequence):
+
+class SyncDoneValue(univ.Sequence):
+    """
+       syncDoneValue ::= SEQUENCE {
+           cookie          syncCookie OPTIONAL,
+           refreshDeletes  BOOLEAN DEFAULT FALSE
+       }
+    """
     componentType = namedtype.NamedTypes(
-        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.OptionalNamedType('cookie', SyncCookie()),
         namedtype.DefaultedNamedType('refreshDeletes', univ.Boolean(False))
     )
 
+
 class SyncDoneControl(ResponseControl):
+    """
+    The Sync Done Control is an LDAP Control [RFC4511] where the
+    controlType is the object identifier 1.3.6.1.4.1.4203.1.9.1.3 and the
+    controlValue contains a BER-encoded syncDoneValue.  The criticality
+    is FALSE (and hence absent).
+    [..]
+    The Sync Done Control is only applicable to the SearchResultDone
+    Message.
+    """
     controlType = '1.3.6.1.4.1.4203.1.9.1.3'
 
     def decodeControlValue(self, encodedControlValue):
-        d = decoder.decode(encodedControlValue, asn1Spec = syncDoneValue())
+        d = decoder.decode(encodedControlValue, asn1Spec=SyncDoneValue())
         cookie = d[0].getComponentByName('cookie')
         if cookie.hasValue():
             self.cookie = str(cookie)
@@ -181,95 +203,121 @@ def decodeControlValue(self, encodedControlValue):
 KNOWN_RESPONSE_CONTROLS[SyncDoneControl.controlType] = SyncDoneControl
 
 
-# 2.5.  Sync Info Message
-#
-#    The Sync Info Message is an LDAP Intermediate Response Message
-#    [RFC4511] where responseName is the object identifier
-#    1.3.6.1.4.1.4203.1.9.1.4 and responseValue contains a BER-encoded
-#    syncInfoValue.  The criticality is FALSE (and hence absent).
-#
-#       syncInfoValue ::= CHOICE {
-#           newcookie      [0] syncCookie,
-#           refreshDelete  [1] SEQUENCE {
-#               cookie         syncCookie OPTIONAL,
-#               refreshDone    BOOLEAN DEFAULT TRUE
-#           },
-#           refreshPresent [2] SEQUENCE {
-#               cookie         syncCookie OPTIONAL,
-#               refreshDone    BOOLEAN DEFAULT TRUE
-#           },
-#           syncIdSet      [3] SEQUENCE {
-#               cookie         syncCookie OPTIONAL,
-#               refreshDeletes BOOLEAN DEFAULT FALSE,
-#               syncUUIDs      SET OF syncUUID
-#           }
-#       }
-#
-
-class refreshDelete(univ.Sequence):
+class RefreshDelete(univ.Sequence):
+    """
+           refreshDelete  [1] SEQUENCE {
+               cookie         syncCookie OPTIONAL,
+               refreshDone    BOOLEAN DEFAULT TRUE
+           },
+    """
     componentType = namedtype.NamedTypes(
-        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.OptionalNamedType('cookie', SyncCookie()),
         namedtype.DefaultedNamedType('refreshDone', univ.Boolean(True))
     )
 
-class refreshPresent(univ.Sequence):
+
+class RefreshPresent(univ.Sequence):
+    """
+           refreshPresent [2] SEQUENCE {
+               cookie         syncCookie OPTIONAL,
+               refreshDone    BOOLEAN DEFAULT TRUE
+           },
+    """
     componentType = namedtype.NamedTypes(
-        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.OptionalNamedType('cookie', SyncCookie()),
         namedtype.DefaultedNamedType('refreshDone', univ.Boolean(True))
     )
 
-class syncUUIDs(univ.SetOf):
-    componentType = syncUUID()
 
-class syncIdSet(univ.Sequence):
+class SyncUUIDs(univ.SetOf):
+    """
+    syncUUIDs      SET OF syncUUID
+    """
+    componentType = SyncUUID()
+
+
+class SyncIdSet(univ.Sequence):
+    """
+     syncIdSet      [3] SEQUENCE {
+         cookie         syncCookie OPTIONAL,
+         refreshDeletes BOOLEAN DEFAULT FALSE,
+         syncUUIDs      SET OF syncUUID
+     }
+    """
     componentType = namedtype.NamedTypes(
-        namedtype.OptionalNamedType('cookie', syncCookie()),
+        namedtype.OptionalNamedType('cookie', SyncCookie()),
         namedtype.DefaultedNamedType('refreshDeletes', univ.Boolean(False)),
-        namedtype.NamedType('syncUUIDs', syncUUIDs())
+        namedtype.NamedType('syncUUIDs', SyncUUIDs())
     )
 
-class syncInfoValue(univ.Choice):
+
+class SyncInfoValue(univ.Choice):
+    """
+       syncInfoValue ::= CHOICE {
+           newcookie      [0] syncCookie,
+           refreshDelete  [1] SEQUENCE {
+               cookie         syncCookie OPTIONAL,
+               refreshDone    BOOLEAN DEFAULT TRUE
+           },
+           refreshPresent [2] SEQUENCE {
+               cookie         syncCookie OPTIONAL,
+               refreshDone    BOOLEAN DEFAULT TRUE
+           },
+           syncIdSet      [3] SEQUENCE {
+               cookie         syncCookie OPTIONAL,
+               refreshDeletes BOOLEAN DEFAULT FALSE,
+               syncUUIDs      SET OF syncUUID
+           }
+       }
+    """
     componentType = namedtype.NamedTypes(
         namedtype.NamedType(
             'newcookie',
-            syncCookie().subtype(
+            SyncCookie().subtype(
                 implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)
             )
         ),
         namedtype.NamedType(
             'refreshDelete',
-            refreshDelete().subtype(
+            RefreshDelete().subtype(
                 implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)
             )
         ),
         namedtype.NamedType(
             'refreshPresent',
-            refreshPresent().subtype(
+            RefreshPresent().subtype(
                 implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2)
             )
         ),
         namedtype.NamedType(
             'syncIdSet',
-            syncIdSet().subtype(
+            SyncIdSet().subtype(
                 implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3)
             )
         )
     )
 
+
 class SyncInfoMessage:
+    """
+    The Sync Info Message is an LDAP Intermediate Response Message
+    [RFC4511] where responseName is the object identifier
+    1.3.6.1.4.1.4203.1.9.1.4 and responseValue contains a BER-encoded
+    syncInfoValue.  The criticality is FALSE (and hence absent).
+    """
     responseName = '1.3.6.1.4.1.4203.1.9.1.4'
 
     def __init__(self, encodedMessage):
-        d = decoder.decode(encodedMessage, asn1Spec = syncInfoValue())
+        d = decoder.decode(encodedMessage, asn1Spec=SyncInfoValue())
         self.newcookie = None
         self.refreshDelete = None
         self.refreshPresent = None
         self.syncIdSet = None
 
-        for attr in [ 'newcookie', 'refreshDelete', 'refreshPresent', 'syncIdSet']:
+        for attr in ['newcookie', 'refreshDelete', 'refreshPresent', 'syncIdSet']:
             comp = d[0].getComponentByName(attr)
 
-            if comp.hasValue():
+            if comp is not None and comp.hasValue():
 
                 if attr == 'newcookie':
                     self.newcookie = str(comp)
@@ -292,7 +340,7 @@ def __init__(self, encodedMessage):
                     val['syncUUIDs'] = uuids
                     val['refreshDeletes'] = bool(comp.getComponentByName('refreshDeletes'))
 
-                setattr(self,attr,val)
+                setattr(self, attr, val)
                 return
 
 
@@ -352,9 +400,12 @@ def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
         """
         while True:
             type, msg, mid, ctrls, n, v = self.result4(
-                    msgid=msgid, timeout=timeout,
-                    add_intermediates=1, add_ctrls=1, all = 0
-                    )
+                msgid=msgid,
+                timeout=timeout,
+                add_intermediates=1,
+                add_ctrls=1,
+                all=0,
+            )
 
             if type == 101:
                 # search result. This marks the end of a refreshOnly session.
@@ -363,7 +414,7 @@ def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
                 for c in ctrls:
                     if c.__class__.__name__ != 'SyncDoneControl':
                         continue
-                    self.syncrepl_present(None,refreshDeletes=c.refreshDeletes)
+                    self.syncrepl_present(None, refreshDeletes=c.refreshDeletes)
                     if c.cookie is not None:
                         self.syncrepl_set_cookie(c.cookie)
 
@@ -418,7 +469,6 @@ def syncrepl_poll(self, msgid=-1, timeout=None, all=0):
                             self.syncrepl_present(sim.syncIdSet['syncUUIDs'])
                         if 'cookie' in sim.syncIdSet:
                             self.syncrepl_set_cookie(sim.syncIdSet['cookie'])
-                        pass
 
             if all == 0:
                 return True
@@ -455,7 +505,6 @@ def syncrepl_present(self, uuids, refreshDeletes=False):
         If called with uuids set to None and refreshDeletes set to True,
         syncrepl_present() should reset the list of recorded uuids, without
         deleting any entries.
-
         """
         pass
 
@@ -464,7 +513,6 @@ def syncrepl_delete(self, uuids):
         Called by syncrepl_poll() to delete entries. A list
         of UUIDs of the entries to be deleted is given in the
         uuids parameter.
-
         """
         pass
 
@@ -475,7 +523,6 @@ def syncrepl_entry(self, dn, attrs, uuid):
         The provided uuid is used to identify the provided entry in
         any future modification (including dn modification), deletion,
         and presentation operations.
-
         """
         pass
 

From 2e885351fb96cdbe193bfeb3d40557d68b7608d2 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Sun, 19 Nov 2017 20:24:23 +0000
Subject: [PATCH 538/868] some cosmetics in syncrepl demo script, use logging

---
 Demo/pyasn1/syncrepl.py | 110 +++++++++++++++++++++-------------------
 1 file changed, 58 insertions(+), 52 deletions(-)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 1177d18..1454eef 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -7,16 +7,14 @@
 Notes:
 
 The bound user needs read access to the attributes entryDN and entryCSN.
-
-This needs the following software:
-Python
-pyasn1 0.1.4+
-pyasn1-modules
-python-ldap 2.4.10+
 """
 
 # Import modules from Python standard lib
-import shelve,signal,time,sys,logging
+import logging
+import shelve
+import signal
+import sys
+import time
 
 # Import the python-ldap modules
 import ldap
@@ -25,28 +23,34 @@
 from ldap.ldapobject import ReconnectLDAPObject
 from ldap.syncrepl import SyncreplConsumer
 
+logger = logging.getLogger('syncrepl')
+logger.setLevel(logging.DEBUG)
+logger.addHandler(logging.StreamHandler())
 
 # Global state
 watcher_running = True
 ldap_connection = False
 
 
-class SyncReplConsumer(ReconnectLDAPObject, SyncreplConsumer):
+class SyncReplClient(ReconnectLDAPObject, SyncreplConsumer):
     """
-    Syncrepl Consumer interface
+    Syncrepl Consumer Client
     """
 
     def __init__(self, db_path, *args, **kwargs):
         # Initialise the LDAP Connection first
         ldap.ldapobject.ReconnectLDAPObject.__init__(self, *args, **kwargs)
         # Now prepare the data store
-        self.__data = shelve.open(db_path, 'c')
+        if db_path:
+            self.__data = shelve.open(db_path, 'c')
+        else:
+            self.__data = dict()
         # We need this for later internal use
         self.__presentUUIDs = dict()
 
     def close_db(self):
-            # Close the data store properly to avoid corruption
-            self.__data.close()
+        # Close the data store properly to avoid corruption
+        self.__data.close()
 
     def syncrepl_get_cookie(self):
         if 'cookie' in self.__data:
@@ -55,7 +59,8 @@ def syncrepl_get_cookie(self):
     def syncrepl_set_cookie(self,cookie):
         self.__data['cookie'] = cookie
 
-    def syncrepl_entry(self,dn,attributes,uuid):
+    def syncrepl_entry(self, dn, attributes, uuid):
+        logger.debug('dn=%r attributes=%r uuid=%r', dn, attributes, uuid)
         # First we determine the type of change we have here
         # (and store away the previous data for later if needed)
         previous_attributes = dict()
@@ -69,18 +74,18 @@ def syncrepl_entry(self,dn,attributes,uuid):
         attributes['dn'] = dn
         self.__data[uuid] = attributes
         # Debugging
-        print 'Detected', change_type, 'of entry:', dn
+        logger.debug('Detected %s of entry %r', change_type, dn)
         # If we have a cookie then this is not our first time being run,
         # so it must be a change
         if 'ldap_cookie' in self.__data:
-                self.perform_application_sync(dn, attributes, previous_attributes)
+            self.perform_application_sync(dn, attributes, previous_attributes)
 
     def syncrepl_delete(self,uuids):
         # Make sure we know about the UUID being deleted, just in case...
         uuids = [uuid for uuid in uuids if uuid in self.__data]
         # Delete all the UUID values we know of
         for uuid in uuids:
-            print 'Detected deletion of entry:', self.__data[uuid]['dn']
+            logger.debug('Detected deletion of entry %r', self.__data[uuid]['dn'])
             del self.__data[uuid]
 
     def syncrepl_present(self,uuids,refreshDeletes=False):
@@ -105,10 +110,10 @@ def syncrepl_present(self,uuids,refreshDeletes=False):
                     self.__presentUUIDs[uuid] = True
 
     def syncrepl_refreshdone(self):
-        print 'Initial synchronization is now done, persist phase begins'
+        logger.info('Initial synchronization is now done, persist phase begins')
 
     def perform_application_sync(self,dn,attributes,previous_attributes):
-        print 'Performing application sync for:', dn
+        logger.info('Performing application sync for %r', dn)
         return True
 
 
@@ -116,67 +121,69 @@ def perform_application_sync(self,dn,attributes,previous_attributes):
 def commenceShutdown(signum, stack):
     # Declare the needed global variables
     global watcher_running, ldap_connection
-    print 'Shutting down!'
+    logger.warn('Shutting down!')
 
     # We are no longer running
     watcher_running = False
 
     # Tear down the server connection
-    if( ldap_connection ):
-            ldap_connection.close_db()
-            ldap_connection.unbind_s()
-            del ldap_connection
+    if ldap_connection:
+        ldap_connection.close_db()
+        ldap_connection.unbind_s()
+        del ldap_connection
 
     # Shutdown
     sys.exit(0)
 
 # Time to actually begin execution
 # Install our signal handlers
-signal.signal(signal.SIGTERM,commenceShutdown)
-signal.signal(signal.SIGINT,commenceShutdown)
+signal.signal(signal.SIGTERM, commenceShutdown)
+signal.signal(signal.SIGINT, commenceShutdown)
 
 
 try:
-  ldap_url = ldapurl.LDAPUrl(sys.argv[1])
-  database_path = sys.argv[2]
+    ldap_url = ldapurl.LDAPUrl(sys.argv[1])
+    database_path = sys.argv[2]
 except IndexError,e:
-    print 'Usage:'
-    print sys.argv[0], '<LDAP URL> <pathname of database>'
-    print sys.argv[0], '\'ldap://127.0.0.1/cn=users,dc=test'\
-                       '?*'\
-                       '?sub'\
-                       '?(objectClass=*)'\
-                       '?bindname=uid=admin%2ccn=users%2cdc=test,'\
-                       'X-BINDPW=password\' db.shelve'
+    print (
+        'Usage:\n'
+        '{script_name} <LDAP URL> <pathname of database>\n'
+        '{script_name} "ldap://127.0.0.1/cn=users,dc=test'
+         '?*'
+         '?sub'
+         '?(objectClass=*)'
+         '?bindname=uid=admin%2ccn=users%2cdc=test,'
+         'X-BINDPW=password" db.shelve'
+    ).format(script_name=sys.argv[0])
     sys.exit(1)
 except ValueError,e:
-  print 'Error parsing command-line arguments:',str(e)
-  sys.exit(1)
+    print 'Error parsing command-line arguments:', str(e)
+    sys.exit(1)
 
 while watcher_running:
-    print 'Connecting to LDAP server now...'
+    logger.info('Connecting to %s now...', ldap_url.initializeUrl())
     # Prepare the LDAP server connection (triggers the connection as well)
-    ldap_connection = SyncReplConsumer(database_path, ldap_url.initializeUrl())
+    ldap_connection = SyncReplClient(database_path, ldap_url.initializeUrl())
 
     # Now we login to the LDAP server
     try:
         ldap_connection.simple_bind_s(ldap_url.who, ldap_url.cred)
-    except ldap.INVALID_CREDENTIALS, e:
-        print 'Login to LDAP server failed: ', str(e)
+    except ldap.INVALID_CREDENTIALS, err:
+        logger.error('Login to LDAP server failed: %s', err)
         sys.exit(1)
     except ldap.SERVER_DOWN:
-        print 'LDAP server is down, going to retry.'
+        logger.warn('LDAP server is down, going to retry.')
         time.sleep(5)
         continue
 
     # Commence the syncing
-    print 'Commencing sync process'
+    logger.debug('Commencing sync process')
     ldap_search = ldap_connection.syncrepl_search(
-      ldap_url.dn or '',
-      ldap_url.scope or ldap.SCOPE_SUBTREE,
-      mode = 'refreshAndPersist',
-      attrlist=ldap_url.attrs,
-      filterstr = ldap_url.filterstr or '(objectClass=*)'
+        ldap_url.dn or '',
+        ldap_url.scope or ldap.SCOPE_SUBTREE,
+        mode = 'refreshAndPersist',
+        attrlist=ldap_url.attrs,
+        filterstr = ldap_url.filterstr or '(objectClass=*)'
     )
 
     try:
@@ -185,10 +192,9 @@ def commenceShutdown(signum, stack):
     except KeyboardInterrupt:
         # User asked to exit
         commenceShutdown(None, None)
-        pass
-    except Exception, e:
+    except Exception, err:
         # Handle any exception
         if watcher_running:
-            print 'Encountered a problem, going to retry. Error:', str(e)
+            logger.exception('Unhandled exception, going to retry: %s', err)
+            logger.info('Going to retry after 5 secs')
             time.sleep(5)
-        pass

From 1c26ef117568b336e9de613b7ebc06f5be69b4ba Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 10:53:51 +0000
Subject: [PATCH 539/868] raise ldap.PROTOCOL_ERROR if compare operation
 returned a wrong result

---
 Lib/ldap/ldapobject.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 855dabf..805b6e3 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -286,12 +286,14 @@ def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
   def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
     msgid = self.compare_ext(dn,attr,value,serverctrls,clientctrls)
     try:
-      resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
+        ldap_res = self.result3(msgid,all=1,timeout=self.timeout)
     except ldap.COMPARE_TRUE:
       return 1
     except ldap.COMPARE_FALSE:
       return 0
-    return None
+    raise ldap.PROTOCOL_ERROR(
+        'Compare operation returned wrong result: %r' % (ldap_res)
+    )
 
   def compare(self,dn,attr,value):
     return self.compare_ext(dn,attr,value,None,None)

From d40f13c88f1b678f1750204c6bb1ef06d6737bdb Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 11:42:19 +0000
Subject: [PATCH 540/868] added tests for ldap.syncrepl

---
 CHANGES                  |   1 +
 Tests/t_ldap_syncrepl.py | 469 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 470 insertions(+)
 create mode 100644 Tests/t_ldap_syncrepl.py

diff --git a/CHANGES b/CHANGES
index 1d3bba0..6bd4f73 100644
--- a/CHANGES
+++ b/CHANGES
@@ -26,6 +26,7 @@ Tests/
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
 * added LDIF test with folded, base64-encoded attribute
 * added more tests for sub-module ldap.dn
+* added tests for ldap.syncrepl (thanks to Karl Kornel)
 
 ----------------------------------------------------------------
 Released 2.5.1 2017-11-12
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
new file mode 100644
index 0000000..72cbce3
--- /dev/null
+++ b/Tests/t_ldap_syncrepl.py
@@ -0,0 +1,469 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for python-ldap's module ldap.syncrepl
+
+See http://www.python-ldap.org/ for details.
+
+$Id: t_ldap_syncrepl.py,v 1.1 2017/11/20 11:42:19 stroeder Exp $
+"""
+
+
+import os
+import unittest
+import shelve
+
+from slapdtest import SlapdObject, SlapdTestCase
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
+from ldap.ldapobject import SimpleLDAPObject
+from ldap.syncrepl import SyncreplConsumer
+
+# a template string for generating simple slapd.conf file
+SLAPD_CONF_PROVIDER_TEMPLATE = r"""
+serverID %(serverid)s
+moduleload back_%(database)s
+moduleload syncprov
+include "%(schema_prefix)s/core.schema"
+loglevel %(loglevel)s
+allow bind_v2
+
+authz-regexp
+  "gidnumber=%(root_gid)s\\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth"
+  "%(rootdn)s"
+
+database %(database)s
+directory "%(directory)s"
+suffix "%(suffix)s"
+rootdn "%(rootdn)s"
+rootpw "%(rootpw)s"
+overlay syncprov
+syncprov-checkpoint 100 10
+syncprov-sessionlog 100
+index objectclass,entryCSN,entryUUID eq
+"""
+
+# Define initial data load, both as an LDIF and as a dictionary.
+LDIF_TEMPLATE = """dn: %(suffix)s
+objectClass: dcObject
+objectClass: organization
+dc: %(dc)s
+o: %(dc)s
+
+dn: %(rootdn)s
+objectClass: applicationProcess
+objectClass: simpleSecurityObject
+cn: %(rootcn)s
+userPassword: %(rootpw)s
+
+dn: cn=Foo1,%(suffix)s
+objectClass: organizationalRole
+cn: Foo1
+
+dn: cn=Foo2,%(suffix)s
+objectClass: organizationalRole
+cn: Foo2
+
+dn: cn=Foo3,%(suffix)s
+objectClass: organizationalRole
+cn: Foo3
+
+dn: ou=Container,%(suffix)s
+objectClass: organizationalUnit
+ou: Container
+
+dn: cn=Foo4,ou=Container,%(suffix)s
+objectClass: organizationalRole
+cn: Foo4
+
+"""
+
+# NOTE: For the dict, it needs to be kept up-to-date as we make changes!
+LDAP_ENTRIES = {
+    'ou=Container,dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['organizationalUnit'],
+        'ou': ['Container']
+    },
+    'cn=Foo2,dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['organizationalRole'],
+        'cn': ['Foo2']
+    },
+    'cn=Foo4,ou=Container,dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['organizationalRole'],
+        'cn': ['Foo4']
+    },
+    'cn=Manager,dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['applicationProcess', 'simpleSecurityObject'],
+        'userPassword': ['password'],
+        'cn': ['Manager']
+    },
+    'cn=Foo3,dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['organizationalRole'],
+        'cn': ['Foo3']
+    },
+    'cn=Foo1,dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['organizationalRole'],
+        'cn': ['Foo1']
+    },
+    'dc=slapd-test,dc=python-ldap,dc=org': {
+        'objectClass': ['dcObject', 'organization'],
+        'dc': ['slapd-test'],
+        'o': ['slapd-test']
+    }
+}
+
+
+class SyncreplProvider(SlapdObject):
+    slapd_conf_template = SLAPD_CONF_PROVIDER_TEMPLATE
+
+
+class SyncreplClient(SimpleLDAPObject, SyncreplConsumer):
+    """
+    This is a very simple class to start up the syncrepl search
+    and handle callbacks that come in.
+
+    Needs to be separate, because once an LDAP client starts a syncrepl
+    search, it can't be used for anything else.
+    """
+    server_class = SyncreplProvider
+
+    def __init__(self, uri, dn, password, storage=None):
+        """
+        Set up our object by creating a search client, connecting, and binding.
+        """
+
+        if storage is not None:
+            self.data = shelve.open(storage)
+            self.uuid_dn = shelve.open(storage + 'uuid_dn')
+            self.dn_attrs = shelve.open(storage + 'dn_attrs')
+            self.using_shelve = True
+        else:
+            self.data = {}
+            self.uuid_dn = {}
+            self.dn_attrs = {}
+            self.using_shelve = False
+
+        self.data['cookie'] = None
+        self.present = []
+        self.refresh_done = False
+
+        SimpleLDAPObject.__init__(self, uri)
+        self.simple_bind_s(dn, password)
+
+
+    def unbind_s(self):
+        """
+        In addition to unbinding from LDAP, we need to close the shelf.
+        """
+        if self.using_shelve is True:
+            self.data.close()
+            self.uuid_dn.close()
+            self.dn_attrs.close()
+        SimpleLDAPObject.unbind_s(self)
+
+
+    def search(self, search_base, search_mode):
+        """
+        Start a syncrepl search operation, given a base DN and search mode.
+        """
+        self.search_id = self.syncrepl_search(
+            search_base,
+            ldap.SCOPE_SUBTREE,
+            mode=search_mode,
+            filterstr='(objectClass=*)'
+        )
+
+
+    def cancel(self):
+        """
+        A simple wrapper to call parent class with syncrepl search ID.
+        """
+        SimpleLDAPObject.cancel(self, self.search_id)
+
+
+    def poll(self, timeout=None, all=0):
+        """
+        Take the params, add the syncrepl search ID, and call the proper poll.
+        """
+        return self.syncrepl_poll(
+            self.search_id,
+            timeout=timeout,
+            all=all
+        )
+
+
+    def syncrepl_get_cookie(self):
+        """
+        Pull cookie from storage, if one exists.
+        """
+        return self.data['cookie']
+
+
+    def syncrepl_set_cookie(self, cookie):
+        """
+        Update stored cookie.
+        """
+        self.data['cookie'] = cookie
+
+
+    def syncrepl_refreshdone(self):
+        """
+        Just update a variable.
+        """
+        self.refresh_done = True
+
+
+    def syncrepl_delete(self, uuids):
+        """
+        Delete the given items from both maps.
+        """
+        for uuid in uuids:
+            del self.dn_attrs[self.uuid_dn[uuid]]
+            del self.uuid_dn[uuid]
+
+
+    def syncrepl_entry(self, dn, attrs, uuid):
+        """
+        Handles adds and changes (including DN changes).
+        """
+        if uuid in self.uuid_dn:
+            # Catch changing DNs.
+            if dn != self.uuid_dn[uuid]:
+                # Delete data associated with old DN.
+                del self.dn_attrs[self.uuid_dn[uuid]]
+
+        # Update both maps.
+        self.uuid_dn[uuid] = dn
+        self.dn_attrs[dn] = attrs
+
+
+    def syncrepl_present(self, uuids, refreshDeletes=False):
+        """
+        The 'present' message from the LDAP server is the most complicated
+        part of the refresh phase.  Suggest looking here for more info:
+        http://syncrepl-client.readthedocs.io/en/latest/client.html
+        """
+        if (uuids is not None) and (refreshDeletes is False):
+            self.present.extend(uuids)
+
+        elif (uuids is None) and (refreshDeletes is False):
+            deleted_uuids = list()
+            for uuid in self.uuid_dn.keys():
+                if uuid not in self.present:
+                    deleted_uuids.append(uuid)
+
+            if len(deleted_uuids) > 0:
+                self.syncrepl_delete(deleted_uuids)
+
+        elif (uuids is not None) and (refreshDeletes is True):
+            self.syncrepl_delete(uuids)
+
+        elif (uuids is None) and (refreshDeletes is True):
+            pass
+
+
+class Test00_Syncrepl(SlapdTestCase):
+    """
+    This is a test of all the basic Syncrepl operations.  It covers starting a
+    search (both types of search), doing the refresh part of the search,
+    and checking that we got everything that we expected.  We also test that
+    timeouts and cancellation are working properly.
+    """
+
+    server_class = SyncreplProvider
+    ldap_object_class = SimpleLDAPObject
+
+    @classmethod
+    def setUpClass(cls):
+        super(Test00_Syncrepl, cls).setUpClass()
+        # insert some Foo* objects via ldapadd
+        cls.server.ldapadd(
+            LDIF_TEMPLATE % {
+                'suffix':cls.server.suffix,
+                'rootdn':cls.server.root_dn,
+                'rootcn':cls.server.root_cn,
+                'rootpw':cls.server.root_pw,
+                'dc': cls.server.suffix.split(',')[0][3:],
+            }
+        )
+
+
+    def setUp(self):
+        try:
+            self._ldap_conn
+        except AttributeError:
+            # open local LDAP connection
+            self._ldap_conn = self._open_ldap_conn()
+
+
+    def tearDown(self):
+        self.tester.unbind_s()
+
+
+    def test_refreshOnly_search(self):
+        '''
+        Test to see if we can initialize a syncrepl search.
+        '''
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw
+        )
+        self.tester.search(
+            self.server.suffix,
+            'refreshOnly'
+        )
+
+
+    def test_refreshAndPersist_search(self):
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw
+        )
+        self.tester.search(
+            self.server.suffix,
+            'refreshAndPersist'
+        )
+
+
+    def test_refreshOnly_poll_full(self):
+        """
+        Test doing a full refresh cycle, and check what we got.
+        """
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw
+        )
+        self.tester.search(
+            self.server.suffix,
+            'refreshOnly'
+        )
+        poll_result = self.tester.poll(
+            all=1,
+            timeout=None
+        )
+        self.assertFalse(poll_result)
+        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+
+
+    def test_refreshAndPersist_poll_only(self):
+        """
+        Test the refresh part of refresh-and-persist, and check what we got.
+        """
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw
+        )
+        self.tester.search(
+            self.server.suffix,
+            'refreshAndPersist'
+        )
+
+        # Make sure to stop the test before going into persist mode.
+        while self.tester.refresh_done is not True:
+            poll_result = self.tester.poll(
+                all=0,
+                timeout=None
+            )
+            self.assertTrue(poll_result)
+
+        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+
+
+    def test_refreshAndPersist_timeout(self):
+        """
+        Make sure refreshAndPersist can handle a search with timeouts.
+        """
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw
+        )
+        self.tester.search(
+            self.server.suffix,
+            'refreshAndPersist'
+        )
+
+        # Run a quick refresh, that shouldn't have any changes.
+        while self.tester.refresh_done is not True:
+            poll_result = self.tester.poll(
+                all=0,
+                timeout=None
+            )
+            self.assertTrue(poll_result)
+
+        # Again, server data should not have changed.
+        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+
+        # Run a search with timeout.
+        # Nothing is changing the server, so it shoud timeout.
+        self.assertRaises(
+            ldap.TIMEOUT,
+            self.tester.poll,
+            all=0,
+            timeout=1
+        )
+
+
+    def test_refreshAndPersist_cancelled(self):
+        """
+        Make sure refreshAndPersist can handle cancelling a syncrepl search.
+        """
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw
+        )
+        self.tester.search(
+            self.server.suffix,
+            'refreshAndPersist'
+        )
+
+        # Run a quick refresh, that shouldn't have any changes.
+        while self.tester.refresh_done is not True:
+            poll_result = self.tester.poll(
+                all=0,
+                timeout=None
+            )
+            self.assertTrue(poll_result)
+
+        # Again, server data should not have changed.
+        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+
+        # Request cancellation.
+        self.tester.cancel()
+
+        # Run another poll, without timeout, but which should cancel out.
+        self.assertRaises(
+            ldap.CANCELLED,
+            self.tester.poll,
+            all=1,
+            timeout=None
+        )
+
+        # Server data should still be intact.
+        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+
+
+    # TODO:
+    # * Make a new client, with a data store, and close.  Then, load a new
+    # client with the same datastore, and see if the data store loads OK.
+    # * Make a new client, with a data store, and close.  Then, load a new
+    # client with the same datastore.  Delete an entry, and the cookie.
+    # Start the sync, and everything should sync up OK.
+    # * Load the refreshOnly client, using existing data.  Make a change
+    # on the server, and the client should pick it up in the refresh phase.
+    # * Load the refreshAndPersist client, using existing data.  Make a change
+    # on the server, and the client should pick it up in the refresh phase.
+    # * Load the refreshAndPersist client, using existing data.  Let the
+    # refresh phase complete.  Make a change on the server, and the client
+    # should pick it up during the persist phase.
+
+
+if __name__ == '__main__':
+    unittest.main()

From 773d7fbe9e045043b3d1de80af2f63d670d18ef3 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 16:04:56 +0000
Subject: [PATCH 541/868] another LDAPObject test

---
 Tests/t_ldapobject.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index dfe2412..196a9f3 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -188,6 +188,13 @@ def test006_sasl_extenal_bind_s(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s(authz_id=authz_id)
         self.assertEqual(l.whoami_s(), authz_id.lower())
+
+    def test007_timeout(self):
+        l = self.ldap_object_class(self.server.ldap_uri)
+        m = l.search_ext(self.server.suffix, ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        l.abandon(m)
+        with self.assertRaises(ldap.TIMEOUT):
+            result = l.result(m, timeout=0.001)
         
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):

From d448fb999c8f3a2610988a0bbada42fcecc53c36 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 17:33:06 +0000
Subject: [PATCH 542/868] assume C extension API for Python 2.7+

---
 CHANGES              |  1 +
 Modules/LDAPObject.c | 21 ++++++++++++++++++---
 Modules/LDAPObject.h |  2 +-
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6bd4f73..6f96481 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,7 @@ Modules/
 * removed obsolete back-ward compability constants from common.h
 * build checks whether LDAP_API_VERSION is OpenLDAP 2.4.x
 * _ldap.__author__ and _ldap.__license__ also set from ldap.pkginfo
+* assume C extension API for Python 2.7+
 
 Lib/
 * removed all dependencies on modules string and types
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 3291379..95387a0 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1402,11 +1402,10 @@ setattr(LDAPObject* self, char* name, PyObject* value)
 PyTypeObject LDAP_Type = {
 #if defined(MS_WINDOWS) || defined(__CYGWIN__)
         /* see http://www.python.org/doc/FAQ.html#3.24 */
-        PyObject_HEAD_INIT(NULL)
+        PyVarObject_HEAD_INIT(NULL, 0)
 #else /* ! MS_WINDOWS */
-        PyObject_HEAD_INIT(&PyType_Type)
+        PyVarObject_HEAD_INIT(&PyType_Type, 0)
 #endif /* MS_WINDOWS */
-        0,                      /*ob_size*/
         "LDAP",                 /*tp_name*/
         sizeof(LDAPObject),     /*tp_basicsize*/
         0,                      /*tp_itemsize*/
@@ -1421,4 +1420,20 @@ PyTypeObject LDAP_Type = {
         0,                      /*tp_as_sequence*/
         0,                      /*tp_as_mapping*/
         0,                      /*tp_hash*/
+        0,                      /*tp_call*/
+        0,                      /*tp_str*/
+        0,                      /*tp_getattro*/
+        0,                      /*tp_setattro*/
+        0,                      /*tp_as_buffer*/
+        0,                      /*tp_flags*/
+        0,                      /*tp_doc*/
+        0,                      /*tp_traverse*/
+        0,                      /*tp_clear*/
+        0,                      /*tp_richcompare*/
+        0,                      /*tp_weaklistoffset*/
+        0,                      /*tp_iter*/
+        0,                      /*tp_iternext*/
+        methods,                /*tp_methods*/
+        0,                      /*tp_members*/
+        0,                      /*tp_getset*/
 };
diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index a0adc3f..8cd6fc3 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -25,7 +25,7 @@ typedef struct {
 } LDAPObject;
 
 extern PyTypeObject LDAP_Type;
-#define LDAPObject_Check(v)     ((v)->ob_type == &LDAP_Type)
+#define LDAPObject_Check(v)     (Py_TYPE(v) == &LDAP_Type)
 
 extern LDAPObject *newLDAPObject( LDAP* );
 

From 608cda54bf03dfd146a787580f36c550e9d1d4ac Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 17:34:15 +0000
Subject: [PATCH 543/868] prepare release 2.5.2

---
 CHANGES | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 6f96481..b3ef0d5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 2.5.2 2017-11-xx
+Released 2.5.2 2017-11-20
 
 Changes since 2.5.1:
 

From a603396e140418f774748bf134e827a10204c61b Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 17:39:12 +0000
Subject: [PATCH 544/868] use single quotes

---
 Tests/t_cext.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index e1d79d3..cac661e 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -192,7 +192,7 @@ def test_anon_rootdse_search(self):
         l = self._open_conn(bind=False)
         # see if we can get the rootdse with anon search (without prior bind)
         m = l.search_ext(
-            "",
+            '',
             _ldap.SCOPE_BASE,
             '(objectClass=*)',
             ['objectClass', 'namingContexts'],

From 798cb611d3223b31fa2b5852ca280d0aac6bd116 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 19:34:39 +0000
Subject: [PATCH 545/868] use ..assertEqual() instead of .assertEquals() in
 t_ldap_syncrepl.py

---
 Tests/t_ldap_syncrepl.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 72cbce3..b9640fc 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -4,7 +4,7 @@
 
 See http://www.python-ldap.org/ for details.
 
-$Id: t_ldap_syncrepl.py,v 1.1 2017/11/20 11:42:19 stroeder Exp $
+$Id: t_ldap_syncrepl.py,v 1.2 2017/11/20 19:34:39 stroeder Exp $
 """
 
 
@@ -347,7 +347,7 @@ def test_refreshOnly_poll_full(self):
             timeout=None
         )
         self.assertFalse(poll_result)
-        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+        self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
 
     def test_refreshAndPersist_poll_only(self):
@@ -372,7 +372,7 @@ def test_refreshAndPersist_poll_only(self):
             )
             self.assertTrue(poll_result)
 
-        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+        self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
 
     def test_refreshAndPersist_timeout(self):
@@ -398,7 +398,7 @@ def test_refreshAndPersist_timeout(self):
             self.assertTrue(poll_result)
 
         # Again, server data should not have changed.
-        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+        self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
         # Run a search with timeout.
         # Nothing is changing the server, so it shoud timeout.
@@ -433,7 +433,7 @@ def test_refreshAndPersist_cancelled(self):
             self.assertTrue(poll_result)
 
         # Again, server data should not have changed.
-        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+        self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
         # Request cancellation.
         self.tester.cancel()
@@ -447,7 +447,7 @@ def test_refreshAndPersist_cancelled(self):
         )
 
         # Server data should still be intact.
-        self.assertEquals(self.tester.dn_attrs, LDAP_ENTRIES)
+        self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
 
     # TODO:

From 3141ce062a45638f1329e67334fe1aa7fd8ddbf7 Mon Sep 17 00:00:00 2001
From: stroeder <stroeder>
Date: Mon, 20 Nov 2017 19:35:38 +0000
Subject: [PATCH 546/868] removed CVS-Id in t_ldap_syncrepl.py

---
 Tests/t_ldap_syncrepl.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index b9640fc..8f39c67 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -3,8 +3,6 @@
 Automatic tests for python-ldap's module ldap.syncrepl
 
 See http://www.python-ldap.org/ for details.
-
-$Id: t_ldap_syncrepl.py,v 1.2 2017/11/20 19:34:39 stroeder Exp $
 """
 
 

From aeeac962b7e122e3ab0465658e9148beea00d60f Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 16:16:47 +0100
Subject: [PATCH 547/868] Infra: Condense CHANGELOG from 2.5

---
 CHANGES | 55 +++++++++++++++++++++++--------------------------------
 1 file changed, 23 insertions(+), 32 deletions(-)

diff --git a/CHANGES b/CHANGES
index b3ef0d5..92b4737 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,36 +1,5 @@
 ----------------------------------------------------------------
-Released 2.5.2 2017-11-20
-
-Changes since 2.5.1:
-
-Modules/
-* PyBytes_ instead of PyString_ and added PyInt_FromLong compat macro
-* moved code from version.c to ldapmodule.c
-* removed obsolete back-ward compability constants from common.h
-* build checks whether LDAP_API_VERSION is OpenLDAP 2.4.x
-* _ldap.__author__ and _ldap.__license__ also set from ldap.pkginfo
-* assume C extension API for Python 2.7+
-
-Lib/
-* removed all dependencies on modules string and types
-* removed use of .has_key()
-* removed class ldap.ldapobject.NonblockingLDAPObject
-* new global constant ldap.LIBLDAP_API_INFO
-* right after importing _ldap there is a call into libldap to initialize it
-* method .decodeControlValue() of SSSResponseControl and VLVResponseControl
-  does not set class attribute result_code anymore
-* always use bytes() for UUID() constructor in ldap.syncrepl
-* module ldif now uses functions b64encode() and b64decode()
-* fixed pickling and restoring of ReconnectLDAPObject
-
-Tests/
-* scripts do not directly call SlapdTestCase.setUpClass() anymore
-* added LDIF test with folded, base64-encoded attribute
-* added more tests for sub-module ldap.dn
-* added tests for ldap.syncrepl (thanks to Karl Kornel)
-
-----------------------------------------------------------------
-Released 2.5.1 2017-11-12
+Released 3.0.0 xxxx-xx-xx
 
 Changes since 2.4.45:
 
@@ -39,9 +8,16 @@ Mandatory prerequisites:
 - pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
 
 Modules/
+(thanks to Michael Ströder)
 * removed unused code schema.c
+* moved code from version.c to ldapmodule.c
+* removed obsolete back-ward compability constants from common.h
+* build checks whether LDAP_API_VERSION is OpenLDAP 2.4.x
+* _ldap.__author__ and _ldap.__license__ also set from ldap.pkginfo
+* assume C extension API for Python 2.7+
 
 Lib/
+(thanks to Michael Ströder)
 * ldap.__version__, ldap.__author__ and ldap.__license__ now
   imported from new sub-module ldap.pkginfo also to setup.py
 * Added safety assertion when importing _ldap:
@@ -58,9 +34,24 @@ Lib/
   but should not be used in new code because they might be removed
   in a later release.
 * removed SSSRequestControl from ldap.controls.KNOWN_RESPONSE_CONTROLS
+* removed all dependencies on modules string and types
+* removed use of .has_key()
+* removed class ldap.ldapobject.NonblockingLDAPObject
+* new global constant ldap.LIBLDAP_API_INFO
+* right after importing _ldap there is a call into libldap to initialize it
+* method .decodeControlValue() of SSSResponseControl and VLVResponseControl
+  does not set class attribute result_code anymore
+* always use bytes() for UUID() constructor in ldap.syncrepl
+* module ldif now uses functions b64encode() and b64decode()
+* fixed pickling and restoring of ReconnectLDAPObject
 
 Tests/
+(thanks to Michael Ströder)
 * added explicit reconnect tests for ReconnectLDAPObject
+* scripts do not directly call SlapdTestCase.setUpClass() anymore
+* added LDIF test with folded, base64-encoded attribute
+* added more tests for sub-module ldap.dn
+* added tests for ldap.syncrepl (thanks to Karl Kornel)
 
 ----------------------------------------------------------------
 Released 2.4.45 2017-10-09

From 83c7235f926457266e323a98c083723ea294339e Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 15:36:42 +0100
Subject: [PATCH 548/868] Infra: Add a .gitignore file

---
 .gitignore | 17 +++++++++++++++++
 CHANGES    |  3 +++
 2 files changed, 20 insertions(+)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..072e203
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,17 @@
+
+# Auto-generated
+.*.swp
+*.pyc
+__pycache__/
+.tox
+
+# shared libs installed by 'setup.py test'
+/Lib/*.so*
+/Lib/*.dylib
+/Lib/*.pyd
+
+# Build related
+*.egg-info
+build/
+dist/
+PKG-INFO
diff --git a/CHANGES b/CHANGES
index 92b4737..a8ad44a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,9 @@ Mandatory prerequisites:
 - Python 2.7.x
 - pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
 
+Infrastructure:
+- Add .gitignore
+
 Modules/
 (thanks to Michael Ströder)
 * removed unused code schema.c

From e73f8d8dedb7840371b9253f797f1fdb17cc32ea Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 21:11:44 +0100
Subject: [PATCH 549/868] py3: Use print as a function rather than statement

---
 Demo/Lib/ldap/async/deltree.py  |  4 +++-
 Demo/Lib/ldapurl/urlsearch.py   | 10 ++++----
 Demo/initialize.py              | 21 +++++++++--------
 Demo/ldapcontrols.py            |  9 ++++----
 Demo/ldapurl_search.py          |  6 +++--
 Demo/matchedvalues.py           | 13 ++++++-----
 Demo/options.py                 | 29 ++++++++++++-----------
 Demo/page_control.py            | 17 +++++++-------
 Demo/paged_search_ext_s.py      |  3 ++-
 Demo/passwd_ext_op.py           |  5 ++--
 Demo/pyasn1/dds.py              | 13 ++++++-----
 Demo/pyasn1/derefcontrol.py     |  7 +++---
 Demo/pyasn1/noopsearch.py       | 11 +++++----
 Demo/pyasn1/ppolicy.py          | 15 ++++++------
 Demo/pyasn1/psearch.py          | 11 +++++----
 Demo/pyasn1/readentrycontrol.py | 41 +++++++++++++++++----------------
 Demo/pyasn1/sessiontrack.py     |  8 ++++---
 Demo/pyasn1/syncrepl.py         |  3 ++-
 Demo/rename.py                  |  5 ++--
 Demo/resiter.py                 |  3 ++-
 Demo/sasl_bind.py               | 13 ++++++-----
 Demo/schema.py                  | 39 ++++++++++++++++---------------
 Demo/schema_tree.py             | 39 ++++++++++++++++---------------
 Demo/simple.py                  |  7 +++---
 Demo/simplebrowse.py            | 39 ++++++++++++++++---------------
 Doc/ldap-resiter.rst            |  2 +-
 Doc/ldap.rst                    |  2 +-
 27 files changed, 201 insertions(+), 174 deletions(-)

diff --git a/Demo/Lib/ldap/async/deltree.py b/Demo/Lib/ldap/async/deltree.py
index 58df3b3..04506b3 100644
--- a/Demo/Lib/ldap/async/deltree.py
+++ b/Demo/Lib/ldap/async/deltree.py
@@ -1,3 +1,5 @@
+from __future__ import print_function
+
 import ldap,ldap.async
 
 class DeleteLeafs(ldap.async.AsyncSearchHandler):
@@ -62,7 +64,7 @@ def DelTree(l,dn,scope=ldap.SCOPE_ONELEVEL):
   non_leaf_entries = leafs_deleter.nonLeafEntries[:]
   while non_leaf_entries:
     dn = non_leaf_entries.pop()
-    print deleted_entries,len(non_leaf_entries),dn
+    print(deleted_entries,len(non_leaf_entries),dn)
     leafs_deleter.startSearch(dn,ldap.SCOPE_SUBTREE)
     leafs_deleter.processResults()
     deleted_entries = deleted_entries+leafs_deleter.deletedEntries
diff --git a/Demo/Lib/ldapurl/urlsearch.py b/Demo/Lib/ldapurl/urlsearch.py
index 996e6da..b293aa2 100644
--- a/Demo/Lib/ldapurl/urlsearch.py
+++ b/Demo/Lib/ldapurl/urlsearch.py
@@ -3,30 +3,30 @@
 
 No output of LDAP data is produced except trace output.
 """
-
+from __future__ import print_function
 import sys,getpass,ldap,ldapurl
 
 try:
   ldapUrl = ldapurl.LDAPUrl(ldapUrl=sys.argv[1])
 except IndexError:
-  print 'Usage: %s [LDAP URL]' % (sys.argv[0])
+  print('Usage: %s [LDAP URL]' % (sys.argv[0]))
   sys.exit(1)
 
 for a in [
   'urlscheme','hostport','dn','attrs','scope',
   'filterstr','extensions','who','cred'
 ]:
-  print a,repr(getattr(ldapUrl,a))
+  print(a,repr(getattr(ldapUrl,a)))
 
 l = ldap.initialize(ldapUrl.initializeUrl(),trace_level=1)
 if ldapUrl.who!=None:
   if ldapUrl.cred!=None:
     cred=ldapUrl.cred
   else:
-    print 'Enter password for simple bind with',repr(ldapUrl.who)
+    print('Enter password for simple bind with',repr(ldapUrl.who))
     cred=getpass.getpass()
   l.simple_bind_s(ldapUrl.who,cred)
 
 res = l.search_s(ldapUrl.dn,ldapUrl.scope,ldapUrl.filterstr,ldapUrl.attrs)
 
-print len(res),'search results'
+print(len(res),'search results')
diff --git a/Demo/initialize.py b/Demo/initialize.py
index ab2647e..952b3f4 100644
--- a/Demo/initialize.py
+++ b/Demo/initialize.py
@@ -7,6 +7,7 @@
 ldaps://localhost:1391 (LDAP over SSL)
 ldapi://%2ftmp%2fopenldap2 (domain socket /tmp/openldap2)
 """
+from __future__ import print_function
 
 import sys,os,ldap
 
@@ -23,10 +24,10 @@
 # Complete path name of the file containing all trusted CA certs
 CACERTFILE='/etc/ssl/ca-bundle.pem'
 
-print """##################################################################
+print("""##################################################################
 # LDAPv3 connection with StartTLS ext. op.
 ##################################################################
-"""
+""")
 
 # Create LDAPObject instance
 l = ldap.initialize('ldap://localhost:1390',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
@@ -44,8 +45,8 @@
 # Now try StartTLS extended operation
 l.start_tls_s()
 
-print '***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION)
-print '***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER)
+print('***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION))
+print('***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER))
 
 # Try an explicit anon bind to provoke failure
 l.simple_bind_s('','')
@@ -53,10 +54,10 @@
 # Close connection
 l.unbind_s()
 
-print """##################################################################
+print("""##################################################################
 # LDAPv3 connection over SSL
 ##################################################################
-"""
+""")
 
 # Create LDAPObject instance
 l = ldap.initialize('ldaps://localhost:1391',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
@@ -74,16 +75,16 @@
 # Try an explicit anon bind to provoke failure
 l.simple_bind_s('','')
 
-print '***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION)
-print '***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER)
+print('***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION))
+print('***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER))
 
 # Close connection
 l.unbind_s()
 
-print """##################################################################
+print("""##################################################################
 # LDAPv3 connection over Unix domain socket
 ##################################################################
-"""
+""")
 
 # Create LDAPObject instance
 l = ldap.initialize('ldapi://%2ftmp%2fopenldap-socket',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
diff --git a/Demo/ldapcontrols.py b/Demo/ldapcontrols.py
index 214042d..a5ba8d3 100644
--- a/Demo/ldapcontrols.py
+++ b/Demo/ldapcontrols.py
@@ -1,15 +1,16 @@
+from __future__ import print_function
 import ldap,ldapurl,pprint
 
 from ldap.controls import LDAPControl,BooleanControl
 
 l = ldap.initialize('ldap://localhost:1390',trace_level=2)
 
-print 60*'#'
+print(60*'#')
 
 pprint.pprint(l.get_option(ldap.OPT_SERVER_CONTROLS))
 l.manage_dsa_it(1,1)
 pprint.pprint(l.get_option(ldap.OPT_SERVER_CONTROLS))
-print 60*'#'
+print(60*'#')
 
 # Search with ManageDsaIT control (which has no value)
 pprint.pprint(l.search_ext_s(
@@ -19,7 +20,7 @@
   ['*','+'],
   serverctrls = [ LDAPControl('2.16.840.1.113730.3.4.2',1,None) ],
 ))
-print 60*'#'
+print(60*'#')
 
 # Search with Subentries control (which has boolean value)
 pprint.pprint(l.search_ext_s(
@@ -30,4 +31,4 @@
   serverctrls = [ BooleanControl('1.3.6.1.4.1.4203.1.10.1',1,1) ],
 ))
 
-print 60*'#'
+print(60*'#')
diff --git a/Demo/ldapurl_search.py b/Demo/ldapurl_search.py
index 2c63009..07ffbca 100644
--- a/Demo/ldapurl_search.py
+++ b/Demo/ldapurl_search.py
@@ -1,3 +1,5 @@
+from __future__ import print_function
+
 import sys,pprint,ldap
 
 from ldap.ldapobject import LDAPObject
@@ -15,7 +17,7 @@ class MyLDAPUrl(LDAPUrl):
 ldap_url = MyLDAPUrl(sys.argv[1])
 trace_level = int(ldap_url.trace_level or '0')
 
-print '***trace_level',trace_level
+print('***trace_level',trace_level)
 
 ldap.trace_level = trace_level
 
@@ -37,6 +39,6 @@ class MyLDAPUrl(LDAPUrl):
 
 pprint.pprint(result)
 
-print '***DIAGNOSTIC_MESSAGE',repr(l.get_option(ldap.OPT_DIAGNOSTIC_MESSAGE))
+print('***DIAGNOSTIC_MESSAGE',repr(l.get_option(ldap.OPT_DIAGNOSTIC_MESSAGE)))
 
 l.unbind_s()
diff --git a/Demo/matchedvalues.py b/Demo/matchedvalues.py
index 4de3e8a..59c594f 100644
--- a/Demo/matchedvalues.py
+++ b/Demo/matchedvalues.py
@@ -27,16 +27,17 @@
 # Matched values control: (mail=*@example.org)
 # dn: uid=jsmith,ou=People,dc=example,dc=com
 # mail: jsmith@example.org
+from __future__ import print_function
 
 import ldap
 from ldap.controls import MatchedValuesControl
 
 def print_result(search_result):
     for n in range(len(search_result)):
-        print "dn: %s" % search_result[n][0]
+        print("dn: %s" % search_result[n][0])
         for attr in search_result[n][1].keys():
             for i in range(len(search_result[n][1][attr])):
-                print "%s: %s" % (attr, search_result[n][1][attr][i])
+                print("%s: %s" % (attr, search_result[n][1][attr][i]))
         print
 
 
@@ -51,13 +52,13 @@ def print_result(search_result):
 mv = MatchedValuesControl(criticality=True, controlValue=control_filter)
 
 res = ld.search_ext_s(base, scope, filter, attrlist = ['mail'])
-print "LDAP filter used: %s" % filter
-print "Requesting 'mail' attribute back"
+print("LDAP filter used: %s" % filter)
+print("Requesting 'mail' attribute back")
 print
-print "No matched values control:"
+print("No matched values control:")
 print_result(res)
 
 res = ld.search_ext_s(base, scope, filter, attrlist = ['mail'], serverctrls = [mv])
-print "Matched values control: %s" % control_filter
+print("Matched values control: %s" % control_filter)
 print_result(res)
 
diff --git a/Demo/options.py b/Demo/options.py
index fb37209..8b4e215 100644
--- a/Demo/options.py
+++ b/Demo/options.py
@@ -1,27 +1,28 @@
+from __future__ import print_function
 
 import ldap
 
 host="localhost:1390"
 
-print "API info:",ldap.get_option(ldap.OPT_API_INFO)
-print "debug level:",ldap.get_option(ldap.OPT_DEBUG_LEVEL)
-#print "Setting debug level to 255..."
+print("API info:",ldap.get_option(ldap.OPT_API_INFO))
+print("debug level:",ldap.get_option(ldap.OPT_DEBUG_LEVEL))
+#print("Setting debug level to 255...")
 #ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
-#print "debug level:",ldap.get_option(ldap.OPT_DEBUG_LEVEL)
-print "default size limit:",ldap.get_option(ldap.OPT_SIZELIMIT)
-print "Setting default size limit to 10..."
+#print("debug level:",ldap.get_option(ldap.OPT_DEBUG_LEVEL))
+print("default size limit:",ldap.get_option(ldap.OPT_SIZELIMIT))
+print("Setting default size limit to 10...")
 ldap.set_option(ldap.OPT_SIZELIMIT,10)
-print "default size limit:",ldap.get_option(ldap.OPT_SIZELIMIT)
-print "Creating connection to",host,"..."
+print("default size limit:",ldap.get_option(ldap.OPT_SIZELIMIT))
+print("Creating connection to",host,"...")
 l=ldap.init(host)
-print "size limit:",l.get_option(ldap.OPT_SIZELIMIT)
-print "Setting connection size limit to 20..."
+print("size limit:",l.get_option(ldap.OPT_SIZELIMIT))
+print("Setting connection size limit to 20...")
 l.set_option(ldap.OPT_SIZELIMIT,20)
-print "size limit:",l.get_option(ldap.OPT_SIZELIMIT)
-#print "Setting time limit to 60 secs..."
+print("size limit:",l.get_option(ldap.OPT_SIZELIMIT))
+#print("Setting time limit to 60 secs...")
 l.set_option(ldap.OPT_TIMELIMIT,60)
-#print "time limit:",l.get_option(ldap.OPT_TIMELIMIT)
-print "Binding..."
+#print("time limit:",l.get_option(ldap.OPT_TIMELIMIT))
+print("Binding...")
 l.simple_bind_s("","")
 
 
diff --git a/Demo/page_control.py b/Demo/page_control.py
index 0fc904b..8238ede 100644
--- a/Demo/page_control.py
+++ b/Demo/page_control.py
@@ -1,4 +1,5 @@
 # -*- coding: utf-8 -*-
+from __future__ import print_function
 
 url = "ldap://localhost:1390"
 base = "dc=stroeder,dc=de"
@@ -41,20 +42,20 @@
 pages = 0
 while True:
     pages += 1
-    print '-'*60
-    print "Getting page %d" % (pages)
+    print('-'*60)
+    print("Getting page %d" % (pages))
     rtype, rdata, rmsgid, serverctrls = l.result3(msgid,resp_ctrl_classes=known_ldap_resp_ctrls)
-    print '%d results' % len(rdata)
-    print 'serverctrls=',pprint.pprint(serverctrls)
-    print 'rdata=',pprint.pprint(rdata)
+    print('%d results' % len(rdata))
+    print('serverctrls=',pprint.pprint(serverctrls))
+    print('rdata=',pprint.pprint(rdata))
     pctrls = [
       c
       for c in serverctrls
       if c.controlType == SimplePagedResultsControl.controlType
     ]
     if pctrls:
-        print 'pctrls[0].size',repr(pctrls[0].size)
-        print 'pctrls[0].cookie',repr(pctrls[0].cookie)
+        print('pctrls[0].size',repr(pctrls[0].size))
+        print('pctrls[0].cookie',repr(pctrls[0].cookie))
         if pctrls[0].cookie:
             # Copy cookie from response control to request control
             req_ctrl.cookie = pctrls[0].cookie
@@ -68,7 +69,7 @@
         else:
             break
     else:
-        print "Warning:  Server ignores RFC 2696 control."
+        print("Warning:  Server ignores RFC 2696 control.")
         break
 
 l.unbind_s()
diff --git a/Demo/paged_search_ext_s.py b/Demo/paged_search_ext_s.py
index d0e0982..457d79c 100644
--- a/Demo/paged_search_ext_s.py
+++ b/Demo/paged_search_ext_s.py
@@ -1,3 +1,4 @@
+from __future__ import print_function
 url = "ldap://localhost:1390/"
 base = "dc=stroeder,dc=de"
 search_flt = r'(objectClass=*)'
@@ -104,4 +105,4 @@ class MyLDAPObject(ReconnectLDAPObject,PagedResultsSearchObject):
 
 l.unbind_s()
 
-print 'Received %d results in %d pages.' % (len(all_results),result_pages)
+print('Received %d results in %d pages.' % (len(all_results),result_pages))
diff --git a/Demo/passwd_ext_op.py b/Demo/passwd_ext_op.py
index 1030f0e..cc5d22c 100644
--- a/Demo/passwd_ext_op.py
+++ b/Demo/passwd_ext_op.py
@@ -1,6 +1,7 @@
 """
 Example showing the use of the password extended operation.
 """
+from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
@@ -11,9 +12,9 @@
 
 lu = ldapurl.LDAPUrl(sys.argv[1])
 
-print 'Old password'
+print('Old password')
 oldpw = getpass.getpass()
-print 'New password'
+print('New password')
 newpw = getpass.getpass()
 
 # Set path name of file containing all CA certificates
diff --git a/Demo/pyasn1/dds.py b/Demo/pyasn1/dds.py
index 656b439..71722b0 100644
--- a/Demo/pyasn1/dds.py
+++ b/Demo/pyasn1/dds.py
@@ -8,6 +8,7 @@
 pyasn1-modules
 python-ldap 2.4+
 """
+from __future__ import print_function
 
 from ldap.extop.dds import RefreshRequest,RefreshResponse
 
@@ -17,7 +18,7 @@
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
   request_ttl = int(sys.argv[2])
 except IndexError,ValueError:
-  print 'Usage: dds.py <LDAP URL> <TTL>'
+  print('Usage: dds.py <LDAP URL> <TTL>')
   sys.exit(1)
 
 # Set debugging level
@@ -32,14 +33,14 @@
 )
 
 if ldap_url.cred is None:
-  print 'Password for %s:' % (repr(ldap_url.who))
+  print('Password for %s:' % (repr(ldap_url.who)))
   ldap_url.cred = getpass.getpass()
 
 try:
   ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
 
 except ldap.INVALID_CREDENTIALS,e:
-  print 'Simple bind failed:',str(e)
+  print('Simple bind failed:',str(e))
   sys.exit(1)
 
 else:
@@ -47,9 +48,9 @@
   try:
     extop_resp_obj = ldap_conn.extop_s(extreq,extop_resp_class=RefreshResponse)
   except ldap.LDAPError,e:
-    print str(e)
+    print(str(e))
   else:
     if extop_resp_obj.responseTtl!=request_ttl:
-      print 'Different response TTL:',extop_resp_obj.responseTtl
+      print('Different response TTL:',extop_resp_obj.responseTtl)
     else:
-      print 'Response TTL:',extop_resp_obj.responseTtl
+      print('Response TTL:',extop_resp_obj.responseTtl)
diff --git a/Demo/pyasn1/derefcontrol.py b/Demo/pyasn1/derefcontrol.py
index 1098529..0e7153d 100644
--- a/Demo/pyasn1/derefcontrol.py
+++ b/Demo/pyasn1/derefcontrol.py
@@ -3,6 +3,7 @@
 This sample script demonstrates the use of the dereference control
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
 """
+from __future__ import print_function
 
 import pprint,ldap,ldap.modlist,ldap.resiter
 
@@ -29,8 +30,8 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
   }
 )
 
-print 'pyasn1 output of request control:'
-print dc._derefSpecs().prettyPrint()
+print('pyasn1 output of request control:')
+print(dc._derefSpecs().prettyPrint())
 
 msg_id = l.search_ext(
   'dc=demo1,dc=freeipa,dc=org',
@@ -43,6 +44,6 @@ class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
 for res_type,res_data,res_msgid,res_controls in l.allresults(msg_id,add_ctrls=1):
   for dn,entry,deref_control in res_data:
     # process dn and entry
-    print dn,entry['objectClass']
+    print(dn,entry['objectClass'])
     if deref_control:
       pprint.pprint(deref_control[0].derefRes)
diff --git a/Demo/pyasn1/noopsearch.py b/Demo/pyasn1/noopsearch.py
index 08635de..88d2d89 100644
--- a/Demo/pyasn1/noopsearch.py
+++ b/Demo/pyasn1/noopsearch.py
@@ -9,6 +9,7 @@
 pyasn1-modules
 python-ldap 2.4+
 """
+from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
@@ -19,7 +20,7 @@
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
 except IndexError:
-  print 'Usage: noopsearch.py <LDAP URL>'
+  print('Usage: noopsearch.py <LDAP URL>')
   sys.exit(1)
 
 # Set debugging level
@@ -34,14 +35,14 @@
 )
 
 if ldap_url.who and ldap_url.cred is None:
-  print 'Password for %s:' % (repr(ldap_url.who))
+  print('Password for %s:' % (repr(ldap_url.who)))
   ldap_url.cred = getpass.getpass()
 
 try:
   ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
 
 except ldap.INVALID_CREDENTIALS,e:
-  print 'Simple bind failed:',str(e)
+  print('Simple bind failed:',str(e))
   sys.exit(1)
 
 try:
@@ -69,5 +70,5 @@
   if c.controlType==SearchNoOpControl.controlType
 ][0]
 
-print 'Number of search results: %d' % noop_srch_ctrl.numSearchResults
-print 'Number of search continuations: %d' % noop_srch_ctrl.numSearchContinuations
+print('Number of search results: %d' % noop_srch_ctrl.numSearchResults)
+print('Number of search continuations: %d' % noop_srch_ctrl.numSearchContinuations)
diff --git a/Demo/pyasn1/ppolicy.py b/Demo/pyasn1/ppolicy.py
index 8722356..97720b0 100644
--- a/Demo/pyasn1/ppolicy.py
+++ b/Demo/pyasn1/ppolicy.py
@@ -9,6 +9,7 @@
 pyasn1-modules
 python-ldap 2.4+
 """
+from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
@@ -17,7 +18,7 @@
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
 except IndexError,ValueError:
-  print 'Usage: ppolicy.py <LDAP URL>'
+  print('Usage: ppolicy.py <LDAP URL>')
   sys.exit(1)
 
 # Set debugging level
@@ -32,19 +33,19 @@
 )
 
 if ldap_url.cred is None:
-  print 'Password for %s:' % (repr(ldap_url.who))
+  print('Password for %s:' % (repr(ldap_url.who)))
   ldap_url.cred = getpass.getpass()
 
 try:
   msgid = ldap_conn.simple_bind(ldap_url.who,ldap_url.cred,serverctrls=[PasswordPolicyControl()])
   res_type,res_data,res_msgid,res_ctrls = ldap_conn.result3(msgid)
 except ldap.INVALID_CREDENTIALS,e:
-  print 'Simple bind failed:',str(e)
+  print('Simple bind failed:',str(e))
   sys.exit(1)
 else:
   if res_ctrls[0].controlType==PasswordPolicyControl.controlType:
     ppolicy_ctrl = res_ctrls[0]
-    print 'PasswordPolicyControl'
-    print 'error',repr(ppolicy_ctrl.error),(ppolicy_ctrl.error!=None)*repr(PasswordPolicyError(ppolicy_ctrl.error))
-    print 'timeBeforeExpiration',repr(ppolicy_ctrl.timeBeforeExpiration)
-    print 'graceAuthNsRemaining',repr(ppolicy_ctrl.graceAuthNsRemaining)
+    print('PasswordPolicyControl')
+    print('error',repr(ppolicy_ctrl.error),(ppolicy_ctrl.error!=None)*repr(PasswordPolicyError(ppolicy_ctrl.error)))
+    print('timeBeforeExpiration',repr(ppolicy_ctrl.timeBeforeExpiration))
+    print('graceAuthNsRemaining',repr(ppolicy_ctrl.graceAuthNsRemaining))
diff --git a/Demo/pyasn1/psearch.py b/Demo/pyasn1/psearch.py
index 02852b1..b2300ad 100644
--- a/Demo/pyasn1/psearch.py
+++ b/Demo/pyasn1/psearch.py
@@ -10,6 +10,7 @@
 pyasn1-modules
 python-ldap 2.4+
 """
+from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
@@ -18,7 +19,7 @@
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
 except IndexError:
-  print 'Usage: psearch.py <LDAP URL>'
+  print('Usage: psearch.py <LDAP URL>')
   sys.exit(1)
 
 # Set debugging level
@@ -33,14 +34,14 @@
 )
 
 if ldap_url.cred is None:
-  print 'Password for %s:' % (repr(ldap_url.who))
+  print('Password for %s:' % (repr(ldap_url.who)))
   ldap_url.cred = getpass.getpass()
 
 try:
   ldap_conn.simple_bind_s(ldap_url.who,ldap_url.cred)
 
 except ldap.INVALID_CREDENTIALS,e:
-  print 'Simple bind failed:',str(e)
+  print('Simple bind failed:',str(e))
   sys.exit(1)
 
 psc = PersistentSearchControl()
@@ -64,7 +65,7 @@
       resp_ctrl_classes={EntryChangeNotificationControl.controlType:EntryChangeNotificationControl},
     )
   except ldap.TIMEOUT:
-    print 'Timeout waiting for results...'
+    print('Timeout waiting for results...')
   else:
     for dn,entry,srv_ctrls in res_data:
       ecn_ctrls = [
@@ -76,4 +77,4 @@
       if ecn_ctrls:
         changeType,previousDN,changeNumber = ecn_ctrls[0].changeType,ecn_ctrls[0].previousDN,ecn_ctrls[0].changeNumber
         change_type_desc = CHANGE_TYPES_STR[changeType]
-        print 'changeType: %s (%d), changeNumber: %s, previousDN: %s' % (change_type_desc,changeType,changeNumber,repr(previousDN))
+        print('changeType: %s (%d), changeNumber: %s, previousDN: %s' % (change_type_desc,changeType,changeNumber,repr(previousDN)))
diff --git a/Demo/pyasn1/readentrycontrol.py b/Demo/pyasn1/readentrycontrol.py
index b52ea91..10faa2b 100644
--- a/Demo/pyasn1/readentrycontrol.py
+++ b/Demo/pyasn1/readentrycontrol.py
@@ -4,6 +4,7 @@
 
 Originally contributed by Andreas Hasenack <ahasenack@terra.com.br>
 """
+from __future__ import print_function
 
 import pprint,ldap,ldap.modlist
 
@@ -14,10 +15,10 @@
 l = ldap.initialize(uri,trace_level=2)
 l.simple_bind_s('uid=diradm,ou=schulung,dc=stroeder,dc=local','testsecret')
 
-print """#---------------------------------------------------------------------------
+print("""#---------------------------------------------------------------------------
 # Add new entry
 #---------------------------------------------------------------------------
-"""
+""")
 
 new_test_dn = "uid=ablume,ou=Users,ou=schulung,dc=stroeder,dc=local"
 new_test_dn2 = "uid=ablume2,ou=Users,ou=schulung,dc=stroeder,dc=local"
@@ -38,13 +39,13 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print "resp_ctrls[0].dn:",resp_ctrls[0].dn
-print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
 
-print """#---------------------------------------------------------------------------
+print("""#---------------------------------------------------------------------------
 # Modify entry
 #---------------------------------------------------------------------------
-"""
+""")
 
 pr = PreReadControl(criticality=True,attrList=['uidNumber','gidNumber','entryCSN'])
 
@@ -54,8 +55,8 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print "resp_ctrls[0].dn:",resp_ctrls[0].dn
-print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
 
 pr = PostReadControl(criticality=True,attrList=['uidNumber','gidNumber','entryCSN'])
 
@@ -65,13 +66,13 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print "resp_ctrls[0].dn:",resp_ctrls[0].dn
-print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
 
-print """#---------------------------------------------------------------------------
+print("""#---------------------------------------------------------------------------
 # Rename entry
 #---------------------------------------------------------------------------
-"""
+""")
 
 pr = PostReadControl(criticality=True,attrList=['uid'])
 msg_id = l.rename(
@@ -81,8 +82,8 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print "resp_ctrls[0].dn:",resp_ctrls[0].dn
-print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
 
 pr = PreReadControl(criticality=True,attrList=['uid'])
 msg_id = l.rename(
@@ -92,13 +93,13 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print "resp_ctrls[0].dn:",resp_ctrls[0].dn
-print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
 
-print """#---------------------------------------------------------------------------
+print("""#---------------------------------------------------------------------------
 # Delete entry
 #---------------------------------------------------------------------------
-"""
+""")
 
 pr = PreReadControl(criticality=True,attrList=['*','+'])
 msg_id = l.delete_ext(
@@ -106,5 +107,5 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print "resp_ctrls[0].dn:",resp_ctrls[0].dn
-print "resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry)
+print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
index 1a1eab1..337c5e9 100644
--- a/Demo/pyasn1/sessiontrack.py
+++ b/Demo/pyasn1/sessiontrack.py
@@ -8,6 +8,8 @@
 https://tools.ietf.org/html/draft-wahl-ldap-session-03
 """
 
+from __future__ import print_function
+
 __version__ = '0.1'
 
 import sys,getpass,ldap,ldapurl
@@ -17,7 +19,7 @@
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
 except IndexError,ValueError:
-  print 'Usage: %s <LDAP URL>' % (sys.argv[0])
+  print('Usage: %s <LDAP URL>' % (sys.argv[0]))
   sys.exit(1)
 
 # Set debugging level
@@ -32,14 +34,14 @@
 )
 
 if ldap_url.who and ldap_url.cred is None:
-  print 'Password for %s:' % (repr(ldap_url.who))
+  print('Password for %s:' % (repr(ldap_url.who)))
   ldap_url.cred = getpass.getpass()
 
 try:
   ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
 
 except ldap.INVALID_CREDENTIALS,e:
-  print 'Simple bind failed:',str(e)
+  print('Simple bind failed:',str(e))
   sys.exit(1)
 
 st_ctrl = SessionTrackingControl(
diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 1454eef..479a626 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -8,6 +8,7 @@
 
 The bound user needs read access to the attributes entryDN and entryCSN.
 """
+from __future__ import print_function
 
 # Import modules from Python standard lib
 import logging
@@ -157,7 +158,7 @@ def commenceShutdown(signum, stack):
     ).format(script_name=sys.argv[0])
     sys.exit(1)
 except ValueError,e:
-    print 'Error parsing command-line arguments:', str(e)
+    print('Error parsing command-line arguments:',str(e))
     sys.exit(1)
 
 while watcher_running:
diff --git a/Demo/rename.py b/Demo/rename.py
index 1bb6fd7..91d7528 100644
--- a/Demo/rename.py
+++ b/Demo/rename.py
@@ -1,10 +1,11 @@
+from __future__ import print_function
 import ldap
 from getpass import getpass
 
 # Create LDAPObject instance
 l = ldap.initialize('ldap://localhost:1389',trace_level=1)
 
-print 'Password:'
+print('Password:')
 cred = getpass()
 
 try:
@@ -15,7 +16,7 @@
   # Try a bind to provoke failure if protocol version is not supported
   l.bind_s('cn=root,dc=stroeder,dc=com',cred,ldap.AUTH_SIMPLE)
 
-  print 'Using rename_s():'
+  print('Using rename_s():')
 
   l.rename_s(
     'uid=fred,ou=Unstructured testing tree,dc=stroeder,dc=com',
diff --git a/Demo/resiter.py b/Demo/resiter.py
index ff9fe5a..d6796ba 100644
--- a/Demo/resiter.py
+++ b/Demo/resiter.py
@@ -4,6 +4,7 @@
 
 See http://www.python-ldap.org for details.
 """
+from __future__ import print_function
 
 import ldap,ldap.resiter
 
@@ -16,6 +17,6 @@ class LDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
 
 result_iter = l.allresults(msgid)
 for result_type,result_list,result_msgid,result_serverctrls in result_iter:
-  print result_type,result_list,result_msgid,result_serverctrls
+  print(result_type,result_list,result_msgid,result_serverctrls)
 
 l.unbind_s()
diff --git a/Demo/sasl_bind.py b/Demo/sasl_bind.py
index 05af652..7ff75bf 100644
--- a/Demo/sasl_bind.py
+++ b/Demo/sasl_bind.py
@@ -1,5 +1,6 @@
 # For documentation, see comments in Module/LDAPObject.c and the
 # ldap.sasl module documentation.
+from __future__ import print_function
 
 import ldap,ldap.sasl
 
@@ -60,7 +61,7 @@
   ),
 ]:
   sasl_auth = ldap.sasl.sasl(sasl_cb_value_dict,sasl_mech)
-  print 20*'*',sasl_auth.mech,20*'*'
+  print(20*'*',sasl_auth.mech,20*'*')
   # Open the LDAP connection
   l = ldap.initialize(ldap_uri,trace_level=0)
   # Set protocol version to LDAPv3 to enable SASL bind!
@@ -68,15 +69,15 @@
   try:
     l.sasl_interactive_bind_s("", sasl_auth)
   except ldap.LDAPError,e:
-    print 'Error using SASL mechanism',sasl_auth.mech,str(e)
+    print('Error using SASL mechanism',sasl_auth.mech,str(e))
   else:
-    print 'Sucessfully bound using SASL mechanism:',sasl_auth.mech
+    print('Sucessfully bound using SASL mechanism:',sasl_auth.mech)
     try:
-      print 'Result of Who Am I? ext. op:',repr(l.whoami_s())
+      print('Result of Who Am I? ext. op:',repr(l.whoami_s()))
     except ldap.LDAPError,e:
-      print 'Error using SASL mechanism',sasl_auth.mech,str(e)
+      print('Error using SASL mechanism',sasl_auth.mech,str(e))
     try:
-      print 'OPT_X_SASL_USERNAME',repr(l.get_option(ldap.OPT_X_SASL_USERNAME))
+      print('OPT_X_SASL_USERNAME',repr(l.get_option(ldap.OPT_X_SASL_USERNAME)))
     except AttributeError:
       pass
 
diff --git a/Demo/schema.py b/Demo/schema.py
index c8103f3..9f650d2 100644
--- a/Demo/schema.py
+++ b/Demo/schema.py
@@ -1,3 +1,4 @@
+from __future__ import print_function
 import sys,ldap,ldap.schema
 
 schema_attrs = ldap.schema.SCHEMA_ATTRS
@@ -9,39 +10,39 @@
 subschemasubentry_dn,schema = ldap.schema.urlfetch(sys.argv[-1])
 
 if subschemasubentry_dn is None:
-  print 'No sub schema sub entry found!'
+  print('No sub schema sub entry found!')
   sys.exit(1)
 
 if schema.non_unique_oids:
-  print '*** Schema errors ***'
-  print 'non-unique OIDs:\n','\r\n'.join(schema.non_unique_oids)
+  print('*** Schema errors ***')
+  print('non-unique OIDs:\n','\r\n'.join(schema.non_unique_oids))
 
-print '*** Schema from',repr(subschemasubentry_dn)
+print('*** Schema from',repr(subschemasubentry_dn))
 
 # Display schema
 for attr_type,schema_class in ldap.schema.SCHEMA_CLASS_MAPPING.items():
-  print '*'*20,attr_type,'*'*20
+  print('*'*20,attr_type,'*'*20)
   for element_id in schema.listall(schema_class):
     se_orig = schema.get_obj(schema_class,element_id)
-    print attr_type,str(se_orig)
-print '*** Testing object class inetOrgPerson ***'
+    print(attr_type,str(se_orig))
+print('*** Testing object class inetOrgPerson ***')
 
 drink = schema.get_obj(ldap.schema.AttributeType,'favouriteDrink')
 if not drink is None:
-  print '*** drink ***'
-  print 'drink.names',repr(drink.names)
-  print 'drink.collective',repr(drink.collective)
+  print('*** drink ***')
+  print('drink.names',repr(drink.names))
+  print('drink.collective',repr(drink.collective))
 
 inetOrgPerson = schema.get_obj(ldap.schema.ObjectClass,'inetOrgPerson')
 if not inetOrgPerson is None:
-  print inetOrgPerson.must,inetOrgPerson.may
+  print(inetOrgPerson.must,inetOrgPerson.may)
 
-print '*** person,organizationalPerson,inetOrgPerson ***'
+print('*** person,organizationalPerson,inetOrgPerson ***')
 try:
-  print schema.attribute_types(
+  print(schema.attribute_types()
     ['person','organizationalPerson','inetOrgPerson']
   )
-  print schema.attribute_types(
+  print(schema.attribute_types()
     ['person','organizationalPerson','inetOrgPerson'],
     attr_type_filter = [
       ('no_user_mod',[0]),
@@ -49,15 +50,15 @@
     ]  
   )
 except KeyError,e:
-  print '***KeyError',str(e)
+  print('***KeyError',str(e))
 
 
 schema.ldap_entry()
 
-print str(schema.get_obj(ldap.schema.MatchingRule,'2.5.13.0'))
-print str(schema.get_obj(ldap.schema.MatchingRuleUse,'2.5.13.0'))
+print(str(schema.get_obj(ldap.schema.MatchingRule,'2.5.13.0')))
+print(str(schema.get_obj(ldap.schema.MatchingRuleUse,'2.5.13.0')))
 
-print str(schema.get_obj(ldap.schema.AttributeType,'name'))
-print str(schema.get_inheritedobj(ldap.schema.AttributeType,'cn',['syntax','equality','substr','ordering']))
+print(str(schema.get_obj(ldap.schema.AttributeType,'name')))
+print(str(schema.get_inheritedobj(ldap.schema.AttributeType,'cn',['syntax','equality','substr','ordering'])))
 
 must_attr,may_attr = schema.attribute_types(['person','organizationalPerson','inetOrgPerson'],raise_keyerror=0)
diff --git a/Demo/schema_tree.py b/Demo/schema_tree.py
index 3b3a091..ef8bcec 100644
--- a/Demo/schema_tree.py
+++ b/Demo/schema_tree.py
@@ -4,6 +4,7 @@
 
 Usage: schema_oc_tree.py [--html] [LDAP URL]
 """
+from __future__ import print_function
 
 import sys,getopt,ldap,ldap.schema
 
@@ -14,11 +15,11 @@ def PrintSchemaTree(schema,se_class,se_tree,se_oid,level):
   """ASCII text output for console"""
   se_obj = schema.get_obj(se_class,se_oid)
   if se_obj!=None:
-    print '|    '*(level-1)+'+---'*(level>0), \
+    print('|    '*(level-1)+'+---'*(level>0), \)
           ', '.join(se_obj.names), \
           '(%s)' % se_obj.oid
   for sub_se_oid in se_tree[se_oid]:
-    print '|    '*(level+1)
+    print('|    '*(level+1))
     PrintSchemaTree(schema,se_class,se_tree,sub_se_oid,level+1)
 
 
@@ -26,17 +27,17 @@ def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
   """HTML output for browser"""
   se_obj = schema.get_obj(se_class,se_oid)
   if se_obj!=None:
-    print """
+    print("""
     <dt><strong>%s (%s)</strong></dt>
     <dd>
       %s
-    """ % (', '.join(se_obj.names),se_obj.oid,se_obj.desc)
+    """ % (', '.join(se_obj.names),se_obj.oid,se_obj.desc))
   if se_tree[se_oid]:
-    print '<dl>'
+    print('<dl>')
     for sub_se_oid in se_tree[se_oid]:
       HTMLSchemaTree(schema,se_class,se_tree,sub_se_oid,level+1)
-    print '</dl>'
-  print '</dd>'
+    print('</dl>')
+  print('</dd>')
 
 
 ldap.set_option(ldap.OPT_DEBUG_LEVEL,0)
@@ -46,13 +47,13 @@ def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
 subschemasubentry_dn,schema = ldap.schema.urlfetch(sys.argv[-1],ldap.trace_level)
 
 if subschemasubentry_dn is None:
-  print 'No sub schema sub entry found!'
+  print('No sub schema sub entry found!')
   sys.exit(1)
 
 try:
   options,args=getopt.getopt(sys.argv[1:],'',['html'])
 except getopt.error,e:
-  print 'Error: %s\nUsage: schema_oc_tree.py [--html] [LDAP URL]'
+  print('Error: %s\nUsage: schema_oc_tree.py [--html] [LDAP URL]')
 
 html_output = options and options[0][0]=='--html'
 
@@ -60,41 +61,41 @@ def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
 at_tree = schema.tree(ldap.schema.AttributeType)
 
 #for k,v in oc_tree.items():
-#  print k,'->',v
+#  print(k,'->',v)
 #for k,v in at_tree.items():
-#  print k,'->',v
+#  print(k,'->',v)
 
 if html_output:
 
-  print """<html>
+  print("""<html>
 <head>
   <title>Object class tree</title>
 </head>
 <body bgcolor="#ffffff">
 <h1>Object class tree</h1>
 <dl>
-"""
+""")
   HTMLSchemaTree(schema,ldap.schema.ObjectClass,oc_tree,'2.5.6.0',0)
-  print """</dl>
+  print("""</dl>
 <h1>Attribute type tree</h1>
 <dl>
-"""
+""")
   for a in schema.listall(ldap.schema.AttributeType):
     if at_tree[a]:
       HTMLSchemaTree(schema,ldap.schema.AttributeType,at_tree,a,0)
       print
 
-  print """</dl>
+  print("""</dl>
 </body>
 </html>
-"""
+""")
 
 else:
 
-  print '*** Object class tree ***\n'
+  print('*** Object class tree ***\n')
   print
   PrintSchemaTree(schema,ldap.schema.ObjectClass,oc_tree,'2.5.6.0',0)
 
-  print '\n*** Attribute types tree ***\n'
+  print('\n*** Attribute types tree ***\n')
   PrintSchemaTree(schema,ldap.schema.AttributeType,at_tree,'_',0)
 
diff --git a/Demo/simple.py b/Demo/simple.py
index e4cf4d0..6004c9e 100644
--- a/Demo/simple.py
+++ b/Demo/simple.py
@@ -1,3 +1,4 @@
+from __future__ import print_function
 import sys,getpass
 import ldap
 
@@ -14,7 +15,7 @@
 
 try:
     dn = "ou=CSEE,o=UQ,c=AU"
-    print "Adding", repr(dn)
+    print("Adding", repr(dn))
     l.add_s(dn,
 	 [
 	    ("objectclass",["organizationalUnit"]),
@@ -32,7 +33,7 @@
 #
 
 dn = "cn=David Leonard,ou=CSEE,o=UQ,c=AU"
-print "Updating", repr(dn)
+print("Updating", repr(dn))
 
 try:
 	l.delete_s(dn)
@@ -100,7 +101,7 @@
 	_ldap.SCOPE_SUBTREE, 
 	"objectclass=*",
       )
-print res
+print(res)
 
 l.unbind()
 
diff --git a/Demo/simplebrowse.py b/Demo/simplebrowse.py
index 804d12f..aa88f67 100644
--- a/Demo/simplebrowse.py
+++ b/Demo/simplebrowse.py
@@ -3,6 +3,7 @@
 #
 # simple LDAP server browsing example
 #
+from __future__ import print_function
 
 import ldap
 from traceback import print_exc
@@ -10,7 +11,7 @@
 url = "ldap://ldap.openldap.org/"
 dn = "dc=openldap,dc=org"
 
-print "Connecting to", url
+print("Connecting to", url)
 
 l = ldap.initialize(url)
 l.bind_s("", "", ldap.AUTH_SIMPLE);
@@ -30,18 +31,18 @@
     try:
 
 	if cmd == "?":
-		print  "cd <dn>	- change DN to <dn>"
-		print  "cd <n>	- change DN to number <n> of last 'ls'"
-		print  "cd -	- change to previous DN"
-		print  "cd ..	- change to one-level higher DN"
-		print  "cd 	- change to root DN"
-		print  "ls	- list children of crrent DN"
-		print  ".	- show attributes of current DN"
-		print  "/<expr>	- list descendents matching filter <expr>"
-		print  "?	- show this help"
+		print( "cd <dn>	- change DN to <dn>")
+		print( "cd <n>	- change DN to number <n> of last 'ls'")
+		print( "cd -	- change to previous DN")
+		print( "cd ..	- change to one-level higher DN")
+		print( "cd 	- change to root DN")
+		print( "ls	- list children of crrent DN")
+		print( ".	- show attributes of current DN")
+		print( "/<expr>	- list descendents matching filter <expr>")
+		print( "?	- show this help")
 
 	elif cmd == "ls":
-		print "Children of", `dn`, ":"
+		print("Children of", `dn`, ":")
 		dnlist = []
 		#
 		# List the children at one level down from the current dn
@@ -58,7 +59,7 @@
 				shortname = name[:-len(dn)-2]+" +"
 			else:
 				shortname = name
-			print " %3d. %s" % (len(dnlist), shortname)
+			print(" %3d. %s" % (len(dnlist), shortname))
 			dnlist.append(name)
 
 	elif cmd == "cd":
@@ -79,7 +80,7 @@
 			        godn = arg
                         else:
 			        if dnlist is None:
-				        print "do an ls first"
+				        print("do an ls first")
                                 else:
 			                godn = dnlist[i]
 		                lastdn = dn
@@ -93,10 +94,10 @@
 		# No attributes are listed, so the default is for
 		# the client to receive all attributes on the DN.
 		#
-		print "Attributes of", `dn`, ":"
+		print("Attributes of", `dn`, ":")
 		for name,attrs in l.search_s(dn, ldap.SCOPE_BASE,
 		    "objectclass=*"):
-			print "  %-24s" % name
+			print("  %-24s" % name)
 			for k,vals in attrs.items():
 			    for v in vals:
 				if len(v) > 200: 
@@ -104,7 +105,7 @@
 						("... (%d bytes)" % len(v))
 				else:
 					v = `v`
-				print "      %-12s: %s" % (k, v)
+				print("      %-12s: %s" % (k, v))
 
 	elif cmd.startswith("/"):
 		#
@@ -114,13 +115,13 @@
 		# that we're not interested in them.
 		#
 		expr = cmd[1:]
-		print "Descendents matching filter", `expr`, ":"
+		print("Descendents matching filter", `expr`, ":")
 		for name,attrs in l.search_s(dn, ldap.SCOPE_SUBTREE,
 		    expr, []):
-			print "  %24s", name
+			print("  %24s", name)
 
 	else:
-		print "unknown command - try '?' for help"
+		print("unknown command - try '?' for help")
 
     except:
 	print_exc()
diff --git a/Doc/ldap-resiter.rst b/Doc/ldap-resiter.rst
index 0beabb8..0e72e92 100644
--- a/Doc/ldap-resiter.rst
+++ b/Doc/ldap-resiter.rst
@@ -46,4 +46,4 @@ processing them in a for-loop.
   for res_type,res_data,res_msgid,res_controls in l.allresults(msg_id):
     for dn,entry in res_data:
       # process dn and entry
-      print dn,entry['objectClass']
+      print(dn,entry['objectClass'])
diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index e983f64..5160f30 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -1169,6 +1169,6 @@ subtree search.
 [('cn=Fred Feuerstein,ou=Testing,dc=stroeder,dc=de', {'cn': ['Fred Feuerstein']})]
 >>> r = l.search_s('ou=Testing,dc=stroeder,dc=de',ldap.SCOPE_SUBTREE,'(objectClass=*)',['cn','mail'])
 >>> for dn,entry in r:
->>>   print 'Processing',repr(dn)
+>>>   print('Processing',repr(dn))
 >>>   handle_ldap_entry(entry)
 

From 17365cc6045b8c7ce9f5f3292ac592f8dc8e5448 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 21:17:56 +0100
Subject: [PATCH 550/868] py3: Use new syntax for exceptions

except ExcType, value  ->  except ExcType as value
raise ExcType, value  ->  raise ExcType(value)
raise value  ->  raise  (when re-raising)
---
 Demo/Lib/ldap/async/deltree.py |  4 ++--
 Demo/paged_search_ext_s.py     |  2 +-
 Demo/pyasn1/dds.py             |  6 +++---
 Demo/pyasn1/noopsearch.py      |  4 ++--
 Demo/pyasn1/ppolicy.py         |  4 ++--
 Demo/pyasn1/psearch.py         |  2 +-
 Demo/pyasn1/sessiontrack.py    |  4 ++--
 Demo/pyasn1/syncrepl.py        |  6 +++---
 Demo/sasl_bind.py              |  4 ++--
 Demo/schema.py                 |  2 +-
 Demo/schema_tree.py            |  2 +-
 Lib/ldap/controls/__init__.py  |  4 ++--
 Lib/ldap/controls/openldap.py  |  2 +-
 Lib/ldap/functions.py          |  2 +-
 Lib/ldap/ldapobject.py         | 10 +++++-----
 Lib/ldap/schema/subentry.py    |  2 +-
 Lib/ldif.py                    |  2 +-
 Tests/t_cext.py                |  4 ++--
 Tests/t_ldapobject.py          |  2 +-
 Tests/t_ldif.py                |  2 +-
 20 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/Demo/Lib/ldap/async/deltree.py b/Demo/Lib/ldap/async/deltree.py
index 04506b3..9e23f1c 100644
--- a/Demo/Lib/ldap/async/deltree.py
+++ b/Demo/Lib/ldap/async/deltree.py
@@ -17,7 +17,7 @@ def __init__(self,l):
 
   def startSearch(self,searchRoot,searchScope):
     if not searchScope in [ldap.SCOPE_ONELEVEL,ldap.SCOPE_SUBTREE]:
-      raise ValueError, "Parameter searchScope must be either ldap.SCOPE_ONELEVEL or ldap.SCOPE_SUBTREE."
+      raise ValueError("Parameter searchScope must be either ldap.SCOPE_ONELEVEL or ldap.SCOPE_SUBTREE.")
     self.nonLeafEntries = []
     self.deletedEntries = 0
     ldap.async.AsyncSearchHandler.startSearch(
@@ -47,7 +47,7 @@ def _processSingleResult(self,resultType,resultItem):
       else:
         try:
           self._l.delete_s(dn)
-        except ldap.NOT_ALLOWED_ON_NONLEAF,e:
+        except ldap.NOT_ALLOWED_ON_NONLEAF as e:
           self.nonLeafEntries.append(dn)
         else:
           self.deletedEntries = self.deletedEntries+1
diff --git a/Demo/paged_search_ext_s.py b/Demo/paged_search_ext_s.py
index 457d79c..d0f8291 100644
--- a/Demo/paged_search_ext_s.py
+++ b/Demo/paged_search_ext_s.py
@@ -73,7 +73,7 @@ def paged_search_ext_s(self,base,scope,filterstr='(objectClass=*)',attrlist=None
             else:
               break # no more pages available
 
-      except ldap.SERVER_DOWN,e:
+      except ldap.SERVER_DOWN as e:
         try:
           self.reconnect(self._uri)
         except AttributeError:
diff --git a/Demo/pyasn1/dds.py b/Demo/pyasn1/dds.py
index 71722b0..c803a1d 100644
--- a/Demo/pyasn1/dds.py
+++ b/Demo/pyasn1/dds.py
@@ -17,7 +17,7 @@
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
   request_ttl = int(sys.argv[2])
-except IndexError,ValueError:
+except (IndexError, ValueError):
   print('Usage: dds.py <LDAP URL> <TTL>')
   sys.exit(1)
 
@@ -39,7 +39,7 @@
 try:
   ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
 
-except ldap.INVALID_CREDENTIALS,e:
+except ldap.INVALID_CREDENTIALS as e:
   print('Simple bind failed:',str(e))
   sys.exit(1)
 
@@ -47,7 +47,7 @@
   extreq = RefreshRequest(entryName=ldap_url.dn,requestTtl=request_ttl)
   try:
     extop_resp_obj = ldap_conn.extop_s(extreq,extop_resp_class=RefreshResponse)
-  except ldap.LDAPError,e:
+  except ldap.LDAPError as e:
     print(str(e))
   else:
     if extop_resp_obj.responseTtl!=request_ttl:
diff --git a/Demo/pyasn1/noopsearch.py b/Demo/pyasn1/noopsearch.py
index 88d2d89..2045f50 100644
--- a/Demo/pyasn1/noopsearch.py
+++ b/Demo/pyasn1/noopsearch.py
@@ -41,7 +41,7 @@
 try:
   ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
 
-except ldap.INVALID_CREDENTIALS,e:
+except ldap.INVALID_CREDENTIALS as e:
   print('Simple bind failed:',str(e))
   sys.exit(1)
 
@@ -59,7 +59,7 @@
   ldap.TIMEOUT,
   ldap.TIMELIMIT_EXCEEDED,
   ldap.SIZELIMIT_EXCEEDED,
-  ldap.ADMINLIMIT_EXCEEDED),e:
+  ldap.ADMINLIMIT_EXCEEDED) as e:
   ldap_conn.abandon(msg_id)
   sys.exit(1)
 
diff --git a/Demo/pyasn1/ppolicy.py b/Demo/pyasn1/ppolicy.py
index 97720b0..cf6b2ac 100644
--- a/Demo/pyasn1/ppolicy.py
+++ b/Demo/pyasn1/ppolicy.py
@@ -17,7 +17,7 @@
 
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
-except IndexError,ValueError:
+except (IndexError,ValueError):
   print('Usage: ppolicy.py <LDAP URL>')
   sys.exit(1)
 
@@ -39,7 +39,7 @@
 try:
   msgid = ldap_conn.simple_bind(ldap_url.who,ldap_url.cred,serverctrls=[PasswordPolicyControl()])
   res_type,res_data,res_msgid,res_ctrls = ldap_conn.result3(msgid)
-except ldap.INVALID_CREDENTIALS,e:
+except ldap.INVALID_CREDENTIALS as e:
   print('Simple bind failed:',str(e))
   sys.exit(1)
 else:
diff --git a/Demo/pyasn1/psearch.py b/Demo/pyasn1/psearch.py
index b2300ad..3bd59e6 100644
--- a/Demo/pyasn1/psearch.py
+++ b/Demo/pyasn1/psearch.py
@@ -40,7 +40,7 @@
 try:
   ldap_conn.simple_bind_s(ldap_url.who,ldap_url.cred)
 
-except ldap.INVALID_CREDENTIALS,e:
+except ldap.INVALID_CREDENTIALS as e:
   print('Simple bind failed:',str(e))
   sys.exit(1)
 
diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
index 337c5e9..91909a3 100644
--- a/Demo/pyasn1/sessiontrack.py
+++ b/Demo/pyasn1/sessiontrack.py
@@ -18,7 +18,7 @@
 
 try:
   ldap_url = ldapurl.LDAPUrl(sys.argv[1])
-except IndexError,ValueError:
+except (IndexError, ValueError):
   print('Usage: %s <LDAP URL>' % (sys.argv[0]))
   sys.exit(1)
 
@@ -40,7 +40,7 @@
 try:
   ldap_conn.simple_bind_s(ldap_url.who or '',ldap_url.cred or '')
 
-except ldap.INVALID_CREDENTIALS,e:
+except ldap.INVALID_CREDENTIALS as e:
   print('Simple bind failed:',str(e))
   sys.exit(1)
 
diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 479a626..e4c62e8 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -157,7 +157,7 @@ def commenceShutdown(signum, stack):
          'X-BINDPW=password" db.shelve'
     ).format(script_name=sys.argv[0])
     sys.exit(1)
-except ValueError,e:
+except ValueError as e:
     print('Error parsing command-line arguments:',str(e))
     sys.exit(1)
 
@@ -169,7 +169,7 @@ def commenceShutdown(signum, stack):
     # Now we login to the LDAP server
     try:
         ldap_connection.simple_bind_s(ldap_url.who, ldap_url.cred)
-    except ldap.INVALID_CREDENTIALS, err:
+    except ldap.INVALID_CREDENTIALS as err:
         logger.error('Login to LDAP server failed: %s', err)
         sys.exit(1)
     except ldap.SERVER_DOWN:
@@ -193,7 +193,7 @@ def commenceShutdown(signum, stack):
     except KeyboardInterrupt:
         # User asked to exit
         commenceShutdown(None, None)
-    except Exception, err:
+    except Exception as err:
         # Handle any exception
         if watcher_running:
             logger.exception('Unhandled exception, going to retry: %s', err)
diff --git a/Demo/sasl_bind.py b/Demo/sasl_bind.py
index 7ff75bf..667221c 100644
--- a/Demo/sasl_bind.py
+++ b/Demo/sasl_bind.py
@@ -68,13 +68,13 @@
   l.protocol_version = 3
   try:
     l.sasl_interactive_bind_s("", sasl_auth)
-  except ldap.LDAPError,e:
+  except ldap.LDAPError as e:
     print('Error using SASL mechanism',sasl_auth.mech,str(e))
   else:
     print('Sucessfully bound using SASL mechanism:',sasl_auth.mech)
     try:
       print('Result of Who Am I? ext. op:',repr(l.whoami_s()))
-    except ldap.LDAPError,e:
+    except ldap.LDAPError as e:
       print('Error using SASL mechanism',sasl_auth.mech,str(e))
     try:
       print('OPT_X_SASL_USERNAME',repr(l.get_option(ldap.OPT_X_SASL_USERNAME)))
diff --git a/Demo/schema.py b/Demo/schema.py
index 9f650d2..4d350f0 100644
--- a/Demo/schema.py
+++ b/Demo/schema.py
@@ -49,7 +49,7 @@
       ('usage',range(2)),
     ]  
   )
-except KeyError,e:
+except KeyError as e:
   print('***KeyError',str(e))
 
 
diff --git a/Demo/schema_tree.py b/Demo/schema_tree.py
index ef8bcec..79c8a83 100644
--- a/Demo/schema_tree.py
+++ b/Demo/schema_tree.py
@@ -52,7 +52,7 @@ def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
 
 try:
   options,args=getopt.getopt(sys.argv[1:],'',['html'])
-except getopt.error,e:
+except getopt.error:
   print('Error: %s\nUsage: schema_oc_tree.py [--html] [LDAP URL]')
 
 html_output = options and options[0][0]=='--html'
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index 56d611b..932fa53 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -148,9 +148,9 @@ def DecodeControlTuples(ldapControlTuples,knownLDAPControls=None):
       control.controlType,control.criticality = controlType,criticality
       try:
         control.decodeControlValue(encodedControlValue)
-      except PyAsn1Error,e:
+      except PyAsn1Error:
         if criticality:
-          raise e
+          raise
       else:
         result.append(control)
   return result
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index ee7b575..7108c63 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -67,7 +67,7 @@ def noop_search_st(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass=*)
       ldap.TIMELIMIT_EXCEEDED,
       ldap.SIZELIMIT_EXCEEDED,
       ldap.ADMINLIMIT_EXCEEDED
-    ),e:
+    ) as e:
       self.abandon(msg_id)
       raise e
     else:
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 6ddab54..c60d42b 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -53,7 +53,7 @@ def _ldap_function_call(lock,func,*args,**kwargs):
     finally:
       if lock:
         lock.release()
-  except LDAPError,e:
+  except LDAPError as e:
     if __debug__ and ldap._trace_level>=2:
       ldap._trace_file.write('=> LDAPError: %s\n' % (str(e)))
     raise
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 805b6e3..a199462 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -96,7 +96,7 @@ def _ldap_call(self,func,*args,**kwargs):
             diagnostic_message_success = self._l.get_option(ldap.OPT_DIAGNOSTIC_MESSAGE)
       finally:
         self._ldap_object_lock.release()
-    except LDAPError, e:
+    except LDAPError as e:
       exc_type,exc_value,exc_traceback = sys.exc_info()
       try:
         if 'info' not in e.args[0] and 'errno' in e.args[0]:
@@ -125,9 +125,9 @@ def __getattr__(self,name):
     elif name in self.__dict__:
       return self.__dict__[name]
     else:
-      raise AttributeError,'%s has no attribute %s' % (
+      raise AttributeError('%s has no attribute %s' % (
         self.__class__.__name__,repr(name)
-      )
+      ))
 
   def fileno(self):
     """
@@ -865,14 +865,14 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
             SimpleLDAPObject.start_tls_s(self)
           # Repeat last simple or SASL bind
           self._apply_last_bind()
-        except (ldap.SERVER_DOWN,ldap.TIMEOUT),e:
+        except (ldap.SERVER_DOWN,ldap.TIMEOUT):
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('*** %s reconnect to %s failed\n' % (
               counter_text,uri
             ))
           reconnect_counter = reconnect_counter-1
           if not reconnect_counter:
-            raise e
+            raise
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('=> delay %s...\n' % (retry_delay))
           time.sleep(retry_delay)
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 99a0dc4..3612a38 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -430,7 +430,7 @@ def attribute_types(
               schema_attr_type = self.sed[AttributeType][a]
             except KeyError:
               if raise_keyerror:
-                raise KeyError,'No attribute type found in sub schema by name %s' % (a)
+                raise KeyError('No attribute type found in sub schema by name %s' % (a))
               # If there's no schema element for this attribute type
               # but still KeyError is to be ignored we filter it away
               del l[a]
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 86b8ac9..714d01c 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -335,7 +335,7 @@ def _next_key_and_value(self):
       return '-',None
     try:
       colon_pos = unfolded_line.index(':')
-    except ValueError,e:
+    except ValueError as e:
       raise ValueError('no value-spec in %s' % (repr(unfolded_line)))
     attr_type = unfolded_line[0:colon_pos]
     # if needed attribute value is BASE64 decoded
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index cac661e..7c1417b 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -253,7 +253,7 @@ def test_abandon(self):
         self.assertNone(ret)
         try:
             r = l.result4(m, _ldap.MSG_ALL, 0.3)  # (timeout /could/ be longer)
-        except _ldap.TIMEOUT, e:
+        except _ldap.TIMEOUT as e:
             pass
         else:
             self.fail("expected TIMEOUT, got %r" % r)
@@ -683,7 +683,7 @@ def test_errno107(self):
         try:
             m = l.simple_bind("", "")
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        except _ldap.SERVER_DOWN, ldap_err:
+        except _ldap.SERVER_DOWN as ldap_err:
             errno = ldap_err.args[0]['errno']
             if errno != 107:
                 self.fail("expected errno=107, got %d" % errno)
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 196a9f3..5773ff2 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -159,7 +159,7 @@ def test004_errno107(self):
         try:
             m = l.simple_bind_s("", "")
             r = l.result4(m, ldap.MSG_ALL, self.timeout)
-        except ldap.SERVER_DOWN, ldap_err:
+        except ldap.SERVER_DOWN as ldap_err:
             errno = ldap_err.args[0]['errno']
             if errno != 107:
                 self.fail("expected errno=107, got %d" % errno)
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 3da213f..76701cc 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -662,7 +662,7 @@ def test_bad_change_records(self):
             ldif_string = textwrap.dedent(bad_ldif_string).lstrip() + '\n'
             try:
                 res = self._parse_records(ldif_string)
-            except ValueError, value_error:
+            except ValueError as value_error:
                 pass
             else:
                 self.fail("should have raised ValueError: %r" % bad_ldif_string)

From 17b4000d7d0eaab602098ac3aa5d858373d659af Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 21:30:42 +0100
Subject: [PATCH 551/868] py3: Use modern idioms with built-in types

d.has_key(x)  ->  x in d
list(x); x.sort()  ->  sorted(x)
filter(lambda...)  ->  list comprehension
d.keys()  ->  list(d.keys())  (when keys are modified)
x == None  ->  x is None
---
 Demo/Lib/ldap/async/deltree.py | 2 +-
 Lib/ldap/modlist.py            | 6 +++---
 Lib/ldap/schema/subentry.py    | 7 ++++---
 Lib/ldif.py                    | 6 +++---
 Tests/t_cidict.py              | 6 ++----
 5 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/Demo/Lib/ldap/async/deltree.py b/Demo/Lib/ldap/async/deltree.py
index 9e23f1c..68d3643 100644
--- a/Demo/Lib/ldap/async/deltree.py
+++ b/Demo/Lib/ldap/async/deltree.py
@@ -30,7 +30,7 @@ def startSearch(self,searchRoot,searchScope):
     )
 
   def _processSingleResult(self,resultType,resultItem):
-    if self._entryResultTypes.has_key(resultType):
+    if resultType in self._entryResultTypes:
       # Don't process search references
       dn,entry = resultItem
       hasSubordinates = entry.get(
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 6f4bf1e..a853500 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -18,7 +18,7 @@ def addModlist(entry,ignore_attr_types=None):
       # This attribute type is ignored
       continue
     # Eliminate empty attr value strings in list
-    attrvaluelist = filter(lambda x:x!=None,entry[attrtype])
+    attrvaluelist = [item for item in entry[attrtype] if item is not None]
     if attrvaluelist:
       modlist.append((attrtype,entry[attrtype]))
   return modlist # addModlist()
@@ -58,10 +58,10 @@ def modifyModlist(
       # This attribute type is ignored
       continue
     # Filter away null-strings
-    new_value = filter(lambda x:x!=None,new_entry[attrtype])
+    new_value = [item for item in new_entry[attrtype] if item is not None]
     if attrtype_lower in attrtype_lower_map:
       old_value = old_entry.get(attrtype_lower_map[attrtype_lower],[])
-      old_value = filter(lambda x:x!=None,old_value)
+      old_value = [item for item in old_value if item is not None]
       del attrtype_lower_map[attrtype_lower]
     else:
       old_value = []
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 3612a38..fbc33c5 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -294,7 +294,8 @@ def get_structural_oc(self,oc_list):
       if oc_se and oc_se.kind==0:
         struct_ocs[oc_se.oid] = None
     result = None
-    struct_oc_list = struct_ocs.keys()
+    # Build a copy of the oid list, to be cleaned as we go.
+    struct_oc_list = list(struct_ocs)
     while struct_oc_list:
       oid = struct_oc_list.pop()
       for child_oid in oc_tree[oid]:
@@ -417,14 +418,14 @@ def attribute_types(
 
     # Remove all mandantory attribute types from
     # optional attribute type list
-    for a in r_may.keys():
+    for a in list(r_may.keys()):
       if a in r_must:
         del r_may[a]
 
     # Apply attr_type_filter to results
     if attr_type_filter:
       for l in [r_must,r_may]:
-        for a in l.keys():
+        for a in list(l.keys()):
           for afk,afv in attr_type_filter:
             try:
               schema_attr_type = self.sed[AttributeType][a]
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 714d01c..318f46c 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -125,7 +125,7 @@ def _needs_base64_encoding(self,attr_type,attr_value):
     returns 1 if attr_value has to be base-64 encoded because
     of special chars or because attr_type is in self._base64_attrs
     """
-    return self._base64_attrs.has_key(attr_type.lower()) or \
+    return attr_type.lower() in self._base64_attrs or \
            not safe_string_re.search(attr_value) is None
 
   def _unparseAttrTypeandValue(self,attr_type,attr_value):
@@ -351,7 +351,7 @@ def _next_key_and_value(self):
       attr_value = None
       if self._process_url_schemes:
         u = urlparse.urlparse(url)
-        if self._process_url_schemes.has_key(u[0]):
+        if u[0] in self._process_url_schemes:
           attr_value = urllib.urlopen(url).read()
     else:
       attr_value = unfolded_line[colon_pos+1:]
@@ -369,7 +369,7 @@ def _consume_empty_lines(self):
     # Consume empty lines
     try:
       k,v = next_key_and_value()
-      while k==v==None:
+      while k is None and v is None:
         k,v = next_key_and_value()
     except EOFError:
       k,v = None,None
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index c8812f2..dea802d 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -32,11 +32,9 @@ def test_cidict(self):
         cix["xYZ"] = 987
         self.assertEqual(cix["XyZ"], 987)
         self.assertEqual(cix.get("xyz", None), 987)
-        cix_keys = cix.keys()
-        cix_keys.sort()
+        cix_keys = sorted(cix.keys())
         self.assertEqual(cix_keys, ['AbCDeF','xYZ'])
-        cix_items = cix.items()
-        cix_items.sort()
+        cix_items = sorted(cix.items())
         self.assertEqual(cix_items, [('AbCDeF',123), ('xYZ',987)])
         del cix["abcdEF"]
         self.assertEqual("abcdef" in cix, False)

From 587460a228441dfcc56cba9ce8bebd393c9f24bb Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 21:42:00 +0100
Subject: [PATCH 552/868] py3: Add and use the ldap.compat module

Add a module providing common things that differ
between Python 2 and 3.

(This is really a limited approximation of the six library)
---
 Lib/ldap/cidict.py          |  2 +-
 Lib/ldap/compat.py          | 43 +++++++++++++++++++++++++++++++++++++
 Lib/ldap/ldapobject.py      |  6 +++++-
 Lib/ldap/schema/models.py   |  9 +++++---
 Lib/ldap/schema/subentry.py |  5 +++--
 Lib/ldapurl.py              |  8 +++----
 Lib/ldif.py                 |  8 +++----
 Lib/slapdtest.py            |  5 +++--
 Tests/t_ldapurl.py          |  8 +++----
 setup.py                    |  1 +
 10 files changed, 73 insertions(+), 22 deletions(-)
 create mode 100644 Lib/ldap/compat.py

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 07832ef..fdfba4b 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -8,7 +8,7 @@
 
 from ldap import __version__
 
-from UserDict import IterableUserDict
+from ldap.compat import IterableUserDict
 
 
 class cidict(IterableUserDict):
diff --git a/Lib/ldap/compat.py b/Lib/ldap/compat.py
new file mode 100644
index 0000000..de0e110
--- /dev/null
+++ b/Lib/ldap/compat.py
@@ -0,0 +1,43 @@
+"""Compatibility wrappers for Py2/Py3."""
+
+import sys
+
+if sys.version_info[0] < 3:
+    from UserDict import UserDict, IterableUserDict
+    from urllib import quote
+    from urllib import quote_plus
+    from urllib import unquote as urllib_unquote
+    from urllib import urlopen
+    from urlparse import urlparse
+
+    def unquote(uri):
+        """Specialized unquote that uses UTF-8 for parsing."""
+        uri = uri.encode('ascii')
+        unquoted = urllib_unquote(uri)
+        return unquoted.decode('utf-8')
+
+    # Old-style of re-raising an exception is SyntaxError in Python 3,
+    # so hide behind exec() so the Python 3 parser doesn't see it
+    exec('''def reraise(exc_type, exc_value, exc_traceback):
+        """Re-raise an exception given information from sys.exc_info()
+
+        Note that unlike six.reraise, this does not support replacing the
+        traceback. All arguments must come from a single sys.exc_info() call.
+        """
+        raise exc_type, exc_value, exc_traceback
+    ''')
+
+else:
+    from collections import UserDict
+    IterableUserDict = UserDict
+    from urllib.parse import quote, quote_plus, unquote, urlparse
+    from urllib.request import urlopen
+
+    def reraise(exc_type, exc_value, exc_traceback):
+        """Re-raise an exception given information from sys.exc_info()
+
+        Note that unlike six.reraise, this does not support replacing the
+        traceback. All arguments must come from a single sys.exc_info() call.
+        """
+        # In Python 3, all exception info is contained in one object.
+        raise exc_value
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index a199462..970f014 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -24,6 +24,7 @@
 from ldap.schema import SCHEMA_ATTRS
 from ldap.controls import LDAPControl,DecodeControlTuples,RequestControlTuples
 from ldap.extop import ExtendedRequest,ExtendedResponse
+from ldap.compat import reraise
 
 from ldap import LDAPError
 
@@ -105,7 +106,10 @@ def _ldap_call(self,func,*args,**kwargs):
         pass
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
-      raise exc_type,exc_value,exc_traceback
+      try:
+        reraise(exc_type, exc_value, exc_traceback)
+      finally:
+        exc_type = exc_value = exc_traceback = None
     else:
       if __debug__ and self._trace_level>=2:
         if not diagnostic_message_success is None:
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 8471954..c3bb702 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -4,7 +4,10 @@
 See https://www.python-ldap.org/ for details.
 """
 
-import UserDict,ldap.cidict
+import sys
+
+import ldap.cidict
+from ldap.compat import IterableUserDict
 
 from ldap.schema.tokenizer import split_tokens,extract_tokens
 
@@ -615,7 +618,7 @@ def __str__(self):
     return '( %s )' % ''.join(result)
 
 
-class Entry(UserDict.IterableUserDict):
+class Entry(IterableUserDict):
   """
   Schema-aware implementation of an LDAP entry class.
 
@@ -628,7 +631,7 @@ def __init__(self,schema,dn,entry):
     self._attrtype2keytuple = {}
     self._s = schema
     self.dn = dn
-    UserDict.UserDict.__init__(self,{})
+    IterableUserDict.IterableUserDict.__init__(self,{})
     self.update(entry)
 
   def _at2key(self,nameoroid):
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index fbc33c5..4d42b19 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -473,8 +473,9 @@ def urlfetch(uri,trace_level=0):
     l.unbind_s()
     del l
   else:
-    import urllib,ldif
-    ldif_file = urllib.urlopen(uri)
+    import ldif
+    from ldap.compat import urlopen
+    ldif_file = urlopen(uri)
     ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
     ldif_parser.parse()
     subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index bbd6929..366e177 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -16,9 +16,7 @@
   'LDAPUrlExtension','LDAPUrlExtensions','LDAPUrl'
 ]
 
-import UserDict
-
-from urllib import quote,unquote
+from ldap.compat import UserDict, quote, unquote
 
 LDAP_SCOPE_BASE = 0
 LDAP_SCOPE_ONELEVEL = 1
@@ -132,14 +130,14 @@ def __ne__(self,other):
     return not self.__eq__(other)
 
 
-class LDAPUrlExtensions(UserDict.UserDict):
+class LDAPUrlExtensions(UserDict):
   """
   Models a collection of LDAP URL extensions as
   dictionary type
   """
 
   def __init__(self,default=None):
-    UserDict.UserDict.__init__(self)
+    UserDict.__init__(self)
     for k,v in (default or {}).items():
       self[k]=v
 
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 318f46c..7659358 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -18,8 +18,6 @@
   'LDIFCopy',
 ]
 
-import urlparse
-import urllib
 import re
 from base64 import b64encode, b64decode
 
@@ -28,6 +26,8 @@
 except ImportError:
   from StringIO import StringIO
 
+from ldap.compat import urlparse, urlopen
+
 attrtype_pattern = r'[\w;.-]+(;[\w_-]+)*'
 attrvalue_pattern = r'(([^,]|\\,)+|".*?")'
 attrtypeandvalue_pattern = attrtype_pattern + r'[ ]*=[ ]*' + attrvalue_pattern
@@ -350,9 +350,9 @@ def _next_key_and_value(self):
       url = unfolded_line[colon_pos+2:].strip()
       attr_value = None
       if self._process_url_schemes:
-        u = urlparse.urlparse(url)
+        u = urlparse(url)
         if u[0] in self._process_url_schemes:
-          attr_value = urllib.urlopen(url).read()
+          attr_value = urlopen(url).read()
     else:
       attr_value = unfolded_line[colon_pos+1:]
     return attr_type,attr_value
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 2f98672..6bb43f0 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -14,7 +14,8 @@
 import logging
 from logging.handlers import SysLogHandler
 import unittest
-import urllib
+
+from ldap.compat import quote_plus
 
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = r"""
@@ -125,7 +126,7 @@ def __init__(self):
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
-        self.ldapi_uri = "ldapi://%s" % urllib.quote_plus(ldapi_path)
+        self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
 
     def setup_rundir(self):
         """
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index c87b752..407538f 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -6,7 +6,7 @@
 """
 
 import unittest
-import urllib
+from ldap.compat import quote
 
 import ldapurl
 from ldapurl import LDAPUrl
@@ -185,9 +185,9 @@ def test_combo(self):
             "ldap://127.0.0.1:1234/dc=example,dc=com"
             + "?attr1,attr2,attr3"
             + "?sub"
-            + "?" + urllib.quote("(objectClass=*)")
-            + "?bindname=" + urllib.quote("cn=d,c=au")
-            + ",X-BINDPW=" + urllib.quote("???")
+            + "?" + quote("(objectClass=*)")
+            + "?bindname=" + quote("cn=d,c=au")
+            + ",X-BINDPW=" + quote("???")
             + ",trace=8"
         )
         self.assertEqual(u.urlscheme, "ldap")
diff --git a/setup.py b/setup.py
index 6bbf595..a475a35 100644
--- a/setup.py
+++ b/setup.py
@@ -137,6 +137,7 @@ class OpenLDAP2:
     'ldap',
     'slapdtest',
     'ldap.async',
+    'ldap.compat',
     'ldap.controls',
     'ldap.controls.deref',
     'ldap.controls.libldap',

From 03e8e7e8dc058fcfd8880c861fa9d1d28efe5b8b Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 21:45:52 +0100
Subject: [PATCH 553/868] py3: Use "int" instead of "long" (in Python code)

In Python 2.7, long integers behave sufficiently similarly
to normal int.
In Python 3, there is only one kind of int.
---
 Lib/ldap/ldapobject.py    | 4 ++--
 Lib/ldap/schema/models.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 970f014..e83287d 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -808,7 +808,7 @@ def __init__(
     self._retry_max = retry_max
     self._retry_delay = retry_delay
     self._start_tls = 0
-    self._reconnects_done = 0L
+    self._reconnects_done = 0
 
   def __getstate__(self):
     """return data representation for pickled object"""
@@ -886,7 +886,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
             self._trace_file.write('*** %s reconnect to %s successful => repeat last operation\n' % (
               counter_text,uri
             ))
-          self._reconnects_done = self._reconnects_done + 1L
+          self._reconnects_done = self._reconnects_done + 1
           break
     finally:
       self._reconnect_lock.release()
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index c3bb702..300981e 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -267,9 +267,9 @@ def _set_attrs(self,l,d):
           self.syntax_len = None
           for i in l:
             if i.startswith("{") and i.endswith("}"):
-              self.syntax_len=long(i[1:-1])
+              self.syntax_len = int(i[1:-1])
         else:
-          self.syntax_len = long(syntax_len[:-1])
+          self.syntax_len = int(syntax_len[:-1])
     self.single_value = d['SINGLE-VALUE']!=None
     self.collective = d['COLLECTIVE']!=None
     self.no_user_mod = d['NO-USER-MODIFICATION']!=None

From b62c5894d882867fc3bfc2dc2aaa54ff3fdcd9f0 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 21:59:57 +0100
Subject: [PATCH 554/868] py3: Use absolute imports

---
 Lib/ldap/__init__.py |  4 ++--
 Tests/__init__.py    | 24 +++++++++++++-----------
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index c8a1b12..dab97a6 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -86,9 +86,9 @@ def release(self):
 # Create module-wide lock for serializing all calls into underlying LDAP lib
 _ldap_module_lock = LDAPLock(desc='Module wide')
 
-from functions import open,initialize,init,get_option,set_option,escape_str,strf_secs,strp_secs
+from ldap.functions import open,initialize,init,get_option,set_option,escape_str,strf_secs,strp_secs
 
-from ldapobject import NO_UNIQUE_ENTRY
+from ldap.ldapobject import NO_UNIQUE_ENTRY
 
 from ldap.dn import explode_dn,explode_rdn,str2dn,dn2str
 del str2dn
diff --git a/Tests/__init__.py b/Tests/__init__.py
index b7b5378..df95a06 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -5,14 +5,16 @@
 See https://www.python-ldap.org/ for details.
 """
 
-import t_cext
-import t_cidict
-import t_ldap_dn
-import t_ldap_filter
-import t_ldap_functions
-import t_ldap_modlist
-import t_ldap_schema_tokenizer
-import t_ldapurl
-import t_ldif
-import t_ldapobject
-import t_ldap_schema_subentry
+from __future__ import absolute_import
+
+from . import t_cext
+from . import t_cidict
+from . import t_ldap_dn
+from . import t_ldap_filter
+from . import t_ldap_functions
+from . import t_ldap_modlist
+from . import t_ldap_schema_tokenizer
+from . import t_ldapurl
+from . import t_ldif
+from . import t_ldapobject
+from . import t_ldap_schema_subentry

From 8a54ae3c3396280fa7a6936f31e8948d95cf8b1c Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:16:50 +0100
Subject: [PATCH 555/868] py3: Import StringIO from io

This was backported to Python 2.7. It uses the C-optimized version,
so cStringIO is not needed either.
---
 Lib/ldif.py | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index 7659358..94ffd91 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -20,11 +20,7 @@
 
 import re
 from base64 import b64encode, b64decode
-
-try:
-  from cStringIO import StringIO
-except ImportError:
-  from StringIO import StringIO
+from io import StringIO
 
 from ldap.compat import urlparse, urlopen
 

From 301939e165efadbe93d83eedb87af6efea14754f Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:29:02 +0100
Subject: [PATCH 556/868] Tests: Expand cidict membership tests

Note that for backwards compatibility, cidict keeps the
has_key method even on Python 3.
---
 Tests/t_cidict.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index dea802d..00d0726 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -37,9 +37,12 @@ def test_cidict(self):
         cix_items = sorted(cix.items())
         self.assertEqual(cix_items, [('AbCDeF',123), ('xYZ',987)])
         del cix["abcdEF"]
-        self.assertEqual("abcdef" in cix, False)
+        self.assertEqual("abcdef" in cix._keys, False)
         self.assertEqual("AbCDef" in cix._keys, False)
+        self.assertEqual("abcdef" in cix, False)
+        self.assertEqual("AbCDef" in cix, False)
         self.assertEqual(cix.has_key("abcdef"), False)
+        self.assertEqual(cix.has_key("AbCDef"), False)
 
 
 if __name__ == '__main__':

From f605dbf25ac1dc0e94fe66eca1a2b8f60b06806c Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:33:06 +0100
Subject: [PATCH 557/868] Infra: Re-format README to Restructured Text, add
 REMADE.rst symlink

The symlink is intended for tools that automatically pretty-print the file.
---
 README     | 99 +++++++++++++++++++++++++++++-------------------------
 README.rst |  1 +
 2 files changed, 54 insertions(+), 46 deletions(-)
 create mode 120000 README.rst

diff --git a/README b/README
index d8e88bb..6081b4b 100644
--- a/README
+++ b/README
@@ -3,6 +3,7 @@ python-ldap: LDAP client API for Python
 ---------------------------------------
 
 What is python-ldap?
+====================
 
 python-ldap provides an object-oriented API to access LDAP
 directory servers from Python programs. Mainly it wraps the
@@ -22,79 +23,85 @@ For module documentation, see:
 	https://www.python-ldap.org/
 
 Quick usage example:
+====================
+
+.. code-block:: python
+
     import ldap
     l = ldap.initialize("ldap://my_ldap_server.my_domain")
     l.simple_bind_s("","")
     l.search_s("o=My Organisation, c=AU", ldap.SCOPE_SUBTREE, "objectclass=*")
 
-See directory Demo/ of source distribution package for more
+See directory ``Demo/`` of source distribution package for more
 example code.
 
 Author(s) contact and documentation:
+====================================
 
    https://www.python-ldap.org/
 
-   If you are looking for help, please try the mailing list archives
-   first, then send a question to the mailing list.
-   Be warned that questions will be ignored if they can be
-   trivially answered by referring to the documentation.
+If you are looking for help, please try the mailing list archives
+first, then send a question to the mailing list.
+Be warned that questions will be ignored if they can be
+trivially answered by referring to the documentation.
 
-   If you are interested in helping, please contact the mailing list.
-   If you want new features or upgrades, please check the mailing list
-   archives and then enquire about any progress.
+If you are interested in helping, please contact the mailing list.
+If you want new features or upgrades, please check the mailing list
+archives and then enquire about any progress.
 
 Acknowledgements:
+=================
 
-   Thanks to Konstantin Chuguev <Konstantin.Chuguev at dante.org.uk>
-   and Steffen Ries <steffen.ries at sympatico.ca> for working
-   on support for OpenLDAP 2.0.x features.
+Thanks to Konstantin Chuguev <Konstantin.Chuguev at dante.org.uk>
+and Steffen Ries <steffen.ries at sympatico.ca> for working
+on support for OpenLDAP 2.0.x features.
 
-   Thanks to Michael Stroeder <michael at stroeder.com> for the
-   modules ldif, ldapurl, ldap/schema/*.py, ldap/*.py and ldap/controls/*.py.
+Thanks to Michael Stroeder <michael at stroeder.com> for the
+modules ``ldif``, ``ldapurl``, ``ldap/schema/*.py``, ``ldap/*.py`` and ``ldap/controls/*.py``.
 
-   Thanks to Hans Aschauer <Hans.Aschauer at Physik.uni-muenchen.de>
-   for the C wrapper schema and SASL support.
+Thanks to Hans Aschauer <Hans.Aschauer at Physik.uni-muenchen.de>
+for the C wrapper schema and SASL support.
 
-   Thanks to Mauro Cicognini <mcicogni at siosistemi.it> for the
-   WIN32/MSVC6 bits, and the pre-built WIN32 ldap.pyd.
+Thanks to Mauro Cicognini <mcicogni at siosistemi.it> for the
+WIN32/MSVC6 bits, and the pre-built WIN32 ``ldap.pyd``.
 
-   Thanks to Waldemar Osuch <waldemar.osuch at gmail.com> for contributing
-   the new-style docs based on reStructuredText.
+Thanks to Waldemar Osuch <waldemar.osuch at gmail.com> for contributing
+the new-style docs based on reStructuredText.
 
-   Thanks to Torsten Kurbad <torsten at tk-webart.de> for the
-   easy_install support.
+Thanks to Torsten Kurbad <torsten at tk-webart.de> for the
+easy_install support.
 
-   Thanks to James Andrewartha <jamesa at daa.com.au> for
-   significant contribution to Doc/*.tex.
+Thanks to James Andrewartha <jamesa at daa.com.au> for
+significant contribution to ``Doc/*.tex``.
 
-   Thanks to Rich Megginson <rmeggins at redhat.com> for extending
-   support for LDAPv3 controls and adding support for LDAPv3 extended
-   operations.
+Thanks to Rich Megginson <rmeggins at redhat.com> for extending
+support for LDAPv3 controls and adding support for LDAPv3 extended
+operations.
 
-   Thanks to Peter Gietz, DAASI for funding some control modules.
+Thanks to Peter Gietz, DAASI for funding some control modules.
 
-   Thanks to Chris Mikkelson for various fixes and ldap.syncrepl.
+Thanks to Chris Mikkelson for various fixes and ldap.syncrepl.
 
-   These very kind people have supplied patches or suggested changes:
+These very kind people have supplied patches or suggested changes:
 
-       Federico Di Gregorio <fog at mixadlive.com>
-       John Benninghoff <johnb at netscape.com>
-       Donn Cave <donn at u.washington.edu>
-       Jason Gunthorpe <jgg at debian.org>
-       gurney_j <gurney_j at 4j.lane.edu>
-       Eric S. Johansson <esj at harvee.billerica.ma.us>
-       David Margrave <davidma at premier1.net>
-       Uche Ogbuji <uche.ogbuji at fourthought.com>
-       Neale Pickett <neale at lanl.gov>
-       Blake Weston <weston at platinum1.cambridge.scr.slb.com>
-       Wido Depping <wido.depping at gmail.com>
-       Deepak Giridharagopal <deepak at arlut.utexas.edu>
-       Ingo Steuwer <steuwer at univention.de>
-       Andreas Hasenack <ahasenack at terra.com.br>
-       Matej Vela <vela at debian.org>
+* Federico Di Gregorio <fog at mixadlive.com>
+* John Benninghoff <johnb at netscape.com>
+* Donn Cave <donn at u.washington.edu>
+* Jason Gunthorpe <jgg at debian.org>
+* gurney_j <gurney_j at 4j.lane.edu>
+* Eric S. Johansson <esj at harvee.billerica.ma.us>
+* David Margrave <davidma at premier1.net>
+* Uche Ogbuji <uche.ogbuji at fourthought.com>
+* Neale Pickett <neale at lanl.gov>
+* Blake Weston <weston at platinum1.cambridge.scr.slb.com>
+* Wido Depping <wido.depping at gmail.com>
+* Deepak Giridharagopal <deepak at arlut.utexas.edu>
+* Ingo Steuwer <steuwer at univention.de>
+* Andreas Hasenack <ahasenack at terra.com.br>
+* Matej Vela <vela at debian.org>
 
-   Thanks to all the guys on the python-ldap mailing list for
-   their contributions and input into this package.
+Thanks to all the guys on the python-ldap mailing list for
+their contributions and input into this package.
 
    Thanks! We may have missed someone: please mail us if we have omitted
    your name.
diff --git a/README.rst b/README.rst
new file mode 120000
index 0000000..100b938
--- /dev/null
+++ b/README.rst
@@ -0,0 +1 @@
+README
\ No newline at end of file

From b2c2b5cb06fc68f1c7ceeac50df20454415be71b Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:37:46 +0100
Subject: [PATCH 558/868] slapdtest: Open slapd config file in text mode when
 writing it

---
 Lib/slapdtest.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 6bb43f0..3c6e549 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -214,9 +214,8 @@ def _ln_schema_files(self, file_names, source_dir):
     def _write_config(self):
         """Writes the slapd.conf file out, and returns the path to it."""
         self._log.debug('Writing config to %s', self._slapd_conf)
-        config_file = file(self._slapd_conf, 'wb')
-        config_file.write(self.gen_config())
-        config_file.close()
+        with open(self._slapd_conf, 'w') as config_file:
+            config_file.write(self.gen_config())
         self._log.info('Wrote config to %s', self._slapd_conf)
 
     def _test_config(self):

From 42f3e84834eb11505d8df77494bfe662d5540746 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:38:40 +0100
Subject: [PATCH 559/868] slapdtest: Automatically try some common locations
 for SCHEMADIR

---
 Lib/slapdtest.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 3c6e549..2580ef3 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -105,7 +105,14 @@ class SlapdObject(object):
     TMPDIR = os.environ.get('TMP', os.getcwd())
     SBINDIR = os.environ.get('SBIN', '/usr/sbin')
     BINDIR = os.environ.get('BIN', '/usr/bin')
-    SCHEMADIR = os.environ.get('SCHEMA', '/etc/openldap/schema')
+    if 'SCHEMA' in os.environ:
+        SCHEMADIR = os.environ['SCHEMA']
+    elif os.path.isdir("/etc/openldap/schema"):
+        SCHEMADIR = "/etc/openldap/schema"
+    elif os.path.isdir("/etc/ldap/schema"):
+        SCHEMADIR = "/etc/ldap/schema"
+    else:
+        PATH_SCHEMA_CORE = None
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
     PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')

From d54539f25bbfb028bfe75c877200b76690eb45d4 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:39:24 +0100
Subject: [PATCH 560/868] slapdtest: Ensure server is stopped when the process
 exits

---
 Lib/slapdtest.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 2580ef3..1aba887 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -12,6 +12,7 @@
 import time
 import subprocess
 import logging
+import atexit
 from logging.handlers import SysLogHandler
 import unittest
 
@@ -151,6 +152,9 @@ def _cleanup_rundir(self):
         """
         Recursively delete whole directory specified by `path'
         """
+        # cleanup_rundir() is called in atexit handler. Until Python 3.4,
+        # the rest of the world is already destroyed.
+        import os, os.path
         if not os.path.exists(self.testrundir):
             return
         self._log.debug('clean-up %s', self.testrundir)
@@ -278,6 +282,7 @@ def start(self):
 
         if self._proc is None:
             # prepare directory structure
+            atexit.register(self.stop)
             self._cleanup_rundir()
             self.setup_rundir()
             self._write_config()

From e90c7d15a870f1ac33fa6f177c42830c7d2271d7 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:46:08 +0100
Subject: [PATCH 561/868] Tests: Replace deprecated "failIf" name by
 "assertFalse"

---
 Tests/t_cext.py    | 4 ++--
 Tests/t_ldapurl.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 7c1417b..3cbdbe7 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -64,10 +64,10 @@ def _open_conn(self, bind=True):
         return l
 
     def assertNotNone(self, expr, msg=None):
-        self.failIf(expr is None, msg or repr(expr))
+        self.assertFalse(expr is None, msg or repr(expr))
 
     def assertNone(self, expr, msg=None):
-        self.failIf(expr is not None, msg or repr(expr))
+        self.assertFalse(expr is not None, msg or repr(expr))
 
     # Test for the existence of a whole bunch of constants
     # that the C module is supposed to export
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 407538f..a68b032 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -178,7 +178,7 @@ def test_ldapurl(self):
 class TestLDAPUrl(unittest.TestCase):
 
     def assertNone(self, expr, msg=None):
-        self.failIf(expr is not None, msg or ("%r" % expr))
+        self.assertFalse(expr is not None, msg or ("%r" % expr))
 
     def test_combo(self):
         u = MyLDAPUrl(

From ffd35806229eafe373c41a32f645c9c51307f1f9 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 22:55:33 +0100
Subject: [PATCH 562/868] Infra: Remove PKG-INFO

---
 PKG-INFO | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 PKG-INFO

diff --git a/PKG-INFO b/PKG-INFO
deleted file mode 100644
index e69de29..0000000

From 39ad22ec7185df86ca79781ad96e03c1f2bba898 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 23:12:06 +0100
Subject: [PATCH 563/868] Doc: Write about bytes/text management

This should eventually be moved elsewhere in the docs.
---
 Doc/index.rst | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/Doc/index.rst b/Doc/index.rst
index 14992a6..1f9bf6a 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -34,6 +34,43 @@ Contents
    slapdtest.rst
 
 
+
+*********************
+Bytes/text management
+*********************
+
+The LDAP protocol states that some fields (distinguised names, relative distinguished names,
+attribute names, queries) be encoded in UTF-8; some other (mostly attribute *values*) **MAY**
+contain any type of data, and thus be treated as bytes.
+
+In Python 2, ``python-ldap`` used bytes for all fields, including those guaranteed to be text.
+In order to support Python 3, this distinction is made explicit. This is done
+through the ``bytes_mode`` flag to ``ldap.initialize()``.
+
+When porting from ``python-ldap`` 2.x, users are advised to update their code to set ``bytes_mode=False``
+on calls to these methods.
+Under Python 2, ``python-pyldap`` aggressively checks the type of provided arguments, and will raise a ``TypeError``
+for any invalid parameter.
+However, if the ``bytes_mode`` kwarg isn't provided, ``pyldap`` will only
+raise warnings.
+
+The typical usage is as follows; note that only the result's *values* are of the bytes type:
+
+.. code-block:: pycon
+
+    >>> import ldap
+    >>> con = ldap.initialize('ldap://localhost:389', bytes_mode=False)
+    >>> con.simple_bind_s('login', 'secret_password')
+    >>> results = con.search_s('ou=people,dc=example,dc=org', ldap.SCOPE_SUBTREE, "(cn=Raphaël)")
+    >>> results
+    [
+        ("cn=Raphaël,ou=people,dc=example,dc=org", {
+            'cn': [b'Rapha\xc3\xabl'],
+            'sn': [b'Barrois'],
+        }),
+    ]
+
+
 ******************
 Indices and tables
 ******************

From b0c908149af50bd3645744091ddf3697c4e02750 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 23:13:08 +0100
Subject: [PATCH 564/868] Modules: Use alternate sasl.h location on macOS

---
 Modules/LDAPObject.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 95387a0..43bde96 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -14,8 +14,12 @@
 #include "options.h"
 
 #ifdef HAVE_SASL
+#ifdef __APPLE__
+#include <sasl/sasl.h>
+#else
 #include <sasl.h>
 #endif
+#endif
 
 static void free_attrs(char***, PyObject*);
 

From 2a30680d10ffc9db9adf634e7d075965a7ec1fcd Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 23:14:04 +0100
Subject: [PATCH 565/868] Modules: Eliminate getter & setter that reimplement
 the default

---
 Modules/LDAPObject.c | 21 ++-------------------
 1 file changed, 2 insertions(+), 19 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 43bde96..2eff88e 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1384,23 +1384,6 @@ static PyMethodDef methods[] = {
     { NULL, NULL }
 };
 
-/* get attribute */
-
-static PyObject*
-getattr(LDAPObject* self, char* name) 
-{
-        return Py_FindMethod(methods, (PyObject*)self, name);
-}
-
-/* set attribute */
-
-static int
-setattr(LDAPObject* self, char* name, PyObject* value) 
-{
-        PyErr_SetString(PyExc_AttributeError, name);
-        return -1;
-}
-
 /* type entry */
 
 PyTypeObject LDAP_Type = {
@@ -1416,8 +1399,8 @@ PyTypeObject LDAP_Type = {
         /* methods */
         (destructor)dealloc,    /*tp_dealloc*/
         0,                      /*tp_print*/
-        (getattrfunc)getattr,   /*tp_getattr*/
-        (setattrfunc)setattr,   /*tp_setattr*/
+        0,                      /*tp_getattr*/
+        0,                      /*tp_setattr*/
         0,                      /*tp_compare*/
         0,                      /*tp_repr*/
         0,                      /*tp_as_number*/

From 83763d908bb443f3284d72bf9f43487fb112c175 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Thu, 23 Nov 2017 23:26:05 +0100
Subject: [PATCH 566/868] Tests: Add a test for whoami after unbind

---
 Tests/t_cext.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 3cbdbe7..cd171b6 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -576,6 +576,13 @@ def test_whoami_anonymous(self):
         r = l.whoami_s()
         self.assertEqual("", r)
 
+    def test_whoami_after_unbind(self):
+        # https://github.com/pyldap/pyldap/issues/29
+        l = self._open_conn(bind=True)
+        l.unbind_ext()
+        with self.assertRaises(_ldap.LDAPError):
+            l.whoami_s()
+
     def test_passwd(self):
         l = self._open_conn()
         # first, create a user to change password on

From 750fe8cd39ff49f5e21b5e3133b112ae23afec31 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:09:22 +0100
Subject: [PATCH 567/868] Modules: Use Python 3- compatible module
 initialization

---
 Modules/ldapmodule.c | 65 ++++++++++++++++++++++++++++----------------
 1 file changed, 42 insertions(+), 23 deletions(-)

diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index a788ae1..46c9c8a 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -8,6 +8,12 @@
 
 #include "LDAPObject.h"
 
+#if PY_MAJOR_VERSION >= 3
+PyMODINIT_FUNC PyInit__ldap(void);
+#else
+PyMODINIT_FUNC init_ldap(void);
+#endif
+
 #define _STR(x)        #x
 #define STR(x) _STR(x)
 
@@ -15,38 +21,24 @@ static char version_str[] = STR(LDAPMODULE_VERSION);
 static char author_str[] = STR(LDAPMODULE_AUTHOR);
 static char license_str[] = STR(LDAPMODULE_LICENSE);
 
-void
-LDAPinit_pkginfo( PyObject* d )
+static void
+init_pkginfo( PyObject* m )
 {
-	PyObject *version;
-	PyObject *author;
-	PyObject *license;
-
-	version = PyString_FromString(version_str);
-	author = PyString_FromString(author_str);
-	license = PyString_FromString(license_str);
-
-	PyDict_SetItemString( d, "__version__", version );
-	PyDict_SetItemString(d, "__author__", author);
-	PyDict_SetItemString(d, "__license__", license);
-
-	Py_DECREF(version);
-	Py_DECREF(author);
-	Py_DECREF(license);
+	PyModule_AddStringConstant(m, "__version__", version_str);
+	PyModule_AddStringConstant(m, "__author__", author_str);
+	PyModule_AddStringConstant(m, "__license__", license_str);
 }
 
-DL_EXPORT(void) init_ldap(void);
-
 /* dummy module methods */
-
 static PyMethodDef methods[]  = {
 	{ NULL, NULL }
 };
 
 /* module initialisation */
 
-DL_EXPORT(void)
-init_ldap()
+
+/* Common initialization code */
+PyObject* init_ldap_module()
 {
 	PyObject *m, *d;
 
@@ -55,12 +47,26 @@ init_ldap()
 #endif
 
 	/* Create the module and add the functions */
+#if PY_MAJOR_VERSION >= 3
+        static struct PyModuleDef ldap_moduledef = {
+                PyModuleDef_HEAD_INIT,
+                "_ldap",              /* m_name */
+                "",                   /* m_doc */
+                -1,                   /* m_size */
+                methods,              /* m_methods */
+        };
+        m = PyModule_Create(&ldap_moduledef);
+#else
 	m = Py_InitModule("_ldap", methods);
+#endif
+
+        PyType_Ready(&LDAP_Type);
 
 	/* Add some symbolic constants to the module */
 	d = PyModule_GetDict(m);
 
-	LDAPinit_pkginfo(d);
+	init_pkginfo(m);
+
 	LDAPinit_constants(d);
 	LDAPinit_errors(d);
 	LDAPinit_functions(d);
@@ -69,4 +75,17 @@ init_ldap()
 	/* Check for errors */
 	if (PyErr_Occurred())
 		Py_FatalError("can't initialize module _ldap");
+
+        return m;
+}
+
+
+#if PY_MAJOR_VERSION < 3
+PyMODINIT_FUNC init_ldap() {
+    init_ldap_module();
 }
+#else
+PyMODINIT_FUNC PyInit__ldap() {
+    return init_ldap_module();
+}
+#endif

From fa35757fa2a425784676a91909b8f721cf13c095 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:45:54 +0100
Subject: [PATCH 568/868] py3: Make the bytes/text distinction

- DNs, attribute names, URLs are text (encoded to UTF-8 on the wire)
- Attribute values are always bytes

A "bytes_mode" switch controls behavior under Python 2.
---
 Lib/ldap/dn.py              |   3 +
 Lib/ldap/functions.py       |  12 +-
 Lib/ldap/ldapobject.py      | 214 +++++++++++++++++++++++++++++++++++-
 Lib/ldap/sasl.py            |   6 +
 Lib/ldap/schema/models.py   |   3 +
 Lib/ldap/schema/subentry.py |   4 +-
 Lib/ldif.py                 |  58 ++++++++--
 Lib/slapdtest.py            |  12 +-
 Modules/LDAPObject.c        |  41 ++++---
 Modules/berval.c            |  24 +++-
 Modules/berval.h            |   1 +
 Modules/constants.c         |  34 +++---
 Modules/errors.c            |   8 +-
 Modules/functions.c         |   6 +-
 Modules/ldapcontrol.c       |   8 +-
 Modules/message.c           |  43 ++++++--
 Modules/options.c           |   4 +-
 Tests/t_cext.py             |  72 ++++++------
 Tests/t_ldap_dn.py          |  35 +++---
 Tests/t_ldap_syncrepl.py    |  32 +++---
 Tests/t_ldapobject.py       | 158 ++++++++++++++++++++++----
 Tests/t_ldapurl.py          |   6 +-
 Tests/t_ldif.py             |  24 +++-
 23 files changed, 636 insertions(+), 172 deletions(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 3298551..00c7b06 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -4,6 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
+import sys
 from ldap.pkginfo import __version__
 
 import _ldap
@@ -46,6 +47,8 @@ def str2dn(dn,flags=0):
   """
   if not dn:
     return []
+  if sys.version_info[0] < 3 and isinstance(dn, unicode):
+      dn = dn.encode('utf-8')
   return ldap.functions._ldap_function_call(None,_ldap.str2dn,dn,flags)
 
 
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index c60d42b..b887037 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -62,7 +62,7 @@ def _ldap_function_call(lock,func,*args,**kwargs):
   return result
 
 
-def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None):
+def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None, bytes_mode=None):
   """
   Return LDAPObject instance by opening LDAP connection to
   LDAP host specified by LDAP URL
@@ -76,11 +76,13 @@ def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None):
   trace_file
         File object where to write the trace output to.
         Default is to use stdout.
+  bytes_mode
+        Whether to enable "bytes_mode" for backwards compatibility under Py2.
   """
-  return LDAPObject(uri,trace_level,trace_file,trace_stack_limit)
+  return LDAPObject(uri,trace_level,trace_file,trace_stack_limit,bytes_mode)
 
 
-def open(host,port=389,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None):
+def open(host,port=389,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None,bytes_mode=None):
   """
   Return LDAPObject instance by opening LDAP connection to
   specified LDAP host
@@ -95,10 +97,12 @@ def open(host,port=389,trace_level=0,trace_file=sys.stdout,trace_stack_limit=Non
   trace_file
         File object where to write the trace output to.
         Default is to use stdout.
+  bytes_mode
+        Whether to enable "bytes_mode" for backwards compatibility under Py2.
   """
   import warnings
   warnings.warn('ldap.open() is deprecated! Use ldap.initialize() instead.', DeprecationWarning,2)
-  return initialize('ldap://%s:%d' % (host,port),trace_level,trace_file,trace_stack_limit)
+  return initialize('ldap://%s:%d' % (host,port),trace_level,trace_file,trace_stack_limit,bytes_mode)
 
 init = open
 
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index e83287d..01f0044 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -4,6 +4,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 from os import strerror
 
 from ldap.pkginfo import __version__, __author__, __license__
@@ -20,6 +22,7 @@
   import traceback
 
 import sys,time,pprint,_ldap,ldap,ldap.sasl,ldap.functions
+import warnings
 
 from ldap.schema import SCHEMA_ATTRS
 from ldap.controls import LDAPControl,DecodeControlTuples,RequestControlTuples
@@ -28,6 +31,11 @@
 
 from ldap import LDAPError
 
+PY2 = bool(sys.version_info[0] <= 2)
+if PY2:
+  text_type = unicode
+else:
+  text_type = str
 
 class NO_UNIQUE_ENTRY(ldap.NO_SUCH_OBJECT):
   """
@@ -55,7 +63,7 @@ class SimpleLDAPObject:
 
   def __init__(
     self,uri,
-    trace_level=0,trace_file=None,trace_stack_limit=5
+    trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None
   ):
     self._trace_level = trace_level
     self._trace_file = trace_file or sys.stdout
@@ -66,6 +74,186 @@ def __init__(
     self.timeout = -1
     self.protocol_version = ldap.VERSION3
 
+    # Bytes mode
+    # ----------
+
+    # By default, raise a TypeError when receiving invalid args
+    self.bytes_mode_hardfail = True
+    if bytes_mode is None and PY2:
+      warnings.warn(
+        "Under Python 2, python-ldap uses bytes by default. "
+        "This will be removed in Python 3 (no bytes for DN/RDN/field names). "
+        "Please call initialize(..., bytes_mode=False) explicitly.",
+        BytesWarning,
+        stacklevel=2,
+      )
+      bytes_mode = True
+      # Disable hard failure when running in backwards compatibility mode.
+      self.bytes_mode_hardfail = False
+    elif bytes_mode and not PY2:
+      raise ValueError("bytes_mode is *not* supported under Python 3.")
+    # On by default on Py2, off on Py3.
+    self.bytes_mode = bytes_mode
+
+  def _bytesify_input(self, value):
+    """Adapt a value following bytes_mode in Python 2.
+
+    In Python 3, returns the original value unmodified.
+
+    With bytes_mode ON, takes bytes or None and returns bytes or None.
+    With bytes_mode OFF, takes unicode or None and returns bytes or None.
+
+    This function should be applied on all text inputs (distinguished names
+    and attribute names in modlists) to convert them to the bytes expected
+    by the C bindings.
+    """
+    if not PY2:
+      return value
+
+    if value is None:
+      return value
+    elif self.bytes_mode:
+      if isinstance(value, bytes):
+        return value
+      else:
+        if self.bytes_mode_hardfail:
+          raise TypeError("All provided fields *must* be bytes when bytes mode is on; got %r" % (value,))
+        else:
+          warnings.warn(
+            "Received non-bytes value %r with default (disabled) bytes mode; please choose an explicit "
+            "option for bytes_mode on your LDAP connection" % (value,),
+            BytesWarning,
+            stacklevel=6,
+          )
+          return value.encode('utf-8')
+    else:
+      if not isinstance(value, text_type):
+        raise TypeError("All provided fields *must* be text when bytes mode is off; got %r" % (value,))
+      assert not isinstance(value, bytes)
+      return value.encode('utf-8')
+
+  def _bytesify_inputs(self, *values):
+    """Adapt values following bytes_mode.
+
+    Applies _bytesify_input on each arg.
+
+    Usage:
+    >>> a, b, c = self._bytesify_inputs(a, b, c)
+    """
+    if not PY2:
+      return values
+    return (
+      self._bytesify_input(value)
+      for value in values
+    )
+
+  def _bytesify_modlist(self, modlist, with_opcode):
+    """Adapt a modlist according to bytes_mode.
+
+    A modlist is a tuple of (op, attr, value), where:
+    - With bytes_mode ON, attr is checked to be bytes
+    - With bytes_mode OFF, attr is converted from unicode to bytes
+    - value is *always* bytes
+    """
+    if not PY2:
+      return modlist
+    if with_opcode:
+      return tuple(
+        (op, self._bytesify_input(attr), val)
+        for op, attr, val in modlist
+      )
+    else:
+      return tuple(
+        (self._bytesify_input(attr), val)
+        for attr, val in modlist
+      )
+
+  def _unbytesify_text_value(self, value):
+    """Adapt a 'known text, UTF-8 encoded' returned value following bytes_mode.
+
+    With bytes_mode ON, takes bytes or None and returns bytes or None.
+    With bytes_mode OFF, takes bytes or None and returns unicode or None.
+
+    This function should only be applied on field *values*; distinguished names
+    or field *names* are already natively handled in result4.
+    """
+    if value is None:
+      return value
+
+    # Preserve logic of assertions only under Python 2
+    if PY2:
+      assert isinstance(value, bytes), "Expected bytes value, got text instead (%r)" % (value,)
+
+    if self.bytes_mode:
+      return value
+    else:
+      return value.decode('utf-8')
+
+  def _maybe_rebytesify_text(self, value):
+    """Re-encodes text to bytes if needed by bytes_mode.
+
+    Takes unicode (and checks for it), and returns:
+    - bytes under bytes_mode
+    - unicode otherwise.
+    """
+    if not PY2:
+      return value
+
+    if value is None:
+      return value
+
+    assert isinstance(value, text_type), "Should return text, got bytes instead (%r)" % (value,)
+    if not self.bytes_mode:
+      return value
+    else:
+      return value.encode('utf-8')
+
+  def _bytesify_result_value(self, result_value):
+    """Applies bytes_mode to a result value.
+
+    Such a value can either be:
+    - a dict mapping an attribute name to its list of values
+      (where attribute names are unicode and values bytes)
+    - a list of referals (which are unicode)
+    """
+    if not PY2:
+      return result_value
+    if hasattr(result_value, 'items'):
+      # It's a attribute_name: [values] dict
+      return dict(
+        (self._maybe_rebytesify_text(key), value)
+        for (key, value) in result_value.items()
+      )
+    elif isinstance(result_value, bytes):
+      return result_value
+    else:
+      # It's a list of referals
+      # Example value:
+      # [u'ldap://DomainDnsZones.xxxx.root.local/DC=DomainDnsZones,DC=xxxx,DC=root,DC=local']
+      return [self._maybe_rebytesify_text(referal) for referal in result_value]
+
+  def _bytesify_results(self, results, with_ctrls=False):
+    """Converts a "results" object according to bytes_mode.
+
+    Takes:
+    - a list of (dn, {field: [values]}) if with_ctrls is False
+    - a list of (dn, {field: [values]}, ctrls) if with_ctrls is True
+
+    And, if bytes_mode is on, converts dn and fields to bytes.
+    """
+    if not PY2:
+      return results
+    if with_ctrls:
+      return [
+        (self._maybe_rebytesify_text(dn), self._bytesify_result_value(fields), ctrls)
+        for (dn, fields, ctrls) in results
+      ]
+    else:
+      return [
+        (self._maybe_rebytesify_text(dn), self._bytesify_result_value(fields))
+        for (dn, fields) in results
+      ]
+
   def _ldap_lock(self,desc=''):
     if ldap.LIBLDAP_R:
       return ldap.LDAPLock(desc='%s within %s' %(desc,repr(self)))
@@ -185,6 +373,8 @@ def add_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
         The parameter modlist is similar to the one passed to modify(),
         except that no operation integer need be included in the tuples.
     """
+    dn = self._bytesify_input(dn)
+    modlist = self._bytesify_modlist(modlist, with_opcode=False)
     return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def add_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
@@ -209,6 +399,7 @@ def simple_bind(self,who='',cred='',serverctrls=None,clientctrls=None):
     """
     simple_bind([who='' [,cred='']]) -> int
     """
+    who, cred = self._bytesify_inputs(who, cred)
     return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def simple_bind_s(self,who='',cred='',serverctrls=None,clientctrls=None):
@@ -285,6 +476,7 @@ def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
         A design bug in the library prevents value from containing
         nul characters.
     """
+    dn, attr = self._bytesify_inputs(dn, attr)
     return self._ldap_call(self._l.compare_ext,dn,attr,value,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
@@ -315,6 +507,7 @@ def delete_ext(self,dn,serverctrls=None,clientctrls=None):
         form returns the message id of the initiated request, and the
         result can be obtained from a subsequent call to result().
     """
+    dn = self._bytesify_input(dn)
     return self._ldap_call(self._l.delete_ext,dn,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def delete_ext_s(self,dn,serverctrls=None,clientctrls=None):
@@ -363,6 +556,8 @@ def modify_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
     """
     modify_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
     """
+    dn = self._bytesify_input(dn)
+    modlist = self._bytesify_modlist(modlist, with_opcode=True)
     return self._ldap_call(self._l.modify_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def modify_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
@@ -416,6 +611,7 @@ def modrdn_s(self,dn,newrdn,delold=1):
     return self.rename_s(dn,newrdn,None,delold)
 
   def passwd(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
+    user, oldpw, newpw = self._bytesify_inputs(user, oldpw, newpw)
     return self._ldap_call(self._l.passwd,user,oldpw,newpw,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def passwd_s(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
@@ -437,6 +633,7 @@ def rename(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls
         This actually corresponds to the rename* routines in the
         LDAP-EXT C API library.
     """
+    dn, newrdn, newsuperior = self._bytesify_inputs(dn, newrdn, newsuperior)
     return self._ldap_call(self._l.rename,dn,newrdn,newsuperior,delold,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def rename_s(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls=None):
@@ -525,6 +722,8 @@ def result4(self,msgid=ldap.RES_ANY,all=1,timeout=None,add_ctrls=0,add_intermedi
       if add_ctrls:
         resp_data = [ (t,r,DecodeControlTuples(c,resp_ctrl_classes)) for t,r,c in resp_data ]
     decoded_resp_ctrls = DecodeControlTuples(resp_ctrls,resp_ctrl_classes)
+    if resp_data is not None:
+        resp_data = self._bytesify_results(resp_data, with_ctrls=add_ctrls)
     return resp_type, resp_data, resp_msgid, decoded_resp_ctrls, resp_name, resp_value
 
   def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
@@ -572,6 +771,9 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
         The amount of search results retrieved can be limited with the
         sizelimit parameter if non-zero.
     """
+    base, filterstr = self._bytesify_inputs(base, filterstr)
+    if attrlist is not None:
+      attrlist = tuple(self._bytesify_inputs(*attrlist))
     return self._ldap_call(
       self._l.search_ext,
       base,scope,filterstr,
@@ -665,6 +867,8 @@ def search_subschemasubentry_s(self,dn=''):
 
     None as result indicates that the DN of the sub schema sub entry could
     not be determined.
+
+    Returns: None or text/bytes depending on bytes_mode.
     """
     try:
       r = self.search_s(
@@ -686,7 +890,9 @@ def search_subschemasubentry_s(self,dn=''):
             # If dn was already root DSE we can return here
             return None
         else:
-          return search_subschemasubentry_dn
+          # With legacy bytes mode, return bytes; otherwise, since this is a DN,
+          # RFCs impose that the field value *can* be decoded to UTF-8.
+          return self._unbytesify_text_value(search_subschemasubentry_dn)
     except IndexError:
       return None
 
@@ -788,7 +994,7 @@ class ReconnectLDAPObject(SimpleLDAPObject):
 
   def __init__(
     self,uri,
-    trace_level=0,trace_file=None,trace_stack_limit=5,
+    trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None,
     retry_max=1,retry_delay=60.0
   ):
     """
@@ -803,7 +1009,7 @@ def __init__(
     self._uri = uri
     self._options = []
     self._last_bind = None
-    SimpleLDAPObject.__init__(self,uri,trace_level,trace_file,trace_stack_limit)
+    SimpleLDAPObject.__init__(self,uri,trace_level,trace_file,trace_stack_limit,bytes_mode)
     self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
     self._retry_max = retry_max
     self._retry_delay = retry_delay
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index 34d4cb0..fa6f4f5 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -46,6 +46,8 @@ def __init__(self, cb_value_dict, mech):
         the SASL mechaninsm to be uesd.
         """
         self.cb_value_dict = cb_value_dict or {}
+        if not isinstance(mech, bytes):
+            mech = mech.encode('utf-8')
         self.mech = mech
 
     def callback(self, cb_id, challenge, prompt, defresult):
@@ -64,6 +66,8 @@ def callback(self, cb_id, challenge, prompt, defresult):
         useful for writing generic sasl GUIs, which would need to know all
         the questions to ask, before the answers are returned to the sasl
         lib (in contrast to one question at a time).
+
+        Unicode strings are always converted to bytes.
         """
 
         # The following print command might be useful for debugging
@@ -78,6 +82,8 @@ def callback(self, cb_id, challenge, prompt, defresult):
                     repr(defresult),
                     repr(self.cb_value_dict.get(cb_result))
                 ))
+        if not isinstance(cb_result, bytes):
+            cb_result = cb_result.encode('utf-8')
         return cb_result
 
 
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 300981e..c0391b4 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -32,6 +32,7 @@ class SchemaElement:
 
   schema_element_str
     String which contains the schema element description to be parsed.
+    (Bytestrings are decoded using UTF-8)
 
   Class attributes:
 
@@ -46,6 +47,8 @@ class SchemaElement:
   }
 
   def __init__(self,schema_element_str=None):
+    if sys.version_info >= (3, 0) and isinstance(schema_element_str, bytes):
+      schema_element_str = schema_element_str.decode('utf-8')
     if schema_element_str:
       l = split_tokens(schema_element_str)
       self.set_id(l[1])
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 4d42b19..2a42b4c 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -456,7 +456,9 @@ def urlfetch(uri,trace_level=0):
   if uri.startswith('ldap:') or uri.startswith('ldaps:') or uri.startswith('ldapi:'):
     import ldapurl
     ldap_url = ldapurl.LDAPUrl(uri)
-    l=ldap.initialize(ldap_url.initializeUrl(),trace_level)
+
+    # This is an internal function; don't enable bytes_mode.
+    l=ldap.initialize(ldap_url.initializeUrl(),trace_level,bytes_mode=False)
     l.protocol_version = ldap.VERSION3
     l.simple_bind_s(ldap_url.who or '', ldap_url.cred or '')
     subschemasubentry_dn = l.search_subschemasubentry_s(ldap_url.dn)
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 94ffd91..82c4e3f 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -4,6 +4,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 __version__ = '2.5.2'
 
 __all__ = [
@@ -60,7 +62,7 @@ def is_dn(s):
   return rm!=None and rm.group(0)==s
 
 
-SAFE_STRING_PATTERN = '(^(\000|\n|\r| |:|<)|[\000\n\r\200-\377]+|[ ]+$)'
+SAFE_STRING_PATTERN = b'(^(\000|\n|\r| |:|<)|[\000\n\r\200-\377]+|[ ]+$)'
 safe_string_re = re.compile(SAFE_STRING_PATTERN)
 
 def list_dict(l):
@@ -80,7 +82,7 @@ class LDIFWriter:
   def __init__(self,output_file,base64_attrs=None,cols=76,line_sep='\n'):
     """
     output_file
-        file object for output
+        file object for output; should be opened in *text* mode
     base64_attrs
         list of attribute types to be base64-encoded in any case
     cols
@@ -129,15 +131,17 @@ def _unparseAttrTypeandValue(self,attr_type,attr_value):
     Write a single attribute type/value pair
 
     attr_type
-          attribute type
+          attribute type (text)
     attr_value
-          attribute value
+          attribute value (bytes)
     """
     if self._needs_base64_encoding(attr_type,attr_value):
       # Encode with base64
-      self._unfold_lines(':: '.join([attr_type, b64encode(attr_value).replace('\n','')]))
+      encoded = b64encode(attr_value).decode('ascii')
+      encoded = encoded.replace('\n','')
+      self._unfold_lines(':: '.join([attr_type, encoded]))
     else:
-      self._unfold_lines(': '.join([attr_type,attr_value]))
+      self._unfold_lines(': '.join([attr_type, attr_value.decode('ascii')]))
     return # _unparseAttrTypeandValue()
 
   def _unparseEntryRecord(self,entry):
@@ -161,13 +165,14 @@ def _unparseChangeRecord(self,modlist):
       changetype = 'modify'
     else:
       raise ValueError("modlist item of wrong length: %d" % (mod_len))
-    self._unparseAttrTypeandValue('changetype',changetype)
+    self._unparseAttrTypeandValue('changetype',changetype.encode('ascii'))
     for mod in modlist:
       if mod_len==2:
         mod_type,mod_vals = mod
       elif mod_len==3:
         mod_op,mod_type,mod_vals = mod
-        self._unparseAttrTypeandValue(MOD_OP_STR[mod_op],mod_type)
+        self._unparseAttrTypeandValue(MOD_OP_STR[mod_op],
+                                      mod_type.encode('ascii'))
       else:
         raise ValueError("Subsequent modlist item of wrong length")
       if mod_vals:
@@ -185,7 +190,8 @@ def unparse(self,dn,record):
           or a list with a modify list like for LDAPObject.modify().
     """
     # Start with line containing the distinguished name
-    self._unparseAttrTypeandValue('dn',dn)
+    dn = dn.encode('utf-8')
+    self._unparseAttrTypeandValue('dn', dn)
     # Dispatch to record type specific writers
     if isinstance(record,dict):
       self._unparseEntryRecord(record)
@@ -260,6 +266,8 @@ def __init__(
         String used as line separator
     """
     self._input_file = input_file
+    # Detect whether the file is open in text or bytes mode.
+    self._file_sends_bytes = isinstance(self._input_file.read(0), bytes)
     self._max_entries = max_entries
     self._process_url_schemes = list_dict([s.lower() for s in (process_url_schemes or [])])
     self._ignored_attr_types = list_dict([a.lower() for a in (ignored_attr_types or [])])
@@ -287,6 +295,10 @@ def handle(self,dn,entry):
 
   def _readline(self):
     s = self._input_file.readline()
+    if self._file_sends_bytes:
+      # The RFC does not allow UTF-8 values; we support it as a
+      # non-official, backwards compatibility layer
+      s = s.decode('utf-8')
     self.line_counter = self.line_counter + 1
     self.byte_counter = self.byte_counter + len(s)
     if not s:
@@ -319,6 +331,8 @@ def _next_key_and_value(self):
     """
     Parse a single attribute type and value pair from one or
     more lines of LDIF data
+
+    Returns attr_type (text) and attr_value (bytes)
     """
     # Reading new attribute line
     unfolded_line = self._unfold_lines()
@@ -338,9 +352,15 @@ def _next_key_and_value(self):
     value_spec = unfolded_line[colon_pos:colon_pos+2]
     if value_spec==': ':
       attr_value = unfolded_line[colon_pos+2:].lstrip()
+      # All values should be valid ascii; we support UTF-8 as a
+      # non-official, backwards compatibility layer.
+      attr_value = attr_value.encode('utf-8')
     elif value_spec=='::':
       # attribute value needs base64-decoding
-      attr_value = self._b64decode(unfolded_line[colon_pos+2:])
+      # base64 makes sens only for ascii
+      attr_value = unfolded_line[colon_pos+2:]
+      attr_value = attr_value.encode('ascii')
+      attr_value = self._b64decode(attr_value)
     elif value_spec==':<':
       # fetch attribute value from URL
       url = unfolded_line[colon_pos+2:].strip()
@@ -350,7 +370,9 @@ def _next_key_and_value(self):
         if u[0] in self._process_url_schemes:
           attr_value = urlopen(url).read()
     else:
-      attr_value = unfolded_line[colon_pos+1:]
+      # All values should be valid ascii; we support UTF-8 as a
+      # non-official, backwards compatibility layer.
+      attr_value = unfolded_line[colon_pos+1:].encode('utf-8')
     return attr_type,attr_value
 
   def _consume_empty_lines(self):
@@ -383,7 +405,7 @@ def parse_entry_records(self):
       k,v = self._consume_empty_lines()
       # Consume 'version' line
       if k=='version':
-        self.version = int(v)
+        self.version = int(v.decode('ascii'))
         k,v = self._consume_empty_lines()
     except EOFError:
       return
@@ -394,6 +416,9 @@ def parse_entry_records(self):
       # Consume first line which must start with "dn: "
       if k!='dn':
         raise ValueError('Line %d: First line of record does not start with "dn:": %s' % (self.line_counter,repr(k)))
+      # Value of a 'dn' field *has* to be valid UTF-8
+      # k is text, v is bytes.
+      v = v.decode('utf-8')
       if not is_dn(v):
         raise ValueError('Line %d: Not a valid string-representation for dn: %s.' % (self.line_counter,repr(v)))
       dn = v
@@ -452,6 +477,9 @@ def parse_change_records(self):
       # Consume first line which must start with "dn: "
       if k!='dn':
         raise ValueError('Line %d: First line of record does not start with "dn:": %s' % (self.line_counter,repr(k)))
+      # Value of a 'dn' field *has* to be valid UTF-8
+      # k is text, v is bytes.
+      v = v.decode('utf-8')
       if not is_dn(v):
         raise ValueError('Line %d: Not a valid string-representation for dn: %s.' % (self.line_counter,repr(v)))
       dn = v
@@ -460,6 +488,8 @@ def parse_change_records(self):
       # Read "control:" lines
       controls = []
       while k!=None and k=='control':
+        # v is still bytes, spec says it should be valid utf-8; decode it.
+        v = v.decode('utf-8')
         try:
           control_type,criticality,control_value = v.split(' ',2)
         except ValueError:
@@ -472,6 +502,8 @@ def parse_change_records(self):
       changetype = None
       # Consume changetype line of record
       if k=='changetype':
+        # v is still bytes, spec says it should be valid utf-8; decode it.
+        v = v.decode('utf-8')
         if not v in valid_changetype_dict:
           raise ValueError('Invalid changetype: %s' % repr(v))
         changetype = v
@@ -491,6 +523,8 @@ def parse_change_records(self):
             except KeyError:
               raise ValueError('Line %d: Invalid mod-op string: %s' % (self.line_counter,repr(k)))
             # we now have the attribute name to be modified
+            # v is still bytes, spec says it should be valid utf-8; decode it.
+            v = v.decode('utf-8')
             modattr = v
             modvalues = []
             try:
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 1aba887..fcd36e1 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -5,6 +5,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 __version__ = '2.5.2'
 
 import os
@@ -365,13 +367,15 @@ def ldapadd(self, ldif, extra_args=None):
         """
         Runs ldapadd on this slapd instance, passing it the ldif content
         """
-        self._cli_popen(self.PATH_LDAPADD, extra_args=extra_args, stdin_data=ldif)
+        self._cli_popen(self.PATH_LDAPADD, extra_args=extra_args,
+                        stdin_data=ldif.encode('utf-8'))
 
     def ldapmodify(self, ldif, extra_args=None):
         """
         Runs ldapadd on this slapd instance, passing it the ldif content
         """
-        self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args, stdin_data=ldif)
+        self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args,
+                        stdin_data=ldif.encode('utf-8'))
 
 
 class SlapdTestCase(unittest.TestCase):
@@ -383,11 +387,11 @@ class SlapdTestCase(unittest.TestCase):
     server = None
     ldap_object_class = None
 
-    def _open_ldap_conn(self, who=None, cred=None):
+    def _open_ldap_conn(self, who=None, cred=None, **kwargs):
         """
         return a LDAPObject instance after simple bind
         """
-        ldap_conn = self.ldap_object_class(self.server.ldap_uri)
+        ldap_conn = self.ldap_object_class(self.server.ldap_uri, **kwargs)
         ldap_conn.protocol_version = 3
         #ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
         ldap_conn.simple_bind_s(who or self.server.root_dn, cred or self.server.root_pw)
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 2eff88e..ce0ff52 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -142,7 +142,7 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
 
     if (list == Py_None) {
         /* None indicates a NULL mod_bvals */
-    } else if (PyString_Check(list)) {
+    } else if (PyBytes_Check(list)) {
         /* Single string is a singleton list */
         lm->mod_bvalues = PyMem_NEW(struct berval *, 2);
         if (lm->mod_bvalues == NULL)
@@ -151,8 +151,8 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
         if (lm->mod_bvalues[0] == NULL)
             goto nomem;
         lm->mod_bvalues[1] = NULL;
-        lm->mod_bvalues[0]->bv_len = PyString_Size(list);
-        lm->mod_bvalues[0]->bv_val = PyString_AsString(list);
+        lm->mod_bvalues[0]->bv_len = PyBytes_Size(list);
+        lm->mod_bvalues[0]->bv_val = PyBytes_AsString(list);
     } else if (PySequence_Check(list)) {
         nstrs = PySequence_Length(list);
         lm->mod_bvalues = PyMem_NEW(struct berval *, nstrs + 1);
@@ -166,14 +166,14 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
           item = PySequence_GetItem(list, i);
           if (item == NULL)
               goto error;
-          if (!PyString_Check(item)) {
+          if (!PyBytes_Check(item)) {
               PyErr_SetObject( PyExc_TypeError, Py_BuildValue( "sO",
-                  "expected a string in the list", item));
+                  "expected a byte string in the list", item));
               Py_DECREF(item);
               goto error;
           }
-          lm->mod_bvalues[i]->bv_len = PyString_Size(item);
-          lm->mod_bvalues[i]->bv_val = PyString_AsString(item);
+          lm->mod_bvalues[i]->bv_len = PyBytes_Size(item);
+          lm->mod_bvalues[i]->bv_val = PyBytes_AsString(item);
           Py_DECREF(item);
         }
         if (nstrs == 0)
@@ -268,7 +268,11 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
 
     if (attrlist == Py_None) {
         /* None means a NULL attrlist */
-    } else if (PyString_Check(attrlist)) {
+#if PY_MAJOR_VERSION == 2
+    } else if (PyBytes_Check(attrlist)) {
+#else
+    } else if (PyUnicode_Check(attrlist)) {
+#endif
         /* caught by John Benninghoff <johnb@netscape.com> */
         PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
                   "expected *list* of strings, not a string", attrlist ));
@@ -289,12 +293,21 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
             item = PySequence_Fast_GET_ITEM(*seq, i);
             if (item == NULL)
                 goto error;
-            if (!PyString_Check(item)) {
+#if PY_MAJOR_VERSION == 2
+            /* Encoded by Python to UTF-8 */
+            if (!PyBytes_Check(item)) {
+#else
+            if (!PyUnicode_Check(item)) {
+#endif
                 PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
                                 "expected string in list", item));
                 goto error;
             }
-            attrs[i] = PyString_AsString(item);
+#if PY_MAJOR_VERSION == 2
+            attrs[i] = PyBytes_AsString(item);
+#else
+            attrs[i] = PyUnicode_AsUTF8(item);
+#endif
         }
         attrs[len] = NULL;
     }
@@ -551,7 +564,7 @@ static int interaction ( unsigned flags,
   if (result == NULL) 
     /*searching for a better error code */
     return LDAP_OPERATIONS_ERROR; 
-  c_result = PyString_AsString(result); /*xxx Error checking?? */
+  c_result = PyBytes_AsString(result); /*xxx Error checking?? */
   
   /* according to the sasl docs, we should malloc() the returned
      string only for calls where interact->id == SASL_CB_PASS, so we
@@ -647,7 +660,7 @@ l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
 
     if (ldaperror == LDAP_SASL_BIND_IN_PROGRESS) {
         if (servercred && servercred->bv_val && *servercred->bv_val)
-            return PyString_FromStringAndSize( servercred->bv_val, servercred->bv_len );
+            return PyBytes_FromStringAndSize( servercred->bv_val, servercred->bv_len );
     } else if (ldaperror != LDAP_SUCCESS)
         return LDAPerror( self->ldap, "l_ldap_sasl_bind_s" );
     return PyInt_FromLong( ldaperror );
@@ -699,7 +712,7 @@ l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
     /* now we extract the sasl mechanism from the SASL Object */
     mechanism = PyObject_GetAttrString(SASLObject, "mech");
     if (mechanism == NULL) return NULL;
-    c_mechanism = PyString_AsString(mechanism);
+    c_mechanism = PyBytes_AsString(mechanism);
     Py_DECREF(mechanism);
     mechanism = NULL;
 
@@ -1188,7 +1201,7 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
     if ( ldaperror!=LDAP_SUCCESS )
         return LDAPerror( self->ldap, "ldap_whoami_s" );
 
-    result = LDAPberval_to_object(bvalue);
+    result = LDAPberval_to_unicode_object(bvalue);
 
     return result;
 }
diff --git a/Modules/berval.c b/Modules/berval.c
index b118669..73d7f9b 100644
--- a/Modules/berval.c
+++ b/Modules/berval.c
@@ -89,7 +89,29 @@ LDAPberval_to_object(const struct berval *bv)
         Py_INCREF(ret);
     }
     else {
-        ret = PyString_FromStringAndSize(bv->bv_val, bv->bv_len);
+        ret = PyBytes_FromStringAndSize(bv->bv_val, bv->bv_len);
+    }
+
+    return ret;
+}
+
+/*
+ * Same as LDAPberval_to_object, but returns a Unicode PyObject.
+ * Use when the value is known to be text (for instance a distinguishedName).
+ *
+ * Returns a new Python object on success, or NULL on failure.
+ */
+PyObject *
+LDAPberval_to_unicode_object(const struct berval *bv)
+{
+    PyObject *ret = NULL;
+
+    if (!bv) {
+        ret = Py_None;
+        Py_INCREF(ret);
+    }
+    else {
+        ret = PyUnicode_FromStringAndSize(bv->bv_val, bv->bv_len);
     }
 
     return ret;
diff --git a/Modules/berval.h b/Modules/berval.h
index 514e9f9..2489e45 100644
--- a/Modules/berval.h
+++ b/Modules/berval.h
@@ -10,5 +10,6 @@ int  LDAPberval_from_object(PyObject *obj, struct berval *bv);
 int  LDAPberval_from_object_check(PyObject *obj);
 void LDAPberval_release(struct berval *bv);
 PyObject *LDAPberval_to_object(const struct berval *bv);
+PyObject *LDAPberval_to_unicode_object(const struct berval *bv);
 
 #endif /* __h_berval_ */
diff --git a/Modules/constants.c b/Modules/constants.c
index 06c249a..7ed9e41 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -307,71 +307,71 @@ LDAPinit_constants( PyObject* d )
   PyDict_SetItemString( d, "TLS_AVAIL", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_MANAGEDSAIT);
+  obj = PyUnicode_FromString(LDAP_CONTROL_MANAGEDSAIT);
   PyDict_SetItemString( d, "CONTROL_MANAGEDSAIT", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_PROXY_AUTHZ);
+  obj = PyUnicode_FromString(LDAP_CONTROL_PROXY_AUTHZ);
   PyDict_SetItemString( d, "CONTROL_PROXY_AUTHZ", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_SUBENTRIES);
+  obj = PyUnicode_FromString(LDAP_CONTROL_SUBENTRIES);
   PyDict_SetItemString( d, "CONTROL_SUBENTRIES", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_VALUESRETURNFILTER);
+  obj = PyUnicode_FromString(LDAP_CONTROL_VALUESRETURNFILTER);
   PyDict_SetItemString( d, "CONTROL_VALUESRETURNFILTER", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_ASSERT);
+  obj = PyUnicode_FromString(LDAP_CONTROL_ASSERT);
   PyDict_SetItemString( d, "CONTROL_ASSERT", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_PRE_READ);
+  obj = PyUnicode_FromString(LDAP_CONTROL_PRE_READ);
   PyDict_SetItemString( d, "CONTROL_PRE_READ", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_POST_READ);
+  obj = PyUnicode_FromString(LDAP_CONTROL_POST_READ);
   PyDict_SetItemString( d, "CONTROL_POST_READ", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_SORTREQUEST);
+  obj = PyUnicode_FromString(LDAP_CONTROL_SORTREQUEST);
   PyDict_SetItemString( d, "CONTROL_SORTREQUEST", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_SORTRESPONSE);
+  obj = PyUnicode_FromString(LDAP_CONTROL_SORTRESPONSE);
   PyDict_SetItemString( d, "CONTROL_SORTRESPONSE", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_PAGEDRESULTS);
+  obj = PyUnicode_FromString(LDAP_CONTROL_PAGEDRESULTS);
   PyDict_SetItemString( d, "CONTROL_PAGEDRESULTS", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_SYNC);
+  obj = PyUnicode_FromString(LDAP_CONTROL_SYNC);
   PyDict_SetItemString( d, "CONTROL_SYNC", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_SYNC_STATE);
+  obj = PyUnicode_FromString(LDAP_CONTROL_SYNC_STATE);
   PyDict_SetItemString( d, "CONTROL_SYNC_STATE", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_SYNC_DONE);
+  obj = PyUnicode_FromString(LDAP_CONTROL_SYNC_DONE);
   PyDict_SetItemString( d, "CONTROL_SYNC_DONE", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_SYNC_INFO);
+  obj = PyUnicode_FromString(LDAP_SYNC_INFO);
   PyDict_SetItemString( d, "SYNC_INFO", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_PASSWORDPOLICYREQUEST);
+  obj = PyUnicode_FromString(LDAP_CONTROL_PASSWORDPOLICYREQUEST);
   PyDict_SetItemString( d, "CONTROL_PASSWORDPOLICYREQUEST", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_PASSWORDPOLICYRESPONSE);
+  obj = PyUnicode_FromString(LDAP_CONTROL_PASSWORDPOLICYRESPONSE);
   PyDict_SetItemString( d, "CONTROL_PASSWORDPOLICYRESPONSE", obj );
   Py_DECREF(obj);
 
-  obj = PyString_FromString(LDAP_CONTROL_RELAX);
+  obj = PyUnicode_FromString(LDAP_CONTROL_RELAX);
   PyDict_SetItemString( d, "CONTROL_RELAX", obj );
   Py_DECREF(obj);
 
diff --git a/Modules/errors.c b/Modules/errors.c
index 3731965..e5cb0ee 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -80,7 +80,7 @@ LDAPerror( LDAP *l, char *msg )
     if (info == NULL)
       return NULL;
 
-    str = PyString_FromString(ldap_err2string(errnum));
+    str = PyUnicode_FromString(ldap_err2string(errnum));
     if (str)
       PyDict_SetItemString( info, "desc", str );
     Py_XDECREF(str);
@@ -95,7 +95,7 @@ LDAPerror( LDAP *l, char *msg )
     if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
       && matched != NULL) {
         if (*matched != '\0') {
-      str = PyString_FromString(matched);
+      str = PyUnicode_FromString(matched);
       if (str)
           PyDict_SetItemString( info, "matched", str );
       Py_XDECREF(str);
@@ -104,13 +104,13 @@ LDAPerror( LDAP *l, char *msg )
     }
     
     if (errnum == LDAP_REFERRAL) {
-        str = PyString_FromString(msg);
+        str = PyUnicode_FromString(msg);
         if (str)
       PyDict_SetItemString( info, "info", str );
         Py_XDECREF(str);
     } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
         if (error != NULL && *error != '\0') {
-            str = PyString_FromString(error);
+            str = PyUnicode_FromString(error);
             if (str)
                 PyDict_SetItemString( info, "info", str );
             Py_XDECREF(str);
diff --git a/Modules/functions.c b/Modules/functions.c
index b2dbf83..ffb6765 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -76,9 +76,9 @@ l_ldap_str2dn( PyObject* unused, PyObject *args )
 	    LDAPAVA *ava = rdn[j];
 	    PyObject *tuple;
 
-	    tuple = Py_BuildValue("(O&O&i)", 
-		LDAPberval_to_object, &ava->la_attr,
-		LDAPberval_to_object, &ava->la_value,
+	    tuple = Py_BuildValue("(O&O&i)",
+		LDAPberval_to_unicode_object, &ava->la_attr,
+		LDAPberval_to_unicode_object, &ava->la_value,
 		ava->la_flags & ~(LDAP_AVA_FREE_ATTR|LDAP_AVA_FREE_VALUE));
 	    if (!tuple) {
 		Py_DECREF(rdnlist);
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 0bf86a1..f3dc92a 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -102,13 +102,13 @@ Tuple_to_LDAPControl( PyObject* tup )
         berbytes.bv_len = 0;
         berbytes.bv_val = NULL;
     }
-    else if (PyString_Check(bytes)) {
-        berbytes.bv_len = PyString_Size(bytes);
-        berbytes.bv_val = PyString_AsString(bytes);
+    else if (PyBytes_Check(bytes)) {
+        berbytes.bv_len = PyBytes_Size(bytes);
+        berbytes.bv_val = PyBytes_AsString(bytes);
     }
     else {
 	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-            "expected a string", bytes));
+            "expected bytes", bytes));
         LDAPControl_DEL(lc);
         return NULL;
     }
diff --git a/Modules/message.c b/Modules/message.c
index 33127b6..1a289db 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -49,6 +49,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 	 BerElement *ber = NULL;
 	 PyObject* entrytuple; 
 	 PyObject* attrdict; 
+	 PyObject* pydn;
 
 	 dn = ldap_get_dn( ld, entry );
 	 if (dn == NULL)  {
@@ -91,22 +92,26 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 	      attr = ldap_next_attribute( ld, entry, ber )
 	 ) {
 	     PyObject* valuelist;
+	     PyObject* pyattr;
+	     pyattr = PyUnicode_FromString(attr);
+
 	     struct berval ** bvals =
 	     	ldap_get_values_len( ld, entry, attr );
 
 	     /* Find which list to append to */
-	     if ( PyMapping_HasKeyString( attrdict, attr ) ) {
-		 valuelist = PyMapping_GetItemString( attrdict, attr );
+	     if ( PyDict_Contains( attrdict, pyattr ) ) {
+		 valuelist = PyDict_GetItem( attrdict, pyattr );
 	     } else {
 		 valuelist = PyList_New(0);
-		 if (valuelist != NULL && PyMapping_SetItemString(attrdict, 
-		     attr, valuelist) == -1) {
+		 if (valuelist != NULL && PyDict_SetItem(attrdict,
+		     pyattr, valuelist) == -1) {
 			Py_DECREF(valuelist);
 			valuelist = NULL;	/* catch error later */
 		 }
 	     }
 
 	     if (valuelist == NULL) {
+		Py_DECREF(pyattr);
 		Py_DECREF(attrdict);
 		Py_DECREF(result);
 		if (ber != NULL)
@@ -125,6 +130,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 
 		    valuestr = LDAPberval_to_object(bvals[i]);
 		    if (PyList_Append( valuelist, valuestr ) == -1) {
+		        Py_DECREF(pyattr);
 			Py_DECREF(attrdict);
 			Py_DECREF(result);
 			Py_DECREF(valuestr);
@@ -141,15 +147,25 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 	    	}
 		ldap_value_free_len(bvals);
 	     }
+	     Py_DECREF(pyattr);
 	     Py_DECREF( valuelist );
 	     ldap_memfree(attr);
 	 }
 
+	 pydn = PyUnicode_FromString(dn);
+	 if (pydn == NULL) {
+	     Py_DECREF(result);
+	     ldap_msgfree( m );
+	     ldap_memfree(dn);
+	     return NULL;
+	 }
+
 	 if (add_ctrls) {
-	    entrytuple = Py_BuildValue("(sOO)", dn, attrdict, pyctrls);
+	    entrytuple = Py_BuildValue("(OOO)", pydn, attrdict, pyctrls);
 	 } else {
-	    entrytuple = Py_BuildValue("(sO)", dn, attrdict);
+	    entrytuple = Py_BuildValue("(OO)", pydn, attrdict);
 	 }
+	 Py_DECREF(pydn);
 	 ldap_memfree(dn);
 	 Py_DECREF(attrdict);
 	 Py_XDECREF(pyctrls);
@@ -191,7 +207,8 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 	 if (refs) {
 	     Py_ssize_t i;
 	     for (i=0; refs[i] != NULL; i++) {
-		 PyObject *refstr = PyString_FromString(refs[i]);
+                 /* A referal is a distinguishedName => unicode */
+		 PyObject *refstr = PyUnicode_FromString(refs[i]);
 		 PyList_Append(reflist, refstr);
 		 Py_DECREF(refstr);
 	     }
@@ -218,6 +235,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 		 PyObject* valtuple;
 		 PyObject *valuestr;
 		 char *retoid = 0;
+		 PyObject *pyoid;
 		 struct berval *retdata = 0;
 
 		 if (ldap_parse_intermediate( ld, entry, &retoid, &retdata, &serverctrls, 0 ) != LDAP_SUCCESS) {
@@ -240,10 +258,17 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 
 		 valuestr = LDAPberval_to_object(retdata);
 		 ber_bvfree( retdata );
-		 valtuple = Py_BuildValue("(sOO)", retoid,
+		 pyoid = PyUnicode_FromString(retoid);
+		 ldap_memfree( retoid );
+		 if (pyoid == NULL)  {
+			Py_DECREF(result);
+			ldap_msgfree( m );
+			return NULL;
+		 }
+		 valtuple = Py_BuildValue("(OOO)", pyoid,
 					  valuestr ? valuestr : Py_None,
 					  pyctrls);
-		 ldap_memfree( retoid );
+		 Py_DECREF(pyoid);
 		 Py_DECREF(valuestr);
 		 Py_XDECREF(pyctrls);
 		 PyList_Append(result, valtuple);
diff --git a/Modules/options.c b/Modules/options.c
index a437ca4..7cf996b 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -204,7 +204,7 @@ LDAP_get_option(LDAPObject *self, int option)
 	    extensions = PyTuple_New(num_extensions);
 	    for (i = 0; i < num_extensions; i++)
 		PyTuple_SET_ITEM(extensions, i,
-		    PyString_FromString(apiinfo.ldapai_extensions[i]));
+		    PyUnicode_FromString(apiinfo.ldapai_extensions[i]));
 
 	    /* return api info as a dictionary */
 	    v = Py_BuildValue("{s:i, s:i, s:i, s:s, s:i, s:O}",
@@ -321,7 +321,7 @@ LDAP_get_option(LDAPObject *self, int option)
 		Py_INCREF(Py_None);
 		return Py_None;
 	    }
-	    v = PyString_FromString(strval);
+	    v = PyUnicode_FromString(strval);
 	    ldap_memfree(strval);
 	    return v;
 
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index cd171b6..d4740d0 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -5,6 +5,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 import os
 import unittest
 from slapdtest import SlapdTestCase
@@ -195,7 +197,7 @@ def test_anon_rootdse_search(self):
             '',
             _ldap.SCOPE_BASE,
             '(objectClass=*)',
-            ['objectClass', 'namingContexts'],
+            [str('objectClass'), str('namingContexts')],
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
@@ -205,9 +207,9 @@ def test_anon_rootdse_search(self):
         self.assertEqual(ctrls, [])
         root_dse = pmsg[0][1]
         self.assertTrue('objectClass' in root_dse)
-        self.assertTrue('OpenLDAProotDSE' in root_dse['objectClass'])
+        self.assertTrue(b'OpenLDAProotDSE' in root_dse['objectClass'])
         self.assertTrue('namingContexts' in root_dse)
-        self.assertEqual(root_dse['namingContexts'], [self.server.suffix])
+        self.assertEqual(root_dse['namingContexts'], [self.server.suffix.encode('ascii')])
 
     def test_unbind(self):
         l = self._open_conn()
@@ -235,8 +237,8 @@ def test_search_ext_individual(self):
         self.assertEqual(len(pmsg[0]), 2)
         self.assertEqual(pmsg[0][0], self.server.suffix)
         self.assertEqual(pmsg[0][0], self.server.suffix)
-        self.assertTrue('dcObject' in pmsg[0][1]['objectClass'])
-        self.assertTrue('organization' in pmsg[0][1]['objectClass'])
+        self.assertTrue(b'dcObject' in pmsg[0][1]['objectClass'])
+        self.assertTrue(b'organization' in pmsg[0][1]['objectClass'])
         self.assertEqual(msgid, m)
         self.assertEqual(ctrls, [])
 
@@ -278,9 +280,9 @@ def test_add(self):
         m = l.add_ext(
             "cn=Foo," + self.server.suffix,
             [
-                ('objectClass', 'organizationalRole'),
-                ('cn', 'Foo'),
-                ('description', 'testing'),
+                ('objectClass', b'organizationalRole'),
+                ('cn', b'Foo'),
+                ('description', b'testing'),
             ]
         )
         self.assertEqual(type(m), type(0))
@@ -302,9 +304,9 @@ def test_add(self):
             (
                 'cn=Foo,'+self.server.suffix,
                 {
-                    'objectClass': ['organizationalRole'],
-                    'cn': ['Foo'],
-                    'description': ['testing'],
+                    'objectClass': [b'organizationalRole'],
+                    'cn': [b'Foo'],
+                    'description': [b'testing'],
                 }
             )
         )
@@ -319,10 +321,10 @@ def test_compare(self):
         m = l.add_ext(
             dn,
             [
-                ('objectClass', 'person'),
-                ('sn', 'CompareTest'),
-                ('cn', 'CompareTest'),
-                ('userPassword', 'the_password'),
+                ('objectClass', b'person'),
+                ('sn', b'CompareTest'),
+                ('cn', b'CompareTest'),
+                ('userPassword', b'the_password'),
             ],
         )
         self.assertEqual(type(m), type(0))
@@ -373,8 +375,8 @@ def test_delete(self):
         m = l.add_ext(
             dn,
             [
-                ('objectClass', 'organizationalRole'),
-                ('cn', 'Deleteme'),
+                ('objectClass', b'organizationalRole'),
+                ('cn', b'Deleteme'),
             ]
         )
         self.assertEqual(type(m), type(0))
@@ -395,7 +397,7 @@ def test_modify_no_such_object(self):
         m = l.modify_ext(
             "cn=DoesNotExist,"+self.server.suffix,
             [
-                (_ldap.MOD_ADD, 'description', ['blah']),
+                (_ldap.MOD_ADD, 'description', [b'blah']),
             ]
         )
         try:
@@ -413,7 +415,7 @@ def test_modify_no_such_object_empty_attrs(self):
         m = l.modify_ext(
             "cn=DoesNotExist,"+self.server.suffix,
             [
-                (_ldap.MOD_ADD, 'description', ['dummy']),
+                (_ldap.MOD_ADD, 'description', [b'dummy']),
             ]
         )
         self.assertTrue(isinstance(m, int))
@@ -434,10 +436,10 @@ def test_modify(self):
         m = l.add_ext(
             dn,
             [
-                ('objectClass', 'person'),
-                ('cn', 'AddToMe'),
-                ('sn', 'Modify'),
-                ('description', 'a description'),
+                ('objectClass', b'person'),
+                ('cn', b'AddToMe'),
+                ('sn', b'Modify'),
+                ('description', b'a description'),
             ]
         )
         self.assertEqual(type(m), type(0))
@@ -447,7 +449,7 @@ def test_modify(self):
         m = l.modify_ext(
             dn,
             [
-                (_ldap.MOD_ADD, 'description', ['b desc', 'c desc']),
+                (_ldap.MOD_ADD, 'description', [b'b desc', b'c desc']),
             ]
         )
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
@@ -466,7 +468,7 @@ def test_modify(self):
         self.assertEqual(pmsg[0][0], dn)
         d = list(pmsg[0][1]['description'])
         d.sort()
-        self.assertEqual(d, ['a description', 'b desc', 'c desc'])
+        self.assertEqual(d, [b'a description', b'b desc', b'c desc'])
 
     def test_rename(self):
         l = self._open_conn()
@@ -474,8 +476,8 @@ def test_rename(self):
         m = l.add_ext(
             dn,
             [
-                ('objectClass', 'organizationalRole'),
-                ('cn', 'RenameMe'),
+                ('objectClass', b'organizationalRole'),
+                ('cn', b'RenameMe'),
             ]
         )
         self.assertEqual(type(m), type(0))
@@ -507,15 +509,15 @@ def test_rename(self):
         self.assertEqual(ctrls, [])
         self.assertEqual(len(pmsg), 1)
         self.assertEqual(pmsg[0][0], dn2)
-        self.assertEqual(pmsg[0][1]['cn'], ['IAmRenamed'])
+        self.assertEqual(pmsg[0][1]['cn'], [b'IAmRenamed'])
 
         # create the container
         containerDn = "ou=RenameContainer,"+self.server.suffix
         m = l.add_ext(
             containerDn,
             [
-                ('objectClass', 'organizationalUnit'),
-                ('ou', 'RenameContainer'),
+                ('objectClass', b'organizationalUnit'),
+                ('ou', b'RenameContainer'),
             ]
         )
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
@@ -551,7 +553,7 @@ def test_rename(self):
         self.assertEqual(ctrls, [])
         self.assertEqual(len(pmsg), 1)
         self.assertEqual(pmsg[0][0], dn3)
-        self.assertEqual(pmsg[0][1]['cn'], ['IAmRenamedAgain'])
+        self.assertEqual(pmsg[0][1]['cn'], [b'IAmRenamedAgain'])
 
 
     def test_whoami(self):
@@ -590,10 +592,10 @@ def test_passwd(self):
         m = l.add_ext(
             dn,
             [
-                ('objectClass', 'person'),
-                ('sn', 'PasswordTest'),
-                ('cn', 'PasswordTest'),
-                ('userPassword', 'initial'),
+                ('objectClass', b'person'),
+                ('sn', b'PasswordTest'),
+                ('cn', b'PasswordTest'),
+                ('userPassword', b'initial'),
             ]
         )
         self.assertEqual(type(m), type(0))
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 97274f3..459c1dc 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -5,6 +5,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 # from Python's standard lib
 import unittest
 
@@ -27,9 +29,10 @@ def test_is_dn(self):
         self.assertEqual(ldap.dn.is_dn(',cn=foobar,ou=ae-dir'), False)
         self.assertEqual(ldap.dn.is_dn('cn=foobar,ou=ae-dir,'), False)
         self.assertEqual(ldap.dn.is_dn('uid=xkcd,cn=foobar,ou=ae-dir'), True)
+        self.assertEqual(ldap.dn.is_dn('cn=äöüÄÖÜß,o=äöüÄÖÜß'), True)
         self.assertEqual(
             ldap.dn.is_dn(
-                'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c.o=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f'
+                r'cn=\c3\a4\c3\b6\c3\bc\c3\84\c3\96\c3\9c\c3\9f,o=\c3\a4\c3\b6\c3\bc\c3\84\c3\96\c3\9c\c3\9f'
             ),
             True
         )
@@ -97,9 +100,9 @@ def test_str2dn(self):
             ]
         )
         self.assertEqual(
-            ldap.dn.str2dn('cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com', flags=0),
+            ldap.dn.str2dn('cn=äöüÄÖÜß,dc=example,dc=com', flags=0),
             [
-                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('cn', 'äöüÄÖÜß', 4)],
                 [('dc', 'example', 1)],
                 [('dc', 'com', 1)]
             ]
@@ -107,7 +110,7 @@ def test_str2dn(self):
         self.assertEqual(
             ldap.dn.str2dn('cn=\\c3\\a4\\c3\\b6\\c3\\bc\\c3\\84\\c3\\96\\c3\\9c\\c3\\9f,dc=example,dc=com', flags=0),
             [
-                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('cn', 'äöüÄÖÜß', 4)],
                 [('dc', 'example', 1)],
                 [('dc', 'com', 1)]
             ]
@@ -156,19 +159,11 @@ def test_dn2str(self):
         )
         self.assertEqual(
             ldap.dn.dn2str([
-                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
-                [('dc', 'example', 1)],
-                [('dc', 'com', 1)]
-            ]),
-            'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com'
-        )
-        self.assertEqual(
-            ldap.dn.dn2str([
-                [('cn', '\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 4)],
+                [('cn', 'äöüÄÖÜß', 4)],
                 [('dc', 'example', 1)],
                 [('dc', 'com', 1)]
             ]),
-            'cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com'
+            'cn=äöüÄÖÜß,dc=example,dc=com'
         )
 
     def test_explode_dn(self):
@@ -197,12 +192,12 @@ def test_explode_dn(self):
             ['uid=test\\, 42', 'ou=Testing', 'dc=example', 'dc=com']
         )
         self.assertEqual(
-            ldap.dn.explode_dn('cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f,dc=example,dc=com', flags=0),
-            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 'dc=example', 'dc=com']
+            ldap.dn.explode_dn('cn=äöüÄÖÜß,dc=example,dc=com', flags=0),
+            ['cn=äöüÄÖÜß', 'dc=example', 'dc=com']
         )
         self.assertEqual(
             ldap.dn.explode_dn('cn=\\c3\\a4\\c3\\b6\\c3\\bc\\c3\\84\\c3\\96\\c3\\9c\\c3\\9f,dc=example,dc=com', flags=0),
-            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', 'dc=example', 'dc=com']
+            ['cn=äöüÄÖÜß', 'dc=example', 'dc=com']
         )
 
     def test_explode_rdn(self):
@@ -239,12 +234,12 @@ def test_explode_rdn(self):
             ['uid=test\\+ 42']
         )
         self.assertEqual(
-            ldap.dn.explode_rdn('cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f', flags=0),
-            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f']
+            ldap.dn.explode_rdn('cn=äöüÄÖÜß', flags=0),
+            ['cn=äöüÄÖÜß']
         )
         self.assertEqual(
             ldap.dn.explode_rdn('cn=\\c3\\a4\\c3\\b6\\c3\\bc\\c3\\84\\c3\\96\\c3\\9c\\c3\\9f', flags=0),
-            ['cn=\xc3\xa4\xc3\xb6\xc3\xbc\xc3\x84\xc3\x96\xc3\x9c\xc3\x9f']
+            ['cn=äöüÄÖÜß']
         )
 
 
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 8f39c67..831c063 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -81,34 +81,34 @@
 # NOTE: For the dict, it needs to be kept up-to-date as we make changes!
 LDAP_ENTRIES = {
     'ou=Container,dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['organizationalUnit'],
-        'ou': ['Container']
+        'objectClass': [b'organizationalUnit'],
+        'ou': [b'Container']
     },
     'cn=Foo2,dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['organizationalRole'],
-        'cn': ['Foo2']
+        'objectClass': [b'organizationalRole'],
+        'cn': [b'Foo2']
     },
     'cn=Foo4,ou=Container,dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['organizationalRole'],
-        'cn': ['Foo4']
+        'objectClass': [b'organizationalRole'],
+        'cn': [b'Foo4']
     },
     'cn=Manager,dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['applicationProcess', 'simpleSecurityObject'],
-        'userPassword': ['password'],
-        'cn': ['Manager']
+        'objectClass': [b'applicationProcess', b'simpleSecurityObject'],
+        'userPassword': [b'password'],
+        'cn': [b'Manager']
     },
     'cn=Foo3,dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['organizationalRole'],
-        'cn': ['Foo3']
+        'objectClass': [b'organizationalRole'],
+        'cn': [b'Foo3']
     },
     'cn=Foo1,dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['organizationalRole'],
-        'cn': ['Foo1']
+        'objectClass': [b'organizationalRole'],
+        'cn': [b'Foo1']
     },
     'dc=slapd-test,dc=python-ldap,dc=org': {
-        'objectClass': ['dcObject', 'organization'],
-        'dc': ['slapd-test'],
-        'o': ['slapd-test']
+        'objectClass': [b'dcObject', b'organization'],
+        'dc': [b'slapd-test'],
+        'o': [b'slapd-test']
     }
 }
 
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 5773ff2..d55d018 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -5,6 +5,17 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
+import sys
+
+if sys.version_info[0] <= 2:
+    PY2 = True
+    text_type = unicode
+else:
+    PY2 = False
+    text_type = str
+
 import os
 import unittest
 import pickle
@@ -83,7 +94,101 @@ def setUp(self):
             self._ldap_conn
         except AttributeError:
             # open local LDAP connection
-            self._ldap_conn = self._open_ldap_conn()
+            self._ldap_conn = self._open_ldap_conn(bytes_mode=False)
+
+    def test_reject_bytes_base(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+
+        with self.assertRaises(TypeError):
+            l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
+        with self.assertRaises(TypeError):
+            l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
+        with self.assertRaises(TypeError):
+            l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*'])
+
+    def test_search_keys_are_text(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+        result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
+        result.sort()
+        dn, fields = result[0]
+        self.assertEqual(dn, 'cn=Foo1,%s' % base)
+        self.assertEqual(type(dn), text_type)
+        for key, values in fields.items():
+            self.assertEqual(type(key), text_type)
+            for value in values:
+                self.assertEqual(type(value), bytes)
+
+    def _get_bytes_ldapobject(self, explicit=True):
+        if explicit:
+            kwargs = {'bytes_mode': True}
+        else:
+            kwargs = {}
+        return self._open_ldap_conn(
+            who=self.server.root_dn.encode('utf-8'),
+            cred=self.server.root_pw.encode('utf-8'),
+            **kwargs
+        )
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_bytesmode_search_requires_bytes(self):
+        l = self._get_bytes_ldapobject()
+        base = self.server.suffix
+
+        with self.assertRaises(TypeError):
+            l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*'])
+        with self.assertRaises(TypeError):
+            l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
+        with self.assertRaises(TypeError):
+            l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_bytesmode_search_results_have_bytes(self):
+        l = self._get_bytes_ldapobject()
+        base = self.server.suffix
+        result = l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
+        result.sort()
+        dn, fields = result[0]
+        self.assertEqual(dn, b'cn=Foo1,%s' % base)
+        self.assertEqual(type(dn), bytes)
+        for key, values in fields.items():
+            self.assertEqual(type(key), bytes)
+            for value in values:
+                self.assertEqual(type(value), bytes)
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_unset_bytesmode_search_warns_bytes(self):
+        l = self._get_bytes_ldapobject(explicit=False)
+        base = self.server.suffix
+
+        l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*'])
+        l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
+        l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
+
+    def test_search_accepts_unicode_dn(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+
+        with self.assertRaises(ldap.NO_SUCH_OBJECT):
+            result = l.search_s("CN=abc\U0001f498def", ldap.SCOPE_SUBTREE)
+
+    def test_filterstr_accepts_unicode(self):
+        l = self._ldap_conn
+        base = self.server.suffix
+        result = l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=abc\U0001f498def)', ['*'])
+        self.assertEqual(result, [])
+
+    def test_attrlist_accepts_unicode(self):
+        base = self.server.suffix
+        result = self._ldap_conn.search_s(
+            base, ldap.SCOPE_SUBTREE,
+            '(cn=Foo*)', ['abc', 'abc\U0001f498def'])
+        result.sort()
+
+        for dn, attrs in result:
+            self.assertIsInstance(dn, text_type)
+            self.assertEqual(attrs, {})
 
     def test001_search_subtree(self):
         result = self._ldap_conn.search_s(
@@ -98,19 +203,19 @@ def test001_search_subtree(self):
             [
                 (
                     'cn=Foo1,'+self.server.suffix,
-                    {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo1'], 'objectClass': [b'organizationalRole']}
                 ),
                 (
                     'cn=Foo2,'+self.server.suffix,
-                    {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo2'], 'objectClass': [b'organizationalRole']}
                 ),
                 (
                     'cn=Foo3,'+self.server.suffix,
-                    {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo3'], 'objectClass': [b'organizationalRole']}
                 ),
                 (
                     'cn=Foo4,ou=Container,'+self.server.suffix,
-                    {'cn': ['Foo4'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo4'], 'objectClass': [b'organizationalRole']}
                 ),
             ]
         )
@@ -128,15 +233,15 @@ def test002_search_onelevel(self):
             [
                 (
                     'cn=Foo1,'+self.server.suffix,
-                    {'cn': ['Foo1'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo1'], 'objectClass': [b'organizationalRole']}
                 ),
                 (
                     'cn=Foo2,'+self.server.suffix,
-                    {'cn': ['Foo2'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo2'], 'objectClass': [b'organizationalRole']}
                 ),
                 (
                     'cn=Foo3,'+self.server.suffix,
-                    {'cn': ['Foo3'], 'objectClass': ['organizationalRole']}
+                    {'cn': [b'Foo3'], 'objectClass': [b'organizationalRole']}
                 ),
             ]
         )
@@ -151,9 +256,22 @@ def test003_search_oneattr(self):
         result.sort()
         self.assertEqual(
             result,
-            [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': ['Foo4']})]
+            [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': [b'Foo4']})]
         )
 
+    def test_search_subschema(self):
+        l = self._ldap_conn
+        dn = l.search_subschemasubentry_s()
+        self.assertIsInstance(dn, text_type)
+        self.assertEqual(dn, "cn=Subschema")
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_search_subschema_have_bytes(self):
+        l = self._get_bytes_ldapobject(explicit=False)
+        dn = l.search_subschemasubentry_s()
+        self.assertIsInstance(dn, bytes)
+        self.assertEqual(dn, b"cn=Subschema")
+
     def test004_errno107(self):
         l = self.ldap_object_class('ldap://127.0.0.1:42')
         try:
@@ -228,20 +346,22 @@ def test103_reconnect_get_state(self):
         self.assertEqual(
             l1.__getstate__(),
             {
-                '_last_bind': (
+                str('_last_bind'): (
                     'simple_bind_s',
                     (bind_dn, 'user1_pw'),
                     {}
                 ),
-                '_options': [(17, 3)],
-                '_reconnects_done': 0L,
-                '_retry_delay': 60.0,
-                '_retry_max': 1,
-                '_start_tls': 0,
-                '_trace_level': 0,
-                '_trace_stack_limit': 5,
-                '_uri': self.server.ldapi_uri,
-                'timeout': -1,
+                str('_options'): [(17, 3)],
+                str('_reconnects_done'): 0,
+                str('_retry_delay'): 60.0,
+                str('_retry_max'): 1,
+                str('_start_tls'): 0,
+                str('_trace_level'): 0,
+                str('_trace_stack_limit'): 5,
+                str('_uri'): self.server.ldapi_uri,
+                str('bytes_mode'): l1.bytes_mode,
+                str('bytes_mode_hardfail'): l1.bytes_mode_hardfail,
+                str('timeout'): -1,
             },
         )
 
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index a68b032..2be03f6 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -5,6 +5,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 import unittest
 from ldap.compat import quote
 
@@ -274,7 +276,7 @@ def test_parse_dn(self):
         u = LDAPUrl("ldap:///dn=foo%3f")
         self.assertEqual(u.dn, "dn=foo?")
         u = LDAPUrl("ldap:///dn=str%c3%b6der.com")
-        self.assertEqual(u.dn, "dn=str\xc3\xb6der.com")
+        self.assertEqual(u.dn, "dn=str\xf6der.com")
 
     def test_parse_attrs(self):
         u = LDAPUrl("ldap:///?")
@@ -338,7 +340,7 @@ def test_parse_filter(self):
         u = LDAPUrl("ldap:///???(cn=Q%3f)")
         self.assertEqual(u.filterstr, "(cn=Q?)")
         u = LDAPUrl("ldap:///???(sn=Str%c3%b6der)") # (possibly bad?)
-        self.assertEqual(u.filterstr, "(sn=Str\xc3\xb6der)")
+        self.assertEqual(u.filterstr, "(sn=Str\xf6der)")
         u = LDAPUrl("ldap:///???(sn=Str\\c3\\b6der)")
         self.assertEqual(u.filterstr, "(sn=Str\\c3\\b6der)") # (recommended)
         u = LDAPUrl("ldap:///???(cn=*\\2a*)")
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 76701cc..adf0d26 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -5,6 +5,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+from __future__ import unicode_literals
+
 # from Python's standard lib
 import unittest
 import textwrap
@@ -184,7 +186,7 @@ def test_folded(self):
              value
             attrib2: %s
 
-            """ % (b'asdf.'*20), [
+            """ % ('asdf.'*20), [
                 (
                     'cn=x,cn=y,cn=z',
                     {
@@ -273,6 +275,26 @@ def test_big_binary(self):
         )
 
     def test_unicode(self):
+        # Encode "Ströder" as UTF-8+Base64
+        # Putting "Ströder" in a single line would be an invalid LDIF file
+        # per https://tools.ietf.org/html/rfc2849 (only safe ascii is allowed in a file)
+        self.check_records(
+            """
+            dn: cn=Michael Stroeder,dc=stroeder,dc=com
+            lastname:: U3Ryw7ZkZXI=
+
+            """,
+            [
+                (
+                    'cn=Michael Stroeder,dc=stroeder,dc=com',
+                    {'lastname': [b'Str\303\266der']},
+                ),
+            ]
+        )
+
+    def test_unencoded_unicode(self):
+        # Encode "Ströder" as UTF-8, without base64
+        # This is an invalid LDIF file, but such files are often found in the wild.
         self.check_records(
             """
             dn: cn=Michael Stroeder,dc=stroeder,dc=com

From 388eafbf7d1d105385704b3f84ae76e15d8e788c Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:46:12 +0100
Subject: [PATCH 569/868] Modules: Python 3, alias PyInt to PyLong

---
 Modules/common.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Modules/common.h b/Modules/common.h
index 1ec232c..0eea1d9 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -27,5 +27,11 @@
 void LDAPadd_methods( PyObject*d, PyMethodDef*methods );
 #define PyNone_Check(o) ((o) == Py_None)
 
+/* Py2/3 compatibility */
+#if PY_VERSION_HEX >= 0x03000000
+/* In Python 3, alias PyInt to PyLong */
+#define PyInt_FromLong PyLong_FromLong
+#endif
+
 #endif /* __h_common_ */
 

From 4549352213556c4cd3303f2ae0fab9a90abf5bc1 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:46:50 +0100
Subject: [PATCH 570/868] Tests: Add a test suite for binds

---
 Tests/__init__.py |  1 +
 Tests/t_bind.py   | 82 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)
 create mode 100644 Tests/t_bind.py

diff --git a/Tests/__init__.py b/Tests/__init__.py
index df95a06..1ca8d20 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -7,6 +7,7 @@
 
 from __future__ import absolute_import
 
+from . import t_bind
 from . import t_cext
 from . import t_cidict
 from . import t_ldap_dn
diff --git a/Tests/t_bind.py b/Tests/t_bind.py
new file mode 100644
index 0000000..373688b
--- /dev/null
+++ b/Tests/t_bind.py
@@ -0,0 +1,82 @@
+from __future__ import unicode_literals
+
+import sys
+
+if sys.version_info[0] <= 2:
+    PY2 = True
+    text_type = unicode
+else:
+    PY2 = False
+    text_type = str
+
+import ldap, unittest
+from slapdtest import SlapdObject
+from ldap.ldapobject import LDAPObject
+
+server = None
+
+
+class TestBinds(unittest.TestCase):
+
+    def setUp(self):
+        global server
+        if server is None:
+            server = SlapdObject()
+            server.start()
+
+        self.server = server
+        self.unicode_val = "abc\U0001f498def"
+        self.unicode_val_bytes = self.unicode_val.encode('utf-8')
+
+        self.dn_unicode = "CN=" + self.unicode_val
+        self.dn_bytes = self.dn_unicode.encode('utf-8')
+
+    def _get_ldapobject(self, bytes_mode=None):
+        l = LDAPObject(self.server.ldap_uri, bytes_mode=bytes_mode)
+        l.protocol_version = 3
+        l.set_option(ldap.OPT_REFERRALS,0)
+        return l
+
+    def test_simple_bind(self):
+        l = self._get_ldapobject(False)
+        with self.assertRaises(ldap.INVALID_CREDENTIALS):
+            l.simple_bind_s(self.dn_unicode, self.unicode_val)
+
+    def test_unicode_bind(self):
+        l = self._get_ldapobject(False)
+        l.simple_bind(self.dn_unicode, "ascii")
+
+        l = self._get_ldapobject(False)
+        l.simple_bind("CN=user", self.unicode_val)
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_unicode_bind_bytesmode(self):
+        l = self._get_ldapobject(True)
+        with self.assertRaises(TypeError):
+            l.simple_bind_s(self.dn_unicode, self.unicode_val_bytes)
+
+        with self.assertRaises(TypeError):
+            l.simple_bind_s(self.dn_bytes, self.unicode_val)
+
+        # Works when encoded to UTF-8
+        with self.assertRaises(ldap.INVALID_CREDENTIALS):
+            l.simple_bind_s(self.dn_bytes, self.unicode_val_bytes)
+
+    def test_unicode_bind_no_bytesmode(self):
+        l = self._get_ldapobject(False)
+        with self.assertRaises(TypeError):
+            l.simple_bind_s(self.dn_bytes, self.unicode_val)
+
+        # Works fine in Python 3 because 'cred' (the password) is read in
+        # using the "s#" format which, unlike "s", accepts either a str
+        # (unicode) *or* bytes.
+        #
+        # with self.assertRaises(TypeError):
+        #     l.simple_bind_s(self.dn_unicode, self.unicode_val_bytes)
+
+        with self.assertRaises(ldap.INVALID_CREDENTIALS):
+            l.simple_bind_s(self.dn_unicode, self.unicode_val)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 2949e780efe25ae65f9e893a952d3e85abf73972 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:47:14 +0100
Subject: [PATCH 571/868] Tests: Add a test suite for edits

---
 Tests/__init__.py |  1 +
 Tests/t_edit.py   | 89 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 Tests/t_edit.py

diff --git a/Tests/__init__.py b/Tests/__init__.py
index 1ca8d20..46b3861 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -18,4 +18,5 @@
 from . import t_ldapurl
 from . import t_ldif
 from . import t_ldapobject
+from . import t_edit
 from . import t_ldap_schema_subentry
diff --git a/Tests/t_edit.py b/Tests/t_edit.py
new file mode 100644
index 0000000..9aee43e
--- /dev/null
+++ b/Tests/t_edit.py
@@ -0,0 +1,89 @@
+from __future__ import unicode_literals
+
+import sys
+
+if sys.version_info[0] <= 2:
+    PY2 = True
+    text_type = unicode
+else:
+    PY2 = False
+    text_type = str
+
+import ldap, unittest
+from slapdtest import SlapdObject
+
+from ldap.ldapobject import LDAPObject
+
+server = None
+
+
+class EditionTests(unittest.TestCase):
+
+    def setUp(self):
+        global server
+        if server is None:
+            server = SlapdObject()
+            server.start()
+            base = server.suffix
+            suffix_dc = base.split(',')[0][3:]
+
+            # insert some Foo* objects via ldapadd
+            server.ldapadd("\n".join([
+                'dn: '+server.suffix,
+                'objectClass: dcObject',
+                'objectClass: organization',
+                'dc: '+suffix_dc,
+                'o: '+suffix_dc,
+                '',
+                'dn: '+server.root_dn,
+                'objectClass: applicationProcess',
+                'cn: '+server.root_cn,
+                '',
+                "dn: cn=Foo1,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo1",
+                "",
+                "dn: cn=Foo2,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo2",
+                "",
+                "dn: cn=Foo3,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo3",
+                "",
+                "dn: ou=Container,"+base,
+                "objectClass: organizationalUnit",
+                "ou: Container",
+                "",
+                "dn: cn=Foo4,ou=Container,"+base,
+                "objectClass: organizationalRole",
+                "cn: Foo4",
+                "",
+            ])+"\n")
+
+        l = LDAPObject(server.ldap_uri, bytes_mode=False)
+        l.protocol_version = 3
+        l.set_option(ldap.OPT_REFERRALS,0)
+        l.simple_bind_s(server.root_dn,
+                server.root_pw)
+        self.ldap = l
+        self.server = server
+
+    def test_add_object(self):
+        base = self.server.suffix
+        dn = "cn=Added,ou=Container," + base
+        self.ldap.add_ext_s(dn, [
+            ("objectClass", [b'organizationalRole']),
+            ("cn", [b'Added']),
+        ])
+
+        # Lookup the object
+        result = self.ldap.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Added)', ['*'])
+        self.assertEqual(result, [
+            ("cn=Added,ou=Container," + base,
+                {'cn': [b'Added'], 'objectClass': [b'organizationalRole']}),
+        ])
+
+
+if __name__ == '__main__':
+    unittest.main()

From ebcdaae35bb126dd94bafd5d2d82f1460c1562b0 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:48:30 +0100
Subject: [PATCH 572/868] Tests: Add a smoke-check for listall() and
 attribute_types()

---
 Tests/t_ldap_schema_subentry.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index de6421a..83ed006 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -10,6 +10,7 @@
 
 import ldif
 import ldap.schema
+from ldap.schema.models import ObjectClass
 
 TEST_SUBSCHEMA_FILES = (
     'Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif',
@@ -30,6 +31,15 @@ def test_subschema_file(self):
             _, subschema_subentry = ldif_parser.all_records[0]
             sub_schema = ldap.schema.SubSchema(subschema_subentry)
 
+            # Smoke-check for listall() and attribute_types()
+            for objclass in sub_schema.listall(ObjectClass):
+                must, may = sub_schema.attribute_types([objclass])
+
+                for oid, attributetype in must.items():
+                    self.assertEqual(attributetype.oid, oid)
+                for oid, attributetype in may.items():
+                    self.assertEqual(attributetype.oid, oid)
+
 
 if __name__ == '__main__':
     unittest.main()

From eb06c59afa2ca0c440db8f9e9c2181f3931b4c17 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:51:29 +0100
Subject: [PATCH 573/868] Infra: Advertise and test Python 3 compatibility

- Add 3.3 - 3.6 to tox.ini
- Add .travis.yml for Travis CI
- Add 3.3 - 3.6 to Trove classifiers
- Add Python version checking to setup.py
---
 .travis.yml | 25 +++++++++++++++++++++++++
 setup.py    | 25 ++++++++++++++++++++++---
 tox.ini     |  3 ++-
 3 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 .travis.yml

diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..542377d
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,25 @@
+language: python
+
+python:
+- '2.7'
+- '3.3'
+- '3.4'
+- '3.5'
+- '3.6'
+# Note: when updating Python versions, also change setup.py and tox.ini
+
+sudo: false
+
+cache: pip
+
+addons:
+  apt:
+    packages:
+      - ldap-utils
+      - slapd
+
+install:
+  - pip install "pip>=7.1.0"
+  - pip install tox-travis tox
+
+script: tox
diff --git a/setup.py b/setup.py
index a475a35..af6443b 100644
--- a/setup.py
+++ b/setup.py
@@ -4,6 +4,8 @@
 See https://www.python-ldap.org/ for details.
 """
 
+import sys,os
+
 has_setuptools = False
 try:
   from setuptools import setup, Extension
@@ -11,8 +13,15 @@
 except ImportError:
   from distutils.core import setup, Extension
 
-from ConfigParser import ConfigParser
-import sys,os,time
+if sys.version_info[0] == 2 and sys.version_info[1] < 7:
+    raise RuntimeError('This software requires Python 2.7 or 3.x.')
+if sys.version_info[0] >= 3 and sys.version_info < (3, 3):
+    raise RuntimeError('The C API from Python 3.3+ is required.')
+
+if sys.version_info[0] >= 3:
+    from configparser import ConfigParser
+else:
+    from ConfigParser import ConfigParser
 
 sys.path.insert(0, os.path.join(os.getcwd(), 'Lib/ldap'))
 import pkginfo
@@ -59,7 +68,8 @@ class OpenLDAP2:
   kwargs = dict(
     include_package_data = True,
     install_requires = ['setuptools'],
-    zip_safe = False
+    zip_safe = False,
+    python_requires = '>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
   )
 
 setup(
@@ -88,8 +98,17 @@ class OpenLDAP2:
     'Operating System :: Microsoft :: Windows',
     'Operating System :: POSIX',
     'Programming Language :: C',
+
     'Programming Language :: Python',
     'Programming Language :: Python :: 2',
+    'Programming Language :: Python :: 2.7',
+    'Programming Language :: Python :: 3',
+    'Programming Language :: Python :: 3.3',
+    'Programming Language :: Python :: 3.4',
+    'Programming Language :: Python :: 3.5',
+    'Programming Language :: Python :: 3.6',
+    # Note: when updating Python versions, also change .travis.yml and tox.ini
+
     'Topic :: Database',
     'Topic :: Internet',
     'Topic :: Software Development :: Libraries :: Python Modules',
diff --git a/tox.ini b/tox.ini
index d11ce1c..61a6aed 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,7 +4,8 @@
 # and then run "tox" from this directory.
 
 [tox]
-envlist = py27
+# Note: when updating Python versions, also change setup.py and .travis.yml
+envlist = py27,py33,py34,py35,py36
 
 [testenv]
 commands = {envpython} setup.py test

From 9608ead48b756b514f8a1e65135cd9b091d78683 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 10:53:46 +0100
Subject: [PATCH 574/868] Infra: Set authorship to the python-ldap project

---
 setup.cfg | 2 +-
 setup.py  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 10dafc9..59816b7 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -30,7 +30,7 @@ optimize = 1
 provides = python-ldap
 requires = python libldap-2_4
 vendor = python-ldap project
-packager = Michael Ströder
+packager = python-ldap team
 distribution_name = openSUSE 11.x
 release = 1
 doc_files = CHANGES README INSTALL TODO Demo/
diff --git a/setup.py b/setup.py
index af6443b..89351b5 100644
--- a/setup.py
+++ b/setup.py
@@ -85,7 +85,7 @@ class OpenLDAP2:
   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations
   and controls, etc.). 
   """,
-  author = pkginfo.__author__,
+  author = 'python-ldap project',
   author_email = 'python-ldap@python.org',
   url = 'https://www.python-ldap.org/',
   download_url = 'https://pypi.python.org/pypi/python-ldap/',

From 92283a24a1a7dcdd60ac9368b6a5e71c235f9d89 Mon Sep 17 00:00:00 2001
From: pyldap contributors <python-ldap@python.org>
Date: Fri, 24 Nov 2017 11:26:23 +0100
Subject: [PATCH 575/868] Infra: Thank all pyldap contributors

The changes are squashed, so we don't have line-by-line authorship
in Git. List people here instead, and link to the history.
---
 README | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/README b/README
index 6081b4b..431559d 100644
--- a/README
+++ b/README
@@ -100,6 +100,27 @@ These very kind people have supplied patches or suggested changes:
 * Andreas Hasenack <ahasenack at terra.com.br>
 * Matej Vela <vela at debian.org>
 
+These people contributed to Python 3 porting (at https://github.com/pyldap/):
+* A. Karl Kornel <akkornel at stanford.edu>
+* Alex Willmer <alex at moreati.org.uk>
+* Aymeric Augustin <aymeric.augustin at oscaro.com>
+* Bradley Baetz <bbaetz at google.com>
+* Christian Heimes <cheimes at redhat.com>
+* Dirk Mueller <dirk at dmllr.de>
+* Jon Dufresne <jon.dufresne at gmail.com>
+* Martin Basti <mbasti at redhat.com>
+* Miro Hroncok <miro at hroncok.cz>
+* Paul Aurich <paul at darkrain42.org>
+* Petr Viktorin <pviktori at redhat.com>
+* Pieterjan De Potter <pieterjan.depotter at ugent.be>
+* Raphaël Barrois <raphael.barrois at polyconseil.fr>
+* Robert Kuska <rkuska at redhat.com>
+* Stanislav Láznička <stlaz at users.noreply.github.com>
+* Tobias Bräutigam <tobias.braeutigam at gonicus.de>
+* Tom van Dijk <t.vandijk at utwente.nl>
+* Wentao Han <wentao.han at gmail.com>
+* William Brown <firstyear at redhat.com>
+
 Thanks to all the guys on the python-ldap mailing list for
 their contributions and input into this package.
 

From 31389576dcf1badff9c8cbe4af445bbb9f2ef69d Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 11:41:55 +0100
Subject: [PATCH 576/868] Infra: Update CHANGELOG

---
 CHANGES | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index a8ad44a..113eb27 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,11 +4,15 @@ Released 3.0.0 xxxx-xx-xx
 Changes since 2.4.45:
 
 Mandatory prerequisites:
-- Python 2.7.x
+- Python 2.7.x or 3.3+
 - pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
 
+Python 3 support is merged from the pyldap fork (https://github.com/pyldap)
+
 Infrastructure:
 - Add .gitignore
+- Re-format README to ReStructured Text
+- Setup for automatic testing using Travis CI
 
 Modules/
 (thanks to Michael Ströder)
@@ -48,6 +52,10 @@ Lib/
 * module ldif now uses functions b64encode() and b64decode()
 * fixed pickling and restoring of ReconnectLDAPObject
 
+Lib/slapdtest.py
+* Automatically try some common locations for SCHEMADIR
+* Ensure server is stopped when the process exits
+
 Tests/
 (thanks to Michael Ströder)
 * added explicit reconnect tests for ReconnectLDAPObject
@@ -56,6 +64,13 @@ Tests/
 * added more tests for sub-module ldap.dn
 * added tests for ldap.syncrepl (thanks to Karl Kornel)
 
+Tests/
+(thanks to pyldap contributors):
+* Expand cidict membership test
+* Add test suite for binds
+* Add test suite for edits
+* Add a smoke-check for listall() and attribute_types()
+
 ----------------------------------------------------------------
 Released 2.4.45 2017-10-09
 

From 8955a321a7b4fbd1920d9ff130b14f285c919a50 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 23 Nov 2017 12:40:09 +0100
Subject: [PATCH 577/868] Add coverage reporting

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .coveragerc              | 26 ++++++++++++++++++++++++++
 .gitignore               |  2 ++
 .travis.yml              |  6 +++++-
 Makefile                 | 11 +++++++++++
 Tests/__init__.py        |  1 +
 Tests/t_untested_mods.py | 15 +++++++++++++++
 tox.ini                  | 13 +++++++++++--
 7 files changed, 71 insertions(+), 3 deletions(-)
 create mode 100644 .coveragerc
 create mode 100644 Makefile
 create mode 100644 Tests/t_untested_mods.py

diff --git a/.coveragerc b/.coveragerc
new file mode 100644
index 0000000..fc432b9
--- /dev/null
+++ b/.coveragerc
@@ -0,0 +1,26 @@
+[run]
+branch = True
+source =
+    Lib/
+omit =
+    Lib/slapdtest.py
+
+[paths]
+source =
+    Lib/
+    .tox/*/lib/python*/site-packages/
+
+[report]
+ignore_errors = False
+precision = 1
+exclude_lines =
+    pragma: no cover
+    raise NotImplementedError
+    if 0:
+    if __name__ == .__main__.:
+    if PY2
+    if not PY2
+
+[html]
+directory = build/htmlcov
+title = python-ldap coverage report
diff --git a/.gitignore b/.gitignore
index 072e203..03b366d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,8 @@
 *.pyc
 __pycache__/
 .tox
+.coverage*
+!.coveragerc
 
 # shared libs installed by 'setup.py test'
 /Lib/*.so*
diff --git a/.travis.yml b/.travis.yml
index 542377d..48f09be 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -20,6 +20,10 @@ addons:
 
 install:
   - pip install "pip>=7.1.0"
-  - pip install tox-travis tox
+  - pip install tox-travis tox codecov coverage
 
 script: tox
+
+after_success:
+  - python -m coverage combine
+  - codecov
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..56aaa8c
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,11 @@
+.NOTPARALLEL:
+
+.PHONY: all
+all:
+
+.PHONY: clean
+clean:
+	rm -rf build dist *.egg-info $(VENV) .tox
+	rm -f .coverage .coverage.*
+	find . -name '*.py[co]' -or -name '*.so*' -or -name '*.dylib' -delete
+	find . -depth -name __pycache__ -exec rm -rf {} \;
diff --git a/Tests/__init__.py b/Tests/__init__.py
index 46b3861..9f54f87 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -20,3 +20,4 @@
 from . import t_ldapobject
 from . import t_edit
 from . import t_ldap_schema_subentry
+from . import t_untested_mods
diff --git a/Tests/t_untested_mods.py b/Tests/t_untested_mods.py
new file mode 100644
index 0000000..6221f24
--- /dev/null
+++ b/Tests/t_untested_mods.py
@@ -0,0 +1,15 @@
+# modules without any tests
+import ldap.async
+import ldap.controls.deref
+import ldap.controls.openldap
+import ldap.controls.pagedresults
+import ldap.controls.ppolicy
+import ldap.controls.psearch
+import ldap.controls.pwdpolicy
+import ldap.controls.readentry
+import ldap.controls.sessiontrack
+import ldap.controls.sss
+import ldap.controls.vlv
+import ldap.logger
+import ldap.resiter
+import ldap.syncrepl
diff --git a/tox.ini b/tox.ini
index 61a6aed..417c7aa 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,10 +5,19 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py33,py34,py35,py36
+envlist = py27,py33,py34,py35,py36,coverage-report
 
 [testenv]
-commands = {envpython} setup.py test
 deps =
+    coverage
     pyasn1
     pyasn1_modules
+commands = {envpython} -m coverage run --parallel setup.py test
+
+[testenv:coverage-report]
+deps = coverage
+skip_install = true
+commands =
+    {envpython} -m coverage combine
+    {envpython} -m coverage report --show-missing
+    {envpython} -m coverage html

From cc64929507e5ce9a95b67fbd6c2e826d7f5d124f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 24 Nov 2017 18:37:36 +0100
Subject: [PATCH 578/868] Remove unused LDAPberval helper functions

LDAPberval_from_object(), LDAPberval_from_object_check(), and
LDAPberval_release() were introduced in 20bee65a but never used.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/berval.c | 67 ------------------------------------------------
 Modules/berval.h |  3 ---
 2 files changed, 70 deletions(-)

diff --git a/Modules/berval.c b/Modules/berval.c
index 73d7f9b..7435ee0 100644
--- a/Modules/berval.c
+++ b/Modules/berval.c
@@ -3,73 +3,6 @@
 #include "common.h"
 #include "berval.h"
 
-/*
- * Converts a Python object into a data for a berval structure.
- *
- * New memory is allocated, and the content of the object is copied into it.
- * Then the (pre-existing) berval structure's field are filled in with pointer
- * and length data.
- *
- * The source object must implement the buffer interface, or be None.
- * If the source object is None, bv->bv_val will be set to NULL and bv_len to 0.
- * Otherwise, bv->bv_val will be non-NULL (even for zero-length data).
- * This allows the caller to distinguish a None argument as something special.
- *
- * Returns 0 on failure, leaving *bv unchanged, and setting an error.
- * Returns 1 on success: the berval must be freed with LDAPberval_release().
- */
-int
-LDAPberval_from_object(PyObject *obj, struct berval *bv)
-{
-    const void *data;
-    char *datacp;
-    Py_ssize_t len;
-
-    if (PyNone_Check(obj)) {
-        bv->bv_len = 0;
-        bv->bv_val = NULL;
-        return 1;
-    }
-
-    if (!PyObject_AsReadBuffer(obj, &data, &len))
-        return 0;
-
-    datacp = PyMem_MALLOC(len ? len : 1);
-    if (!datacp) {
-        PyErr_NoMemory();
-        return 0;
-    }
-    memcpy(datacp, data, len);
-
-    bv->bv_len = len;
-    bv->bv_val = datacp;
-    return 1;
-}
-
-/*
- * Returns true if the object could be used to initialize a berval structure
- * with LDAPberval_from_object()
- */
-int
-LDAPberval_from_object_check(PyObject *obj)
-{
-    return PyNone_Check(obj) ||
-           PyObject_CheckReadBuffer(obj);
-}
-
-/*
- * Releases memory allocated by LDAPberval_from_object().
- * Has no effect if the berval pointer is NULL or the berval data is NULL.
- */
-void
-LDAPberval_release(struct berval *bv) {
-    if (bv && bv->bv_val) {
-        PyMem_FREE(bv->bv_val);
-        bv->bv_len = 0;
-        bv->bv_val = NULL;
-    }
-}
-
 /*
  * Copies out the data from a berval, and returns it as a new Python object,
  * Returns None if the berval pointer is NULL.
diff --git a/Modules/berval.h b/Modules/berval.h
index 2489e45..9702b8c 100644
--- a/Modules/berval.h
+++ b/Modules/berval.h
@@ -6,9 +6,6 @@
 #include "common.h"
 #include "lber.h"
 
-int  LDAPberval_from_object(PyObject *obj, struct berval *bv);
-int  LDAPberval_from_object_check(PyObject *obj);
-void LDAPberval_release(struct berval *bv);
 PyObject *LDAPberval_to_object(const struct berval *bv);
 PyObject *LDAPberval_to_unicode_object(const struct berval *bv);
 

From dab4f67d71ad8a11f6043fa47dc52faaf3639d19 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 18:42:16 +0100
Subject: [PATCH 579/868] Lib: Use absolute import for ldap.pkginfo

---
 Lib/ldap/__init__.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index dab97a6..b22a6f4 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -6,7 +6,7 @@
 
 # This is also the overall release version number
 
-from pkginfo import __version__, __author__, __license__
+from ldap.pkginfo import __version__, __author__, __license__
 
 import sys
 
@@ -17,8 +17,6 @@
   _trace_file = sys.stderr
   _trace_stack_limit = None
 
-from ldap.pkginfo import __version__
-
 import _ldap
 assert _ldap.__version__==__version__, \
        ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))

From c3876a07f9b6f0238c945dee8911904444a18177 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 23 Nov 2017 12:23:35 +0100
Subject: [PATCH 580/868] Check for LDAP schema and slapd binaries

Integration tests depend on openldap client and server binaries. Fail
with a human readable message in case a tool or schema is missing.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest.py | 14 +++++++++++++-
 Tests/t_bind.py  | 25 ++++++++++++-------------
 2 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index fcd36e1..4955420 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -115,7 +115,7 @@ class SlapdObject(object):
     elif os.path.isdir("/etc/ldap/schema"):
         SCHEMADIR = "/etc/ldap/schema"
     else:
-        PATH_SCHEMA_CORE = None
+        SCHEMADIR = None
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
     PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
@@ -138,6 +138,17 @@ def __init__(self):
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
 
+    def _check_requirements(self):
+        binaries = [
+            self.PATH_LDAPADD, self.PATH_LDAPMODIFY, self.PATH_LDAPWHOAMI,
+            self.PATH_SLAPD, self.PATH_SLAPTEST
+        ]
+        for binary in binaries:
+            if not os.path.isfile(binary):
+                raise ValueError('Binary {} is missing.'.format(binary))
+        if self.SCHEMADIR is None:
+            raise ValueError('SCHEMADIR is None, ldap schemas are missing.')
+
     def setup_rundir(self):
         """
         creates rundir structure
@@ -283,6 +294,7 @@ def start(self):
         """
 
         if self._proc is None:
+            self._check_requirements()
             # prepare directory structure
             atexit.register(self.stop)
             self._cleanup_rundir()
diff --git a/Tests/t_bind.py b/Tests/t_bind.py
index 373688b..290deb6 100644
--- a/Tests/t_bind.py
+++ b/Tests/t_bind.py
@@ -13,23 +13,22 @@
 from slapdtest import SlapdObject
 from ldap.ldapobject import LDAPObject
 
-server = None
-
-
 class TestBinds(unittest.TestCase):
 
-    def setUp(self):
-        global server
-        if server is None:
-            server = SlapdObject()
-            server.start()
+    @classmethod
+    def setUpClass(cls):
+        cls.server = SlapdObject()
+        cls.server.start()
+
+        cls.unicode_val = "abc\U0001f498def"
+        cls.unicode_val_bytes = cls.unicode_val.encode('utf-8')
 
-        self.server = server
-        self.unicode_val = "abc\U0001f498def"
-        self.unicode_val_bytes = self.unicode_val.encode('utf-8')
+        cls.dn_unicode = "CN=" + cls.unicode_val
+        cls.dn_bytes = cls.dn_unicode.encode('utf-8')
 
-        self.dn_unicode = "CN=" + self.unicode_val
-        self.dn_bytes = self.dn_unicode.encode('utf-8')
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.stop()
 
     def _get_ldapobject(self, bytes_mode=None):
         l = LDAPObject(self.server.ldap_uri, bytes_mode=bytes_mode)

From df3b25422a2b046fb4d9f995fe52a075015ad395 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=81=A3=20Florian=20Best?=
 <spaceone@users.noreply.github.com>
Date: Sat, 25 Nov 2017 13:24:49 +0100
Subject: [PATCH 581/868] Doc: return value of {modify,add,delete}_ext_s() is a
 4-tuple

https://github.com/python-ldap/python-ldap/pull/13
---
 Doc/ldap.rst           | 6 +++---
 Lib/ldap/ldapobject.py | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Doc/ldap.rst b/Doc/ldap.rst
index 5160f30..d526370 100644
--- a/Doc/ldap.rst
+++ b/Doc/ldap.rst
@@ -647,7 +647,7 @@ and wait for and return with the server's result, or with
 
 .. py:method:: LDAPObject.add_ext(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> int
 
-.. py:method:: LDAPObject.add_ext_s(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> None
+.. py:method:: LDAPObject.add_ext_s(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> tuple
 
    Performs an LDAP add operation. The *dn* argument is the distinguished
    name (DN) of the entry to add, and *modlist* is a list of attributes to be
@@ -713,7 +713,7 @@ and wait for and return with the server's result, or with
 
 .. py:method:: LDAPObject.delete_ext(dn [, serverctrls=None [, clientctrls=None]]) -> int
 
-.. py:method:: LDAPObject.delete_ext_s(dn [, serverctrls=None [, clientctrls=None]]) -> None
+.. py:method:: LDAPObject.delete_ext_s(dn [, serverctrls=None [, clientctrls=None]]) -> tuple
 
    Performs an LDAP delete operation on *dn*. The asynchronous form
    returns the message id of the initiated request, and the result can be obtained
@@ -751,7 +751,7 @@ and wait for and return with the server's result, or with
 
 .. py:method:: LDAPObject.modify_ext(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> int
 
-.. py:method:: LDAPObject.modify_ext_s(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> None
+.. py:method:: LDAPObject.modify_ext_s(dn, modlist [, serverctrls=None [, clientctrls=None]]) -> tuple
 
    Performs an LDAP modify operation on an entry's attributes.
    The *dn* argument is the distinguished name (DN) of the entry to modify,
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 01f0044..36f98cf 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -502,7 +502,7 @@ def delete_ext(self,dn,serverctrls=None,clientctrls=None):
     delete(dn) -> int
     delete_s(dn) -> None
     delete_ext(dn[,serverctrls=None[,clientctrls=None]]) -> int
-    delete_ext_s(dn[,serverctrls=None[,clientctrls=None]]) -> None
+    delete_ext_s(dn[,serverctrls=None[,clientctrls=None]]) -> tuple
         Performs an LDAP delete operation on dn. The asynchronous
         form returns the message id of the initiated request, and the
         result can be obtained from a subsequent call to result().
@@ -570,7 +570,7 @@ def modify(self,dn,modlist):
     modify(dn, modlist) -> int
     modify_s(dn, modlist) -> None
     modify_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
-    modify_ext_s(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> None
+    modify_ext_s(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> tuple
         Performs an LDAP modify operation on an entry's attributes.
         dn is the DN of the entry to modify, and modlist is the list
         of modifications to make to the entry.

From a6dfb2a63d435d5485f8c2b66f338ca4183cc192 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 15:07:46 +0100
Subject: [PATCH 582/868] Infra: Fix formatting and Unicode in README

---
 README | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README b/README
index 431559d..b788be3 100644
--- a/README
+++ b/README
@@ -101,6 +101,7 @@ These very kind people have supplied patches or suggested changes:
 * Matej Vela <vela at debian.org>
 
 These people contributed to Python 3 porting (at https://github.com/pyldap/):
+
 * A. Karl Kornel <akkornel at stanford.edu>
 * Alex Willmer <alex at moreati.org.uk>
 * Aymeric Augustin <aymeric.augustin at oscaro.com>
@@ -109,7 +110,7 @@ These people contributed to Python 3 porting (at https://github.com/pyldap/):
 * Dirk Mueller <dirk at dmllr.de>
 * Jon Dufresne <jon.dufresne at gmail.com>
 * Martin Basti <mbasti at redhat.com>
-* Miro Hroncok <miro at hroncok.cz>
+* Miro Hrončok <miro at hroncok.cz>
 * Paul Aurich <paul at darkrain42.org>
 * Petr Viktorin <pviktori at redhat.com>
 * Pieterjan De Potter <pieterjan.depotter at ugent.be>

From 2f3cad321b8b98ca444756ccae611ae8a08dc482 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 15:08:35 +0100
Subject: [PATCH 583/868] Infra: Remove e-mails of pyldap contributors from
 README
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mails are stil lavailable in the linked Git repository.
Getting to them takes some effort, but that's a good thing – it should
deter spam harvesters.
---
 README | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/README b/README
index b788be3..1dd06ef 100644
--- a/README
+++ b/README
@@ -102,25 +102,25 @@ These very kind people have supplied patches or suggested changes:
 
 These people contributed to Python 3 porting (at https://github.com/pyldap/):
 
-* A. Karl Kornel <akkornel at stanford.edu>
-* Alex Willmer <alex at moreati.org.uk>
-* Aymeric Augustin <aymeric.augustin at oscaro.com>
-* Bradley Baetz <bbaetz at google.com>
-* Christian Heimes <cheimes at redhat.com>
-* Dirk Mueller <dirk at dmllr.de>
-* Jon Dufresne <jon.dufresne at gmail.com>
-* Martin Basti <mbasti at redhat.com>
-* Miro Hrončok <miro at hroncok.cz>
-* Paul Aurich <paul at darkrain42.org>
-* Petr Viktorin <pviktori at redhat.com>
-* Pieterjan De Potter <pieterjan.depotter at ugent.be>
-* Raphaël Barrois <raphael.barrois at polyconseil.fr>
-* Robert Kuska <rkuska at redhat.com>
-* Stanislav Láznička <stlaz at users.noreply.github.com>
-* Tobias Bräutigam <tobias.braeutigam at gonicus.de>
-* Tom van Dijk <t.vandijk at utwente.nl>
-* Wentao Han <wentao.han at gmail.com>
-* William Brown <firstyear at redhat.com>
+* A. Karl Kornel
+* Alex Willmer
+* Aymeric Augustin
+* Bradley Baetz
+* Christian Heimes
+* Dirk Mueller
+* Jon Dufresne
+* Martin Basti
+* Miro Hrončok
+* Paul Aurich
+* Petr Viktorin
+* Pieterjan De Potter
+* Raphaël Barrois
+* Robert Kuska
+* Stanislav Láznička
+* Tobias Bräutigam
+* Tom van Dijk
+* Wentao Han
+* William Brown
 
 Thanks to all the guys on the python-ldap mailing list for
 their contributions and input into this package.

From e88431b2eab99351264ce933de86cc71e6769721 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 15:13:27 +0100
Subject: [PATCH 584/868] Infra: Escape contributor name using zero-width space

The initial "A." makes ReStructured Text think it's a beginning of
an ordered list, with headings A., B., C., etc.
The result looks bad and is semantically wrong.

The standard way to escape is using a backslash, "A\.". This looks
bad when viewing the source.

Another way is to use a zero-width space. This is invisible when
rendered and in some editors, but more paranoid text-oriented tools
render it as "<U+200B>A." (less) or "<200b>A." (vim).
But, it's outside the name, which makes it a better solution than "A\."
---
 README | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README b/README
index 1dd06ef..2a88bf2 100644
--- a/README
+++ b/README
@@ -102,7 +102,7 @@ These very kind people have supplied patches or suggested changes:
 
 These people contributed to Python 3 porting (at https://github.com/pyldap/):
 
-* A. Karl Kornel
+* ​A. Karl Kornel
 * Alex Willmer
 * Aymeric Augustin
 * Bradley Baetz

From 52077e82e240ca0822994703809d6f0e6a750dae Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Sat, 25 Nov 2017 16:00:17 +0100
Subject: [PATCH 585/868] Fix type conversion in page control

The RFC 2696 function decode_page_control() had a conversion error.
`count` is an unsigned long. The correct format character for
Py_BuildValue() is 'k', not 'l'. The problem caused the function to to return
wrong value every now and then. I have seen 140728898420741 or
140728898420741 instead of 5.

In Python 3, SimplePagedResultsControl converted cookie to text although
it's an OCTET STRING. The cookie is now correctly converted to bytes.

Add tests for all four uncovered helper functions.

https://github.com/python-ldap/python-ldap/pull/10
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/controls/pagedresults.py |  2 +-
 Modules/ldapcontrol.c             |  4 +--
 Tests/__init__.py                 |  1 +
 Tests/t_ldap_controls_libldap.py  | 54 +++++++++++++++++++++++++++++++
 Tests/t_untested_mods.py          |  1 -
 5 files changed, 58 insertions(+), 4 deletions(-)
 create mode 100644 Tests/t_ldap_controls_libldap.py

diff --git a/Lib/ldap/controls/pagedresults.py b/Lib/ldap/controls/pagedresults.py
index fcdff36..efdd040 100644
--- a/Lib/ldap/controls/pagedresults.py
+++ b/Lib/ldap/controls/pagedresults.py
@@ -44,7 +44,7 @@ def encodeControlValue(self):
   def decodeControlValue(self,encodedControlValue):
     decodedValue,_ = decoder.decode(encodedControlValue,asn1Spec=PagedResultsControlValue())
     self.size = int(decodedValue.getComponentByName('size'))
-    self.cookie = str(decodedValue.getComponentByName('cookie'))
+    self.cookie = bytes(decodedValue.getComponentByName('cookie'))
 
 
 KNOWN_RESPONSE_CONTROLS[SimplePagedResultsControl.controlType] = SimplePagedResultsControl
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index f3dc92a..6ff27c5 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -304,7 +304,7 @@ decode_rfc2696(PyObject *self, PyObject *args)
     struct berval ldctl_value;
     ber_tag_t tag;
     struct berval *cookiep;
-    unsigned long count;
+    unsigned long count = 0;
     Py_ssize_t ldctl_value_len;
 
     if (!PyArg_ParseTuple(args, "s#:decode_page_control",
@@ -324,7 +324,7 @@ decode_rfc2696(PyObject *self, PyObject *args)
         goto endlbl;
     }
 
-    res = Py_BuildValue("(lO&)", count, LDAPberval_to_object, cookiep);
+    res = Py_BuildValue("(kO&)", count, LDAPberval_to_object, cookiep);
     ber_bvfree(cookiep);
 
  endlbl:
diff --git a/Tests/__init__.py b/Tests/__init__.py
index 9f54f87..8ceb63b 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -21,3 +21,4 @@
 from . import t_edit
 from . import t_ldap_schema_subentry
 from . import t_untested_mods
+from . import t_ldap_controls_libldap
diff --git a/Tests/t_ldap_controls_libldap.py b/Tests/t_ldap_controls_libldap.py
new file mode 100644
index 0000000..229935e
--- /dev/null
+++ b/Tests/t_ldap_controls_libldap.py
@@ -0,0 +1,54 @@
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
+from ldap.controls import pagedresults
+from ldap.controls import libldap
+
+
+PRC_BER = b'0\x0b\x02\x01\x05\x04\x06cookie'
+SIZE = 5
+COOKIE = b'cookie'
+
+
+class TestLibldapControls(unittest.TestCase):
+    def test_pagedresults_encode(self):
+        pr = pagedresults.SimplePagedResultsControl(
+            size=SIZE, cookie=COOKIE
+        )
+        lib = libldap.SimplePagedResultsControl(
+            size=SIZE, cookie=COOKIE
+        )
+        self.assertEqual(pr.encodeControlValue(), lib.encodeControlValue())
+        self.assertEqual(pr.encodeControlValue(), PRC_BER)
+
+    def test_pagedresults_decode(self):
+        pr = pagedresults.SimplePagedResultsControl()
+        pr.decodeControlValue(PRC_BER)
+        self.assertEqual(pr.size, SIZE)
+        # LDAPString (OCTET STRING)
+        self.assertIsInstance(pr.cookie, bytes)
+        self.assertEqual(pr.cookie, COOKIE)
+
+        lib = libldap.SimplePagedResultsControl()
+        lib.decodeControlValue(PRC_BER)
+        self.assertEqual(lib.size, SIZE)
+        self.assertIsInstance(lib.cookie, bytes)
+        self.assertEqual(lib.cookie, COOKIE)
+
+    def test_matchedvalues(self):
+        mvc = libldap.MatchedValuesControl()
+        # unverified
+        self.assertEqual(mvc.encodeControlValue(), b'0\r\x87\x0bobjectClass')
+
+    def test_assertioncontrol(self):
+        ac = libldap.AssertionControl()
+        # unverified
+        self.assertEqual(ac.encodeControlValue(), b'\x87\x0bobjectClass')
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/Tests/t_untested_mods.py b/Tests/t_untested_mods.py
index 6221f24..7595a78 100644
--- a/Tests/t_untested_mods.py
+++ b/Tests/t_untested_mods.py
@@ -2,7 +2,6 @@
 import ldap.async
 import ldap.controls.deref
 import ldap.controls.openldap
-import ldap.controls.pagedresults
 import ldap.controls.ppolicy
 import ldap.controls.psearch
 import ldap.controls.pwdpolicy

From b91e5d237830d99a7b89f9f29084ba62cd853a49 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Sat, 25 Nov 2017 16:15:38 +0100
Subject: [PATCH 586/868] Add GCOV / LCOV C coverage support

https://github.com/python-ldap/python-ldap/pull/7
---
 .travis.yml |  5 +++++
 Makefile    | 30 ++++++++++++++++++++++++++++++
 setup.py    | 10 +++++++++-
 tox.ini     |  1 +
 4 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 48f09be..14c0965 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,6 +18,9 @@ addons:
       - ldap-utils
       - slapd
 
+env:
+  - WITH_GCOV=1
+
 install:
   - pip install "pip>=7.1.0"
   - pip install tox-travis tox codecov coverage
@@ -25,5 +28,7 @@ install:
 script: tox
 
 after_success:
+  # gather Python coverage
   - python -m coverage combine
+  # send Python and GCOV coverage
   - codecov
diff --git a/Makefile b/Makefile
index 56aaa8c..13d4b8b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,8 @@
+LCOV_INFO=build/lcov.info
+LCOV_REPORT=build/lcov_report
+LCOV_REPORT_OPTIONS=--show-details -no-branch-coverage \
+	--title "python-ldap LCOV report"
+
 .NOTPARALLEL:
 
 .PHONY: all
@@ -9,3 +14,28 @@ clean:
 	rm -f .coverage .coverage.*
 	find . -name '*.py[co]' -or -name '*.so*' -or -name '*.dylib' -delete
 	find . -depth -name __pycache__ -exec rm -rf {} \;
+
+# LCOV report (measuring test coverage for C code)
+.PHONY: lcov-clean lcov-coverage lcov-report lcov-open lcov
+lcov-clean:
+	rm -rf $(LCOV_INFO) $(LCOV_REPORT)
+	find build -name '*.gc??' -delete
+
+lcov-coverage:
+	WITH_GCOV=1 tox -e py27,py36
+
+$(LCOV_INFO):
+	lcov --capture --directory build --output-file $(LCOV_INFO)
+
+$(LCOV_REPORT): $(LCOV_INFO)
+	genhtml --output-directory $(LCOV_REPORT) \
+		$(LCOV_REPORT_OPTIONS) $(LCOV_INFO)
+
+lcov-report: $(LCOV_REPORT)
+
+lcov-open: $(LCOV_REPORT)
+	xdg-open $(LCOV_REPORT)/index.html
+
+lcov: lcov-clean
+	$(MAKE) lcov-coverage
+	$(MAKE) lcov-report
diff --git a/setup.py b/setup.py
index 89351b5..f210c16 100644
--- a/setup.py
+++ b/setup.py
@@ -34,7 +34,7 @@ class OpenLDAP2:
   extra_link_args = []
   extra_objects = []
   libs = ['ldap', 'lber']
-  defines = [ ]
+  defines = []
   extra_files = []
 
 LDAP_CLASS = OpenLDAP2
@@ -55,6 +55,14 @@ class OpenLDAP2:
   origfileslist = origfiles.split(',')
   LDAP_CLASS.extra_files[i]=(destdir, origfileslist)
 
+if os.environ.get('WITH_GCOV'):
+  # Insrumentation for measuring code coverage
+  LDAP_CLASS.extra_compile_args.extend(
+    ['-O0', '-pg', '-fprofile-arcs', '-ftest-coverage']
+  )
+  LDAP_CLASS.extra_link_args.append('-pg')
+  LDAP_CLASS.libs.append('gcov')
+
 #-- Let distutils/setuptools do the rest
 name = 'python-ldap'
 
diff --git a/tox.ini b/tox.ini
index 417c7aa..84002a4 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,6 +13,7 @@ deps =
     pyasn1
     pyasn1_modules
 commands = {envpython} -m coverage run --parallel setup.py test
+passenv = WITH_GCOV
 
 [testenv:coverage-report]
 deps = coverage

From 5d158578ce5a01f159378294ae7a88af66d4a05b Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Sat, 25 Nov 2017 16:22:33 +0100
Subject: [PATCH 587/868] Move install_requires into setup.py

pip install python-ldap will now automatically install requirements and
ensure correct versions. requirements.txt is no longer needed.

https://github.com/python-ldap/python-ldap/pull/3
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 requirements.txt | 3 ---
 setup.py         | 6 +++++-
 tox.ini          | 5 +----
 3 files changed, 6 insertions(+), 8 deletions(-)
 delete mode 100644 requirements.txt

diff --git a/requirements.txt b/requirements.txt
deleted file mode 100644
index 465a037..0000000
--- a/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-pyasn1>=0.3.7
-pyasn1_modules>=0.1.5
-
diff --git a/setup.py b/setup.py
index f210c16..b7303e9 100644
--- a/setup.py
+++ b/setup.py
@@ -75,7 +75,11 @@ class OpenLDAP2:
 if has_setuptools:
   kwargs = dict(
     include_package_data = True,
-    install_requires = ['setuptools'],
+    install_requires = [
+        'setuptools',
+        'pyasn1 >= 0.3.7',
+        'pyasn1_modules >= 0.1.5',
+    ],
     zip_safe = False,
     python_requires = '>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
   )
diff --git a/tox.ini b/tox.ini
index 84002a4..b2d435c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,10 +8,7 @@
 envlist = py27,py33,py34,py35,py36,coverage-report
 
 [testenv]
-deps =
-    coverage
-    pyasn1
-    pyasn1_modules
+deps = coverage
 commands = {envpython} -m coverage run --parallel setup.py test
 passenv = WITH_GCOV
 

From c97e7bf5ea7ff76ce261e7cb2c39572b844a9394 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 25 Nov 2017 16:36:32 +0100
Subject: [PATCH 588/868] Fix typo in setup.py

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index b7303e9..e47d215 100644
--- a/setup.py
+++ b/setup.py
@@ -56,7 +56,7 @@ class OpenLDAP2:
   LDAP_CLASS.extra_files[i]=(destdir, origfileslist)
 
 if os.environ.get('WITH_GCOV'):
-  # Insrumentation for measuring code coverage
+  # Instrumentation for measuring code coverage
   LDAP_CLASS.extra_compile_args.extend(
     ['-O0', '-pg', '-fprofile-arcs', '-ftest-coverage']
   )

From 55cf81ed741b9e5e5b198bf9102fecac19e958a6 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 25 Nov 2017 16:36:48 +0100
Subject: [PATCH 589/868] Remove distclean.sh -- use make clean instead

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 distclean.sh | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100755 distclean.sh

diff --git a/distclean.sh b/distclean.sh
deleted file mode 100755
index 2585116..0000000
--- a/distclean.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/sh
-
-python setup.py clean
-rm -r MANIFEST dist/* build/* Lib/*.egg-info .tox 
-rm Lib/_ldap.so Lib/*.py? Lib/ldap/*.py? Lib/ldap/*/*.py? Tests/*.py? *.py?

From 0079025e71bd13f92fb39965ee705120c02d2ff3 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 25 Nov 2017 16:37:11 +0100
Subject: [PATCH 590/868] Include .coveragerc in sdist

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 MANIFEST.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MANIFEST.in b/MANIFEST.in
index 4f56647..469ebdf 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,7 +1,7 @@
 include MANIFEST.in Makefile CHANGES INSTALL LICENCE README TODO PKG-INFO
+include tox.ini .coveragerc
 include Modules/*.c Modules/*.h Modules/LICENSE
 recursive-include Build *.cfg*
 recursive-include Lib *.py
 recursive-include Demo *.py
-include tox.ini
 recursive-include Tests *.py *.ldif

From e78aeb79f711612886d90da8ff176f0e43a62e09 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 25 Nov 2017 16:37:36 +0100
Subject: [PATCH 591/868] Fix make lcoc when build dir is missing

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 13d4b8b..30f98d5 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,7 @@ clean:
 .PHONY: lcov-clean lcov-coverage lcov-report lcov-open lcov
 lcov-clean:
 	rm -rf $(LCOV_INFO) $(LCOV_REPORT)
-	find build -name '*.gc??' -delete
+	if [ -d build ]; then find build -name '*.gc??' -delete; fi
 
 lcov-coverage:
 	WITH_GCOV=1 tox -e py27,py36

From 2f3d9b770632ffab58d7564dffa22eb8b671826a Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 25 Nov 2017 16:37:57 +0100
Subject: [PATCH 592/868] Remove obsolete .cvsignore files

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .cvsignore                     | 10 ----------
 Demo/.cvsignore                |  5 -----
 Demo/Lib/.cvsignore            |  5 -----
 Demo/Lib/ldap/.cvsignore       |  5 -----
 Demo/Lib/ldap/async/.cvsignore |  5 -----
 Demo/Lib/ldapurl/.cvsignore    |  5 -----
 Demo/Lib/ldif/.cvsignore       |  5 -----
 Doc/.cvsignore                 |  5 -----
 Lib/.cvsignore                 |  5 -----
 Lib/ldap/.cvsignore            |  5 -----
 Lib/ldap/controls/.cvsignore   |  5 -----
 Lib/ldap/extop/.cvsignore      |  5 -----
 Lib/ldap/schema/.cvsignore     |  5 -----
 Modules/.cvsignore             |  2 --
 Tests/.cvsignore               |  5 -----
 15 files changed, 77 deletions(-)
 delete mode 100644 .cvsignore
 delete mode 100644 Demo/.cvsignore
 delete mode 100644 Demo/Lib/.cvsignore
 delete mode 100644 Demo/Lib/ldap/.cvsignore
 delete mode 100644 Demo/Lib/ldap/async/.cvsignore
 delete mode 100644 Demo/Lib/ldapurl/.cvsignore
 delete mode 100644 Demo/Lib/ldif/.cvsignore
 delete mode 100644 Doc/.cvsignore
 delete mode 100644 Lib/.cvsignore
 delete mode 100644 Lib/ldap/.cvsignore
 delete mode 100644 Lib/ldap/controls/.cvsignore
 delete mode 100644 Lib/ldap/extop/.cvsignore
 delete mode 100644 Lib/ldap/schema/.cvsignore
 delete mode 100644 Modules/.cvsignore
 delete mode 100644 Tests/.cvsignore

diff --git a/.cvsignore b/.cvsignore
deleted file mode 100644
index 03123b5..0000000
--- a/.cvsignore
+++ /dev/null
@@ -1,10 +0,0 @@
-build
-dist
-python-ldap-test
-MANIFEST
-.tox
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Demo/.cvsignore b/Demo/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Demo/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Demo/Lib/.cvsignore b/Demo/Lib/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Demo/Lib/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Demo/Lib/ldap/.cvsignore b/Demo/Lib/ldap/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Demo/Lib/ldap/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Demo/Lib/ldap/async/.cvsignore b/Demo/Lib/ldap/async/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Demo/Lib/ldap/async/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Demo/Lib/ldapurl/.cvsignore b/Demo/Lib/ldapurl/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Demo/Lib/ldapurl/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Demo/Lib/ldif/.cvsignore b/Demo/Lib/ldif/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Demo/Lib/ldif/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Doc/.cvsignore b/Doc/.cvsignore
deleted file mode 100644
index 3b5c5ee..0000000
--- a/Doc/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-.build
-python-ldap.pdf
-python-ldap.ps
-*.bck
-*~
diff --git a/Lib/.cvsignore b/Lib/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Lib/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Lib/ldap/.cvsignore b/Lib/ldap/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Lib/ldap/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Lib/ldap/controls/.cvsignore b/Lib/ldap/controls/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Lib/ldap/controls/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Lib/ldap/extop/.cvsignore b/Lib/ldap/extop/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Lib/ldap/extop/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Lib/ldap/schema/.cvsignore b/Lib/ldap/schema/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Lib/ldap/schema/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info
diff --git a/Modules/.cvsignore b/Modules/.cvsignore
deleted file mode 100644
index 244b105..0000000
--- a/Modules/.cvsignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*.bck
-*~
diff --git a/Tests/.cvsignore b/Tests/.cvsignore
deleted file mode 100644
index e1d0aec..0000000
--- a/Tests/.cvsignore
+++ /dev/null
@@ -1,5 +0,0 @@
-*.pyc
-*.pyo
-*.bck
-*~
-*.egg-info

From d2b7faff9701c0877415c5e72b6d948eb987f3ce Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 25 Nov 2017 16:41:55 +0100
Subject: [PATCH 593/868] Remove MANIFEST with make clean

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 30f98d5..770620a 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ all:
 
 .PHONY: clean
 clean:
-	rm -rf build dist *.egg-info $(VENV) .tox
+	rm -rf build dist *.egg-info $(VENV) .tox MANIFEST
 	rm -f .coverage .coverage.*
 	find . -name '*.py[co]' -or -name '*.so*' -or -name '*.dylib' -delete
 	find . -depth -name __pycache__ -exec rm -rf {} \;

From 875ef440682cb3e5ccc6cc9513a4bf2f1d9b72b4 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 27 Nov 2017 14:40:47 +0100
Subject: [PATCH 594/868] Fix syntax of find -delete

With -delete, the matches must be grouped. Otherwise -delete is only
executed for the last matcher.

https://github.com/python-ldap/python-ldap/pull/27
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 770620a..47fac90 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,8 @@ all:
 clean:
 	rm -rf build dist *.egg-info $(VENV) .tox MANIFEST
 	rm -f .coverage .coverage.*
-	find . -name '*.py[co]' -or -name '*.so*' -or -name '*.dylib' -delete
+	find . \( -name '*.py[co]' -or -name '*.so*' -or -name '*.dylib' \) \
+	    -delete
 	find . -depth -name __pycache__ -exec rm -rf {} \;
 
 # LCOV report (measuring test coverage for C code)

From 4aa0d36a12a7275d4d9a28e1b3894c768789ce7c Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 27 Nov 2017 14:49:29 +0100
Subject: [PATCH 595/868] Use `package` to distribute ldap sub-package

Instead of listing all Python files, use distutils' and setuptools'
`package` direcective to ship the ldap. ldap.controls, ldap.extop, and
ldap.schema packages. The modules ldapurl, ldif, and slaptest are not
packages and therefore still use `py_module`.

The `ldap.controls.pagedresults` module is now shipped and installed.

https://github.com/python-ldap/python-ldap/pull/29
Closes: #26
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 setup.py | 32 +++-----------------------------
 1 file changed, 3 insertions(+), 29 deletions(-)

diff --git a/setup.py b/setup.py
index e47d215..2ac63ec 100644
--- a/setup.py
+++ b/setup.py
@@ -165,39 +165,13 @@ class OpenLDAP2:
   py_modules = [
     'ldapurl',
     'ldif',
-    'ldap',
     'slapdtest',
-    'ldap.async',
-    'ldap.compat',
+  ],
+  packages = [
+    'ldap',
     'ldap.controls',
-    'ldap.controls.deref',
-    'ldap.controls.libldap',
-    'ldap.controls.openldap',
-    'ldap.controls.ppolicy',
-    'ldap.controls.psearch',
-    'ldap.controls.pwdpolicy',
-    'ldap.controls.readentry',
-    'ldap.controls.sessiontrack',
-    'ldap.controls.simple',
-    'ldap.controls.sss',
-    'ldap.controls.vlv',
-    'ldap.cidict',
-    'ldap.dn',
     'ldap.extop',
-    'ldap.extop.dds',
-    'ldap.filter',
-    'ldap.functions',
-    'ldap.ldapobject',
-    'ldap.logger',
-    'ldap.modlist',
-    'ldap.pkginfo',
-    'ldap.resiter',
-    'ldap.sasl',
     'ldap.schema',
-    'ldap.schema.models',
-    'ldap.schema.subentry',
-    'ldap.schema.tokenizer',
-    'ldap.syncrepl',
   ],
   package_dir = {'': 'Lib',},
   data_files = LDAP_CLASS.extra_files,

From a72aaace0c4bd1085d23bb740fbc1183c7a16aba Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 27 Nov 2017 12:14:04 +0100
Subject: [PATCH 596/868] Fix multiple ref leaks when raising TypeError

Multiple functions had a reference leak while raising a TypeError with
Py_BuildValue(). The CAPI function Py_BuildValue() returns a new
reference. PyErr_SetObject() does NOT consume the reference. Instead it
increments the reference count of the object again.

A new function LDAPerror_TypeError() handles raising TypeError with
custom message and object.

https://github.com/python-ldap/python-ldap/pull/31/files
Closes: #24
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c  | 31 +++++++++++--------------------
 Modules/errors.c      | 24 ++++++++++++++++++++----
 Modules/errors.h      |  1 +
 Modules/ldapcontrol.c | 12 ++++--------
 4 files changed, 36 insertions(+), 32 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index ce0ff52..3e08473 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -113,9 +113,7 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
     Py_ssize_t i, len, nstrs;
 
     if (!PyTuple_Check(tup)) {
-        PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-           "expected a tuple", tup));
-        return NULL;
+        return LDAPerror_TypeError("expected a tuple", tup);
     }
 
     if (no_op) {
@@ -167,9 +165,7 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
           if (item == NULL)
               goto error;
           if (!PyBytes_Check(item)) {
-              PyErr_SetObject( PyExc_TypeError, Py_BuildValue( "sO",
-                  "expected a byte string in the list", item));
-              Py_DECREF(item);
+              LDAPerror_TypeError("expected a byte string in the list", item);
               goto error;
           }
           lm->mod_bvalues[i]->bv_len = PyBytes_Size(item);
@@ -214,17 +210,13 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
     PyObject *item;
 
     if (!PySequence_Check(list)) {
-        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
-                        "expected list of tuples", list ));
-        return NULL;
+        return LDAPerror_TypeError("expected list of tuples", list);
     }
 
     len = PySequence_Length(list);
 
     if (len < 0) {
-        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
-                         "expected list of tuples", list ));
-        return NULL;
+        return LDAPerror_TypeError("expected list of tuples", list);
     }
 
     lms = PyMem_NEW(LDAPMod *, len + 1);
@@ -274,8 +266,8 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
     } else if (PyUnicode_Check(attrlist)) {
 #endif
         /* caught by John Benninghoff <johnb@netscape.com> */
-        PyErr_SetObject( PyExc_TypeError, Py_BuildValue("sO",
-                  "expected *list* of strings, not a string", attrlist ));
+        LDAPerror_TypeError(
+            "expected *list* of strings, not a string", attrlist);
         goto error;
     } else {
         *seq = PySequence_Fast(attrlist, "expected list of strings or None");
@@ -296,16 +288,15 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
 #if PY_MAJOR_VERSION == 2
             /* Encoded by Python to UTF-8 */
             if (!PyBytes_Check(item)) {
-#else
-            if (!PyUnicode_Check(item)) {
-#endif
-                PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-                                "expected string in list", item));
+                LDAPerror_TypeError("expected bytes in list", item);
                 goto error;
             }
-#if PY_MAJOR_VERSION == 2
             attrs[i] = PyBytes_AsString(item);
 #else
+            if (!PyUnicode_Check(item)) {
+                LDAPerror_TypeError("expected string in list", item);
+                goto error;
+            }
             attrs[i] = PyUnicode_AsUTF8(item);
 #endif
         }
diff --git a/Modules/errors.c b/Modules/errors.c
index e5cb0ee..3c4da78 100644
--- a/Modules/errors.c
+++ b/Modules/errors.c
@@ -36,11 +36,15 @@ static PyObject* errobjects[ LDAP_ERROR_MAX-LDAP_ERROR_MIN+1 ];
 PyObject*
 LDAPerr(int errnum)
 {
-  if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
+  if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX) {
     PyErr_SetNone(errobjects[errnum+LDAP_ERROR_OFFSET]);
-  else
-    PyErr_SetObject(LDAPexception_class, 
-    Py_BuildValue("{s:i}", "errnum", errnum));
+  } else {
+    PyObject *args = Py_BuildValue("{s:i}", "errnum", errnum);
+    if (args == NULL)
+      return NULL;
+    PyErr_SetObject(LDAPexception_class, args);
+    Py_DECREF(args);
+  }
   return NULL;
 }
 
@@ -123,6 +127,18 @@ LDAPerror( LDAP *l, char *msg )
   }
 }
 
+/* Raise TypeError with custom message and object */
+PyObject*
+LDAPerror_TypeError(const char *msg, PyObject *obj) {
+    PyObject *args = Py_BuildValue("sO", msg, obj);
+    if (args == NULL) {
+        return NULL;
+    }
+    PyErr_SetObject(PyExc_TypeError, args);
+    Py_DECREF(args);
+    return NULL;
+}
+
 
 /* initialisation */
 
diff --git a/Modules/errors.h b/Modules/errors.h
index 32aebff..5bd3576 100644
--- a/Modules/errors.h
+++ b/Modules/errors.h
@@ -9,6 +9,7 @@
 
 extern PyObject* LDAPexception_class;
 extern PyObject* LDAPerror( LDAP*, char*msg );
+extern PyObject* LDAPerror_TypeError(const char *, PyObject *);
 extern void LDAPinit_errors( PyObject* );
 PyObject* LDAPerr(int errnum);
 
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 6ff27c5..7e31f72 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -72,9 +72,7 @@ Tuple_to_LDAPControl( PyObject* tup )
     Py_ssize_t len;
 
     if (!PyTuple_Check(tup)) {
-	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-	   "expected a tuple", tup));
-	return NULL;
+      return LDAPerror_TypeError("expected a tuple", tup);
     }
 
     if (!PyArg_ParseTuple( tup, "sbO", &oid, &iscritical, &bytes ))
@@ -107,8 +105,7 @@ Tuple_to_LDAPControl( PyObject* tup )
         berbytes.bv_val = PyBytes_AsString(bytes);
     }
     else {
-	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-            "expected bytes", bytes));
+        LDAPerror_TypeError("expected bytes", bytes);
         LDAPControl_DEL(lc);
         return NULL;
     }
@@ -130,9 +127,8 @@ LDAPControls_from_object(PyObject* list, LDAPControl ***controls_ret)
     PyObject* item;
   
     if (!PySequence_Check(list)) {
-	PyErr_SetObject(PyExc_TypeError, Py_BuildValue("sO",
-	   "expected a list", list));
-	return 0;
+        LDAPerror_TypeError("expected a list", list);
+        return 0;
     }
 
     len = PySequence_Length(list);

From 8807e7554410fb39e44da1320a372a81f2f2acbf Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 22:10:34 +0100
Subject: [PATCH 597/868] Modules: Remove _ldap._forward and _ldap._reverse

These were created only as:
forward = {}
reverse = {0: None}

The only use was the function LDAPconstant, equivalent to:

    def LDAPconstant(i):
        return reverse.get(i, i)

It looks like these were prepared for a better future, but python-ldap
has gone for years or decades without needing to actually use them.
Remove both dictionaries and the function.
---
 Modules/LDAPObject.c |  7 ++++++-
 Modules/constants.c  | 29 +----------------------------
 2 files changed, 7 insertions(+), 29 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 3e08473..a434986 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1059,7 +1059,12 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
 
     pmsg = LDAPmessage_to_python( self->ldap, msg, add_ctrls, add_intermediates );
 
-    result_str = LDAPconstant( res_type );
+    if (res_type == 0) {
+        result_str = Py_None;
+        Py_INCREF(Py_None);
+    } else {
+        result_str = PyInt_FromLong( res_type );
+    }
 
     if (pmsg == NULL) {
             retval = NULL;
diff --git a/Modules/constants.c b/Modules/constants.c
index 7ed9e41..cd3877c 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -6,35 +6,12 @@
 #include "lber.h"
 #include "ldap.h"
 
-static PyObject* reverse;
-static PyObject* forward;
-
-/* convert an result integer into a Python string */
-
-PyObject*
-LDAPconstant( int val ) {
-    PyObject *i = PyInt_FromLong( val );
-    PyObject *s = PyObject_GetItem( reverse, i );
-    if (s == NULL) {
-      PyErr_Clear();
-  return i;
-    }
-    Py_DECREF(i);
-    return s;
-}
-
 /* initialise the module constants */
 
 void
 LDAPinit_constants( PyObject* d )
 {
-  PyObject *zero, *author,*obj;
-
-  reverse = PyDict_New();
-  forward = PyDict_New();
-  
-  PyDict_SetItemString( d, "_reverse", reverse );
-  PyDict_SetItemString( d, "_forward", forward );
+  PyObject *obj;
 
 #define add_int(d, name) \
   { \
@@ -91,10 +68,6 @@ LDAPinit_constants( PyObject* d )
 
   /* reversibles */
 
-  zero = PyInt_FromLong( 0 );
-  PyDict_SetItem( reverse, zero, Py_None );
-  Py_DECREF( zero );
-
   add_int(d,RES_BIND);
   add_int(d,RES_SEARCH_ENTRY);
   add_int(d,RES_SEARCH_RESULT);

From 48a924117b3abe53a98c70d6791488b1ebafced0 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 27 Nov 2017 16:16:35 +0100
Subject: [PATCH 598/868] Refactor: Keep information about OpenLDAP constants
 in Python, generate C

Modules/errors.{c,h} are merged into Modules/constants.{c,h}

The function LDAPerror_TypeError is moved to common.{c,h}, as it's not
concerned with LDAPError.

Add a new Python module, ldap.constants, to keep information about
all OpenLDAP constants that we know about, including those that aren't
available in the OpenLDAP used.

Generate a C header file, Modules/constants_generated.h, from this information.
(Checking generated files into Git is better avoided, but it's much
more straightforward than generating the file from setup.py.)

Use proper error checking when adding the constants.
---
 Lib/ldap/constants.py         | 402 +++++++++++++++++++++++++++++
 Modules/LDAPObject.c          |   1 -
 Modules/common.c              |  12 +
 Modules/common.h              |   2 +
 Modules/constants.c           | 470 +++++++++++-----------------------
 Modules/constants.h           |   9 +-
 Modules/constants_generated.h | 366 ++++++++++++++++++++++++++
 Modules/errors.c              | 249 ------------------
 Modules/errors.h              |  16 --
 Modules/functions.c           |   2 +-
 Modules/ldapcontrol.c         |   1 -
 Modules/ldapmodule.c          |   7 +-
 Modules/message.c             |   1 -
 Modules/options.c             |   2 +-
 setup.py                      |   1 -
 15 files changed, 950 insertions(+), 591 deletions(-)
 create mode 100644 Lib/ldap/constants.py
 create mode 100644 Modules/constants_generated.h
 delete mode 100644 Modules/errors.c
 delete mode 100644 Modules/errors.h

diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
new file mode 100644
index 0000000..6469a30
--- /dev/null
+++ b/Lib/ldap/constants.py
@@ -0,0 +1,402 @@
+"""Definitions for constants exported by OpenLDAP
+
+This file lists all constants we know about, even those that aren't
+available in the OpenLDAP version python-ldap is compiled against.
+
+The information serves two purposes:
+
+- Generate a C header with the constants
+- Provide support for building documentation without compiling python-ldap
+
+"""
+
+from __future__ import print_function
+
+class Constant(object):
+    """Base class for a definition of an OpenLDAP constant 
+    """
+
+    def __init__(self, name, optional=False, requirements=(), doc=None):
+        self.name = name
+        if optional:
+            self_requirement = 'defined(LDAP_{})'.format(self.name)
+            requirements = list(requirements) + [self_requirement]
+        self.requirements = requirements
+        self.doc = self.__doc__ = doc
+
+
+class Error(Constant):
+    """Definition for an OpenLDAP error code
+
+    This is a constant at the C level; in Python errors are provided as
+    exception classes.
+    """
+
+    c_template = 'add_err({self.name});'
+
+
+class Int(Constant):
+    """Definition for an OpenLDAP integer constant"""
+
+    c_template = 'add_int({self.name});'
+
+
+class TLSInt(Int):
+    """Definition for a TLS integer constant -- requires HAVE_TLS"""
+
+    def __init__(self, *args, **kwargs):
+        requrements = list(kwargs.get('requirements', ()))
+        kwargs['requirements'] = ['HAVE_TLS'] + requrements
+        super(TLSInt, self).__init__(*args, **kwargs)
+
+
+class Feature(Constant):
+    """Definition for a feature: 0 or 1 based on a C #ifdef
+
+    """
+
+    c_template = '\n'.join([
+        '',
+        '#ifdef {self.c_feature}',
+        'result = PyModule_AddIntConstant(m, "{self.name}", 1);',
+        '#else',
+        'result = PyModule_AddIntConstant(m, "{self.name}", 0);',
+        '#endif',
+        'check_result();',
+        '',
+    ])
+
+
+    def __init__(self, name, c_feature, **kwargs):
+        super(Feature, self).__init__(name, **kwargs)
+        self.c_feature = c_feature
+
+
+class Str(Constant):
+    c_template = 'add_string({self.name});'
+
+
+API_2004 = 'LDAP_API_VERSION >= 2004'
+
+CONSTANTS = (
+    Error('ADMINLIMIT_EXCEEDED'),
+    Error('AFFECTS_MULTIPLE_DSAS'),
+    Error('ALIAS_DEREF_PROBLEM'),
+    Error('ALIAS_PROBLEM'),
+    Error('ALREADY_EXISTS'),
+    Error('AUTH_METHOD_NOT_SUPPORTED'),
+    Error('AUTH_UNKNOWN'),
+    Error('BUSY'),
+    Error('CLIENT_LOOP'),
+    Error('COMPARE_FALSE'),
+    Error('COMPARE_TRUE'),
+    Error('CONFIDENTIALITY_REQUIRED'),
+    Error('CONNECT_ERROR'),
+    Error('CONSTRAINT_VIOLATION'),
+    Error('CONTROL_NOT_FOUND'),
+    Error('DECODING_ERROR'),
+    Error('ENCODING_ERROR'),
+    Error('FILTER_ERROR'),
+    Error('INAPPROPRIATE_AUTH'),
+    Error('INAPPROPRIATE_MATCHING'),
+    Error('INSUFFICIENT_ACCESS'),
+    Error('INVALID_CREDENTIALS'),
+    Error('INVALID_DN_SYNTAX'),
+    Error('INVALID_SYNTAX'),
+    Error('IS_LEAF'),
+    Error('LOCAL_ERROR'),
+    Error('LOOP_DETECT'),
+    Error('MORE_RESULTS_TO_RETURN'),
+    Error('NAMING_VIOLATION'),
+    Error('NO_MEMORY'),
+    Error('NO_OBJECT_CLASS_MODS'),
+    Error('NO_OBJECT_CLASS_MODS'),
+    Error('NO_RESULTS_RETURNED'),
+    Error('NO_SUCH_ATTRIBUTE'),
+    Error('NO_SUCH_OBJECT'),
+    Error('NOT_ALLOWED_ON_NONLEAF'),
+    Error('NOT_ALLOWED_ON_RDN'),
+    Error('NOT_SUPPORTED'),
+    Error('OBJECT_CLASS_VIOLATION'),
+    Error('OPERATIONS_ERROR'),
+    Error('OTHER'),
+    Error('PARAM_ERROR'),
+    Error('PARTIAL_RESULTS'),
+    Error('PROTOCOL_ERROR'),
+    Error('REFERRAL'),
+    Error('REFERRAL_LIMIT_EXCEEDED'),
+    Error('RESULTS_TOO_LARGE'),
+    Error('SASL_BIND_IN_PROGRESS'),
+    Error('SERVER_DOWN'),
+    Error('SIZELIMIT_EXCEEDED'),
+    Error('STRONG_AUTH_NOT_SUPPORTED'),
+    Error('STRONG_AUTH_REQUIRED'),
+    Error('SUCCESS'),
+    Error('TIMELIMIT_EXCEEDED'),
+    Error('TIMEOUT'),
+    Error('TYPE_OR_VALUE_EXISTS'),
+    Error('UNAVAILABLE'),
+    Error('UNAVAILABLE_CRITICAL_EXTENSION'),
+    Error('UNDEFINED_TYPE'),
+    Error('UNWILLING_TO_PERFORM'),
+    Error('USER_CANCELLED'),
+    Error('VLV_ERROR'),
+    Error('X_PROXY_AUTHZ_FAILURE'),
+
+    Error('CANCELLED', requirements=['defined(LDAP_API_FEATURE_CANCEL)']),
+    Error('NO_SUCH_OPERATION', requirements=['defined(LDAP_API_FEATURE_CANCEL)']),
+    Error('TOO_LATE', requirements=['defined(LDAP_API_FEATURE_CANCEL)']),
+    Error('CANNOT_CANCEL', requirements=['defined(LDAP_API_FEATURE_CANCEL)']),
+
+    Error('ASSERTION_FAILED', optional=True),
+
+    Error('PROXIED_AUTHORIZATION_DENIED', optional=True),
+
+    # simple constants
+
+    Int('API_VERSION'),
+    Int('VENDOR_VERSION'),
+
+    Int('PORT'),
+    Int('VERSION1'),
+    Int('VERSION2'),
+    Int('VERSION3'),
+    Int('VERSION_MIN'),
+    Int('VERSION'),
+    Int('VERSION_MAX'),
+    Int('TAG_MESSAGE'),
+    Int('TAG_MSGID'),
+
+    Int('REQ_BIND'),
+    Int('REQ_UNBIND'),
+    Int('REQ_SEARCH'),
+    Int('REQ_MODIFY'),
+    Int('REQ_ADD'),
+    Int('REQ_DELETE'),
+    Int('REQ_MODRDN'),
+    Int('REQ_COMPARE'),
+    Int('REQ_ABANDON'),
+
+    Int('TAG_LDAPDN'),
+    Int('TAG_LDAPCRED'),
+    Int('TAG_CONTROLS'),
+    Int('TAG_REFERRAL'),
+
+    Int('REQ_EXTENDED'),
+    Int('TAG_NEWSUPERIOR', requirements=[API_2004]),
+    Int('TAG_EXOP_REQ_OID', requirements=[API_2004]),
+    Int('TAG_EXOP_REQ_VALUE', requirements=[API_2004]),
+    Int('TAG_EXOP_RES_OID', requirements=[API_2004]),
+    Int('TAG_EXOP_RES_VALUE', requirements=[API_2004]),
+    Int('TAG_SASL_RES_CREDS', requirements=[API_2004, 'defined(HAVE_SASL)']),
+
+    Int('SASL_AUTOMATIC'),
+    Int('SASL_INTERACTIVE'),
+    Int('SASL_QUIET'),
+
+    # reversibles
+
+    Int('RES_BIND'),
+    Int('RES_SEARCH_ENTRY'),
+    Int('RES_SEARCH_RESULT'),
+    Int('RES_MODIFY'),
+    Int('RES_ADD'),
+    Int('RES_DELETE'),
+    Int('RES_MODRDN'),
+    Int('RES_COMPARE'),
+    Int('RES_ANY'),
+
+    Int('RES_SEARCH_REFERENCE'),
+    Int('RES_EXTENDED'),
+    Int('RES_UNSOLICITED'),
+
+    Int('RES_INTERMEDIATE'),
+
+    # non-reversibles
+
+    Int('AUTH_NONE'),
+    Int('AUTH_SIMPLE'),
+    Int('SCOPE_BASE'),
+    Int('SCOPE_ONELEVEL'),
+    Int('SCOPE_SUBTREE'),
+    Int('SCOPE_SUBORDINATE', optional=True),
+    Int('MOD_ADD'),
+    Int('MOD_DELETE'),
+    Int('MOD_REPLACE'),
+    Int('MOD_INCREMENT'),
+    Int('MOD_BVALUES'),
+
+    Int('MSG_ONE'),
+    Int('MSG_ALL'),
+    Int('MSG_RECEIVED'),
+
+    # (error constants handled above)
+
+    Int('DEREF_NEVER'),
+    Int('DEREF_SEARCHING'),
+    Int('DEREF_FINDING'),
+    Int('DEREF_ALWAYS'),
+    Int('NO_LIMIT'),
+
+    Int('OPT_API_INFO'),
+    Int('OPT_DEREF'),
+    Int('OPT_SIZELIMIT'),
+    Int('OPT_TIMELIMIT'),
+    Int('OPT_REFERRALS', optional=True),
+    Int('OPT_ERROR_NUMBER'),
+    Int('OPT_RESTART'),
+    Int('OPT_PROTOCOL_VERSION'),
+    Int('OPT_SERVER_CONTROLS'),
+    Int('OPT_CLIENT_CONTROLS'),
+    Int('OPT_API_FEATURE_INFO'),
+    Int('OPT_HOST_NAME'),
+
+    Int('OPT_DESC'),
+    Int('OPT_DIAGNOSTIC_MESSAGE'),
+
+    Int('OPT_ERROR_STRING'),
+    Int('OPT_MATCHED_DN'),
+    Int('OPT_DEBUG_LEVEL'),
+    Int('OPT_TIMEOUT'),
+    Int('OPT_REFHOPLIMIT'),
+    Int('OPT_NETWORK_TIMEOUT'),
+    Int('OPT_URI'),
+
+    Int('OPT_DEFBASE', optional=True),
+
+    TLSInt('OPT_X_TLS', optional=True),
+    TLSInt('OPT_X_TLS_CTX'),
+    TLSInt('OPT_X_TLS_CACERTFILE'),
+    TLSInt('OPT_X_TLS_CACERTDIR'),
+    TLSInt('OPT_X_TLS_CERTFILE'),
+    TLSInt('OPT_X_TLS_KEYFILE'),
+    TLSInt('OPT_X_TLS_REQUIRE_CERT'),
+    TLSInt('OPT_X_TLS_CIPHER_SUITE'),
+    TLSInt('OPT_X_TLS_RANDOM_FILE'),
+    TLSInt('OPT_X_TLS_DHFILE'),
+    TLSInt('OPT_X_TLS_NEVER'),
+    TLSInt('OPT_X_TLS_HARD'),
+    TLSInt('OPT_X_TLS_DEMAND'),
+    TLSInt('OPT_X_TLS_ALLOW'),
+    TLSInt('OPT_X_TLS_TRY'),
+    TLSInt('OPT_X_TLS_PEERCERT', optional=True),
+
+    TLSInt('OPT_X_TLS_VERSION', optional=True),
+    TLSInt('OPT_X_TLS_CIPHER', optional=True),
+    TLSInt('OPT_X_TLS_PEERCERT', optional=True),
+
+    # only available if OpenSSL supports it => might cause
+    # backward compability problems
+    TLSInt('OPT_X_TLS_CRLCHECK', optional=True),
+
+    TLSInt('OPT_X_TLS_CRLFILE', optional=True),
+
+    TLSInt('OPT_X_TLS_CRL_NONE'),
+    TLSInt('OPT_X_TLS_CRL_PEER'),
+    TLSInt('OPT_X_TLS_CRL_ALL'),
+    TLSInt('OPT_X_TLS_NEWCTX', optional=True),
+    TLSInt('OPT_X_TLS_PROTOCOL_MIN', optional=True),
+    TLSInt('OPT_X_TLS_PACKAGE', optional=True),
+
+    Int('OPT_X_SASL_MECH'),
+    Int('OPT_X_SASL_REALM'),
+    Int('OPT_X_SASL_AUTHCID'),
+    Int('OPT_X_SASL_AUTHZID'),
+    Int('OPT_X_SASL_SSF'),
+    Int('OPT_X_SASL_SSF_EXTERNAL'),
+    Int('OPT_X_SASL_SECPROPS'),
+    Int('OPT_X_SASL_SSF_MIN'),
+    Int('OPT_X_SASL_SSF_MAX'),
+    Int('OPT_X_SASL_NOCANON', optional=True),
+    Int('OPT_X_SASL_USERNAME', optional=True),
+    Int('OPT_CONNECT_ASYNC', optional=True),
+    Int('OPT_X_KEEPALIVE_IDLE', optional=True),
+    Int('OPT_X_KEEPALIVE_PROBES', optional=True),
+    Int('OPT_X_KEEPALIVE_INTERVAL', optional=True),
+
+    Int('DN_FORMAT_LDAP'),
+    Int('DN_FORMAT_LDAPV3'),
+    Int('DN_FORMAT_LDAPV2'),
+    Int('DN_FORMAT_DCE'),
+    Int('DN_FORMAT_UFN'),
+    Int('DN_FORMAT_AD_CANONICAL'),
+    # Int('DN_FORMAT_LBER'),  # for testing only
+    Int('DN_FORMAT_MASK'),
+    Int('DN_PRETTY'),
+    Int('DN_SKIP'),
+    Int('DN_P_NOLEADTRAILSPACES'),
+    Int('DN_P_NOSPACEAFTERRDN'),
+    Int('DN_PEDANTIC'),
+
+    Int('AVA_NULL'),
+    Int('AVA_STRING'),
+    Int('AVA_BINARY'),
+    Int('AVA_NONPRINTABLE'),
+
+    Int('OPT_SUCCESS'),
+
+    # XXX - these should be errors
+    Int('URL_ERR_BADSCOPE'),
+    Int('URL_ERR_MEM'),
+    # Int('LIBLDAP_R'),
+
+    Feature('LIBLDAP_R', 'HAVE_LIBLDAP_R'),
+    Feature('SASL_AVAIL', 'HAVE_SASL'),
+    Feature('TLS_AVAIL', 'HAVE_TLS'),
+
+    Str("CONTROL_MANAGEDSAIT"),
+    Str("CONTROL_PROXY_AUTHZ"),
+    Str("CONTROL_SUBENTRIES"),
+    Str("CONTROL_VALUESRETURNFILTER"),
+    Str("CONTROL_ASSERT"),
+    Str("CONTROL_PRE_READ"),
+    Str("CONTROL_POST_READ"),
+    Str("CONTROL_SORTREQUEST"),
+    Str("CONTROL_SORTRESPONSE"),
+    Str("CONTROL_PAGEDRESULTS"),
+    Str("CONTROL_SYNC"),
+    Str("CONTROL_SYNC_STATE"),
+    Str("CONTROL_SYNC_DONE"),
+    Str("SYNC_INFO"),
+    Str("CONTROL_PASSWORDPOLICYREQUEST"),
+    Str("CONTROL_PASSWORDPOLICYRESPONSE"),
+    Str("CONTROL_RELAX"),
+)
+
+
+def print_header():
+    """Print the C header file to standard output"""
+
+    print('/*')
+    print(' * Generated with:')
+    print(' *   python Lib/ldap/constants.py > Modules/constants_generated.h')
+    print(' *')
+    print(' * Please do any modifications there, then re-generate this file')
+    print(' */')
+    print('')
+
+    current_requirements = []
+
+    def pop_requirement():
+        popped = current_requirements.pop()
+        print('#endif')
+        print()
+
+    for definition in CONSTANTS:
+        while not set(current_requirements).issubset(definition.requirements):
+            pop_requirement()
+
+        for requirement in definition.requirements:
+            if requirement not in current_requirements:
+                current_requirements.append(requirement)
+                print()
+                print('#if {}'.format(requirement))
+
+        print(definition.c_template.format(self=definition))
+
+    while current_requirements:
+        pop_requirement()
+
+
+if __name__ == '__main__':
+    print_header()
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index a434986..f1ad0d4 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -5,7 +5,6 @@
 
 #include <math.h>
 #include <limits.h>
-#include "errors.h"
 #include "constants.h"
 #include "LDAPObject.h"
 #include "ldapcontrol.h"
diff --git a/Modules/common.c b/Modules/common.c
index 7d3ac8b..0f0cd36 100644
--- a/Modules/common.c
+++ b/Modules/common.c
@@ -16,3 +16,15 @@ LDAPadd_methods( PyObject* d, PyMethodDef* methods )
         Py_DECREF(f);
     }
 }
+
+/* Raise TypeError with custom message and object */
+PyObject*
+LDAPerror_TypeError(const char *msg, PyObject *obj) {
+    PyObject *args = Py_BuildValue("sO", msg, obj);
+    if (args == NULL) {
+        return NULL;
+    }
+    PyErr_SetObject(PyExc_TypeError, args);
+    Py_DECREF(args);
+    return NULL;
+}
diff --git a/Modules/common.h b/Modules/common.h
index 0eea1d9..029f234 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -24,6 +24,8 @@
 #define streq( a, b ) \
 	( (*(a)==*(b)) && 0==strcmp(a,b) )
 
+extern PyObject* LDAPerror_TypeError(const char *, PyObject *);
+
 void LDAPadd_methods( PyObject*d, PyMethodDef*methods );
 #define PyNone_Check(o) ((o) == Py_None)
 
diff --git a/Modules/constants.c b/Modules/constants.c
index cd3877c..4fd09b8 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -6,346 +6,184 @@
 #include "lber.h"
 #include "ldap.h"
 
-/* initialise the module constants */
-
-void
-LDAPinit_constants( PyObject* d )
-{
-  PyObject *obj;
+/* the base exception class */
 
-#define add_int(d, name) \
-  { \
-    PyObject *i = PyInt_FromLong(LDAP_##name); \
-    PyDict_SetItemString( d, #name, i ); \
-    Py_DECREF(i); \
-  }
+PyObject*
+LDAPexception_class;
 
-  /* simple constants */
-
-  add_int(d,API_VERSION);
-  add_int(d,VENDOR_VERSION);
-
-        add_int(d,PORT);
-  add_int(d,VERSION1);
-  add_int(d,VERSION2);
-  add_int(d,VERSION3);
-  add_int(d,VERSION_MIN);
-  add_int(d,VERSION);
-  add_int(d,VERSION_MAX);
-  add_int(d,TAG_MESSAGE);
-  add_int(d,TAG_MSGID);
-
-  add_int(d,REQ_BIND);
-  add_int(d,REQ_UNBIND);
-  add_int(d,REQ_SEARCH);
-  add_int(d,REQ_MODIFY);
-  add_int(d,REQ_ADD);
-  add_int(d,REQ_DELETE);
-  add_int(d,REQ_MODRDN);
-  add_int(d,REQ_COMPARE);
-  add_int(d,REQ_ABANDON);
-
-  add_int(d,TAG_LDAPDN);
-  add_int(d,TAG_LDAPCRED);
-  add_int(d,TAG_CONTROLS);
-  add_int(d,TAG_REFERRAL);
-
-  add_int(d,REQ_EXTENDED);
-#if LDAP_API_VERSION >= 2004
-  add_int(d,TAG_NEWSUPERIOR);
-  add_int(d,TAG_EXOP_REQ_OID);
-  add_int(d,TAG_EXOP_REQ_VALUE);
-  add_int(d,TAG_EXOP_RES_OID);
-  add_int(d,TAG_EXOP_RES_VALUE);
-#ifdef HAVE_SASL
-  add_int(d,TAG_SASL_RES_CREDS);
-#endif
-#endif
+/* list of exception classes */
 
-  add_int(d,SASL_AUTOMATIC);
-  add_int(d,SASL_INTERACTIVE);
-  add_int(d,SASL_QUIET);
-
-  /* reversibles */
-
-  add_int(d,RES_BIND);
-  add_int(d,RES_SEARCH_ENTRY);
-  add_int(d,RES_SEARCH_RESULT);
-  add_int(d,RES_MODIFY);
-  add_int(d,RES_ADD);
-  add_int(d,RES_DELETE);
-  add_int(d,RES_MODRDN);
-  add_int(d,RES_COMPARE);
-  add_int(d,RES_ANY);
-
-  add_int(d,RES_SEARCH_REFERENCE);
-  add_int(d,RES_EXTENDED);
-  add_int(d,RES_UNSOLICITED);
-
-  add_int(d,RES_INTERMEDIATE);
-
-  /* non-reversibles */
-
-  add_int(d,AUTH_NONE);
-  add_int(d,AUTH_SIMPLE);
-  add_int(d,SCOPE_BASE);
-  add_int(d,SCOPE_ONELEVEL);
-  add_int(d,SCOPE_SUBTREE);
-#ifdef LDAP_SCOPE_SUBORDINATE
-  add_int(d,SCOPE_SUBORDINATE);
-#endif
-  add_int(d,MOD_ADD);
-  add_int(d,MOD_DELETE);
-  add_int(d,MOD_REPLACE);
-  add_int(d,MOD_INCREMENT);
-  add_int(d,MOD_BVALUES);
-
-  add_int(d,MSG_ONE);
-  add_int(d,MSG_ALL);
-  add_int(d,MSG_RECEIVED);
-
-  /* (errors.c contains the error constants) */
-
-  add_int(d,DEREF_NEVER);
-  add_int(d,DEREF_SEARCHING);
-  add_int(d,DEREF_FINDING);
-  add_int(d,DEREF_ALWAYS);
-  add_int(d,NO_LIMIT);
-
-  add_int(d,OPT_API_INFO);
-  add_int(d,OPT_DEREF);
-  add_int(d,OPT_SIZELIMIT);
-  add_int(d,OPT_TIMELIMIT);
-#ifdef LDAP_OPT_REFERRALS
-  add_int(d,OPT_REFERRALS);
-#endif
-  add_int(d,OPT_ERROR_NUMBER);
-  add_int(d,OPT_RESTART);
-  add_int(d,OPT_PROTOCOL_VERSION);
-  add_int(d,OPT_SERVER_CONTROLS);
-  add_int(d,OPT_CLIENT_CONTROLS);
-  add_int(d,OPT_API_FEATURE_INFO);
-  add_int(d,OPT_HOST_NAME);
-
-  add_int(d,OPT_DESC);
-  add_int(d,OPT_DIAGNOSTIC_MESSAGE);
-
-  add_int(d,OPT_ERROR_STRING);
-  add_int(d,OPT_MATCHED_DN);
-  add_int(d,OPT_DEBUG_LEVEL);
-  add_int(d,OPT_TIMEOUT);
-  add_int(d,OPT_REFHOPLIMIT);
-  add_int(d,OPT_NETWORK_TIMEOUT);
-  add_int(d,OPT_URI);
-#ifdef LDAP_OPT_DEFBASE
-  add_int(d,OPT_DEFBASE);
-#endif
-#ifdef HAVE_TLS
-  add_int(d,OPT_X_TLS);
-#ifdef LDAP_OPT_X_TLS_NEWCTX
-  add_int(d,OPT_X_TLS_CTX);
-#endif
-  add_int(d,OPT_X_TLS_CACERTFILE);
-  add_int(d,OPT_X_TLS_CACERTDIR);
-  add_int(d,OPT_X_TLS_CERTFILE);
-  add_int(d,OPT_X_TLS_KEYFILE);
-  add_int(d,OPT_X_TLS_REQUIRE_CERT);
-  add_int(d,OPT_X_TLS_CIPHER_SUITE);
-  add_int(d,OPT_X_TLS_RANDOM_FILE);
-  add_int(d,OPT_X_TLS_DHFILE);
-  add_int(d,OPT_X_TLS_NEVER);
-  add_int(d,OPT_X_TLS_HARD);
-  add_int(d,OPT_X_TLS_DEMAND);
-  add_int(d,OPT_X_TLS_ALLOW);
-  add_int(d,OPT_X_TLS_TRY);
-#ifdef LDAP_OPT_X_TLS_PEERCERT
-  add_int(d,OPT_X_TLS_PEERCERT);
-#endif
-#ifdef LDAP_OPT_X_TLS_VERSION
-  add_int(d,OPT_X_TLS_VERSION);
-#endif
-#ifdef LDAP_OPT_X_TLS_CIPHER
-  add_int(d,OPT_X_TLS_CIPHER);
-#endif
-#ifdef LDAP_OPT_X_TLS_PEERCERT
-  add_int(d,OPT_X_TLS_PEERCERT);
-#endif
-#ifdef LDAP_OPT_X_TLS_CRLCHECK
-  /* only available if OpenSSL supports it => might cause backward compability problems */
-  add_int(d,OPT_X_TLS_CRLCHECK);
-#ifdef LDAP_OPT_X_TLS_CRLFILE
-  add_int(d,OPT_X_TLS_CRLFILE);
-#endif
-  add_int(d,OPT_X_TLS_CRL_NONE);
-  add_int(d,OPT_X_TLS_CRL_PEER);
-  add_int(d,OPT_X_TLS_CRL_ALL);
-#endif
-#ifdef LDAP_OPT_X_TLS_NEWCTX
-  add_int(d,OPT_X_TLS_NEWCTX);
-#endif
-#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
-  add_int(d,OPT_X_TLS_PROTOCOL_MIN);
-#endif
-#ifdef LDAP_OPT_X_TLS_PACKAGE
-  add_int(d,OPT_X_TLS_PACKAGE);
-#endif
-#endif
-  add_int(d,OPT_X_SASL_MECH);
-  add_int(d,OPT_X_SASL_REALM);
-  add_int(d,OPT_X_SASL_AUTHCID);
-  add_int(d,OPT_X_SASL_AUTHZID);
-  add_int(d,OPT_X_SASL_SSF);
-  add_int(d,OPT_X_SASL_SSF_EXTERNAL);
-  add_int(d,OPT_X_SASL_SECPROPS);
-  add_int(d,OPT_X_SASL_SSF_MIN);
-  add_int(d,OPT_X_SASL_SSF_MAX);
-#ifdef LDAP_OPT_X_SASL_NOCANON
-  add_int(d,OPT_X_SASL_NOCANON);
-#endif
-#ifdef LDAP_OPT_X_SASL_USERNAME
-  add_int(d,OPT_X_SASL_USERNAME);
-#endif
-#ifdef LDAP_OPT_CONNECT_ASYNC
-  add_int(d,OPT_CONNECT_ASYNC);
-#endif
-#ifdef LDAP_OPT_X_KEEPALIVE_IDLE
-  add_int(d,OPT_X_KEEPALIVE_IDLE);
-#endif
-#ifdef LDAP_OPT_X_KEEPALIVE_PROBES
-  add_int(d,OPT_X_KEEPALIVE_PROBES);
-#endif
-#ifdef LDAP_OPT_X_KEEPALIVE_INTERVAL
-  add_int(d,OPT_X_KEEPALIVE_INTERVAL);
-#endif
+#define LDAP_ERROR_MIN          LDAP_REFERRAL_LIMIT_EXCEEDED
 
-  add_int(d,DN_FORMAT_LDAP);
-  add_int(d,DN_FORMAT_LDAPV3);
-  add_int(d,DN_FORMAT_LDAPV2);
-  add_int(d,DN_FORMAT_DCE);
-  add_int(d,DN_FORMAT_UFN);
-  add_int(d,DN_FORMAT_AD_CANONICAL);
-  /* add_int(d,DN_FORMAT_LBER); */    /* "for testing only" */
-  add_int(d,DN_FORMAT_MASK);
-  add_int(d,DN_PRETTY);
-  add_int(d,DN_SKIP);
-  add_int(d,DN_P_NOLEADTRAILSPACES);
-  add_int(d,DN_P_NOSPACEAFTERRDN);
-  add_int(d,DN_PEDANTIC);
-
-  add_int(d,AVA_NULL);
-  add_int(d,AVA_STRING);
-  add_int(d,AVA_BINARY);
-  add_int(d,AVA_NONPRINTABLE);
-  
-  /*add_int(d,OPT_ON);*/
-  obj = PyInt_FromLong(1);
-  PyDict_SetItemString( d, "OPT_ON", obj );
-  Py_DECREF(obj);
-  /*add_int(d,OPT_OFF);*/
-  obj = PyInt_FromLong(0);
-  PyDict_SetItemString( d, "OPT_OFF", obj );      
-  Py_DECREF(obj);
-  
-  add_int(d,OPT_SUCCESS);
-
-  /* XXX - these belong in errors.c */
-
-  add_int(d,URL_ERR_BADSCOPE);
-  add_int(d,URL_ERR_MEM);
-
-  /* add_int(d,LIBLDAP_R); */
-#ifdef HAVE_LIBLDAP_R
-  obj = PyInt_FromLong(1);
+#ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
+  #define LDAP_ERROR_MAX          LDAP_PROXIED_AUTHORIZATION_DENIED
 #else
-  obj = PyInt_FromLong(0);
+  #ifdef LDAP_ASSERTION_FAILED
+    #define LDAP_ERROR_MAX          LDAP_ASSERTION_FAILED
+  #else
+    #define LDAP_ERROR_MAX          LDAP_OTHER
+  #endif
 #endif
-  PyDict_SetItemString( d, "LIBLDAP_R", obj );
-  Py_DECREF(obj);
 
-  /* add_int(d,SASL); */
-#ifdef HAVE_SASL
-  obj = PyInt_FromLong(1);
-#else
-  obj = PyInt_FromLong(0);
-#endif
-  PyDict_SetItemString( d, "SASL_AVAIL", obj );
-  Py_DECREF(obj);
+#define LDAP_ERROR_OFFSET       -LDAP_ERROR_MIN
+
+static PyObject* errobjects[ LDAP_ERROR_MAX-LDAP_ERROR_MIN+1 ];
 
-  /* add_int(d,TLS); */
-#ifdef HAVE_TLS
-  obj = PyInt_FromLong(1);
-#else
-  obj = PyInt_FromLong(0);
-#endif
-  PyDict_SetItemString( d, "TLS_AVAIL", obj );
-  Py_DECREF(obj);
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_MANAGEDSAIT);
-  PyDict_SetItemString( d, "CONTROL_MANAGEDSAIT", obj );
-  Py_DECREF(obj);
+/* Convert a bare LDAP error number into an exception */
+PyObject*
+LDAPerr(int errnum)
+{
+  if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX) {
+    PyErr_SetNone(errobjects[errnum+LDAP_ERROR_OFFSET]);
+  } else {
+    PyObject *args = Py_BuildValue("{s:i}", "errnum", errnum);
+    if (args == NULL)
+      return NULL;
+    PyErr_SetObject(LDAPexception_class, args);
+    Py_DECREF(args);
+  }
+  return NULL;
+}
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_PROXY_AUTHZ);
-  PyDict_SetItemString( d, "CONTROL_PROXY_AUTHZ", obj );
-  Py_DECREF(obj);
+/* Convert an LDAP error into an informative python exception */
+PyObject*
+LDAPerror( LDAP *l, char *msg )
+{
+  if (l == NULL) {
+    PyErr_SetFromErrno( LDAPexception_class );
+    return NULL;
+  }
+  else {
+    int myerrno, errnum, opt_errnum;
+    PyObject *errobj;
+    PyObject *info;
+    PyObject *str;
+    PyObject *pyerrno;
+
+    /* at first save errno for later use before it gets overwritten by another call */
+    myerrno = errno;
+
+    char *matched, *error;
+
+    opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
+    if (opt_errnum != LDAP_OPT_SUCCESS)
+      errnum = opt_errnum;
+
+    if (errnum == LDAP_NO_MEMORY)
+      return PyErr_NoMemory();
+
+    if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
+      errobj = errobjects[errnum+LDAP_ERROR_OFFSET];
+    else
+      errobj = LDAPexception_class;
+
+    info = PyDict_New();
+    if (info == NULL)
+      return NULL;
+
+    str = PyUnicode_FromString(ldap_err2string(errnum));
+    if (str)
+      PyDict_SetItemString( info, "desc", str );
+    Py_XDECREF(str);
+
+    if (myerrno != 0) {
+        pyerrno = PyInt_FromLong(myerrno);
+        if (pyerrno)
+            PyDict_SetItemString( info, "errno", pyerrno );
+        Py_XDECREF(pyerrno);
+    }
+
+    if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
+      && matched != NULL) {
+        if (*matched != '\0') {
+      str = PyUnicode_FromString(matched);
+      if (str)
+          PyDict_SetItemString( info, "matched", str );
+      Py_XDECREF(str);
+        }
+        ldap_memfree(matched);
+    }
+
+    if (errnum == LDAP_REFERRAL) {
+        str = PyUnicode_FromString(msg);
+        if (str)
+      PyDict_SetItemString( info, "info", str );
+        Py_XDECREF(str);
+    } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
+        if (error != NULL && *error != '\0') {
+            str = PyUnicode_FromString(error);
+            if (str)
+                PyDict_SetItemString( info, "info", str );
+            Py_XDECREF(str);
+        }
+        ldap_memfree(error);
+    }
+    PyErr_SetObject( errobj, info );
+    Py_DECREF(info);
+    return NULL;
+  }
+}
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_SUBENTRIES);
-  PyDict_SetItemString( d, "CONTROL_SUBENTRIES", obj );
-  Py_DECREF(obj);
+/* initialise the module constants */
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_VALUESRETURNFILTER);
-  PyDict_SetItemString( d, "CONTROL_VALUESRETURNFILTER", obj );
-  Py_DECREF(obj);
+int
+LDAPinit_constants( PyObject* m )
+{
+    PyObject *exc;
+    int result;
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_ASSERT);
-  PyDict_SetItemString( d, "CONTROL_ASSERT", obj );
-  Py_DECREF(obj);
+#define check_result() {  \
+    if (result != 0) return -1;  \
+}
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_PRE_READ);
-  PyDict_SetItemString( d, "CONTROL_PRE_READ", obj );
-  Py_DECREF(obj);
+    /* simple constants */
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_POST_READ);
-  PyDict_SetItemString( d, "CONTROL_POST_READ", obj );
-  Py_DECREF(obj);
+    result = PyModule_AddIntConstant(m, "OPT_ON", 1);
+    check_result();
+    result = PyModule_AddIntConstant(m, "OPT_OFF", 0);
+    check_result();
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_SORTREQUEST);
-  PyDict_SetItemString( d, "CONTROL_SORTREQUEST", obj );
-  Py_DECREF(obj);
+    /* exceptions */
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_SORTRESPONSE);
-  PyDict_SetItemString( d, "CONTROL_SORTRESPONSE", obj );
-  Py_DECREF(obj);
+    LDAPexception_class = PyErr_NewException("ldap.LDAPError", NULL, NULL);
+    if (LDAPexception_class == NULL) {
+        return -1;
+    }
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_PAGEDRESULTS);
-  PyDict_SetItemString( d, "CONTROL_PAGEDRESULTS", obj );
-  Py_DECREF(obj);
+    result = PyModule_AddObject(m, "LDAPError", LDAPexception_class);
+    check_result();
+    Py_INCREF(LDAPexception_class);
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_SYNC);
-  PyDict_SetItemString( d, "CONTROL_SYNC", obj );
-  Py_DECREF(obj);
+    /* XXX - backward compatibility with pre-1.8 */
+    result = PyModule_AddObject(m, "error", LDAPexception_class);
+    check_result();
+    Py_INCREF(LDAPexception_class);
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_SYNC_STATE);
-  PyDict_SetItemString( d, "CONTROL_SYNC_STATE", obj );
-  Py_DECREF(obj);
+    /* Generated constants -- see Lib/ldap/constants.py */
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_SYNC_DONE);
-  PyDict_SetItemString( d, "CONTROL_SYNC_DONE", obj );
-  Py_DECREF(obj);
+#define seterrobj2(n, o) \
+    PyModule_AddObject(m, #n, (errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = o))
 
-  obj = PyUnicode_FromString(LDAP_SYNC_INFO);
-  PyDict_SetItemString( d, "SYNC_INFO", obj );
-  Py_DECREF(obj);
+#define add_err(n) {  \
+    exc = PyErr_NewException("ldap." #n, LDAPexception_class, NULL);  \
+    if (exc == NULL) return -1;  \
+    result = seterrobj2(n, exc);  \
+    check_result();  \
+    Py_INCREF(exc);  \
+}
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_PASSWORDPOLICYREQUEST);
-  PyDict_SetItemString( d, "CONTROL_PASSWORDPOLICYREQUEST", obj );
-  Py_DECREF(obj);
+#define add_int(n) {  \
+    result = PyModule_AddIntConstant(m, #n, LDAP_##n);  \
+    check_result();  \
+}
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_PASSWORDPOLICYRESPONSE);
-  PyDict_SetItemString( d, "CONTROL_PASSWORDPOLICYRESPONSE", obj );
-  Py_DECREF(obj);
+#define add_string(n) {  \
+    result = PyModule_AddStringConstant(m, #n, LDAP_##n);  \
+    check_result();  \
+}
 
-  obj = PyUnicode_FromString(LDAP_CONTROL_RELAX);
-  PyDict_SetItemString( d, "CONTROL_RELAX", obj );
-  Py_DECREF(obj);
+#include "constants_generated.h"
 
+    return 0;
 }
diff --git a/Modules/constants.h b/Modules/constants.h
index eb76612..4056f90 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -4,9 +4,16 @@
 #define __h_constants_
 
 #include "common.h"
-extern void LDAPinit_constants( PyObject* d );
+#include "lber.h"
+#include "ldap.h"
+
+extern int LDAPinit_constants( PyObject* m );
 extern PyObject* LDAPconstant( int );
 
+extern PyObject* LDAPexception_class;
+extern PyObject* LDAPerror( LDAP*, char*msg );
+PyObject* LDAPerr(int errnum);
+
 #ifndef LDAP_CONTROL_PAGE_OID
 #define LDAP_CONTROL_PAGE_OID "1.2.840.113556.1.4.319"
 #endif /* !LDAP_CONTROL_PAGE_OID */
diff --git a/Modules/constants_generated.h b/Modules/constants_generated.h
new file mode 100644
index 0000000..27addc9
--- /dev/null
+++ b/Modules/constants_generated.h
@@ -0,0 +1,366 @@
+/*
+ * Generated with:
+ *   python Lib/ldap/constants.py > Modules/constants_generated.h
+ *
+ * Please do any modifications there, then re-generate this file
+ */
+
+add_err(ADMINLIMIT_EXCEEDED);
+add_err(AFFECTS_MULTIPLE_DSAS);
+add_err(ALIAS_DEREF_PROBLEM);
+add_err(ALIAS_PROBLEM);
+add_err(ALREADY_EXISTS);
+add_err(AUTH_METHOD_NOT_SUPPORTED);
+add_err(AUTH_UNKNOWN);
+add_err(BUSY);
+add_err(CLIENT_LOOP);
+add_err(COMPARE_FALSE);
+add_err(COMPARE_TRUE);
+add_err(CONFIDENTIALITY_REQUIRED);
+add_err(CONNECT_ERROR);
+add_err(CONSTRAINT_VIOLATION);
+add_err(CONTROL_NOT_FOUND);
+add_err(DECODING_ERROR);
+add_err(ENCODING_ERROR);
+add_err(FILTER_ERROR);
+add_err(INAPPROPRIATE_AUTH);
+add_err(INAPPROPRIATE_MATCHING);
+add_err(INSUFFICIENT_ACCESS);
+add_err(INVALID_CREDENTIALS);
+add_err(INVALID_DN_SYNTAX);
+add_err(INVALID_SYNTAX);
+add_err(IS_LEAF);
+add_err(LOCAL_ERROR);
+add_err(LOOP_DETECT);
+add_err(MORE_RESULTS_TO_RETURN);
+add_err(NAMING_VIOLATION);
+add_err(NO_MEMORY);
+add_err(NO_OBJECT_CLASS_MODS);
+add_err(NO_OBJECT_CLASS_MODS);
+add_err(NO_RESULTS_RETURNED);
+add_err(NO_SUCH_ATTRIBUTE);
+add_err(NO_SUCH_OBJECT);
+add_err(NOT_ALLOWED_ON_NONLEAF);
+add_err(NOT_ALLOWED_ON_RDN);
+add_err(NOT_SUPPORTED);
+add_err(OBJECT_CLASS_VIOLATION);
+add_err(OPERATIONS_ERROR);
+add_err(OTHER);
+add_err(PARAM_ERROR);
+add_err(PARTIAL_RESULTS);
+add_err(PROTOCOL_ERROR);
+add_err(REFERRAL);
+add_err(REFERRAL_LIMIT_EXCEEDED);
+add_err(RESULTS_TOO_LARGE);
+add_err(SASL_BIND_IN_PROGRESS);
+add_err(SERVER_DOWN);
+add_err(SIZELIMIT_EXCEEDED);
+add_err(STRONG_AUTH_NOT_SUPPORTED);
+add_err(STRONG_AUTH_REQUIRED);
+add_err(SUCCESS);
+add_err(TIMELIMIT_EXCEEDED);
+add_err(TIMEOUT);
+add_err(TYPE_OR_VALUE_EXISTS);
+add_err(UNAVAILABLE);
+add_err(UNAVAILABLE_CRITICAL_EXTENSION);
+add_err(UNDEFINED_TYPE);
+add_err(UNWILLING_TO_PERFORM);
+add_err(USER_CANCELLED);
+add_err(VLV_ERROR);
+add_err(X_PROXY_AUTHZ_FAILURE);
+
+#if defined(LDAP_API_FEATURE_CANCEL)
+add_err(CANCELLED);
+add_err(NO_SUCH_OPERATION);
+add_err(TOO_LATE);
+add_err(CANNOT_CANCEL);
+#endif
+
+
+#if defined(LDAP_ASSERTION_FAILED)
+add_err(ASSERTION_FAILED);
+#endif
+
+
+#if defined(LDAP_PROXIED_AUTHORIZATION_DENIED)
+add_err(PROXIED_AUTHORIZATION_DENIED);
+#endif
+
+add_int(API_VERSION);
+add_int(VENDOR_VERSION);
+add_int(PORT);
+add_int(VERSION1);
+add_int(VERSION2);
+add_int(VERSION3);
+add_int(VERSION_MIN);
+add_int(VERSION);
+add_int(VERSION_MAX);
+add_int(TAG_MESSAGE);
+add_int(TAG_MSGID);
+add_int(REQ_BIND);
+add_int(REQ_UNBIND);
+add_int(REQ_SEARCH);
+add_int(REQ_MODIFY);
+add_int(REQ_ADD);
+add_int(REQ_DELETE);
+add_int(REQ_MODRDN);
+add_int(REQ_COMPARE);
+add_int(REQ_ABANDON);
+add_int(TAG_LDAPDN);
+add_int(TAG_LDAPCRED);
+add_int(TAG_CONTROLS);
+add_int(TAG_REFERRAL);
+add_int(REQ_EXTENDED);
+
+#if LDAP_API_VERSION >= 2004
+add_int(TAG_NEWSUPERIOR);
+add_int(TAG_EXOP_REQ_OID);
+add_int(TAG_EXOP_REQ_VALUE);
+add_int(TAG_EXOP_RES_OID);
+add_int(TAG_EXOP_RES_VALUE);
+
+#if defined(HAVE_SASL)
+add_int(TAG_SASL_RES_CREDS);
+#endif
+
+#endif
+
+add_int(SASL_AUTOMATIC);
+add_int(SASL_INTERACTIVE);
+add_int(SASL_QUIET);
+add_int(RES_BIND);
+add_int(RES_SEARCH_ENTRY);
+add_int(RES_SEARCH_RESULT);
+add_int(RES_MODIFY);
+add_int(RES_ADD);
+add_int(RES_DELETE);
+add_int(RES_MODRDN);
+add_int(RES_COMPARE);
+add_int(RES_ANY);
+add_int(RES_SEARCH_REFERENCE);
+add_int(RES_EXTENDED);
+add_int(RES_UNSOLICITED);
+add_int(RES_INTERMEDIATE);
+add_int(AUTH_NONE);
+add_int(AUTH_SIMPLE);
+add_int(SCOPE_BASE);
+add_int(SCOPE_ONELEVEL);
+add_int(SCOPE_SUBTREE);
+
+#if defined(LDAP_SCOPE_SUBORDINATE)
+add_int(SCOPE_SUBORDINATE);
+#endif
+
+add_int(MOD_ADD);
+add_int(MOD_DELETE);
+add_int(MOD_REPLACE);
+add_int(MOD_INCREMENT);
+add_int(MOD_BVALUES);
+add_int(MSG_ONE);
+add_int(MSG_ALL);
+add_int(MSG_RECEIVED);
+add_int(DEREF_NEVER);
+add_int(DEREF_SEARCHING);
+add_int(DEREF_FINDING);
+add_int(DEREF_ALWAYS);
+add_int(NO_LIMIT);
+add_int(OPT_API_INFO);
+add_int(OPT_DEREF);
+add_int(OPT_SIZELIMIT);
+add_int(OPT_TIMELIMIT);
+
+#if defined(LDAP_OPT_REFERRALS)
+add_int(OPT_REFERRALS);
+#endif
+
+add_int(OPT_ERROR_NUMBER);
+add_int(OPT_RESTART);
+add_int(OPT_PROTOCOL_VERSION);
+add_int(OPT_SERVER_CONTROLS);
+add_int(OPT_CLIENT_CONTROLS);
+add_int(OPT_API_FEATURE_INFO);
+add_int(OPT_HOST_NAME);
+add_int(OPT_DESC);
+add_int(OPT_DIAGNOSTIC_MESSAGE);
+add_int(OPT_ERROR_STRING);
+add_int(OPT_MATCHED_DN);
+add_int(OPT_DEBUG_LEVEL);
+add_int(OPT_TIMEOUT);
+add_int(OPT_REFHOPLIMIT);
+add_int(OPT_NETWORK_TIMEOUT);
+add_int(OPT_URI);
+
+#if defined(LDAP_OPT_DEFBASE)
+add_int(OPT_DEFBASE);
+#endif
+
+
+#if HAVE_TLS
+
+#if defined(LDAP_OPT_X_TLS)
+add_int(OPT_X_TLS);
+#endif
+
+add_int(OPT_X_TLS_CTX);
+add_int(OPT_X_TLS_CACERTFILE);
+add_int(OPT_X_TLS_CACERTDIR);
+add_int(OPT_X_TLS_CERTFILE);
+add_int(OPT_X_TLS_KEYFILE);
+add_int(OPT_X_TLS_REQUIRE_CERT);
+add_int(OPT_X_TLS_CIPHER_SUITE);
+add_int(OPT_X_TLS_RANDOM_FILE);
+add_int(OPT_X_TLS_DHFILE);
+add_int(OPT_X_TLS_NEVER);
+add_int(OPT_X_TLS_HARD);
+add_int(OPT_X_TLS_DEMAND);
+add_int(OPT_X_TLS_ALLOW);
+add_int(OPT_X_TLS_TRY);
+
+#if defined(LDAP_OPT_X_TLS_PEERCERT)
+add_int(OPT_X_TLS_PEERCERT);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_VERSION)
+add_int(OPT_X_TLS_VERSION);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_CIPHER)
+add_int(OPT_X_TLS_CIPHER);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PEERCERT)
+add_int(OPT_X_TLS_PEERCERT);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_CRLCHECK)
+add_int(OPT_X_TLS_CRLCHECK);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_CRLFILE)
+add_int(OPT_X_TLS_CRLFILE);
+#endif
+
+add_int(OPT_X_TLS_CRL_NONE);
+add_int(OPT_X_TLS_CRL_PEER);
+add_int(OPT_X_TLS_CRL_ALL);
+
+#if defined(LDAP_OPT_X_TLS_NEWCTX)
+add_int(OPT_X_TLS_NEWCTX);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PROTOCOL_MIN)
+add_int(OPT_X_TLS_PROTOCOL_MIN);
+#endif
+
+
+#if defined(LDAP_OPT_X_TLS_PACKAGE)
+add_int(OPT_X_TLS_PACKAGE);
+#endif
+
+#endif
+
+add_int(OPT_X_SASL_MECH);
+add_int(OPT_X_SASL_REALM);
+add_int(OPT_X_SASL_AUTHCID);
+add_int(OPT_X_SASL_AUTHZID);
+add_int(OPT_X_SASL_SSF);
+add_int(OPT_X_SASL_SSF_EXTERNAL);
+add_int(OPT_X_SASL_SECPROPS);
+add_int(OPT_X_SASL_SSF_MIN);
+add_int(OPT_X_SASL_SSF_MAX);
+
+#if defined(LDAP_OPT_X_SASL_NOCANON)
+add_int(OPT_X_SASL_NOCANON);
+#endif
+
+
+#if defined(LDAP_OPT_X_SASL_USERNAME)
+add_int(OPT_X_SASL_USERNAME);
+#endif
+
+
+#if defined(LDAP_OPT_CONNECT_ASYNC)
+add_int(OPT_CONNECT_ASYNC);
+#endif
+
+
+#if defined(LDAP_OPT_X_KEEPALIVE_IDLE)
+add_int(OPT_X_KEEPALIVE_IDLE);
+#endif
+
+
+#if defined(LDAP_OPT_X_KEEPALIVE_PROBES)
+add_int(OPT_X_KEEPALIVE_PROBES);
+#endif
+
+
+#if defined(LDAP_OPT_X_KEEPALIVE_INTERVAL)
+add_int(OPT_X_KEEPALIVE_INTERVAL);
+#endif
+
+add_int(DN_FORMAT_LDAP);
+add_int(DN_FORMAT_LDAPV3);
+add_int(DN_FORMAT_LDAPV2);
+add_int(DN_FORMAT_DCE);
+add_int(DN_FORMAT_UFN);
+add_int(DN_FORMAT_AD_CANONICAL);
+add_int(DN_FORMAT_MASK);
+add_int(DN_PRETTY);
+add_int(DN_SKIP);
+add_int(DN_P_NOLEADTRAILSPACES);
+add_int(DN_P_NOSPACEAFTERRDN);
+add_int(DN_PEDANTIC);
+add_int(AVA_NULL);
+add_int(AVA_STRING);
+add_int(AVA_BINARY);
+add_int(AVA_NONPRINTABLE);
+add_int(OPT_SUCCESS);
+add_int(URL_ERR_BADSCOPE);
+add_int(URL_ERR_MEM);
+
+#ifdef HAVE_LIBLDAP_R
+result = PyModule_AddIntConstant(m, "LIBLDAP_R", 1);
+#else
+result = PyModule_AddIntConstant(m, "LIBLDAP_R", 0);
+#endif
+check_result();
+
+
+#ifdef HAVE_SASL
+result = PyModule_AddIntConstant(m, "SASL_AVAIL", 1);
+#else
+result = PyModule_AddIntConstant(m, "SASL_AVAIL", 0);
+#endif
+check_result();
+
+
+#ifdef HAVE_TLS
+result = PyModule_AddIntConstant(m, "TLS_AVAIL", 1);
+#else
+result = PyModule_AddIntConstant(m, "TLS_AVAIL", 0);
+#endif
+check_result();
+
+add_string(CONTROL_MANAGEDSAIT);
+add_string(CONTROL_PROXY_AUTHZ);
+add_string(CONTROL_SUBENTRIES);
+add_string(CONTROL_VALUESRETURNFILTER);
+add_string(CONTROL_ASSERT);
+add_string(CONTROL_PRE_READ);
+add_string(CONTROL_POST_READ);
+add_string(CONTROL_SORTREQUEST);
+add_string(CONTROL_SORTRESPONSE);
+add_string(CONTROL_PAGEDRESULTS);
+add_string(CONTROL_SYNC);
+add_string(CONTROL_SYNC_STATE);
+add_string(CONTROL_SYNC_DONE);
+add_string(SYNC_INFO);
+add_string(CONTROL_PASSWORDPOLICYREQUEST);
+add_string(CONTROL_PASSWORDPOLICYRESPONSE);
+add_string(CONTROL_RELAX);
diff --git a/Modules/errors.c b/Modules/errors.c
deleted file mode 100644
index 3c4da78..0000000
--- a/Modules/errors.c
+++ /dev/null
@@ -1,249 +0,0 @@
-/*
- * errors that arise from ldap use
- * Most errors become their own exception
- * See https://www.python-ldap.org/ for details. */
-
-#include "common.h"
-#include "errors.h"
-#include <errno.h>
-#include <string.h>
-
-/* the base exception class */
-
-PyObject*
-LDAPexception_class;
-
-/* list of error objects */
-
-#define LDAP_ERROR_MIN          LDAP_REFERRAL_LIMIT_EXCEEDED
-
-#ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
-  #define LDAP_ERROR_MAX          LDAP_PROXIED_AUTHORIZATION_DENIED
-#else
-  #ifdef LDAP_ASSERTION_FAILED
-    #define LDAP_ERROR_MAX          LDAP_ASSERTION_FAILED
-  #else
-    #define LDAP_ERROR_MAX          LDAP_OTHER
-  #endif
-#endif
-
-#define LDAP_ERROR_OFFSET       -LDAP_ERROR_MIN
-
-static PyObject* errobjects[ LDAP_ERROR_MAX-LDAP_ERROR_MIN+1 ];
-
-
-/* Convert a bare LDAP error number into an exception */
-PyObject*
-LDAPerr(int errnum)
-{
-  if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX) {
-    PyErr_SetNone(errobjects[errnum+LDAP_ERROR_OFFSET]);
-  } else {
-    PyObject *args = Py_BuildValue("{s:i}", "errnum", errnum);
-    if (args == NULL)
-      return NULL;
-    PyErr_SetObject(LDAPexception_class, args);
-    Py_DECREF(args);
-  }
-  return NULL;
-}
-
-/* Convert an LDAP error into an informative python exception */
-PyObject*
-LDAPerror( LDAP *l, char *msg ) 
-{
-  if (l == NULL) {
-    PyErr_SetFromErrno( LDAPexception_class );
-    return NULL;
-  }
-  else {
-    int myerrno, errnum, opt_errnum;
-    PyObject *errobj;
-    PyObject *info;
-    PyObject *str;
-    PyObject *pyerrno;
-
-    /* at first save errno for later use before it gets overwritten by another call */
-    myerrno = errno;
-
-    char *matched, *error;
-
-    opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
-    if (opt_errnum != LDAP_OPT_SUCCESS)
-      errnum = opt_errnum;
-
-    if (errnum == LDAP_NO_MEMORY)
-      return PyErr_NoMemory();
-
-    if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
-      errobj = errobjects[errnum+LDAP_ERROR_OFFSET];
-    else
-      errobj = LDAPexception_class;
-    
-    info = PyDict_New();
-    if (info == NULL)
-      return NULL;
-
-    str = PyUnicode_FromString(ldap_err2string(errnum));
-    if (str)
-      PyDict_SetItemString( info, "desc", str );
-    Py_XDECREF(str);
-
-    if (myerrno != 0) {
-        pyerrno = PyInt_FromLong(myerrno);
-        if (pyerrno)
-            PyDict_SetItemString( info, "errno", pyerrno );
-        Py_XDECREF(pyerrno);
-    }
-
-    if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
-      && matched != NULL) {
-        if (*matched != '\0') {
-      str = PyUnicode_FromString(matched);
-      if (str)
-          PyDict_SetItemString( info, "matched", str );
-      Py_XDECREF(str);
-        }
-        ldap_memfree(matched);
-    }
-    
-    if (errnum == LDAP_REFERRAL) {
-        str = PyUnicode_FromString(msg);
-        if (str)
-      PyDict_SetItemString( info, "info", str );
-        Py_XDECREF(str);
-    } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
-        if (error != NULL && *error != '\0') {
-            str = PyUnicode_FromString(error);
-            if (str)
-                PyDict_SetItemString( info, "info", str );
-            Py_XDECREF(str);
-        }
-        ldap_memfree(error);
-    }
-    PyErr_SetObject( errobj, info );
-    Py_DECREF(info);
-    return NULL;
-  }
-}
-
-/* Raise TypeError with custom message and object */
-PyObject*
-LDAPerror_TypeError(const char *msg, PyObject *obj) {
-    PyObject *args = Py_BuildValue("sO", msg, obj);
-    if (args == NULL) {
-        return NULL;
-    }
-    PyErr_SetObject(PyExc_TypeError, args);
-    Py_DECREF(args);
-    return NULL;
-}
-
-
-/* initialisation */
-
-void
-LDAPinit_errors( PyObject*d ) {
-
-        /* create the base exception class */
-        LDAPexception_class = PyErr_NewException("ldap.LDAPError",
-                                                  NULL,
-                                                  NULL);
-        PyDict_SetItemString( d, "LDAPError", LDAPexception_class );
-
-  /* XXX - backward compatibility with pre-1.8 */
-  PyDict_SetItemString( d, "error", LDAPexception_class );
-
-  /* create each LDAP error object */
-
-# define seterrobj2(n,o) \
-    PyDict_SetItemString( d, #n, (errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = o) )
-
-
-# define seterrobj(n) { \
-    PyObject *e = PyErr_NewException("ldap." #n,    \
-    LDAPexception_class, NULL);   \
-    seterrobj2(n, e);         \
-    Py_INCREF(e);           \
-  }
-
-  seterrobj(ADMINLIMIT_EXCEEDED);
-  seterrobj(AFFECTS_MULTIPLE_DSAS);
-  seterrobj(ALIAS_DEREF_PROBLEM);
-  seterrobj(ALIAS_PROBLEM);
-  seterrobj(ALREADY_EXISTS);
-  seterrobj(AUTH_METHOD_NOT_SUPPORTED);
-  seterrobj(AUTH_UNKNOWN);
-  seterrobj(BUSY);
-  seterrobj(CLIENT_LOOP);
-  seterrobj(COMPARE_FALSE);
-  seterrobj(COMPARE_TRUE);
-  seterrobj(CONFIDENTIALITY_REQUIRED);
-  seterrobj(CONNECT_ERROR);
-  seterrobj(CONSTRAINT_VIOLATION);
-  seterrobj(CONTROL_NOT_FOUND);
-  seterrobj(DECODING_ERROR);
-  seterrobj(ENCODING_ERROR);
-  seterrobj(FILTER_ERROR);
-  seterrobj(INAPPROPRIATE_AUTH);
-  seterrobj(INAPPROPRIATE_MATCHING);
-  seterrobj(INSUFFICIENT_ACCESS);
-  seterrobj(INVALID_CREDENTIALS);
-  seterrobj(INVALID_DN_SYNTAX);
-  seterrobj(INVALID_SYNTAX);
-  seterrobj(IS_LEAF);
-  seterrobj(LOCAL_ERROR);
-  seterrobj(LOOP_DETECT);
-  seterrobj(MORE_RESULTS_TO_RETURN);
-  seterrobj(NAMING_VIOLATION);
-  seterrobj(NO_MEMORY);
-  seterrobj(NO_OBJECT_CLASS_MODS);
-  seterrobj(NO_OBJECT_CLASS_MODS);
-  seterrobj(NO_RESULTS_RETURNED);
-  seterrobj(NO_SUCH_ATTRIBUTE);
-  seterrobj(NO_SUCH_OBJECT);
-  seterrobj(NOT_ALLOWED_ON_NONLEAF);
-  seterrobj(NOT_ALLOWED_ON_RDN);
-  seterrobj(NOT_SUPPORTED);
-  seterrobj(OBJECT_CLASS_VIOLATION);
-  seterrobj(OPERATIONS_ERROR);
-  seterrobj(OTHER);
-  seterrobj(PARAM_ERROR);
-  seterrobj(PARTIAL_RESULTS);
-  seterrobj(PROTOCOL_ERROR);
-  seterrobj(REFERRAL);
-  seterrobj(REFERRAL_LIMIT_EXCEEDED);
-  seterrobj(RESULTS_TOO_LARGE);
-  seterrobj(SASL_BIND_IN_PROGRESS);
-  seterrobj(SERVER_DOWN);
-  seterrobj(SIZELIMIT_EXCEEDED);
-  seterrobj(STRONG_AUTH_NOT_SUPPORTED);
-  seterrobj(STRONG_AUTH_REQUIRED);
-  seterrobj(SUCCESS);
-  seterrobj(TIMELIMIT_EXCEEDED);
-  seterrobj(TIMEOUT);
-  seterrobj(TYPE_OR_VALUE_EXISTS);
-  seterrobj(UNAVAILABLE);
-  seterrobj(UNAVAILABLE_CRITICAL_EXTENSION);
-  seterrobj(UNDEFINED_TYPE);
-  seterrobj(UNWILLING_TO_PERFORM);
-  seterrobj(USER_CANCELLED);
-  seterrobj(VLV_ERROR);
-  seterrobj(X_PROXY_AUTHZ_FAILURE);
-
-#ifdef LDAP_API_FEATURE_CANCEL
-  seterrobj(CANCELLED);
-  seterrobj(NO_SUCH_OPERATION);
-  seterrobj(TOO_LATE);
-  seterrobj(CANNOT_CANCEL);
-#endif
-
-#ifdef LDAP_ASSERTION_FAILED
-  seterrobj(ASSERTION_FAILED);
-#endif
-
-#ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
-  seterrobj(PROXIED_AUTHORIZATION_DENIED);
-#endif
-
-}
diff --git a/Modules/errors.h b/Modules/errors.h
deleted file mode 100644
index 5bd3576..0000000
--- a/Modules/errors.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/* See https://www.python-ldap.org/ for details. */
-
-#ifndef __h_errors_
-#define __h_errors_
-
-#include "common.h"
-#include "lber.h"
-#include "ldap.h"
-
-extern PyObject* LDAPexception_class;
-extern PyObject* LDAPerror( LDAP*, char*msg );
-extern PyObject* LDAPerror_TypeError(const char *, PyObject *);
-extern void LDAPinit_errors( PyObject* );
-PyObject* LDAPerr(int errnum);
-
-#endif /* __h_errors */
diff --git a/Modules/functions.c b/Modules/functions.c
index ffb6765..a31be05 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -4,7 +4,7 @@
 #include "functions.h"
 #include "LDAPObject.h"
 #include "berval.h"
-#include "errors.h"
+#include "constants.h"
 #include "options.h"
 
 /* ldap_initialize */
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 7e31f72..3f5b2c4 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -4,7 +4,6 @@
 #include "LDAPObject.h"
 #include "ldapcontrol.h"
 #include "berval.h"
-#include "errors.h"
 
 #include "lber.h"
 
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 46c9c8a..ec3a264 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -2,7 +2,6 @@
 
 #include "common.h"
 #include "constants.h"
-#include "errors.h"
 #include "functions.h"
 #include "ldapcontrol.h"
 
@@ -67,8 +66,10 @@ PyObject* init_ldap_module()
 
 	init_pkginfo(m);
 
-	LDAPinit_constants(d);
-	LDAPinit_errors(d);
+	if (LDAPinit_constants(m) == -1) {
+		return NULL;
+	}
+
 	LDAPinit_functions(d);
 	LDAPinit_control(d);
 
diff --git a/Modules/message.c b/Modules/message.c
index 1a289db..babbd25 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -3,7 +3,6 @@
 #include "common.h"
 #include "message.h"
 #include "berval.h"
-#include "errors.h"
 #include "ldapcontrol.h"
 #include "constants.h"
 
diff --git a/Modules/options.c b/Modules/options.c
index 7cf996b..ac1eab6 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -1,7 +1,7 @@
 /* See https://www.python-ldap.org/ for details. */
 
 #include "common.h"
-#include "errors.h"
+#include "constants.h"
 #include "LDAPObject.h"
 #include "ldapcontrol.h"
 #include "options.h"
diff --git a/setup.py b/setup.py
index 2ac63ec..9694fa5 100644
--- a/setup.py
+++ b/setup.py
@@ -136,7 +136,6 @@ class OpenLDAP2:
         'Modules/ldapcontrol.c',
         'Modules/common.c',
         'Modules/constants.c',
-        'Modules/errors.c',
         'Modules/functions.c',
         'Modules/ldapmodule.c',
         'Modules/message.c',

From 4587df60a331b99d695efd2470edf1853b28d8b2 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 22:34:39 +0100
Subject: [PATCH 599/868] Doc: Convert conf.py to Unix line endings

---
 Doc/conf.py | 266 ++++++++++++++++++++++++++--------------------------
 1 file changed, 133 insertions(+), 133 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 9c322de..d40e822 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -1,133 +1,133 @@
-# -*- coding: utf-8 -*-
-#
-# python-ldap documentation build configuration file, created by
-# sphinx-quickstart on Sat Mar 29 15:08:17 2008.
-#
-# This file is execfile()d with the current directory set to its containing dir.
-#
-# The contents of this file are pickled, so don't put values in the namespace
-# that aren't pickleable (module imports are okay, they're removed automatically).
-#
-# All configuration values have a default value; values that are commented out
-# serve to show the default value.
-
-import sys
-
-# If your extensions are in another directory, add it here.
-#sys.path.append('some/directory')
-
-# General configuration
-# ---------------------
-
-# Add any Sphinx extension module names here, as strings. They can be extensions
-# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = ['sphinx.ext.autodoc']
-
-# Add any paths that contain templates here, relative to this directory.
-templates_path = ['.templates']
-
-# The suffix of source filenames.
-source_suffix = '.rst'
-
-# The master toctree document.
-master_doc = 'index'
-
-# General substitutions.
-project = 'python-ldap'
-copyright = '2008-2017, python-ldap project team'
-
-# The default replacements for |version| and |release|, also used in various
-# other places throughout the built documents.
-#
-# The short X.Y version.
-version = '2.5'
-# The full version, including alpha/beta/rc tags.
-release = '2.5.2.0'
-
-# There are two options for replacing |today|: either, you set today to some
-# non-false value, then it is used:
-#today = ''
-# Else, today_fmt is used as the format for a strftime call.
-today_fmt = '%B %d, %Y'
-
-# List of documents that shouldn't be included in the build.
-#unused_docs = []
-
-# If true, '()' will be appended to :func: etc. cross-reference text.
-#add_function_parentheses = True
-
-# If true, the current module name will be prepended to all description
-# unit titles (such as .. function::).
-#add_module_names = True
-
-# If true, sectionauthor and moduleauthor directives will be shown in the
-# output. They are ignored by default.
-#show_authors = False
-
-# The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
-
-
-# Options for HTML output
-# -----------------------
-
-# The style sheet to use for HTML and HTML Help pages. A file of that name
-# must exist either in Sphinx' static/ path, or in one of the custom paths
-# given in html_static_path.
-html_style = 'pyramid.css'
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['/usr/lib/python2.7/site-packages/sphinx/themes/pyramid/static']
-
-# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
-# using the given strftime format.
-html_last_updated_fmt = '%b %d, %Y'
-
-# If true, SmartyPants will be used to convert quotes and dashes to
-# typographically correct entities.
-#html_use_smartypants = True
-
-# Content template for the index page.
-#html_index = ''
-
-# Custom sidebar templates, maps document names to template names.
-#html_sidebars = {}
-
-# Additional templates that should be rendered to pages, maps page names to
-# template names.
-#html_additional_pages = {}
-
-# If false, no module index is generated.
-html_use_modindex = True
-
-# If true, the reST sources are included in the HTML build as _sources/<name>.
-#html_copy_source = True
-
-# Output file base name for HTML help builder.
-htmlhelp_basename = 'python-ldap-doc'
-
-
-# Options for LaTeX output
-# ------------------------
-
-# The paper size ('letter' or 'a4').
-#latex_paper_size = 'letter'
-
-# The font size ('10pt', '11pt' or '12pt').
-#latex_font_size = '10pt'
-
-# Grouping the document tree into LaTeX files. List of tuples
-# (source start file, target name, title, author, document class [howto/manual]).
-latex_documents = [('index', 'python-ldap.tex', 'python-ldap Documentation',
-                    'python-ldap project', 'manual')]
-
-# Additional stuff for the LaTeX preamble.
-#latex_preamble = ''
-
-# Documents to append as an appendix to all manuals.
-#latex_appendices = []
-
-# If false, no module index is generated.
-latex_use_modindex = True
+# -*- coding: utf-8 -*-
+#
+# python-ldap documentation build configuration file, created by
+# sphinx-quickstart on Sat Mar 29 15:08:17 2008.
+#
+# This file is execfile()d with the current directory set to its containing dir.
+#
+# The contents of this file are pickled, so don't put values in the namespace
+# that aren't pickleable (module imports are okay, they're removed automatically).
+#
+# All configuration values have a default value; values that are commented out
+# serve to show the default value.
+
+import sys
+
+# If your extensions are in another directory, add it here.
+#sys.path.append('some/directory')
+
+# General configuration
+# ---------------------
+
+# Add any Sphinx extension module names here, as strings. They can be extensions
+# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
+extensions = ['sphinx.ext.autodoc']
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['.templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General substitutions.
+project = 'python-ldap'
+copyright = '2008-2017, python-ldap project team'
+
+# The default replacements for |version| and |release|, also used in various
+# other places throughout the built documents.
+#
+# The short X.Y version.
+version = '2.5'
+# The full version, including alpha/beta/rc tags.
+release = '2.5.2.0'
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+#today = ''
+# Else, today_fmt is used as the format for a strftime call.
+today_fmt = '%B %d, %Y'
+
+# List of documents that shouldn't be included in the build.
+#unused_docs = []
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+#add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+#add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+#show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+
+# Options for HTML output
+# -----------------------
+
+# The style sheet to use for HTML and HTML Help pages. A file of that name
+# must exist either in Sphinx' static/ path, or in one of the custom paths
+# given in html_static_path.
+html_style = 'pyramid.css'
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['/usr/lib/python2.7/site-packages/sphinx/themes/pyramid/static']
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+html_last_updated_fmt = '%b %d, %Y'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+#html_use_smartypants = True
+
+# Content template for the index page.
+#html_index = ''
+
+# Custom sidebar templates, maps document names to template names.
+#html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+#html_additional_pages = {}
+
+# If false, no module index is generated.
+html_use_modindex = True
+
+# If true, the reST sources are included in the HTML build as _sources/<name>.
+#html_copy_source = True
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'python-ldap-doc'
+
+
+# Options for LaTeX output
+# ------------------------
+
+# The paper size ('letter' or 'a4').
+#latex_paper_size = 'letter'
+
+# The font size ('10pt', '11pt' or '12pt').
+#latex_font_size = '10pt'
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title, author, document class [howto/manual]).
+latex_documents = [('index', 'python-ldap.tex', 'python-ldap Documentation',
+                    'python-ldap project', 'manual')]
+
+# Additional stuff for the LaTeX preamble.
+#latex_preamble = ''
+
+# Documents to append as an appendix to all manuals.
+#latex_appendices = []
+
+# If false, no module index is generated.
+latex_use_modindex = True

From 1bb84f641c16ab41a158c414df7d78fb88b1edcd Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 22:39:20 +0100
Subject: [PATCH 600/868] Doc: Add .gitignore

---
 Doc/.gitignore | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 Doc/.gitignore

diff --git a/Doc/.gitignore b/Doc/.gitignore
new file mode 100644
index 0000000..a485625
--- /dev/null
+++ b/Doc/.gitignore
@@ -0,0 +1 @@
+/_build

From e34bd6b1ee50372918b1201c2e40f7df65064e72 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 23:07:51 +0100
Subject: [PATCH 601/868] Doc: Allow building documentation even without a
 compiled extension

This involves a fake _ldap module and carefully bootstrapping
ldap.__init__ (which imports * from _ldap).
---
 Doc/conf.py                               |  9 ++++++-
 Doc/fake_ldap_module_for_documentation.py | 30 +++++++++++++++++++++++
 Lib/ldap/constants.py                     |  3 +++
 3 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 Doc/fake_ldap_module_for_documentation.py

diff --git a/Doc/conf.py b/Doc/conf.py
index d40e822..d81bf29 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -12,9 +12,16 @@
 # serve to show the default value.
 
 import sys
+import os
 
 # If your extensions are in another directory, add it here.
-#sys.path.append('some/directory')
+_doc_dir = os.path.dirname(__file__)
+sys.path.append(_doc_dir)
+sys.path.append(os.path.join(_doc_dir, '../Lib/'))
+sys.path.insert(0, os.path.join(_doc_dir, '../Lib/ldap'))
+
+# Import fake `_ldap` module
+import fake_ldap_module_for_documentation
 
 # General configuration
 # ---------------------
diff --git a/Doc/fake_ldap_module_for_documentation.py b/Doc/fake_ldap_module_for_documentation.py
new file mode 100644
index 0000000..3080781
--- /dev/null
+++ b/Doc/fake_ldap_module_for_documentation.py
@@ -0,0 +1,30 @@
+"""
+A module that mocks `_ldap` for the purposes of generating documentation
+
+This module provides placeholders for the contents of `_ldap`, making it
+possible to generate documentation even _ldap is not compiled.
+It should also make the documentation independent of which features are
+available in the system OpenLDAP library.
+
+The overly long module name will show up in AttributeError messages,
+hinting that this is not the actual _ldap.
+
+See https://www.python-ldap.org/ for details.
+"""
+
+import sys
+
+# Cause `import _ldap` to import this module instead of the actual `_ldap`.
+sys.modules['_ldap'] = sys.modules[__name__]
+
+from constants import CONSTANTS
+from pkginfo import __version__
+
+for constant in CONSTANTS:
+    globals()[constant.name] = constant
+
+def get_option(num):
+    pass
+
+class LDAPError:
+    pass
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index 6469a30..aafa265 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -10,6 +10,9 @@
 
 """
 
+# This module cannot import anything from ldap.
+# When building documentation, it is used to initialize ldap.__init__.
+
 from __future__ import print_function
 
 class Constant(object):

From 849f36652ddbc1b336aa0b299297d11143c00a98 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 23:28:12 +0100
Subject: [PATCH 602/868] Doc: Get the version from the Python module

---
 Doc/conf.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index d81bf29..43de80a 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -23,6 +23,9 @@
 # Import fake `_ldap` module
 import fake_ldap_module_for_documentation
 
+# Now ldap can be used normally
+from ldap import __version__
+
 # General configuration
 # ---------------------
 
@@ -47,9 +50,9 @@
 # other places throughout the built documents.
 #
 # The short X.Y version.
-version = '2.5'
+version = '.'.join(__version__.split('.')[:2])
 # The full version, including alpha/beta/rc tags.
-release = '2.5.2.0'
+release = __version__
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

From b096d31f1556435d6f6ab615cd597ec5d0ae4e74 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 24 Nov 2017 23:29:08 +0100
Subject: [PATCH 603/868] Doc: Use the default style

The default should be pretty enough.
---
 Doc/conf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 43de80a..63fc24e 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -84,12 +84,12 @@
 # The style sheet to use for HTML and HTML Help pages. A file of that name
 # must exist either in Sphinx' static/ path, or in one of the custom paths
 # given in html_static_path.
-html_style = 'pyramid.css'
+#html_style = 'pyramid.css'
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['/usr/lib/python2.7/site-packages/sphinx/themes/pyramid/static']
+#html_static_path = ['/usr/lib/python2.7/site-packages/sphinx/themes/pyramid/static']
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.

From a3675965499f3a939f7fd6848b2506d2e4ffdd46 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 27 Nov 2017 15:33:45 +0100
Subject: [PATCH 604/868] Modules: Write out error checking in constants.c

---
 Lib/ldap/constants.py         |  5 ++---
 Modules/constants.c           | 30 ++++++++----------------------
 Modules/constants_generated.h | 15 ++++++---------
 3 files changed, 16 insertions(+), 34 deletions(-)

diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index aafa265..c5ac6c1 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -61,11 +61,10 @@ class Feature(Constant):
     c_template = '\n'.join([
         '',
         '#ifdef {self.c_feature}',
-        'result = PyModule_AddIntConstant(m, "{self.name}", 1);',
+        'if (PyModule_AddIntConstant(m, "{self.name}", 1) != 0) return -1;',
         '#else',
-        'result = PyModule_AddIntConstant(m, "{self.name}", 0);',
+        'if (PyModule_AddIntConstant(m, "{self.name}", 0) != 0) return -1;',
         '#endif',
-        'check_result();',
         '',
     ])
 
diff --git a/Modules/constants.c b/Modules/constants.c
index 4fd09b8..8906581 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -131,18 +131,11 @@ int
 LDAPinit_constants( PyObject* m )
 {
     PyObject *exc;
-    int result;
-
-#define check_result() {  \
-    if (result != 0) return -1;  \
-}
 
     /* simple constants */
 
-    result = PyModule_AddIntConstant(m, "OPT_ON", 1);
-    check_result();
-    result = PyModule_AddIntConstant(m, "OPT_OFF", 0);
-    check_result();
+    if (PyModule_AddIntConstant(m, "OPT_ON", 1) != 0) return -1;
+    if (PyModule_AddIntConstant(m, "OPT_OFF", 0) != 0) return -1;
 
     /* exceptions */
 
@@ -151,36 +144,29 @@ LDAPinit_constants( PyObject* m )
         return -1;
     }
 
-    result = PyModule_AddObject(m, "LDAPError", LDAPexception_class);
-    check_result();
+    if (PyModule_AddObject(m, "LDAPError", LDAPexception_class) != 0) return -1;
     Py_INCREF(LDAPexception_class);
 
     /* XXX - backward compatibility with pre-1.8 */
-    result = PyModule_AddObject(m, "error", LDAPexception_class);
-    check_result();
+    if (PyModule_AddObject(m, "error", LDAPexception_class) != 0) return -1;
     Py_INCREF(LDAPexception_class);
 
     /* Generated constants -- see Lib/ldap/constants.py */
 
-#define seterrobj2(n, o) \
-    PyModule_AddObject(m, #n, (errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = o))
-
 #define add_err(n) {  \
     exc = PyErr_NewException("ldap." #n, LDAPexception_class, NULL);  \
     if (exc == NULL) return -1;  \
-    result = seterrobj2(n, exc);  \
-    check_result();  \
+    errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = exc;  \
+    if (PyModule_AddObject(m, #n, exc) != 0) return -1;  \
     Py_INCREF(exc);  \
 }
 
 #define add_int(n) {  \
-    result = PyModule_AddIntConstant(m, #n, LDAP_##n);  \
-    check_result();  \
+    if (PyModule_AddIntConstant(m, #n, LDAP_##n) != 0) return -1;  \
 }
 
 #define add_string(n) {  \
-    result = PyModule_AddStringConstant(m, #n, LDAP_##n);  \
-    check_result();  \
+    if (PyModule_AddStringConstant(m, #n, LDAP_##n) != 0) return -1;  \
 }
 
 #include "constants_generated.h"
diff --git a/Modules/constants_generated.h b/Modules/constants_generated.h
index 27addc9..083ba16 100644
--- a/Modules/constants_generated.h
+++ b/Modules/constants_generated.h
@@ -325,27 +325,24 @@ add_int(URL_ERR_BADSCOPE);
 add_int(URL_ERR_MEM);
 
 #ifdef HAVE_LIBLDAP_R
-result = PyModule_AddIntConstant(m, "LIBLDAP_R", 1);
+if (PyModule_AddIntConstant(m, "LIBLDAP_R", 1) != 0) return -1;
 #else
-result = PyModule_AddIntConstant(m, "LIBLDAP_R", 0);
+if (PyModule_AddIntConstant(m, "LIBLDAP_R", 0) != 0) return -1;
 #endif
-check_result();
 
 
 #ifdef HAVE_SASL
-result = PyModule_AddIntConstant(m, "SASL_AVAIL", 1);
+if (PyModule_AddIntConstant(m, "SASL_AVAIL", 1) != 0) return -1;
 #else
-result = PyModule_AddIntConstant(m, "SASL_AVAIL", 0);
+if (PyModule_AddIntConstant(m, "SASL_AVAIL", 0) != 0) return -1;
 #endif
-check_result();
 
 
 #ifdef HAVE_TLS
-result = PyModule_AddIntConstant(m, "TLS_AVAIL", 1);
+if (PyModule_AddIntConstant(m, "TLS_AVAIL", 1) != 0) return -1;
 #else
-result = PyModule_AddIntConstant(m, "TLS_AVAIL", 0);
+if (PyModule_AddIntConstant(m, "TLS_AVAIL", 0) != 0) return -1;
 #endif
-check_result();
 
 add_string(CONTROL_MANAGEDSAIT);
 add_string(CONTROL_PROXY_AUTHZ);

From 5cbbc49898aa26045a6bd7c2c12b3585fc6517cf Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 27 Nov 2017 15:38:15 +0100
Subject: [PATCH 605/868] Modules: Wrap macros in constants.c in `do {...}
 while (0)`

---
 Modules/constants.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Modules/constants.c b/Modules/constants.c
index 8906581..f0028a0 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -153,21 +153,21 @@ LDAPinit_constants( PyObject* m )
 
     /* Generated constants -- see Lib/ldap/constants.py */
 
-#define add_err(n) {  \
+#define add_err(n) do {  \
     exc = PyErr_NewException("ldap." #n, LDAPexception_class, NULL);  \
     if (exc == NULL) return -1;  \
     errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = exc;  \
     if (PyModule_AddObject(m, #n, exc) != 0) return -1;  \
     Py_INCREF(exc);  \
-}
+} while (0)
 
-#define add_int(n) {  \
+#define add_int(n) do {  \
     if (PyModule_AddIntConstant(m, #n, LDAP_##n) != 0) return -1;  \
-}
+} while (0)
 
-#define add_string(n) {  \
+#define add_string(n) do {  \
     if (PyModule_AddStringConstant(m, #n, LDAP_##n) != 0) return -1;  \
-}
+} while (0)
 
 #include "constants_generated.h"
 

From a06267f2cc9a8fc57c2031d2023ba858dbebcac8 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 27 Nov 2017 16:59:14 +0100
Subject: [PATCH 606/868] Lib: Avoid eval() for getting module-level variables

This is for compatibility with other libraries that inject
extra variables, like unit testing with pytest.

Based on a suggestion by AlanCoding:
https://github.com/python-ldap/python-ldap/pull/25
---
 Lib/ldap/schema/subentry.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 2a42b4c..1c10d21 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -11,8 +11,7 @@
 SCHEMA_CLASS_MAPPING = ldap.cidict.cidict()
 SCHEMA_ATTR_MAPPING = {}
 
-for _name in dir():
-  o = eval(_name)
+for o in list(vars().values()):
   if hasattr(o,'schema_attribute'):
     SCHEMA_CLASS_MAPPING[o.schema_attribute] = o
     SCHEMA_ATTR_MAPPING[o] = o.schema_attribute

From 03d09f0ba20774db9369a2006e705060bd690cea Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sun, 26 Nov 2017 22:16:56 +0100
Subject: [PATCH 607/868] Fix resource leaks in error cases

On several occasions LDAPObject methods did not clean up LDAPControls
and other resources when LDAPControls_from_object() fails. This bug
would lead to memory leaks in case a server control or client control
could not be handled correctly.

Closes: #18
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c | 75 +++++++++++++++++++++++++++++++++-----------
 Tests/t_cext.py      | 47 +++++++++++++++++++++++++++
 2 files changed, 104 insertions(+), 18 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index f1ad0d4..b066cdf 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -351,8 +351,10 @@ l_ldap_unbind_ext( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -392,8 +394,10 @@ l_ldap_abandon_ext( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -434,13 +438,18 @@ l_ldap_add_ext( LDAPObject* self, PyObject *args )
         return NULL;
 
     if (!PyNone_Check(serverctrls)) {
-        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
+            LDAPMods_DEL( mods );
             return NULL;
+        }
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPMods_DEL( mods );
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -482,8 +491,10 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -631,8 +642,10 @@ l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
             return NULL;
     }
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -695,8 +708,10 @@ l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     /* now we extract the sasl mechanism from the SASL Object */
@@ -755,8 +770,10 @@ l_ldap_cancel( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -801,8 +818,10 @@ l_ldap_compare_ext( LDAPObject* self, PyObject *args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -842,8 +861,10 @@ l_ldap_delete_ext( LDAPObject* self, PyObject *args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -884,13 +905,18 @@ l_ldap_modify_ext( LDAPObject* self, PyObject *args )
         return NULL;
 
     if (!PyNone_Check(serverctrls)) {
-        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
+            LDAPMods_DEL( mods );
             return NULL;
+        }
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPMods_DEL( mods );
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -934,8 +960,10 @@ l_ldap_rename( LDAPObject* self, PyObject *args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -1132,13 +1160,18 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(serverctrls)) {
-        if (!LDAPControls_from_object(serverctrls, &server_ldcs))
+        if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
+            free_attrs( &attrs,  attrs_seq);
             return NULL;
+        }
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            free_attrs( &attrs,  attrs_seq);
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -1182,8 +1215,10 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -1290,8 +1325,10 @@ l_ldap_passwd( LDAPObject* self, PyObject *args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -1340,8 +1377,10 @@ l_ldap_extended_operation( LDAPObject* self, PyObject *args )
     }
 
     if (!PyNone_Check(clientctrls)) {
-        if (!LDAPControls_from_object(clientctrls, &client_ldcs))
+        if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
+            LDAPControl_List_DEL( server_ldcs );
             return NULL;
+        }
     }
 
     LDAP_BEGIN_ALLOW_THREADS( self );
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index d4740d0..5aeb03d 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -272,6 +272,13 @@ def test_search_ext_all(self):
         self.assertEqual(msgid, m)
         self.assertEqual(ctrls, [])
 
+    def test_invalid_search_filter(self):
+        l = self._open_conn()
+        with self.assertRaises(_ldap.FILTER_ERROR):
+            l.search_ext(
+                self.server.suffix, _ldap.SCOPE_SUBTREE, 'bogus filter expr'
+            )
+
     def test_add(self):
         """
         test add operation
@@ -726,6 +733,46 @@ def test_invalid_credentials(self):
         else:
             self.fail("expected INVALID_CREDENTIALS, got %r" % r)
 
+    # TODO: test_extop
+
+    def assertInvalidControls(self, func, *args, **kwargs):
+        post = kwargs.pop('post', ())
+        self.assertFalse(kwargs)
+        # last two args are serverctrls, clientctrls
+        with self.assertRaises(TypeError) as e:
+            func(*(args + (object, None) + post))
+        self.assertEqual(e.exception.args, ('expected a list', object))
+        with self.assertRaises(TypeError) as e:
+            func(*(args + (None, object) + post))
+        self.assertEqual(e.exception.args, ('expected a list', object))
+
+    def test_invalid_controls(self):
+        l = self._open_conn()
+        self.assertInvalidControls(l.simple_bind, "", "")
+        self.assertInvalidControls(l.whoami_s)
+        self.assertInvalidControls(l.passwd, 'dn', 'initial', 'changed')
+        self.assertInvalidControls(l.add_ext, 'dn', [('cn', b'cn')])
+        self.assertInvalidControls(
+            l.modify_ext, 'dn', [(_ldap.MOD_ADD, 'attr', [b'value'])])
+        self.assertInvalidControls(l.compare_ext, 'dn', 'val1', 'val2')
+        self.assertInvalidControls(
+            l.rename, 'dn', 'newdn', 'container', False)
+        self.assertInvalidControls(
+            l.search_ext, 'dn', _ldap.SCOPE_SUBTREE, '(objectClass=*)',
+            None, 1)
+        self.assertInvalidControls(l.delete_ext, 'dn')
+        m = l.search_ext(
+            self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        self.assertInvalidControls(l.abandon_ext, m)
+        self.assertInvalidControls(l.cancel, 0)
+        self.assertInvalidControls(l.extop, 'oid', 'value')
+        if hasattr(l, 'sasl_bind_s'):
+            self.assertInvalidControls(l.sasl_bind_s, 'dn', 'MECH', 'CRED')
+        if hasattr(l, 'sasl_interactive_bind_s'):
+            self.assertInvalidControls(
+                l.sasl_interactive_bind_s, 'who', 'SASLObject', post=(1,))
+        self.assertInvalidControls(l.unbind_ext)
+
 
 if __name__ == '__main__':
     unittest.main()

From 54a286b41744fbb1bc5296611d72a33d889a681b Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 11:00:23 +0100
Subject: [PATCH 608/868] C extension reference leak testing

Add documentation how to run refleak tests with pydebug build of
CPython and pytest-refleak. Refleak testing runs each unit test multiple
times. Some small changes are required to clean up after each test cycle
and to avoid extra references.

* Only create logging structure for SlapdObject once. The logging
  framework creates reference cycles that cause false positives.
* Clean up and remove atexit handlers in SlapdObject.stop()
* Remove new entries at the end of each test, either with an
  explicit delete_s() or an write area, which is removed in tearDown().

https://github.com/python-ldap/python-ldap/pull/41
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 INSTALL          | 34 ++++++++++++++++++++++++
 Lib/slapdtest.py | 44 ++++++++++++++++++++++++++-----
 Tests/t_cext.py  | 68 ++++++++++++++++++++++++++++++++++++------------
 Tests/t_edit.py  |  6 +++++
 4 files changed, 129 insertions(+), 23 deletions(-)

diff --git a/INSTALL b/INSTALL
index 98dd40c..57b00b7 100644
--- a/INSTALL
+++ b/INSTALL
@@ -24,3 +24,37 @@ Quick build instructions:
     edit setup.cfg (see Build/ for platform-specific examples)
     python setup.py build
     python setup.py install
+
+--------------------
+Reference leak tests
+--------------------
+
+Reference leak tests require a pydebug build of CPython and pytest with
+pytest-leaks plugin. A pydebug build has a global reference counter, which
+keeps track of all reference increments and decrements. The leak plugin runs
+each tests multiple times and checks if the reference count increases.
+
+Download and compile pydebug build
+----------------------------------
+
+- curl -O https://www.python.org/ftp/python/3.6.3/Python-3.6.3.tar.xz
+- tar xJf Python-3.6.3.tar.xz
+- cd Python-3.6.3
+- ./configure --with-pydebug
+- make
+
+Create virtual env
+------------------
+
+- ./python -m venv /tmp/refleak
+- /tmp/refleak/bin/pip install pytest pytest-leaks
+
+Run refleak tests
+-----------------
+
+- cd path/to/python-ldap
+- /tmp/refleak/bin/pip install --upgrade .
+- /tmp/refleak/bin/pytest -v -R: Tests/t_*.py
+
+Run ``/tmp/refleak/bin/pip install --upgrade .`` every time a file outside
+of ``Tests/`` is modified.
\ No newline at end of file
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 4955420..0bef1c1 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -117,6 +117,7 @@ class SlapdObject(object):
     else:
         SCHEMADIR = None
     PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
+    PATH_LDAPDELETE = os.path.join(BINDIR, 'ldapdelete')
     PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
     PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
     PATH_SLAPD = os.environ.get('SLAPD', os.path.join(SBINDIR, 'slapd'))
@@ -125,8 +126,10 @@ class SlapdObject(object):
     # time in secs to wait before trying to access slapd via LDAP (again)
     _start_sleep = 1.5
 
+    # create loggers once, multiple calls mess up refleak tests
+    _log = combined_logger('python-ldap-test')
+
     def __init__(self):
-        self._log = combined_logger('python-ldap-test')
         self._proc = None
         self._port = self._avail_tcp_port()
         self.server_id = self._port % 4096
@@ -189,9 +192,11 @@ def _avail_tcp_port(self):
         find an available port for TCP connection
         """
         sock = socket.socket()
-        sock.bind((self.local_host, 0))
-        port = sock.getsockname()[1]
-        sock.close()
+        try:
+            sock.bind((self.local_host, 0))
+            port = sock.getsockname()[1]
+        finally:
+            sock.close()
         self._log.info('Found available port %d', port)
         return port
 
@@ -316,6 +321,15 @@ def stop(self):
             self._proc.terminate()
             self.wait()
         self._cleanup_rundir()
+        if hasattr(atexit, 'unregister'):
+            # Python 3
+            atexit.unregister(self.stop)
+        elif hasattr(atexit, '_exithandlers'):
+            # Python 2, can be None during process shutdown
+            try:
+                atexit._exithandlers.remove(self.stop)
+            except ValueError:
+                pass
 
     def restart(self):
         """
@@ -358,7 +372,10 @@ def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None, stdin_data=Non
             '-H', ldap_uri or self.ldapi_uri,
         ] + self._cli_auth_args() + (extra_args or [])
         self._log.debug('Run command: %r', ' '.join(args))
-        proc = subprocess.Popen(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+        proc = subprocess.Popen(
+            args, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE
+        )
         self._log.debug('stdin_data=%r', stdin_data)
         stdout_data, stderr_data = proc.communicate(stdin_data)
         if stdout_data is not None:
@@ -366,7 +383,11 @@ def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None, stdin_data=Non
         if stderr_data is not None:
             self._log.debug('stderr_data=%r', stderr_data)
         if proc.wait() != 0:
-            raise RuntimeError('ldapadd process failed')
+            raise RuntimeError(
+                '{!r} process failed:\n{!r}\n{!r}'.format(
+                    args, stdout_data, stderr_data
+                )
+            )
         return stdout_data, stderr_data
 
     def ldapwhoami(self, extra_args=None):
@@ -389,6 +410,17 @@ def ldapmodify(self, ldif, extra_args=None):
         self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args,
                         stdin_data=ldif.encode('utf-8'))
 
+    def ldapdelete(self, dn, recursive=False, extra_args=None):
+        """
+        Runs ldapdelete on this slapd instance, deleting 'dn'
+        """
+        if extra_args is None:
+            extra_args = []
+        if recursive:
+            extra_args.append('-r')
+        extra_args.append(dn)
+        self._cli_popen(self.PATH_LDAPDELETE, extra_args=extra_args)
+
 
 class SlapdTestCase(unittest.TestCase):
     """
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 5aeb03d..6998e73 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -51,6 +51,40 @@ def setUpClass(cls):
             ])
         )
 
+    def setUp(self):
+        super(TestLdapCExtension, self).setUp()
+        self._writesuffix = None
+
+    def tearDown(self):
+        # cleanup test subtree
+        if self._writesuffix is not None:
+            self.server.ldapdelete(self._writesuffix, recursive=True)
+        super(TestLdapCExtension, self).tearDown()
+
+    @property
+    def writesuffix(self):
+        """Initialize writesuffix on demand
+
+        Creates a clean subtree for tests that write to slapd. ldapdelete
+        is not able to delete a Root DSE, therefore we need a temporary
+        work space.
+
+        :return: DN
+        """
+        if self._writesuffix is not None:
+            return self._writesuffix
+        self._writesuffix = 'ou=write tests,%s' % self.server.suffix
+        # Add writeable subtree
+        self.server.ldapadd(
+            "\n".join([
+                'dn: ' + self._writesuffix,
+                'objectClass: organizationalUnit',
+                'ou:' + self._writesuffix.split(',')[0][3:],
+                ''
+            ])
+        )
+        return self._writesuffix
+
     def _open_conn(self, bind=True):
         """
         Starts a server, and returns a LDAPObject bound to it
@@ -285,7 +319,7 @@ def test_add(self):
         """
         l = self._open_conn()
         m = l.add_ext(
-            "cn=Foo," + self.server.suffix,
+            "cn=Foo," + self.writesuffix,
             [
                 ('objectClass', b'organizationalRole'),
                 ('cn', b'Foo'),
@@ -299,7 +333,7 @@ def test_add(self):
         self.assertEqual(msgid, m)
         self.assertEqual(ctrls, [])
         # search for it back
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(cn=Foo)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         # Expect to get the objects
         self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
@@ -309,7 +343,7 @@ def test_add(self):
         self.assertEqual(
             pmsg[0],
             (
-                'cn=Foo,'+self.server.suffix,
+                'cn=Foo,'+self.writesuffix,
                 {
                     'objectClass': [b'organizationalRole'],
                     'cn': [b'Foo'],
@@ -324,7 +358,7 @@ def test_compare(self):
         """
         l = self._open_conn()
         # first, add an object with a field we can compare on
-        dn = "cn=CompareTest," + self.server.suffix
+        dn = "cn=CompareTest," + self.writesuffix
         m = l.add_ext(
             dn,
             [
@@ -378,7 +412,7 @@ def test_delete_no_such_object(self):
     def test_delete(self):
         l = self._open_conn()
         # first, add an object we will delete
-        dn = "cn=Deleteme,"+self.server.suffix
+        dn = "cn=Deleteme,"+self.writesuffix
         m = l.add_ext(
             dn,
             [
@@ -402,7 +436,7 @@ def test_modify_no_such_object(self):
 
         # try deleting an object that doesn't exist
         m = l.modify_ext(
-            "cn=DoesNotExist,"+self.server.suffix,
+            "cn=DoesNotExist,"+self.writesuffix,
             [
                 (_ldap.MOD_ADD, 'description', [b'blah']),
             ]
@@ -439,7 +473,7 @@ def test_modify(self):
         """
         l = self._open_conn()
         # first, add an object we will delete
-        dn = "cn=AddToMe,"+self.server.suffix
+        dn = "cn=AddToMe,"+self.writesuffix
         m = l.add_ext(
             dn,
             [
@@ -465,7 +499,7 @@ def test_modify(self):
         self.assertEqual(msgid, m)
         self.assertEqual(ctrls, [])
         # search for it back
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(cn=AddToMe)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         # Expect to get the objects
         self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
@@ -479,7 +513,7 @@ def test_modify(self):
 
     def test_rename(self):
         l = self._open_conn()
-        dn = "cn=RenameMe,"+self.server.suffix
+        dn = "cn=RenameMe,"+self.writesuffix
         m = l.add_ext(
             dn,
             [
@@ -500,7 +534,7 @@ def test_rename(self):
         self.assertEqual(ctrls, [])
 
         # make sure the old one is gone
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(cn=RenameMe)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
         self.assertEqual(len(pmsg), 0) # expect no results
@@ -508,8 +542,8 @@ def test_rename(self):
         self.assertEqual(ctrls, [])
 
         # check that the new one looks right
-        dn2 = "cn=IAmRenamed,"+self.server.suffix
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
+        dn2 = "cn=IAmRenamed,"+self.writesuffix
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
         self.assertEqual(msgid, m)
@@ -519,7 +553,7 @@ def test_rename(self):
         self.assertEqual(pmsg[0][1]['cn'], [b'IAmRenamed'])
 
         # create the container
-        containerDn = "ou=RenameContainer,"+self.server.suffix
+        containerDn = "ou=RenameContainer,"+self.writesuffix
         m = l.add_ext(
             containerDn,
             [
@@ -542,18 +576,18 @@ def test_rename(self):
         self.assertEqual(ctrls, [])
 
         # make sure dn2 is gone
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamed)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
         self.assertEqual(len(pmsg), 0) # expect no results
         self.assertEqual(msgid, m)
         self.assertEqual(ctrls, [])
 
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
 
         # make sure dn3 is there
-        m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
+        m = l.search_ext(self.writesuffix, _ldap.SCOPE_SUBTREE, '(cn=IAmRenamedAgain)')
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEqual(result, _ldap.RES_SEARCH_RESULT)
         self.assertEqual(msgid, m)
@@ -595,7 +629,7 @@ def test_whoami_after_unbind(self):
     def test_passwd(self):
         l = self._open_conn()
         # first, create a user to change password on
-        dn = "cn=PasswordTest," + self.server.suffix
+        dn = "cn=PasswordTest," + self.writesuffix
         m = l.add_ext(
             dn,
             [
diff --git a/Tests/t_edit.py b/Tests/t_edit.py
index 9aee43e..df4529a 100644
--- a/Tests/t_edit.py
+++ b/Tests/t_edit.py
@@ -83,6 +83,12 @@ def test_add_object(self):
             ("cn=Added,ou=Container," + base,
                 {'cn': [b'Added'], 'objectClass': [b'organizationalRole']}),
         ])
+        # Delete object
+        self.ldap.delete_s(dn)
+        result = self.ldap.search_s(
+            base, ldap.SCOPE_SUBTREE, '(cn=Added)', ['*']
+        )
+        self.assertEqual(result, [])
 
 
 if __name__ == '__main__':

From 5dcf6e8dda168db39192d5f23637b01e60f25af2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 11:07:35 +0100
Subject: [PATCH 609/868] Add make target for scan-build

Scan-build is a frontend to clang's static code analyzer. It checks C
code for bugs.

https://github.com/python-ldap/python-ldap/pull/39
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Makefile | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Makefile b/Makefile
index 47fac90..1ee3eda 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,9 @@
+PYTHON=python3
 LCOV_INFO=build/lcov.info
 LCOV_REPORT=build/lcov_report
 LCOV_REPORT_OPTIONS=--show-details -no-branch-coverage \
 	--title "python-ldap LCOV report"
+SCAN_REPORT=build/scan_report
 
 .NOTPARALLEL:
 
@@ -40,3 +42,10 @@ lcov-open: $(LCOV_REPORT)
 lcov: lcov-clean
 	$(MAKE) lcov-coverage
 	$(MAKE) lcov-report
+
+# clang-analyzer for static C code analysis
+.PHONY: scan-build
+scan-build:
+	scan-build -o $(SCAN_REPORT) --html-title="python-ldap scan report" \
+		-analyze-headers --view \
+		$(PYTHON) setup.py clean --all build

From 0778a20f8b9aa4d5ade759236b167cf0b234b1d4 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 11:10:13 +0100
Subject: [PATCH 610/868] Fix reference leak in result4

Two error cases are missing a Py_XDECREF(valuestr). A password change
with an invalid old password triggers a reference leak.

Closes: https://github.com/python-ldap/python-ldap/issues/37
https://github.com/python-ldap/python-ldap/pull/38
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index b066cdf..1c0591c 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -998,7 +998,7 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     PyObject *result_str, *retval, *pmsg, *pyctrls = 0;
     int res_msgid = 0;
     char *retoid = 0;
-    PyObject *valuestr = 0;
+    PyObject *valuestr = NULL;
 
     if (!PyArg_ParseTuple( args, "|iidiii", &msgid, &all, &timeout, &add_ctrls, &add_intermediates, &add_extop ))
         return NULL;
@@ -1071,6 +1071,7 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
         } else
             e = "ldap_parse_result";
         ldap_msgfree(msg);
+        Py_XDECREF(valuestr);
         return LDAPerror( self->ldap, e );
     }
 
@@ -1080,6 +1081,7 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
         ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &err);
         LDAP_END_ALLOW_THREADS( self );
         ldap_msgfree(msg);
+        Py_XDECREF(valuestr);
         return LDAPerror(self->ldap, "LDAPControls_to_List");
     }
     ldap_controls_free(serverctrls);
@@ -1108,9 +1110,7 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
         Py_DECREF(pmsg);
         }
     }
-    if (valuestr) {
-        Py_DECREF(valuestr);
-    }
+    Py_XDECREF(valuestr);
     Py_XDECREF(pyctrls);
     Py_DECREF(result_str);
     return retval;

From 9f6f1428fed9976f1215ea80a49004ddad7e96f4 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 11:15:32 +0100
Subject: [PATCH 611/868] Add depends=[headers] to setup.py

Any modification of a header file now triggers a rebuild of the C
extension module.

Closes: https://github.com/python-ldap/python-ldap/pull/33
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 setup.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/setup.py b/setup.py
index 9694fa5..f09d9c3 100644
--- a/setup.py
+++ b/setup.py
@@ -142,6 +142,17 @@ class OpenLDAP2:
         'Modules/options.c',
         'Modules/berval.c',
       ],
+      depends = [
+        'Modules/LDAPObject.h',
+        'Modules/berval.h',
+        'Modules/common.h',
+        'Modules/constants_generated.h',
+        'Modules/constants.h',
+        'Modules/functions.h',
+        'Modules/ldapcontrol.h',
+        'Modules/message.h',
+        'Modules/options.h',
+      ],
       libraries = LDAP_CLASS.libs,
       include_dirs = ['Modules'] + LDAP_CLASS.include_dirs,
       library_dirs = LDAP_CLASS.library_dirs,

From 4b976714e054b52b52a254529dfcc1ad42dd99da Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 11:19:41 +0100
Subject: [PATCH 612/868] Run tests with warnings and bytes warnings

All warnings except expected warnings are turned into exceptions.

Fixed a resource warning in schema test case.

Rename Tests/ldif to Tests/data to prevent an ImportWarning with Python 2:

    Traceback (most recent call last):
    ...
    ImportWarning: Not importing directory 'Tests/ldif': missing __init__.py

https://github.com/python-ldap/python-ldap/pull/15
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .../subschema-ipa.demo1.freeipa.org.ldif           |  0
 Tests/{ldif => data}/subschema-openldap-all.ldif   |  0
 Tests/t_ldap_schema_subentry.py                    | 13 ++++++++-----
 tox.ini                                            | 14 +++++++++++++-
 4 files changed, 21 insertions(+), 6 deletions(-)
 rename Tests/{ldif => data}/subschema-ipa.demo1.freeipa.org.ldif (100%)
 rename Tests/{ldif => data}/subschema-openldap-all.ldif (100%)

diff --git a/Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif b/Tests/data/subschema-ipa.demo1.freeipa.org.ldif
similarity index 100%
rename from Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif
rename to Tests/data/subschema-ipa.demo1.freeipa.org.ldif
diff --git a/Tests/ldif/subschema-openldap-all.ldif b/Tests/data/subschema-openldap-all.ldif
similarity index 100%
rename from Tests/ldif/subschema-openldap-all.ldif
rename to Tests/data/subschema-openldap-all.ldif
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 83ed006..ee79072 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -5,6 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
+import os
 import unittest
 import time
 
@@ -12,9 +13,11 @@
 import ldap.schema
 from ldap.schema.models import ObjectClass
 
+HERE = os.path.abspath(os.path.dirname(__file__))
+
 TEST_SUBSCHEMA_FILES = (
-    'Tests/ldif/subschema-ipa.demo1.freeipa.org.ldif',
-    'Tests/ldif/subschema-openldap-all.ldif',
+    os.path.join(HERE, 'data', 'subschema-ipa.demo1.freeipa.org.ldif'),
+    os.path.join(HERE, 'data', 'subschema-openldap-all.ldif'),
 )
 
 class TestSubschemaLDIF(unittest.TestCase):
@@ -25,9 +28,9 @@ class TestSubschemaLDIF(unittest.TestCase):
     def test_subschema_file(self):
         for test_file in TEST_SUBSCHEMA_FILES:
             # Read and parse LDIF file
-            ldif_file = open(test_file, 'rb')
-            ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
-            ldif_parser.parse()
+            with open(test_file, 'rb') as ldif_file:
+                ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
+                ldif_parser.parse()
             _, subschema_subentry = ldif_parser.all_records[0]
             sub_schema = ldap.schema.SubSchema(subschema_subentry)
 
diff --git a/tox.ini b/tox.ini
index b2d435c..22ca4a8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,8 +9,20 @@ envlist = py27,py33,py34,py35,py36,coverage-report
 
 [testenv]
 deps = coverage
-commands = {envpython} -m coverage run --parallel setup.py test
 passenv = WITH_GCOV
+# - Enable BytesWarning 
+# - Turn all warnings into exceptions.
+# - 'ignore:the imp module is deprecated' is required to ignore import of
+#   'imp' in distutils. Python 3.3 and 3.4 use PendingDeprecationWarning.
+commands = {envpython} -bb -Werror \
+    "-Wignore:the imp module is deprecated:DeprecationWarning" \
+    "-Wignore:the imp module is deprecated:PendingDeprecationWarning" \
+    -m coverage run --parallel setup.py test
+
+[testenv:py27]
+# No warnings with Python 2.7
+commands = {envpython} \
+    -m coverage run --parallel setup.py test
 
 [testenv:coverage-report]
 deps = coverage

From f7012e7bfd717beba2d0e5b96240533c989d4146 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 17:01:08 +0100
Subject: [PATCH 613/868] Doc: Convert Makefile and index.rst to Unix line
 endings

---
 Doc/Makefile  | 136 +++++++++++++++++++++---------------------
 Doc/index.rst | 160 +++++++++++++++++++++++++-------------------------
 2 files changed, 148 insertions(+), 148 deletions(-)

diff --git a/Doc/Makefile b/Doc/Makefile
index 5c8c6f1..9ce697a 100644
--- a/Doc/Makefile
+++ b/Doc/Makefile
@@ -1,68 +1,68 @@
-# Makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line.
-SPHINXOPTS    =
-SPHINXBUILD   = sphinx-build
-PAPER         =
-
-# Internal variables.
-PAPEROPT_a4     = -D latex_paper_size=a4
-PAPEROPT_letter = -D latex_paper_size=letter
-ALLSPHINXOPTS   = -d .build/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
-
-.PHONY: help clean html web htmlhelp latex changes linkcheck
-
-help:
-	@echo "Please use \`make <target>' where <target> is one of"
-	@echo "  html      to make standalone HTML files"
-	@echo "  web       to make files usable by Sphinx.web"
-	@echo "  htmlhelp  to make HTML files and a HTML help project"
-	@echo "  latex     to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
-	@echo "  changes   to make an overview over all changed/added/deprecated items"
-	@echo "  linkcheck to check all external links for integrity"
-
-clean:
-	-rm -rf .build/*
-
-html:
-	mkdir -p .build/html .build/doctrees
-	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) .build/html
-	@echo
-	@echo "Build finished. The HTML pages are in .build/html."
-
-web:
-	mkdir -p .build/web .build/doctrees
-	$(SPHINXBUILD) -b web $(ALLSPHINXOPTS) .build/web
-	@echo
-	@echo "Build finished; now you can run"
-	@echo "  python -m sphinx.web .build/web"
-	@echo "to start the server."
-
-htmlhelp:
-	mkdir -p .build/htmlhelp .build/doctrees
-	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) .build/htmlhelp
-	@echo
-	@echo "Build finished; now you can run HTML Help Workshop with the" \
-	      ".hhp project file in .build/htmlhelp."
-
-latex:
-	mkdir -p .build/latex .build/doctrees
-	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) .build/latex
-	@echo
-	@echo "Build finished; the LaTeX files are in .build/latex."
-	@echo "Run \`make all-pdf' or \`make all-ps' in that directory to" \
-	      "run these through (pdf)latex."
-
-changes:
-	mkdir -p .build/changes .build/doctrees
-	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) .build/changes
-	@echo
-	@echo "The overview file is in .build/changes."
-
-linkcheck:
-	mkdir -p .build/linkcheck .build/doctrees
-	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) .build/linkcheck
-	@echo
-	@echo "Link check complete; look for any errors in the above output " \
-	      "or in .build/linkcheck/output.txt."
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+PAPER         =
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d .build/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help clean html web htmlhelp latex changes linkcheck
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html      to make standalone HTML files"
+	@echo "  web       to make files usable by Sphinx.web"
+	@echo "  htmlhelp  to make HTML files and a HTML help project"
+	@echo "  latex     to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  changes   to make an overview over all changed/added/deprecated items"
+	@echo "  linkcheck to check all external links for integrity"
+
+clean:
+	-rm -rf .build/*
+
+html:
+	mkdir -p .build/html .build/doctrees
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) .build/html
+	@echo
+	@echo "Build finished. The HTML pages are in .build/html."
+
+web:
+	mkdir -p .build/web .build/doctrees
+	$(SPHINXBUILD) -b web $(ALLSPHINXOPTS) .build/web
+	@echo
+	@echo "Build finished; now you can run"
+	@echo "  python -m sphinx.web .build/web"
+	@echo "to start the server."
+
+htmlhelp:
+	mkdir -p .build/htmlhelp .build/doctrees
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) .build/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in .build/htmlhelp."
+
+latex:
+	mkdir -p .build/latex .build/doctrees
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) .build/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in .build/latex."
+	@echo "Run \`make all-pdf' or \`make all-ps' in that directory to" \
+	      "run these through (pdf)latex."
+
+changes:
+	mkdir -p .build/changes .build/doctrees
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) .build/changes
+	@echo
+	@echo "The overview file is in .build/changes."
+
+linkcheck:
+	mkdir -p .build/linkcheck .build/doctrees
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) .build/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in .build/linkcheck/output.txt."
diff --git a/Doc/index.rst b/Doc/index.rst
index 1f9bf6a..8a7974e 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -1,80 +1,80 @@
-##########################
-python-ldap Documentation
-##########################
-
-.. topic:: Abstract
-
-   This document describes the package python-ldap with its various modules.
-
-   Depending on what you want to do this manual assumes basic to expert
-   knowledge about the Python language and the LDAP standard (LDAPv3).
-
-
-********
-Contents
-********
-
-.. toctree::
-   :maxdepth: 3
-
-   installing.rst
-   ldap.rst
-   ldap-async.rst
-   ldap-controls.rst
-   ldap-dn.rst
-   ldap-extop.rst
-   ldap-filter.rst
-   ldap-modlist.rst
-   ldap-resiter.rst
-   ldap-schema.rst
-   ldap-syncrepl.rst
-   ldap-sasl.rst
-   ldif.rst
-   ldapurl.rst
-   slapdtest.rst
-
-
-
-*********************
-Bytes/text management
-*********************
-
-The LDAP protocol states that some fields (distinguised names, relative distinguished names,
-attribute names, queries) be encoded in UTF-8; some other (mostly attribute *values*) **MAY**
-contain any type of data, and thus be treated as bytes.
-
-In Python 2, ``python-ldap`` used bytes for all fields, including those guaranteed to be text.
-In order to support Python 3, this distinction is made explicit. This is done
-through the ``bytes_mode`` flag to ``ldap.initialize()``.
-
-When porting from ``python-ldap`` 2.x, users are advised to update their code to set ``bytes_mode=False``
-on calls to these methods.
-Under Python 2, ``python-pyldap`` aggressively checks the type of provided arguments, and will raise a ``TypeError``
-for any invalid parameter.
-However, if the ``bytes_mode`` kwarg isn't provided, ``pyldap`` will only
-raise warnings.
-
-The typical usage is as follows; note that only the result's *values* are of the bytes type:
-
-.. code-block:: pycon
-
-    >>> import ldap
-    >>> con = ldap.initialize('ldap://localhost:389', bytes_mode=False)
-    >>> con.simple_bind_s('login', 'secret_password')
-    >>> results = con.search_s('ou=people,dc=example,dc=org', ldap.SCOPE_SUBTREE, "(cn=Raphaël)")
-    >>> results
-    [
-        ("cn=Raphaël,ou=people,dc=example,dc=org", {
-            'cn': [b'Rapha\xc3\xabl'],
-            'sn': [b'Barrois'],
-        }),
-    ]
-
-
-******************
-Indices and tables
-******************
-
-* :ref:`genindex`
-* :ref:`modindex`
-* :ref:`search`
+##########################
+python-ldap Documentation
+##########################
+
+.. topic:: Abstract
+
+   This document describes the package python-ldap with its various modules.
+
+   Depending on what you want to do this manual assumes basic to expert
+   knowledge about the Python language and the LDAP standard (LDAPv3).
+
+
+********
+Contents
+********
+
+.. toctree::
+   :maxdepth: 3
+
+   installing.rst
+   ldap.rst
+   ldap-async.rst
+   ldap-controls.rst
+   ldap-dn.rst
+   ldap-extop.rst
+   ldap-filter.rst
+   ldap-modlist.rst
+   ldap-resiter.rst
+   ldap-schema.rst
+   ldap-syncrepl.rst
+   ldap-sasl.rst
+   ldif.rst
+   ldapurl.rst
+   slapdtest.rst
+
+
+
+*********************
+Bytes/text management
+*********************
+
+The LDAP protocol states that some fields (distinguised names, relative distinguished names,
+attribute names, queries) be encoded in UTF-8; some other (mostly attribute *values*) **MAY**
+contain any type of data, and thus be treated as bytes.
+
+In Python 2, ``python-ldap`` used bytes for all fields, including those guaranteed to be text.
+In order to support Python 3, this distinction is made explicit. This is done
+through the ``bytes_mode`` flag to ``ldap.initialize()``.
+
+When porting from ``python-ldap`` 2.x, users are advised to update their code to set ``bytes_mode=False``
+on calls to these methods.
+Under Python 2, ``python-pyldap`` aggressively checks the type of provided arguments, and will raise a ``TypeError``
+for any invalid parameter.
+However, if the ``bytes_mode`` kwarg isn't provided, ``pyldap`` will only
+raise warnings.
+
+The typical usage is as follows; note that only the result's *values* are of the bytes type:
+
+.. code-block:: pycon
+
+    >>> import ldap
+    >>> con = ldap.initialize('ldap://localhost:389', bytes_mode=False)
+    >>> con.simple_bind_s('login', 'secret_password')
+    >>> results = con.search_s('ou=people,dc=example,dc=org', ldap.SCOPE_SUBTREE, "(cn=Raphaël)")
+    >>> results
+    [
+        ("cn=Raphaël,ou=people,dc=example,dc=org", {
+            'cn': [b'Rapha\xc3\xabl'],
+            'sn': [b'Barrois'],
+        }),
+    ]
+
+
+******************
+Indices and tables
+******************
+
+* :ref:`genindex`
+* :ref:`modindex`
+* :ref:`search`

From fa090f9838fb583a2888d77c3099882c863875f9 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 17:02:03 +0100
Subject: [PATCH 614/868] Doc: Move module reference to a subdirectory

As more non-reference documentation is added, it becomes convenient to
create a new namespace for the API docs, so it's not lost between others.

Not included: redirects from old to new names on the hosted documentation
(this will be handled in Read the Docs configuration).
---
 Doc/index.rst                         | 25 ++-----------------------
 Doc/reference/index.rst               | 26 ++++++++++++++++++++++++++
 Doc/{ => reference}/ldap-async.rst    |  0
 Doc/{ => reference}/ldap-controls.rst |  0
 Doc/{ => reference}/ldap-dn.rst       |  0
 Doc/{ => reference}/ldap-extop.rst    |  0
 Doc/{ => reference}/ldap-filter.rst   |  0
 Doc/{ => reference}/ldap-modlist.rst  |  0
 Doc/{ => reference}/ldap-resiter.rst  |  0
 Doc/{ => reference}/ldap-sasl.rst     |  0
 Doc/{ => reference}/ldap-schema.rst   |  0
 Doc/{ => reference}/ldap-syncrepl.rst |  0
 Doc/{ => reference}/ldap.rst          |  0
 Doc/{ => reference}/ldapurl.rst       |  0
 Doc/{ => reference}/ldif.rst          |  0
 Doc/{ => reference}/slapdtest.rst     |  0
 16 files changed, 28 insertions(+), 23 deletions(-)
 create mode 100644 Doc/reference/index.rst
 rename Doc/{ => reference}/ldap-async.rst (100%)
 rename Doc/{ => reference}/ldap-controls.rst (100%)
 rename Doc/{ => reference}/ldap-dn.rst (100%)
 rename Doc/{ => reference}/ldap-extop.rst (100%)
 rename Doc/{ => reference}/ldap-filter.rst (100%)
 rename Doc/{ => reference}/ldap-modlist.rst (100%)
 rename Doc/{ => reference}/ldap-resiter.rst (100%)
 rename Doc/{ => reference}/ldap-sasl.rst (100%)
 rename Doc/{ => reference}/ldap-schema.rst (100%)
 rename Doc/{ => reference}/ldap-syncrepl.rst (100%)
 rename Doc/{ => reference}/ldap.rst (100%)
 rename Doc/{ => reference}/ldapurl.rst (100%)
 rename Doc/{ => reference}/ldif.rst (100%)
 rename Doc/{ => reference}/slapdtest.rst (100%)

diff --git a/Doc/index.rst b/Doc/index.rst
index 8a7974e..476e9cc 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -2,36 +2,15 @@
 python-ldap Documentation
 ##########################
 
-.. topic:: Abstract
-
-   This document describes the package python-ldap with its various modules.
-
-   Depending on what you want to do this manual assumes basic to expert
-   knowledge about the Python language and the LDAP standard (LDAPv3).
-
-
 ********
 Contents
 ********
 
 .. toctree::
-   :maxdepth: 3
+   :maxdepth: 2
 
    installing.rst
-   ldap.rst
-   ldap-async.rst
-   ldap-controls.rst
-   ldap-dn.rst
-   ldap-extop.rst
-   ldap-filter.rst
-   ldap-modlist.rst
-   ldap-resiter.rst
-   ldap-schema.rst
-   ldap-syncrepl.rst
-   ldap-sasl.rst
-   ldif.rst
-   ldapurl.rst
-   slapdtest.rst
+   reference/index.rst
 
 
 
diff --git a/Doc/reference/index.rst b/Doc/reference/index.rst
new file mode 100644
index 0000000..fa45b84
--- /dev/null
+++ b/Doc/reference/index.rst
@@ -0,0 +1,26 @@
+python-ldap Reference Documentation
+===================================
+
+This document describes the package python-ldap with its various modules.
+
+Depending on what you want to do this manual assumes basic to expert
+knowledge about the Python language and the LDAP standard (LDAPv3).
+
+
+.. toctree::
+   :maxdepth: 3
+
+   ldap.rst
+   ldap-async.rst
+   ldap-controls.rst
+   ldap-dn.rst
+   ldap-extop.rst
+   ldap-filter.rst
+   ldap-modlist.rst
+   ldap-resiter.rst
+   ldap-schema.rst
+   ldap-syncrepl.rst
+   ldap-sasl.rst
+   ldif.rst
+   ldapurl.rst
+   slapdtest.rst
diff --git a/Doc/ldap-async.rst b/Doc/reference/ldap-async.rst
similarity index 100%
rename from Doc/ldap-async.rst
rename to Doc/reference/ldap-async.rst
diff --git a/Doc/ldap-controls.rst b/Doc/reference/ldap-controls.rst
similarity index 100%
rename from Doc/ldap-controls.rst
rename to Doc/reference/ldap-controls.rst
diff --git a/Doc/ldap-dn.rst b/Doc/reference/ldap-dn.rst
similarity index 100%
rename from Doc/ldap-dn.rst
rename to Doc/reference/ldap-dn.rst
diff --git a/Doc/ldap-extop.rst b/Doc/reference/ldap-extop.rst
similarity index 100%
rename from Doc/ldap-extop.rst
rename to Doc/reference/ldap-extop.rst
diff --git a/Doc/ldap-filter.rst b/Doc/reference/ldap-filter.rst
similarity index 100%
rename from Doc/ldap-filter.rst
rename to Doc/reference/ldap-filter.rst
diff --git a/Doc/ldap-modlist.rst b/Doc/reference/ldap-modlist.rst
similarity index 100%
rename from Doc/ldap-modlist.rst
rename to Doc/reference/ldap-modlist.rst
diff --git a/Doc/ldap-resiter.rst b/Doc/reference/ldap-resiter.rst
similarity index 100%
rename from Doc/ldap-resiter.rst
rename to Doc/reference/ldap-resiter.rst
diff --git a/Doc/ldap-sasl.rst b/Doc/reference/ldap-sasl.rst
similarity index 100%
rename from Doc/ldap-sasl.rst
rename to Doc/reference/ldap-sasl.rst
diff --git a/Doc/ldap-schema.rst b/Doc/reference/ldap-schema.rst
similarity index 100%
rename from Doc/ldap-schema.rst
rename to Doc/reference/ldap-schema.rst
diff --git a/Doc/ldap-syncrepl.rst b/Doc/reference/ldap-syncrepl.rst
similarity index 100%
rename from Doc/ldap-syncrepl.rst
rename to Doc/reference/ldap-syncrepl.rst
diff --git a/Doc/ldap.rst b/Doc/reference/ldap.rst
similarity index 100%
rename from Doc/ldap.rst
rename to Doc/reference/ldap.rst
diff --git a/Doc/ldapurl.rst b/Doc/reference/ldapurl.rst
similarity index 100%
rename from Doc/ldapurl.rst
rename to Doc/reference/ldapurl.rst
diff --git a/Doc/ldif.rst b/Doc/reference/ldif.rst
similarity index 100%
rename from Doc/ldif.rst
rename to Doc/reference/ldif.rst
diff --git a/Doc/slapdtest.rst b/Doc/reference/slapdtest.rst
similarity index 100%
rename from Doc/slapdtest.rst
rename to Doc/reference/slapdtest.rst

From 4ee76616fe1b791d154fdcf7742f28f5bea99c4a Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 19:42:50 +0100
Subject: [PATCH 615/868] Doc: Fix underline in ldap.resiter documentation

---
 Doc/reference/ldap-resiter.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/reference/ldap-resiter.rst b/Doc/reference/ldap-resiter.rst
index 0e72e92..66ce6ca 100644
--- a/Doc/reference/ldap-resiter.rst
+++ b/Doc/reference/ldap-resiter.rst
@@ -20,7 +20,7 @@ derived classes which has these methods:
 
 
 Examples
-========
+--------
 
 .. _ldap.resiter.ResultProcessor-example:
 

From eab9b59a41f91006c81b5e8c6e16d5719e5d7f37 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 17:12:59 +0100
Subject: [PATCH 616/868] Doc: Include information from python-ldap.org main
 page in the docs

---
 Doc/index.rst | 51 +++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 41 insertions(+), 10 deletions(-)

diff --git a/Doc/index.rst b/Doc/index.rst
index 476e9cc..5142baa 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -1,10 +1,44 @@
-##########################
-python-ldap Documentation
-##########################
+python-ldap
+===========
+
+
+What is python-ldap?
+--------------------
+
+* python-ldap provides an object-oriented API to access LDAP
+  directory servers from `Python`_ programs.
+* For LDAP operations the module wraps `OpenLDAP`_'s
+  client library *libldap* for that purpose.
+* Additionally the package contains modules for other LDAP-related stuff:
+
+  * LDIF
+  * LDAP URLs
+  * LDAPv3 subschema
+
+.. _Python: https://www.python.org/
+.. _OpenLDAP: https://www.openldap.org/
+
+
+Get it!
+-------
+
+:ref:`Download information` is available for several platforms.
+
+
+Mailing list
+------------
+
+Discussion about the use and future of Python-LDAP occurs in
+the ``python-ldap@python.org`` mailing list.
+
+You can `subscribe or unsubscribe`_ to this list or browse the `list archive`_.
+
+.. _subscribe or unsubscribe: https://mail.python.org/mailman/listinfo/python-ldap
+.. _list archive: https://mail.python.org/pipermail/python-ldap/
+
 
-********
 Contents
-********
+--------
 
 .. toctree::
    :maxdepth: 2
@@ -13,10 +47,8 @@ Contents
    reference/index.rst
 
 
-
-*********************
 Bytes/text management
-*********************
+---------------------
 
 The LDAP protocol states that some fields (distinguised names, relative distinguished names,
 attribute names, queries) be encoded in UTF-8; some other (mostly attribute *values*) **MAY**
@@ -50,9 +82,8 @@ The typical usage is as follows; note that only the result's *values* are of the
     ]
 
 
-******************
 Indices and tables
-******************
+------------------
 
 * :ref:`genindex`
 * :ref:`modindex`

From a7d66f9f055744229715aea0ddb42ac7f342a945 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 17:40:20 +0100
Subject: [PATCH 617/868] Doc: Include information from
 python-ldap.org/docs.html

---
 Doc/index.rst     | 12 +++++++++++
 Doc/resources.rst | 55 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 Doc/resources.rst

diff --git a/Doc/index.rst b/Doc/index.rst
index 5142baa..43f57c0 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -37,6 +37,17 @@ You can `subscribe or unsubscribe`_ to this list or browse the `list archive`_.
 .. _list archive: https://mail.python.org/pipermail/python-ldap/
 
 
+Documentation
+-------------
+
+The documentation for python-ldap 3.x is hosted at `Read the Docs`_.
+
+You can switch between versions of the library, or download PDF or HTML
+versions for offline use, using the right sidebar.
+
+.. _Read the Docs: http://python-ldap.readthedocs.io/en/latest/
+
+
 Contents
 --------
 
@@ -45,6 +56,7 @@ Contents
 
    installing.rst
    reference/index.rst
+   resources.rst
 
 
 Bytes/text management
diff --git a/Doc/resources.rst b/Doc/resources.rst
new file mode 100644
index 0000000..56cb1a1
--- /dev/null
+++ b/Doc/resources.rst
@@ -0,0 +1,55 @@
+Third-party documentation
+=========================
+
+The following documents referenced are not written by python-ldap project
+members. Therefore some information might be outdated or links might be broken.
+
+
+*Python LDAP Applications* articles by Matt Butcher
+---------------------------------------------------
+
+* `Part 1 - Installing and Configuring the Python-LDAP Library and Binding to an LDAP Directory <https://www.packtpub.com/article/installing-and-configuring-the-python-ldap-library-and-binding-to-an-ldap-directory>`_
+
+    This also covers SASL.
+
+* `Part 2 - LDAP Operations <https://www.packtpub.com/article/python-ldap-applications-ldap-opearations>`_
+* `Part 3 - More LDAP Operations and the LDAP URL Library <https://www.packtpub.com/article/python-ldap-applications-more-ldap-operations-and-the-ldap-url-library>`_
+* `Part 4 - LDAP Schema <https://www.packtpub.com/article/python-ldap-applications-ldap-schema>`_
+
+    Gee, someone waded through the badly documented mysteries of module
+    :mod:`ldap.schema`.
+
+
+`LDAP Programming in Python <https://www.linuxjournal.com/article/6988>`_
+-------------------------------------------------------------------------
+
+Another article for getting started with python-ldap.
+
+
+
+`RFC 1823 <https://tools.ietf.org/html/rfc1823>`_
+-------------------------------------------------
+
+The LDAP Application Program Interface, mainly for LDAPv2.
+
+
+
+`LDAPEXT draft <https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api>`_
+----------------------------------------------------------------------------
+
+The Internet draft of the discontinued IETF working group LDAPEXT is of
+interest here since the OpenLDAP 2 libs implement this (expired) draft.
+
+
+`OpenLDAP <https://www.openldap.org/>`_
+---------------------------------------
+
+It's worth to have a look at the
+`manual pages <https://www.openldap.org/software/man.cgi?query=ldap>`_ and the
+`Developer's FAQ <https://www.openldap.org/faq/data/cache/4.html>`_.
+
+
+`VSLDAP <https://www.opengroup.org/openbrand/testing/checklist/guide/config_base.html>`_
+----------------------------------------------------------------------------------------
+
+VSLDAP Interoperability Test Suite.

From f0daeb6d017274ce63495305a01129d4e4a520f8 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 18:32:58 +0100
Subject: [PATCH 618/868] Doc: Include information from
 python-ldap.org/download.html

---
 Doc/installing.rst | 157 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 122 insertions(+), 35 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index bcc41be..cc0ee01 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,19 +1,106 @@
-***********************
-Building and installing
-***********************
+.. _Download information:
 
-python-ldap is built and installed using the Python DistUtils installed
-along with your Python installation:
+Installing python-ldap
+######################
 
-::
+Installing from PyPI
+====================
+
+The preferred point for downloading the “official” source distribution
+is now the `PyPI repository`_ which supports installing via `pip`_.
+For example::
+
+    python -m pip install python-ldap
+
+.. _PyPI repository: https://pypi.python.org/pypi/python-ldap/
+.. _pip: https://pip.pypa.io/en/stable/
+
+For installing from PyPI, you will need the :ref:`build prerequisites`
+as when installing from source.
+
+We do not currently provide pre-built packages (wheels).
+
+
+Furthermore, python-ldap requires the modules `pyasn1`_ and `pyasn1-modules`_.
+``pip`` will install these automatically.
+
+.. _pyasn1: https://pypi.python.org/pypi/pyasn1
+.. _pyasn1-modules: https://pypi.python.org/pypi/pyasn1-modules
+
+
+Pre-built Binaries
+==================
+
+Because distributions seem to be all over the place, this page
+tries to list all the current ones we know of.
+
+Note that the python-ldap team is not responsible for the binary packages
+except the sources you can grab from the PyPI page. Also note that binary
+packages are most times not up to date. If you experience troubles
+with a binary package, it would be nice if you try to build a recent version
+of python-ldap before submitting a bug report to make sure you did not
+hit a problem already fixed in recent releases.
+
+`openSUSE Linux <https://www.opensuse.org/>`_
+---------------------------------------------
+
+ships with python-ldap and there's an additional
+`download repository <http://download.opensuse.org/repositories/devel:/languages:/python/>`_
+which contains builds of latest releases
+(see also `OBS package <https://build.opensuse.org/package/show/devel:languages:python/python-ldap>`_
+
+`Debian Linux <https://www.debian.org>`_
+----------------------------------------
+
+Have a look into the
+`Debian Package Tracker <https://tracker.debian.org/pkg/python-ldap>`_
+to get up to date information which versions are available.
+
+
+Windows
+-------
 
-  python setup.py build
-  python setup.py install
+Unoficial packages for Windows are available on
+`Christoph Gohlke's page <https://www.lfd.uci.edu/~gohlke/pythonlibs/>`_.
 
-If you have more than one Python interpreter installed locally you should
+
+`FreeBSD <https://www.freebsd.org/`_
+------------------------------------
+
+The CVS repository of FreeBSD contains the package
+`py-ldap <https://svnweb.freebsd.org/ports/head/net/py-ldap/>`_
+
+Mac OS X
+--------
+
+You can install directly with pip::
+
+    xcode-select --install
+    pip install python-ldap \
+        --global-option=build_ext \
+        --global-option="-I$(xcrun --show-sdk-path)/usr/include/sasl"
+
+
+Installing from Source
+======================
+
+
+python-ldap is built and installed using the Python setuptools.
+From a source repository::
+
+    python -m pip install setuptools
+    python setup.py install
+
+If you have more than one Python interpreter installed locally, you should
 use the same one you plan to use python-ldap with.
 
-See further instructions for using DistUtils here: https://docs.python.org/2.7/install/index.html
+See further instructions can be found in `Setuptools documentation`_.
+
+
+.. _Setuptools documentation: https://docs.python.org/3/distributing/index.html
+
+
+.. _build prerequisites:
 
 Build prerequisites
 ===================
@@ -21,25 +108,18 @@ Build prerequisites
 The following software packages are required to be installed
 on the local system when building python-ldap:
 
-- Python version 2.3 or later including its development files: https://www.python.org/
-- OpenLDAP client libs version 2.4.11 or later: https://www.openldap.org/
+- `Python`_ version 2.7, or 3.3 or later including its development files
+- `OpenLDAP`_ client libs version 2.4.11 or later
   It is not possible and not supported to build with prior versions.
-- OpenSSL (optional): https://www.openssl.org/
-- cyrus-sasl (optional): https://www.cyrusimap.org/sasl/
-- Kerberos libs, MIT or heimdal (optional)
+- `OpenSSL`_ (optional)
+- `cyrus-sasl`_ (optional)
+- Kerberos libraries, MIT or heimdal (optional)
 
-Installation prerequisites
-==========================
+.. _Python: https://www.python.org/
+.. _OpenLDAP: https://www.openldap.org/
+.. _OpenSSL: https://www.openssl.org/
+.. _cyrus-sasl: https://www.cyrusimap.org/sasl/
 
-Furthermore it is required that modules
-:py:mod:`pyasn1` and :py:mod:`pyasn1_modules`
-are installed.
-
-  https://github.com/etingof/pyasn1
-
-  https://pypi.python.org/pypi/pyasn1
-
-  https://pypi.python.org/pypi/pyasn1-modules
 
 setup.cfg
 =========
@@ -70,33 +150,40 @@ documentation of Python's DistUtils.
 
 .. _libs-used-label:
 
-Libs used
----------
 
-.. data:noindex: ldap
-.. data:noindex: ldap_r
+Libraries used
+---------------
+
+.. data:: ldap
+   :noindex:
+.. data:: ldap_r
+   :noindex:
 
    The LDAP protocol library of OpenLDAP. ldap_r is the reentrant version
    and should be preferred.
 
-.. data:noindex: lber
+.. data:: lber
+   :noindex:
 
    The BER encoder/decoder library of OpenLDAP.
 
-.. data:noindex: sasl2
+.. data:: sasl2
+   :noindex:
 
    The Cyrus-SASL library if needed and present during build
 
-.. data:noindex: ssl
+.. data:: ssl
+   :noindex:
 
    The SSL/TLS library of OpenSSL if needed and present during build
 
-.. data:noindex: crypto
+.. data:: crypto
+   :noindex:
 
    The basic cryptographic library of OpenSSL if needed and present during build
 
 Example
-=============
+-------
 
 The following example is for a full-featured build (including SSL and SASL support)
 of python-ldap with OpenLDAP installed in a different prefix directory

From 823760a2438df9994339e0cabf58a76d01bf69e6 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 25 Nov 2017 22:56:03 +0100
Subject: [PATCH 619/868] Doc: Include information from
 python-ldap.org/faq.html

This updates some info that was clearly outdated, but it's not
a comprehensive refresh.
---
 Doc/faq.rst            | 184 +++++++++++++++++++++++++++++++++++++++++
 Doc/index.rst          |   1 +
 Doc/reference/ldap.rst |   2 +
 3 files changed, 187 insertions(+)
 create mode 100644 Doc/faq.rst

diff --git a/Doc/faq.rst b/Doc/faq.rst
new file mode 100644
index 0000000..511735a
--- /dev/null
+++ b/Doc/faq.rst
@@ -0,0 +1,184 @@
+python-ldap FAQ
+===============
+
+Project
+-------
+
+**Q**: Is python-ldap yet another abandon-ware project?
+
+  **A1**: “Jump on in.”
+
+  **A2**: “Jump into the C ;-)”
+
+  **A3**: see file CHANGES in source distribution
+  or `repository`_.
+
+.. _repository: https://github.com/python-ldap/python-ldap/blob/master/CHANGES
+
+
+Usage
+-----
+
+**Q**: Does it work with Python 3?
+
+  **A0**: Yes, from 3.0 on.
+
+  **A1**. For earlier versions, there's `pyldap`_, an independent fork
+  now merged into pyhon-ldap.
+
+.. _pyldap: https://pypi.python.org/pypi/pyldap
+
+
+**Q**: Does it work with Python 2.6? (1.5|2.0|2.1|2.2|2.3|2.4|2.5)?
+
+  **A**: No. Old versions of python-ldap are still available from PyPI, though.
+
+
+**Q**: My code imports module ``_ldap``.
+That used to work but from version 2.0.0pre that does not work anymore?
+
+   **A**: Despite some outdated programming examples the extension module
+    ``_ldap`` **MUST NOT** be imported directly unless 
+    you really know what you're doing (e.g. for internal regression testing).
+
+    Import ``ldap`` instead which is a Python wrapper around ``_ldap``
+    providing the full functionality.
+
+**Q**: My script bound to MS Active Directory but a a search operation results
+in an exception :exc:`ldap.OPERATIONS_ERROR` with the diagnostic messages text
+"In order to perform this operation a successful bind must be
+completed on the connection."
+What's happening here?
+
+    **A**: When searching from the domain level MS AD returns referrals (search continuations)
+    for some objects to indicate to the client where to look for these objects.
+    Client-chasing of referrals is a broken concept since LDAPv3 does not specify
+    which credentials to use when chasing the referral. Windows clients are supposed
+    to simply use their Windows credentials but this does not work in general when
+    chasing referrals received from and pointing to arbitrary LDAP servers.
+
+    Therefore per default ``libldap`` automatically chases the referrals
+    internally with an *anonymous* access which fails with MS AD.
+
+    So best thing is to switch this behaviour off::
+
+      l = ldap.initialize('ldap://foobar')
+      l.set_option(ldap.OPT_REFERRALS,0)
+
+**Q**: Why am I seeing ``ldap.SUCCESS`` traceback as output?
+
+    **A**: Most likely you are using one of the non-synchronous calls, and probably
+    mean to be using a synchronous call
+    (see detailed explanation in :ref:`sending-ldap-requests`.
+
+**Q**: Can I use LDAPv2 via python-ldap?
+
+    **A**: Yes, by explicitly setting the class attribute
+    :attr:`~ldap.LDAPObject.protocol_version`.
+
+    You should not do that nowadays since
+    `LDAPv2 is considered historic <https://tools.ietf.org/html/rfc3494>`_
+    since many years.
+
+
+
+Installing
+----------
+
+**Q**: Does it work with Windows 32?
+
+    **A**: You can find links to pre-compiled packages for Win32 on the
+    :ref:`Download information` page.
+
+
+**Q**: Can python-ldap be built against OpenLDAP 2.3 libs or older?
+
+    **A**: No, for recent python-ldap 2.4.x the OpenLDAP 2.4 client libs or newer are required.
+    Patched builds of python-ldap linked to older libs are not supported by the
+    python-ldap project.
+
+
+**Q**: During build there are warning messages displayed
+telling Lib/ldap.py and Lib/ldap/schema.py are not found::
+
+      warning: build_py: file Lib/ldap.py (for module ldap) not found
+      warning: build_py: file Lib/ldap/schema.py (for module ldap.schema) not found
+
+..
+
+    **A**: ``ldap`` and ``ldap.schema`` are both module packages
+    (directories containing various sub-modules).
+    The messages above are falsely produced by DistUtils.
+    Don't worry about it.
+
+.. _install-macosx:
+
+**Q**: What's the correct way to install on Mac OS X?
+
+  **A**::
+
+      xcode-select --install
+      pip install python-ldap \
+         --global-option=build_ext \
+         --global-option="-I$(xcrun --show-sdk-path)/usr/include/sasl"
+
+
+**Q**: While importing module ldap some shared lib files are not found.
+Error message looks similar to this::
+
+      ImportError: ld.so.1: /usr/local/bin/python: fatal: liblber.so.2: open failed: No such file or directory
+
+..
+
+    **A1**: You need to make sure that the path to ``liblber.so.2`` and
+    ``libldap.so.2`` is in your ``LD_LIBRARY_PATH`` environment variable.
+
+    **A2**: Alternatively if you're on Linux you can add the path to
+    ``liblber.so.2`` and ``libldap.so.2`` to ``/etc/ld.so.conf``
+    and invoke command ``ldconfig`` afterwards.
+
+
+
+Historic
+--------
+
+**Q**: Can python-ldap 2.x be built against Netscape, Mozilla or Novell libs?
+
+  **A**: Nope.
+
+
+**Q**: My binary version of python-ldap was build with LDAP libs 3.3.
+But the python-ldap docs say LDAP libs 2.x are needed. I'm confused!
+
+  Short answer:
+      See answer above and :ref:`download information` for
+      a more recent version.
+
+  Long answer:
+      E.g. some Win32 DLLs floating around for download are based on
+      the old Umich LDAP code which is not maintained anymore for
+      ``many`` years! Last Umich 3.3 release was 1997 if I remember correctly.
+
+      The OpenLDAP project took over the Umich code and started releasing
+      OpenLDAP 1.x series mainly fixing bugs and doing some improvements
+      to the database backend. Still only LDAPv2 was supported at server
+      and client side. (Many commercial vendors also derived their products
+      from the Umich code.)
+
+      OpenLDAP 2.x is a full-fledged LDAPv3 implementation. Still it has
+      its roots in Umich code but has many more features/improvements.
+
+
+**Q**: While importing module ldap there are undefined references reported.
+Error message looks similar to this::
+
+    ImportError: /usr/local/lib/libldap.so.2: undefined symbol: res_query
+
+..
+
+    **A**: Especially on older Linux systems you might have to explicitly link
+    against ``libresolv``.
+
+    Tweak ``setup.cfg`` to contain this line::
+
+        libs = lber ldap resolv
diff --git a/Doc/index.rst b/Doc/index.rst
index 43f57c0..aa93092 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -57,6 +57,7 @@ Contents
    installing.rst
    reference/index.rst
    resources.rst
+   faq.rst
 
 
 Bytes/text management
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index d526370..c80e386 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -614,6 +614,8 @@ with names ending in :py:const:`_ext` or :py:const:`_ext_s`:
   request.
 
 
+.. _sending-ldap-requests:
+
 Sending LDAP requests
 ---------------------
 

From 0fc0d0cfd6b9285bb5c65b2fb1abd3aa890936a5 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 14:08:56 +0100
Subject: [PATCH 620/868] Doc: Prevent doc build from picking up system-wide
 python-ldap

---
 Doc/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 63fc24e..9314231 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -17,7 +17,7 @@
 # If your extensions are in another directory, add it here.
 _doc_dir = os.path.dirname(__file__)
 sys.path.append(_doc_dir)
-sys.path.append(os.path.join(_doc_dir, '../Lib/'))
+sys.path.insert(0, os.path.join(_doc_dir, '../Lib/'))
 sys.path.insert(0, os.path.join(_doc_dir, '../Lib/ldap'))
 
 # Import fake `_ldap` module

From 574c902401aa233bf0896e3dcfccbaa0017b3030 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 14:09:49 +0100
Subject: [PATCH 621/868] Doc: Fix link-line syntax

Words ending with underlines are ReST syntax for links.
---
 Lib/ldap/sasl.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index fa6f4f5..b54bf2a 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -54,7 +54,7 @@ def callback(self, cb_id, challenge, prompt, defresult):
         """
         The callback method will be called by the sasl_bind_s()
         method several times. Each time it will provide the id, which
-        tells us what kind of information is requested (the CB_ ...
+        tells us what kind of information is requested (the CB_*
         constants above). The challenge might be a short (english) text
         or some binary string, from which the return value is calculated.
         The prompt argument is always a human-readable description string;

From 680c3421e041a56bbdaa87fe4698beaada9c0580 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 14:35:48 +0100
Subject: [PATCH 622/868] Omit SysLogHandler when /dev/log does not exist

slaptests use SysLogHandler() to write logs to syslog. Don't create a
SysLogHandler when /dev/log does not exist. This fixes a bug when
building and testing python-ldap in containers or restricted build
environments.

https://github.com/python-ldap/python-ldap/pull/28
See: https://github.com/python-ldap/python-ldap/issues/43
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 0bef1c1..182097a 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -59,7 +59,7 @@ def combined_logger(
             pass
     # for writing to syslog
     new_logger = logging.getLogger(log_name)
-    if sys_log_format:
+    if sys_log_format and os.path.exists('/dev/log'):
         my_syslog_formatter = logging.Formatter(
             fmt=' '.join((log_name, sys_log_format)))
         my_syslog_handler = logging.handlers.SysLogHandler(

From 92bd2e74804bdddb6600940886782e7e7c6b4ead Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sun, 26 Nov 2017 17:44:37 +0100
Subject: [PATCH 623/868] Add doc tests and spelling tests

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml               |  36 ++++++---
 Doc/conf.py               |   7 ++
 Doc/spelling_wordlist.txt | 151 ++++++++++++++++++++++++++++++++++++++
 tox.ini                   |  17 ++++-
 4 files changed, 200 insertions(+), 11 deletions(-)
 create mode 100644 Doc/spelling_wordlist.txt

diff --git a/.travis.yml b/.travis.yml
index 14c0965..581013c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,13 +1,5 @@
 language: python
 
-python:
-- '2.7'
-- '3.3'
-- '3.4'
-- '3.5'
-- '3.6'
-# Note: when updating Python versions, also change setup.py and tox.ini
-
 sudo: false
 
 cache: pip
@@ -17,9 +9,33 @@ addons:
     packages:
       - ldap-utils
       - slapd
+      - enchant
 
-env:
-  - WITH_GCOV=1
+# Note: when updating Python versions, also change setup.py and tox.ini
+matrix:
+  include:
+    - python: 2.7
+      env:
+        - TOXENV=py27
+        - WITH_GCOV=1
+    - python: 3.3
+      env:
+        - TOXENV=py33
+        - WITH_GCOV=1
+    - python: 3.4
+      env:
+        - TOXENV=py34
+        - WITH_GCOV=1
+    - python: 3.5
+      env:
+        - TOXENV=py35
+        - WITH_GCOV=1
+    - python: 3.6
+      env:
+        - TOXENV=py36
+        - WITH_GCOV=1
+    - python: 3.6
+      env: TOXENV=doc
 
 install:
   - pip install "pip>=7.1.0"
diff --git a/Doc/conf.py b/Doc/conf.py
index 9314231..eb9f5a0 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -33,6 +33,13 @@
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
 extensions = ['sphinx.ext.autodoc']
 
+try:
+    import sphinxcontrib.spelling
+except ImportError:
+    pass
+else:
+    extensions.append('sphinxcontrib.spelling')
+
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['.templates']
 
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
new file mode 100644
index 0000000..fcc227f
--- /dev/null
+++ b/Doc/spelling_wordlist.txt
@@ -0,0 +1,151 @@
+args
+async
+attr
+attrlist
+attrList
+attrs
+attrsonly
+attrsOnly
+attrtype
+authzId
+automagically
+backend
+behaviour
+BER
+bindname
+boolean
+booleanValue
+Bytestrings
+cancelled
+canonicalization
+cb
+cfg
+changeNumber
+changesOnly
+changeType
+changeTypes
+cidict
+clientctrls
+conf
+Continously
+controlType
+controlValue
+criticality
+cryptographic
+cyrus
+defresult
+dereferenced
+dereferencing
+desc
+directoryOperation
+distinguished
+distributedOperation
+dit
+dn
+DN
+dSAOperation
+encodedControlValue
+encodedResponseValue
+extype
+exvalue
+favour
+filterstr
+filterStr
+formatOID
+func
+heimdal
+hostport
+hrefTarget
+hrefText
+ignoreResultsNumber
+integerValue
+Interoperability
+isn
+Keepalive
+Kerberos
+keyerror
+knownLDAPControls
+kwarg
+ldap
+ldapadd
+ldapControls
+ldapControlTuples
+ldapdelete
+ldapi
+LDAPObject
+ldaps
+ldapurl
+ldapwhoami
+ldif
+LDIFWriter
+libldap
+libs
+Libs
+modlist
+modrdn
+msgid
+multi
+nameoroid
+nots
+Novell
+objectClass
+oc
+oid
+oids
+openldap
+postalAddress
+pre
+previousDN
+processResultsCount
+Proxied
+py
+rdn
+reentrant
+refmodule
+refreshAndPersist
+refreshDeletes
+refreshOnly
+requestName
+requestValue
+resiter
+respvalue
+ResultProcessor
+returnECs
+ruleid
+rundir
+sasl
+searchRoot
+searchScope
+sed
+serverctrls
+sessionSourceIp
+sessionSourceName
+sessionTrackingIdentifier
+sizelimit
+slapd
+stderr
+stdout
+str
+Subclasses
+subentry
+subschema
+substr
+subtree
+syncrepl
+syntaxes
+timelimit
+tracebacks
+tuple
+tuples
+UDP
+Umich
+unparsing
+unsigend
+uri
+urlPrefix
+urlscheme
+userApplications
+userPassword
+usr
+uuids
+whitespace
diff --git a/tox.ini b/tox.ini
index 22ca4a8..51f8981 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py33,py34,py35,py36,coverage-report
+envlist = py27,py33,py34,py35,py36,doc,coverage-report
 
 [testenv]
 deps = coverage
@@ -31,3 +31,18 @@ commands =
     {envpython} -m coverage combine
     {envpython} -m coverage report --show-missing
     {envpython} -m coverage html
+
+[testenv:doc]
+basepython = python3
+deps =
+    docutils
+    markdown
+    sphinx
+    sphinxcontrib-spelling
+commands =
+    {envpython} setup.py check --restructuredtext --metadata --strict
+    {envpython} -m markdown README -f {envtmpdir}/README.html
+    {envpython} -m sphinx -v -W -b html -d {envtmpdir}/doctrees \
+        {toxinidir}/Doc {envtmpdir}/html
+    {envpython} -m sphinx -v -W -b spelling -d {envtmpdir}/doctrees \
+        {toxinidir}/Doc {envtmpdir}/spelling

From 16e8529a5cb50417ed41a89311c48b891c9e78d8 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 15:23:15 +0100
Subject: [PATCH 624/868] Fix spelling errors

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/faq.rst                   |  2 +-
 Doc/index.rst                 |  2 +-
 Doc/installing.rst            |  2 +-
 Doc/reference/ldap.rst        | 10 +++++-----
 Doc/reference/ldapurl.rst     |  4 ++--
 Lib/ldap/__init__.py          |  2 +-
 Lib/ldap/async.py             |  2 +-
 Lib/ldap/constants.py         |  2 +-
 Lib/ldap/controls/__init__.py |  2 +-
 Lib/ldap/controls/deref.py    |  2 +-
 Lib/ldap/controls/psearch.py  |  4 ++--
 Lib/ldap/controls/sss.py      |  2 +-
 Lib/ldap/controls/vlv.py      |  2 +-
 Lib/ldap/filter.py            |  2 +-
 Lib/ldap/ldapobject.py        |  2 +-
 Lib/ldap/sasl.py              |  2 +-
 Lib/ldap/syncrepl.py          |  2 +-
 Lib/ldif.py                   |  6 +++---
 Lib/slapdtest.py              |  2 +-
 README                        |  2 +-
 20 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/Doc/faq.rst b/Doc/faq.rst
index 511735a..58bb81e 100644
--- a/Doc/faq.rst
+++ b/Doc/faq.rst
@@ -24,7 +24,7 @@ Usage
   **A0**: Yes, from 3.0 on.
 
   **A1**. For earlier versions, there's `pyldap`_, an independent fork
-  now merged into pyhon-ldap.
+  now merged into python-ldap.
 
 .. _pyldap: https://pypi.python.org/pypi/pyldap
 
diff --git a/Doc/index.rst b/Doc/index.rst
index aa93092..f478d10 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -63,7 +63,7 @@ Contents
 Bytes/text management
 ---------------------
 
-The LDAP protocol states that some fields (distinguised names, relative distinguished names,
+The LDAP protocol states that some fields (distinguished names, relative distinguished names,
 attribute names, queries) be encoded in UTF-8; some other (mostly attribute *values*) **MAY**
 contain any type of data, and thus be treated as bytes.
 
diff --git a/Doc/installing.rst b/Doc/installing.rst
index cc0ee01..c78bd7f 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -60,7 +60,7 @@ to get up to date information which versions are available.
 Windows
 -------
 
-Unoficial packages for Windows are available on
+Unofficial packages for Windows are available on
 `Christoph Gohlke's page <https://www.lfd.uci.edu/~gohlke/pythonlibs/>`_.
 
 
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index c80e386..8844e59 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -40,7 +40,7 @@ This module defines the following functions:
    when using multiple URIs you cannot determine to which URI your client
    gets connected.
 
-   Note that internally the OpenLDAP funtion
+   Note that internally the OpenLDAP function
    `ldap_initialize(3) <https://www.openldap.org/software/man.cgi?query=ldap_init&sektion=3>`_
    is called which just initializes the LDAP connection struct in the C API
    - nothing else. Therefore the first call to an operation method (bind,
@@ -141,7 +141,7 @@ following option identifiers are defined as constants:
 
 .. py:data:: OPT_DEREF
 
-   Specifies how alias derefencing is done within the underlying LDAP C lib.
+   Specifies how alias dereferencing is done within the underlying LDAP C lib.
 
 .. py:data:: OPT_ERROR_STRING
 
@@ -296,7 +296,7 @@ The module defines the following exceptions:
 
 .. py:exception:: LDAPError
 
-   This is the base class of all execeptions raised by the module :py:mod:`ldap`.
+   This is the base class of all exceptions raised by the module :py:mod:`ldap`.
    Unlike the C interface, errors are not returned as result codes, but
    are instead turned into exceptions, raised as soon an the error condition
    is detected.
@@ -413,7 +413,7 @@ The module defines the following exceptions:
 
 .. py:exception:: IS_LEAF
 
-   The object specified is a leaf of the diretcory tree.
+   The object specified is a leaf of the directory tree.
    Sets the :py:const:`matched` field of the exception dictionary value.
 
 .. py:exception:: LOCAL_ERROR
@@ -836,7 +836,7 @@ and wait for and return with the server's result, or with
 
    This method is used to wait for and return the result of an operation
    previously initiated by one of the LDAP *asynchronous* operations
-   (eg :py:meth:`search()`, :py:meth:`modify()`, etc.)
+   (e.g. :py:meth:`search()`, :py:meth:`modify()`, etc.)
 
    The *msgid* parameter is the integer identifier returned by that method.
    The identifier is guaranteed to be unique across an LDAP session,
diff --git a/Doc/reference/ldapurl.rst b/Doc/reference/ldapurl.rst
index c13061c..86d0817 100644
--- a/Doc/reference/ldapurl.rst
+++ b/Doc/reference/ldapurl.rst
@@ -9,7 +9,7 @@
 
 This module parses and generates LDAP URLs.    It is implemented in pure Python
 and does not rely on any  non-standard modules. Therefore it can be used stand-
-alone without  the rest of the python-ldap package.    Compability note: This
+alone without  the rest of the python-ldap package.  Compatibility note: This
 module has been solely tested on Python 2.x and above.
 
 .. seealso::
@@ -91,7 +91,7 @@ Example
 ^^^^^^^
 
 Important security advice:
-For security reasons you shouldn't specify passwords in LDAP URLs
+For security reasons you should not specify passwords in LDAP URLs
 unless you really know what you are doing.
 
 The following example demonstrates how to parse a LDAP URL
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index b22a6f4..7cb16b0 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -94,5 +94,5 @@ def release(self):
 
 # More constants
 
-# For compability of 2.3 and 2.4 OpenLDAP API
+# For compatibility of 2.3 and 2.4 OpenLDAP API
 OPT_DIAGNOSTIC_MESSAGE = OPT_ERROR_STRING
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 0dd4940..23c5660 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -36,7 +36,7 @@ def __str__(self):
 
 class AsyncSearchHandler:
   """
-  Class for stream-processsing LDAP search results
+  Class for stream-processing LDAP search results
 
   Arguments:
 
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index c5ac6c1..4c109ac 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -288,7 +288,7 @@ class Str(Constant):
     TLSInt('OPT_X_TLS_PEERCERT', optional=True),
 
     # only available if OpenSSL supports it => might cause
-    # backward compability problems
+    # backward compatibility problems
     TLSInt('OPT_X_TLS_CRLCHECK', optional=True),
 
     TLSInt('OPT_X_TLS_CRLFILE', optional=True),
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index 932fa53..43b938d 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -96,7 +96,7 @@ class attributes
 class LDAPControl(RequestControl,ResponseControl):
   """
   Base class for combined request/response controls mainly
-  for backward-compability to python-ldap 2.3.x
+  for backward-compatibility to python-ldap 2.3.x
   """
 
   def __init__(self,controlType=None,criticality=False,controlValue=None,encodedControlValue=None):
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index d1b5ce9..762ab85 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -26,7 +26,7 @@
 # Request types
 #---------------------------------------------------------------------------
 
-# For compability with ASN.1 declaration in I-D
+# For compatibility with ASN.1 declaration in I-D
 AttributeList = AttributeDescriptionList
 
 class DerefSpec(univ.Sequence):
diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
index 91a5c24..74e40a3 100644
--- a/Lib/ldap/controls/psearch.py
+++ b/Lib/ldap/controls/psearch.py
@@ -40,13 +40,13 @@ class PersistentSearchControl(RequestControl):
   Implements the request control for persistent search.
 
   changeTypes
-    List of strings specifiying the types of changes returned by the server.
+    List of strings specifying the types of changes returned by the server.
     Setting to None requests all changes.
   changesOnly
     Boolean which indicates whether only changes are returned by the server.
   returnECs
     Boolean which indicates whether the server should return an
-    Entry Change Notication response control
+    Entry Change Notification response control
   """
 
   class PersistentSearchControlValue(univ.Sequence):
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 5d4955d..a5312d2 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -126,7 +126,7 @@ def decodeControlValue(self, encoded):
             self.attributeType = attribute_type
         else:
             self.attributeType = None
-        # backward compability class attributes
+        # backward compatibility class attributes
         self.result = self.sortResult
         self.attribute_type_error = self.attributeType
 
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index 74d107b..9fea2f0 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -134,7 +134,7 @@ def decodeControlValue(self,encoded):
             self.contextID = str(context_id)
         else:
             self.contextID = None
-        # backward compability class attributes
+        # backward compatibility class attributes
         self.target_position = self.targetPosition
         self.content_count = self.contentCount
         self.result = self.virtualListViewResult
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index f5d9278..56665dc 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -3,7 +3,7 @@
 
 See https://www.python-ldap.org/ for details.
 
-Compability:
+Compatibility:
 - Tested with Python 2.0+
 """
 
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 36f98cf..c5e62bd 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -647,7 +647,7 @@ def result(self,msgid=ldap.RES_ANY,all=1,timeout=None):
 
         This method is used to wait for and return the result of an
         operation previously initiated by one of the LDAP asynchronous
-        operation routines (eg search(), modify(), etc.) They all
+        operation routines (e.g. search(), modify(), etc.) They all
         returned an invocation identifier (a message id) upon successful
         initiation of their operation. This id is guaranteed to be
         unique across an LDAP session, and can be used to request the
diff --git a/Lib/ldap/sasl.py b/Lib/ldap/sasl.py
index b54bf2a..cc0a2ea 100644
--- a/Lib/ldap/sasl.py
+++ b/Lib/ldap/sasl.py
@@ -55,7 +55,7 @@ def callback(self, cb_id, challenge, prompt, defresult):
         The callback method will be called by the sasl_bind_s()
         method several times. Each time it will provide the id, which
         tells us what kind of information is requested (the CB_*
-        constants above). The challenge might be a short (english) text
+        constants above). The challenge might be a short (English) text
         or some binary string, from which the return value is calculated.
         The prompt argument is always a human-readable description string;
         The defresult is a default value provided by the sasl library
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 8442726..35d4c45 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -484,7 +484,7 @@ def syncrepl_set_cookie(self, cookie):
 
     def syncrepl_get_cookie(self):
         """
-        Called by syncrepl_search() to retreive the cookie stored by syncrepl_set_cookie()
+        Called by syncrepl_search() to retrieve the cookie stored by syncrepl_set_cookie()
         """
         pass
 
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 82c4e3f..aead2ef 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -209,7 +209,7 @@ def unparse(self,dn,record):
 def CreateLDIF(dn,record,base64_attrs=None,cols=76):
   """
   Create LDIF single formatted record including trailing empty line.
-  This is a compability function. Use is deprecated!
+  This is a compatibility function. Use is deprecated!
 
   dn
         string-representation of distinguished name
@@ -449,7 +449,7 @@ def parse_entry_records(self):
 
   def parse(self):
     """
-    Invokes LDIFParser.parse_entry_records() for backward compability
+    Invokes LDIFParser.parse_entry_records() for backward compatibility
     """
     return self.parse_entry_records() # parse()
 
@@ -633,7 +633,7 @@ def handle(self,dn,entry):
 def ParseLDIF(f,ignore_attrs=None,maxentries=0):
   """
   Parse LDIF records read from file.
-  This is a compability function. Use is deprecated!
+  This is a compatibility function. Use is deprecated!
   """
   ldif_parser = LDIFRecordList(
     f,ignored_attr_types=ignore_attrs,max_entries=maxentries,process_url_schemes=0
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 182097a..948ec09 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -83,7 +83,7 @@ class SlapdObject(object):
 
     This class creates a temporary data store for slapd, runs it
     listening on a private Unix domain socket and TCP port,
-    and initialises it with a top-level entry and the root user.
+    and initializes it with a top-level entry and the root user.
 
     When a reference to an instance of this class is lost, the slapd
     server is shut down.
diff --git a/README b/README
index 2a88bf2..81db9bb 100644
--- a/README
+++ b/README
@@ -14,7 +14,7 @@ stuff (e.g. processing LDIF, LDAPURLs, LDAPv3 sub-schema, etc.).
 
 Not included: Direct BER support
 
-See INSTALL for version compability
+See INSTALL for version compatibility
 
 See TODO for planned features. Contributors welcome.
 

From 5f8c419d373f84be91d27e98718658907a764ceb Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 28 Nov 2017 15:34:44 +0100
Subject: [PATCH 625/868] Add tests for start_tls

https://github.com/python-ldap/python-ldap/pull/42
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest.py        | 18 +++++++++
 Tests/certs/README      | 24 ++++++++++++
 Tests/certs/ca.conf     | 77 ++++++++++++++++++++++++++++++++++++
 Tests/certs/ca.pem      | 80 ++++++++++++++++++++++++++++++++++++++
 Tests/certs/client.conf | 16 ++++++++
 Tests/certs/client.key  | 28 ++++++++++++++
 Tests/certs/client.pem  | 83 +++++++++++++++++++++++++++++++++++++++
 Tests/certs/gencerts.sh | 67 ++++++++++++++++++++++++++++++++
 Tests/certs/gennssdb.sh | 28 ++++++++++++++
 Tests/certs/server.conf | 16 ++++++++
 Tests/certs/server.key  | 28 ++++++++++++++
 Tests/certs/server.pem  | 86 +++++++++++++++++++++++++++++++++++++++++
 Tests/t_cext.py         | 29 ++++++++++++++
 13 files changed, 580 insertions(+)
 create mode 100644 Tests/certs/README
 create mode 100644 Tests/certs/ca.conf
 create mode 100644 Tests/certs/ca.pem
 create mode 100644 Tests/certs/client.conf
 create mode 100644 Tests/certs/client.key
 create mode 100644 Tests/certs/client.pem
 create mode 100755 Tests/certs/gencerts.sh
 create mode 100755 Tests/certs/gennssdb.sh
 create mode 100644 Tests/certs/server.conf
 create mode 100644 Tests/certs/server.key
 create mode 100644 Tests/certs/server.pem

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index 182097a..1df142b 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -37,6 +37,12 @@
 suffix "%(suffix)s"
 rootdn "%(rootdn)s"
 rootpw "%(rootpw)s"
+
+TLSCACertificateFile "%(cafile)s"
+TLSCertificateFile "%(servercert)s"
+TLSCertificateKeyFile "%(serverkey)s"
+# ignore missing client cert but fail with invalid client cert
+TLSVerifyClient try
 """
 
 LOCALHOST = '127.0.0.1'
@@ -140,6 +146,15 @@ def __init__(self):
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
+        # TLS certs
+        capath = os.path.abspath(os.path.join(
+            os.getcwd(), 'Tests/certs'
+        ))
+        self.cafile = os.path.join(capath, 'ca.pem')
+        self.servercert = os.path.join(capath, 'server.pem')
+        self.serverkey = os.path.join(capath, 'server.key')
+        self.clientcert = os.path.join(capath, 'client.pem')
+        self.clientkey = os.path.join(capath, 'client.key')
 
     def _check_requirements(self):
         binaries = [
@@ -218,6 +233,9 @@ def gen_config(self):
             'rootpw': self.root_pw,
             'root_uid': os.getuid(),
             'root_gid': os.getgid(),
+            'cafile': self.cafile,
+            'servercert': self.servercert,
+            'serverkey': self.serverkey,
         }
         return self.slapd_conf_template % config_dict
 
diff --git a/Tests/certs/README b/Tests/certs/README
new file mode 100644
index 0000000..4be616a
--- /dev/null
+++ b/Tests/certs/README
@@ -0,0 +1,24 @@
+python-ldap test certificates
+=============================
+
+Certificates and keys
+---------------------
+
+* ``ca.pem``: internal root CA certificate
+* ``server.pem``: TLS server certificate for slapd, signed by root CA. The
+  server cert is valid for DNS Name ``localhost`` and IPs ``127.0.0.1`` and
+  ``:1``.
+* ``server.key``: private key for ``server.pem``, no password protection
+* ``client.pem``: certificate for TLS client cert authentication, signed by
+  root CA.
+* ``client.key``: private key for ``client.pem``, no password protection
+
+Configuration and scripts
+-------------------------
+
+* ``ca.conf`` contains the CA definition as well as extensions for the
+  client and server certificates.
+* ``client.conf`` and ``server.conf`` hold the subject and base configuration
+  for server and client certs.
+* ``gencerts.sh`` creates new CA, client and server certificates.
+* ``gennssdb.sh`` can be used to create a NSSDB for all certs and keys.
diff --git a/Tests/certs/ca.conf b/Tests/certs/ca.conf
new file mode 100644
index 0000000..4fb2e2b
--- /dev/null
+++ b/Tests/certs/ca.conf
@@ -0,0 +1,77 @@
+# Written by Christian Heimes
+
+[default]
+ca = "ca"
+tmpdir = $ENV::CATMPDIR
+outdir = $ENV::CAOUTDIR
+name_opt = multiline,-esc_msb,utf8
+
+[req]
+default_bits = 2048
+encrypt_key = no
+default_md = sha256
+utf8 = yes
+string_mask = utf8only
+prompt = no
+distinguished_name = ca_dn
+
+[ca_dn]
+countryName = "DE"
+organizationName = "python-ldap"
+organizationalUnitName = "slapd-test"
+commonName = "Python LDAP Test CA"
+
+[ca]
+default_ca = python_ldap_ca
+
+[python_ldap_ca]
+certificate = $outdir/$ca.pem
+private_key = $outdir/$ca.key
+new_certs_dir = $tmpdir
+serial = $tmpdir/$ca.crt.srl
+crlnumber = $tmpdir/$ca.crl.srl
+database = $tmpdir/$ca.db
+unique_subject = no
+default_days = 1461
+default_md = sha256
+policy = match_pol
+email_in_dn = no
+preserve = no
+name_opt = $name_opt
+cert_opt = ca_default
+copy_extensions = none
+default_crl_days = 365
+
+[match_pol]
+countryName = match
+stateOrProvinceName = optional
+localityName = optional
+organizationName = match
+organizationalUnitName = match
+commonName = supplied
+
+[ca_ext]
+basicConstraints = critical,CA:true
+keyUsage = critical,keyCertSign,cRLSign
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+
+[server_san]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1
+
+[server_ext]
+basicConstraints = critical,CA:false
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = critical,serverAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+subjectAltName = @server_san
+
+[client_ext]
+basicConstraints = critical,CA:false
+keyUsage = critical,digitalSignature
+extendedKeyUsage = critical,clientAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
diff --git a/Tests/certs/ca.pem b/Tests/certs/ca.pem
new file mode 100644
index 0000000..ffd6a5e
--- /dev/null
+++ b/Tests/certs/ca.pem
@@ -0,0 +1,80 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Validity
+            Not Before: Nov 28 13:49:28 2017 GMT
+            Not After : Nov 28 13:49:28 2021 GMT
+        Subject: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b4:bd:47:78:d9:62:4e:8e:ae:18:53:b8:8e:9f:
+                    0b:13:ea:f2:59:c0:1d:7f:0b:5c:5a:ed:c8:b8:cd:
+                    ff:66:94:c4:40:d5:cd:4c:da:06:d2:35:1c:6a:c5:
+                    76:70:6d:f0:81:8a:25:e4:35:c8:d5:79:17:3e:35:
+                    ec:2b:97:73:77:6c:04:7f:1f:0b:b5:f3:fd:1a:cd:
+                    76:2c:5c:17:45:6a:6d:c4:d1:6c:f8:09:ba:a0:f8:
+                    57:44:d7:b4:1c:a4:be:a4:4b:e4:76:34:1c:b1:0b:
+                    12:42:7e:79:e4:01:e0:5f:8f:6c:03:2d:2a:b6:4e:
+                    72:85:f1:b9:ac:d5:22:a7:0a:fc:5a:0c:e5:75:8f:
+                    9f:20:c2:14:ab:53:6a:b0:e6:8a:0d:f4:97:53:7f:
+                    f7:79:29:dd:ea:df:ae:39:6f:59:d8:b3:8e:da:bf:
+                    08:cd:03:ea:2a:91:33:c9:6f:21:a6:56:06:10:c1:
+                    40:4b:31:95:b0:47:2a:1e:2f:7d:eb:9b:f1:d4:27:
+                    af:1a:5d:bf:0f:b4:f5:d5:b8:1d:04:61:fa:06:af:
+                    49:6f:ff:99:88:f3:44:16:ed:3b:f1:c8:ea:31:0a:
+                    f3:f5:97:7a:17:08:e5:e8:8f:dd:1d:c8:8f:55:bf:
+                    47:93:9a:be:84:99:6f:f3:99:61:5d:b7:13:56:34:
+                    04:91
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+            X509v3 Authority Key Identifier: 
+                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+
+    Signature Algorithm: sha256WithRSAEncryption
+         03:d2:e6:f5:e4:1d:99:2e:df:02:b9:5b:f7:e0:82:ca:39:76:
+         5c:8f:3d:f1:5f:d4:bd:1b:4b:4f:35:4b:5d:f6:21:8b:c0:87:
+         23:de:7e:9d:93:1b:67:60:6d:df:7b:95:f0:6a:87:94:5c:f9:
+         a3:62:50:7b:68:02:b0:5c:d2:4b:f9:b1:97:ba:24:84:47:6e:
+         e1:e9:d6:e0:fa:2f:f7:9b:c5:67:3a:eb:8e:bc:b7:8f:31:7d:
+         5c:ba:91:ce:9d:2c:91:85:32:74:e7:e9:ba:07:61:7c:8b:55:
+         69:db:f9:7b:1d:ef:55:fc:bf:58:fc:99:66:9c:9e:92:35:75:
+         53:0a:31:e1:34:8a:cf:bc:79:b0:0e:ac:bf:aa:f0:e3:74:88:
+         f2:a6:5c:38:ad:21:31:ea:cd:e2:57:01:6b:9e:0b:24:62:78:
+         ac:6a:88:ba:ae:be:20:27:63:ab:3b:e9:2c:c0:5c:81:c5:e7:
+         e6:fe:a7:09:30:b4:28:65:51:6f:1b:1d:22:f8:30:7d:87:ae:
+         da:28:99:5c:8b:15:f0:b7:45:d0:1d:3b:ad:c5:29:4a:ed:11:
+         68:c4:af:28:a3:0b:9f:1b:c8:86:56:80:3d:6b:d3:1f:c6:b0:
+         3d:4a:39:1c:10:57:2d:22:df:d7:7b:ad:7d:f9:12:47:bb:33:
+         29:61:14:c4
+-----BEGIN CERTIFICATE-----
+MIIDijCCAnKgAwIBAgIBATANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
+MTM0OTI4WjBWMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNVBAMME1B5dGhvbiBMREFQIFRlc3QgQ0Ew
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0vUd42WJOjq4YU7iOnwsT
+6vJZwB1/C1xa7ci4zf9mlMRA1c1M2gbSNRxqxXZwbfCBiiXkNcjVeRc+Newrl3N3
+bAR/Hwu18/0azXYsXBdFam3E0Wz4Cbqg+FdE17QcpL6kS+R2NByxCxJCfnnkAeBf
+j2wDLSq2TnKF8bms1SKnCvxaDOV1j58gwhSrU2qw5ooN9JdTf/d5Kd3q3645b1nY
+s47avwjNA+oqkTPJbyGmVgYQwUBLMZWwRyoeL33rm/HUJ68aXb8PtPXVuB0EYfoG
+r0lv/5mI80QW7TvxyOoxCvP1l3oXCOXoj90dyI9Vv0eTmr6EmW/zmWFdtxNWNASR
+AgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1Ud
+DgQWBBQ9gOO7lJfb3d/IGiOKyyvBPRrmhTAfBgNVHSMEGDAWgBQ9gOO7lJfb3d/I
+GiOKyyvBPRrmhTANBgkqhkiG9w0BAQsFAAOCAQEAA9Lm9eQdmS7fArlb9+CCyjl2
+XI898V/UvRtLTzVLXfYhi8CHI95+nZMbZ2Bt33uV8GqHlFz5o2JQe2gCsFzSS/mx
+l7okhEdu4enW4Pov95vFZzrrjry3jzF9XLqRzp0skYUydOfpugdhfItVadv5ex3v
+Vfy/WPyZZpyekjV1Uwox4TSKz7x5sA6sv6rw43SI8qZcOK0hMerN4lcBa54LJGJ4
+rGqIuq6+ICdjqzvpLMBcgcXn5v6nCTC0KGVRbxsdIvgwfYeu2iiZXIsV8LdF0B07
+rcUpSu0RaMSvKKMLnxvIhlaAPWvTH8awPUo5HBBXLSLf13utffkSR7szKWEUxA==
+-----END CERTIFICATE-----
diff --git a/Tests/certs/client.conf b/Tests/certs/client.conf
new file mode 100644
index 0000000..774dc3a
--- /dev/null
+++ b/Tests/certs/client.conf
@@ -0,0 +1,16 @@
+# Written by Christian Heimes
+
+[req]
+default_bits = 2048
+encrypt_key = no
+default_md = sha256
+utf8 = yes
+string_mask = utf8only
+prompt = no
+distinguished_name = client_dn
+
+[client_dn]
+countryName = "DE"
+organizationName = "python-ldap"
+organizationalUnitName = "slapd-test"
+commonName = "client"
diff --git a/Tests/certs/client.key b/Tests/certs/client.key
new file mode 100644
index 0000000..81c3e76
--- /dev/null
+++ b/Tests/certs/client.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4aZb1WfASk2JR
+VAwFMMQCJNkbBDj7d8QdqSMa32jgTG8m/0N5RYGhdIi6zVeO2GmrSDuRd9Lv5hqu
+6ZgFI/rRCYSZHrIe6MXSOs6ZZKHIeQYkZcKa7Eg1FWQPBS51FJjYcotoHj5uxyKZ
+pOBMC63qODgq77G4zcqIKVswKS34KAIwvBAAUmTMtyMOOEh8oZm4V4ILpFFNBfs9
+CcyKMcAtCiFXOYZQ0G16ExzT560FMxMmCHd8HkevhfgFlKZb9/bsHNb+tvBwTQNm
+eUl4gnPDJk6YLBGIscBImvSRJu8o07aZBvAZvRhPa5iX/mtnlg0pDQ9jiGFK24qB
+VPQKtwHjAgMBAAECggEBAIYO7Fir6uP2FHD+4kYbr0HHu7PyG+JirETLoeN1KW50
+4hC9XDWam6PdbVAu2knTdO248uTK8KLI6fjhg0upXjn761LMh7wEh1pOucW07A8q
+O5bWCuRIhC1iwXxRzfX65SnkCwfDhKtPRA3hV9SwYNt1xw8fdFjd8S+OsOWP6gUN
+A33rBN6L44zfabZmcIO4DvSjDP4zoOL640uFg9dyf2yHzFI+q4mZgMK2iW5TZILl
+pNfdQF/hZsqrme+kzUyEtQHzLxGk1twYlFubePS0K1wzXRw6OqFRA0+pYNYP+JmJ
+bQs1k/e/y5qRiD9+UzR3MOTASl9BWDu9KCK1LF5pqYECgYEA7SD43REkVmQkFinf
+Re1kfOTkqCub1t4veTZBqVBNCF10fnQwPk1UQ2PShum1iJun6S3P0NzJP/svGc0N
+m44XJaD8QHnXdsDkHGx36/Cj15+VYpGvSpkPUgVQk4Q82n29Y3v8/xR6xqhXiB2N
+kuWHig8WIrrc690mUlL1NLQvH+ECgYEAxxaggQXlBTdDSMj2x3Y/0TJlkese2Oet
+JxWu6xGfjrsjMxZj1c5C3ESeKws3Z1eH9nk3AVzJ/q/+2SyCM3lM+eFz6dAtKVDB
+Olly4YhxoEZDgW4JXMVLP8d7xNDxWk9y7UitpvfDJ8J0hf//y9KR2jnokkfSKScN
+AsqrMe7+6kMCgYEAgndztV3rGkU6vZ8II1c7xKPDUuu7cHsKr6w0cE2oNIQGxlRy
+/rRZOkK/4E7R/Hl35wm3n3j6mWNARPfXFtEU1zU91NO0wrfaSfE8AeqCmu5IqNTz
+Fx4jmcMm1CMbwDMScpwTVN0VuBuDHXb1H+99pW4rhaw+RN+GaCEQnJDOpMECgYBv
+UTOFcOpRNEkm1VdGx9N/ARLRuAmTdlbW18TqIvx4LiLMWeSQk7fGuYdGwgrEeajI
+I5ah6GP5SCbS/5P9fAGSZoENZx0ZUNH58jHN8SC3YRI1uHT7rkUY8E1ACyQoPuwf
+yNdv2HECNjQ5CJ7aNG7g+igUQpw77l3UBcYbMWrPSQKBgG+R+nFGbjJ7oHyvJyJI
+C3rlD6vay9BoXmjA05dCO36zDcq5xZqwLnQmYkFgBw+RwvwV8gbBirG7GEpy0rdt
+5YbHwiI6fMfLsXocU9f86o2dhhpA2o42ig3mfe8X3LteWtmRfJ3BtHbW2ZWS8Kvx
+MnZGm64AmjWV5oJb7e5jpgu6
+-----END PRIVATE KEY-----
diff --git a/Tests/certs/client.pem b/Tests/certs/client.pem
new file mode 100644
index 0000000..8133c6d
--- /dev/null
+++ b/Tests/certs/client.pem
@@ -0,0 +1,83 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Validity
+            Not Before: Nov 28 13:49:28 2017 GMT
+            Not After : Nov 28 13:49:28 2021 GMT
+        Subject: C=DE, O=python-ldap, OU=slapd-test, CN=client
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b8:69:96:f5:59:f0:12:93:62:51:54:0c:05:30:
+                    c4:02:24:d9:1b:04:38:fb:77:c4:1d:a9:23:1a:df:
+                    68:e0:4c:6f:26:ff:43:79:45:81:a1:74:88:ba:cd:
+                    57:8e:d8:69:ab:48:3b:91:77:d2:ef:e6:1a:ae:e9:
+                    98:05:23:fa:d1:09:84:99:1e:b2:1e:e8:c5:d2:3a:
+                    ce:99:64:a1:c8:79:06:24:65:c2:9a:ec:48:35:15:
+                    64:0f:05:2e:75:14:98:d8:72:8b:68:1e:3e:6e:c7:
+                    22:99:a4:e0:4c:0b:ad:ea:38:38:2a:ef:b1:b8:cd:
+                    ca:88:29:5b:30:29:2d:f8:28:02:30:bc:10:00:52:
+                    64:cc:b7:23:0e:38:48:7c:a1:99:b8:57:82:0b:a4:
+                    51:4d:05:fb:3d:09:cc:8a:31:c0:2d:0a:21:57:39:
+                    86:50:d0:6d:7a:13:1c:d3:e7:ad:05:33:13:26:08:
+                    77:7c:1e:47:af:85:f8:05:94:a6:5b:f7:f6:ec:1c:
+                    d6:fe:b6:f0:70:4d:03:66:79:49:78:82:73:c3:26:
+                    4e:98:2c:11:88:b1:c0:48:9a:f4:91:26:ef:28:d3:
+                    b6:99:06:f0:19:bd:18:4f:6b:98:97:fe:6b:67:96:
+                    0d:29:0d:0f:63:88:61:4a:db:8a:81:54:f4:0a:b7:
+                    01:e3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                TLS Web Client Authentication
+            X509v3 Subject Key Identifier: 
+                C5:E2:E2:72:A6:55:C1:FB:D3:4B:11:01:D0:A0:AE:99:B6:8F:F1:39
+            X509v3 Authority Key Identifier: 
+                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+
+    Signature Algorithm: sha256WithRSAEncryption
+         11:76:03:a3:a6:9d:4e:3e:74:93:50:3b:31:d5:c7:d0:a8:34:
+         84:01:6b:a2:08:cd:89:11:57:97:a2:e9:83:f0:a6:ef:03:8c:
+         b2:8d:31:8f:ee:b3:c9:8c:49:1f:e4:fc:21:58:8d:22:c2:17:
+         96:2e:b1:d1:64:03:d6:48:70:41:65:22:38:bf:9f:00:dd:a8:
+         82:a0:df:22:e0:9a:1b:27:16:4b:db:7f:b0:fe:9f:a8:80:90:
+         69:ad:35:be:e6:95:fe:f9:64:96:0a:d8:d7:8e:aa:63:fb:9a:
+         d5:d0:e9:cb:8c:f3:08:c0:0c:26:72:c9:c6:29:5c:cf:3c:9e:
+         e2:38:37:5a:16:2f:70:82:0b:e6:80:27:90:bd:81:b4:58:52:
+         6c:4e:b7:77:fc:49:76:7a:4f:6c:ee:ff:02:1f:f4:49:6e:78:
+         c3:fa:cd:ee:d3:e7:e5:05:a4:16:97:48:16:44:9f:81:1c:ac:
+         a9:30:0e:1d:ea:15:32:d7:2b:1e:68:92:0a:9c:5b:b2:27:57:
+         d3:21:3e:76:71:94:2d:da:76:61:aa:64:99:b7:54:1c:ba:e2:
+         a5:b3:21:a4:a8:36:fe:5d:a3:73:6a:5e:77:af:ab:9a:d9:62:
+         00:f0:fd:90:1e:b6:cc:57:5d:92:0d:16:16:97:78:48:27:fc:
+         d9:2d:55:4d
+-----BEGIN CERTIFICATE-----
+MIIDkjCCAnqgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
+MTM0OTI4WjBJMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BgNVBAsMCnNsYXBkLXRlc3QxDzANBgNVBAMMBmNsaWVudDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBALhplvVZ8BKTYlFUDAUwxAIk2RsEOPt3xB2pIxrf
+aOBMbyb/Q3lFgaF0iLrNV47YaatIO5F30u/mGq7pmAUj+tEJhJkesh7oxdI6zplk
+och5BiRlwprsSDUVZA8FLnUUmNhyi2gePm7HIpmk4EwLreo4OCrvsbjNyogpWzAp
+LfgoAjC8EABSZMy3Iw44SHyhmbhXggukUU0F+z0JzIoxwC0KIVc5hlDQbXoTHNPn
+rQUzEyYId3weR6+F+AWUplv39uwc1v628HBNA2Z5SXiCc8MmTpgsEYixwEia9JEm
+7yjTtpkG8Bm9GE9rmJf+a2eWDSkND2OIYUrbioFU9Aq3AeMCAwEAAaN4MHYwDAYD
+VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
+AwIwHQYDVR0OBBYEFMXi4nKmVcH700sRAdCgrpm2j/E5MB8GA1UdIwQYMBaAFD2A
+47uUl9vd38gaI4rLK8E9GuaFMA0GCSqGSIb3DQEBCwUAA4IBAQARdgOjpp1OPnST
+UDsx1cfQqDSEAWuiCM2JEVeXoumD8KbvA4yyjTGP7rPJjEkf5PwhWI0iwheWLrHR
+ZAPWSHBBZSI4v58A3aiCoN8i4JobJxZL23+w/p+ogJBprTW+5pX++WSWCtjXjqpj
++5rV0OnLjPMIwAwmcsnGKVzPPJ7iODdaFi9wggvmgCeQvYG0WFJsTrd3/El2ek9s
+7v8CH/RJbnjD+s3u0+flBaQWl0gWRJ+BHKypMA4d6hUy1yseaJIKnFuyJ1fTIT52
+cZQt2nZhqmSZt1QcuuKlsyGkqDb+XaNzal53r6ua2WIA8P2QHrbMV12SDRYWl3hI
+J/zZLVVN
+-----END CERTIFICATE-----
diff --git a/Tests/certs/gencerts.sh b/Tests/certs/gencerts.sh
new file mode 100755
index 0000000..6edafa0
--- /dev/null
+++ b/Tests/certs/gencerts.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+# Written by Christian Heimes
+set -e
+
+export CAOUTDIR=.
+export CATMPDIR=tmp
+
+rm -rf $CATMPDIR
+rm -rf ca.pem ca.key server.pem server.key client.pem client.key
+rm -rf cert9.db key4.db pkcs11.tx
+
+mkdir -p $CAOUTDIR
+mkdir -p $CATMPDIR
+
+touch $CATMPDIR/ca.db
+touch $CATMPDIR/ca.db.attr
+echo '01' > $CATMPDIR/ca.crt.srl
+echo '01' > $CATMPDIR/ca.crl.srl
+
+# root CA
+openssl req -new \
+    -config ca.conf \
+    -out $CATMPDIR/ca.csr \
+    -keyout $CAOUTDIR/ca.key \
+    -batch
+
+openssl ca -selfsign \
+    -config ca.conf \
+    -in $CATMPDIR/ca.csr \
+    -out $CAOUTDIR/ca.pem \
+    -extensions ca_ext \
+    -batch
+
+# server cert
+openssl req -new \
+    -config server.conf \
+    -out $CATMPDIR/server.csr \
+    -keyout $CAOUTDIR/server.key \
+    -batch
+
+openssl ca \
+    -config ca.conf \
+    -in $CATMPDIR/server.csr \
+    -out $CAOUTDIR/server.pem \
+    -policy match_pol \
+    -extensions server_ext \
+    -batch
+
+# client cert
+openssl req -new \
+    -config client.conf \
+    -out $CATMPDIR/client.csr \
+    -keyout $CAOUTDIR/client.key \
+    -batch
+
+openssl ca \
+    -config ca.conf \
+    -in $CATMPDIR/client.csr \
+    -out $CAOUTDIR/client.pem \
+    -policy match_pol \
+    -extensions client_ext \
+    -batch
+
+# cleanup
+rm -rf $CATMPDIR ca.key
+
+echo DONE
diff --git a/Tests/certs/gennssdb.sh b/Tests/certs/gennssdb.sh
new file mode 100755
index 0000000..aeeb333
--- /dev/null
+++ b/Tests/certs/gennssdb.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Written by Christian Heimes
+set -e
+
+CATMPDIR=tmp
+PASSFILE=${CATMPDIR}/passwd.txt
+NSSDB=sql:${CAOUTDIR}
+
+mkdir -p $CATMPDIR
+
+# Create PKCS#12 files for NSSDB import
+echo "dummy" > $PASSFILE
+openssl pkcs12 -name "servercert" -in server.pem -inkey server.key \
+    -caname "testca" -CAfile ca.pem \
+    -password "file:${PASSFILE}" -export -out server.p12
+openssl pkcs12 -name "clientcert" -in client.pem -inkey client.key \
+    -caname "testca" -CAfile ca.pem \
+    -password "file:${PASSFILE}" -export -out client.p12
+
+# Create NSS DB
+certutil -d $NSSDB -N --empty-password
+certutil -d $NSSDB -A -n "testca" -t CT,, -a -i ca.pem
+pk12util -d $NSSDB -i server.p12 -w ${PASSFILE}
+pk12util -d $NSSDB -i client.p12 -w ${PASSFILE}
+certutil -d $NSSDB -L
+
+# cleanup
+rm -rf $CATMPDIR server.p12 client.p12
\ No newline at end of file
diff --git a/Tests/certs/server.conf b/Tests/certs/server.conf
new file mode 100644
index 0000000..94f4427
--- /dev/null
+++ b/Tests/certs/server.conf
@@ -0,0 +1,16 @@
+# Written by Christian Heimes
+
+[req]
+default_bits = 2048
+encrypt_key = no
+default_md = sha256
+utf8 = yes
+string_mask = utf8only
+prompt = no
+distinguished_name = server_dn
+
+[server_dn]
+countryName = "DE"
+organizationName = "python-ldap"
+organizationalUnitName = "slapd-test"
+commonName = "server cert for localhost"
diff --git a/Tests/certs/server.key b/Tests/certs/server.key
new file mode 100644
index 0000000..081dc2f
--- /dev/null
+++ b/Tests/certs/server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDTJOAnZdPnCTmy
+gkI5XUHsuk1xL4eePxMcV+8HYMfQh+b354CygQnRcjj38uQ6S70mOIyCrTWKNrec
+VrnV0xu4o16AkSRrkN0AVpfWk0ae2GaccDV+o82x+NBStfYNXW2xZ1aZIyFplGTU
+yxQCpsU4yCX7RM7Ywq3fM6b8eoR2jRNGC/uMdNN/7WJkHfhJFOYFpPJ6vKOlR3PP
+qzkj8WRu/ill63+phHA3UEUweKG4DoaP85M0WqHW4Kvp0A4sI5uPYI2lPrDqUf6L
+Wc22gUpcFFNDReWYcxLobCsAeT4SqvEC83Dv53NKQS6wt4zLewVG1+8cjyctwv4m
+PAatL8uDAgMBAAECggEACB8+BCX1nciMEKLUG1LMC2grPHRgmiTA/nEff8AoT4w6
+xUSBfdxa3VSwflE4mEl7kDHSreAt1BBAxeHMKj6BrXuTUgzDQuQCrFWoZ5eousmG
+QPRMCoAQlI0GrnfTbDYw1wcrnJ5uVZpgupLJRUTXB1UjqOO/tTTf7VsWTFYGLG00
+8OeIenTGX0E1mVW9ERYCSYEtMfhQhSS3dhPmMm5VV6muIxv4ym6r2uodCY7ocxGA
+JmI9F22xovH8CUtzoRbh0o4Y9VUVkKcMDl35+hya8c0BH4Vh22hnYgiyUkS1pBgY
+GiX/rmU4FxkzLDrLLMB8cf+rzh+aOKjNupZ2dbNgsQKBgQDu3DLRHhUJEUcoK6Gb
+ltVK179WsT1Me1Y/qiZ2SgGsXmSZFK+8cYLvXUI7Epz2Du2DwAb1J+sItie5QQ9g
+o6eymTS7DuQ6MFS1UmC8PfSNjT/dFd/sVIEFJRcNkVC4CpJCnE4MQOUb6OIT8YnR
++HNDNMWc5+ab1OeFxMWRSrP52wKBgQDiS4oFkhfPtaxVyUHuiR0+0icjCGehWSM0
+eNoiX561HtBrYCZYp6kg1JMSLBSJPRaHi78td3z+6iDvE6HQtwrLq/LNd2CRJ80U
+rkGjsItpZYfnJVMmK6Y4KksGlvYqWshWb8Zp0o+LPRb6g0TxZrbOGv7yD8FjaZwq
+wlGxleIJeQKBgDDR+uT5BA2lZWjVeiOF8bRpYmdCtKe0Mc2zZkcZGzxy0pbjPoQC
+o2NvKUFPrZsxM+SQ1Bs5fHV8XaQkoxL6gCUl4Tw2b/lgtX+WBcWT2C8yZpI2jV0N
+bI1zpkGUqO3k4z4QGnewr+NDdyniXWv4Hv7mg1ltoJnLK0MRE9x9a0mvAoGBAIi4
+8w8ikVhhf1nlWvxvw0etWRAFh/coD+koC0MxWoY7s9jsIr71rW20gZc9Irs4OWBz
+wnIJ+29YrcVEq0ObE96yaORS9/k7fuC719S6WcC4I0A4gOBTBv5wLxwwIVK9vsTa
+i5psKWYK5tM8dG8Vi+VC0j4V3tXdfQkolosg74yhAoGAOLj21q7nNk+ExGAOesmR
+qykxwIXxbHxDIfmEJJVE6OJMRvubr8WgaiSG0ptWBeiHDnldUS436difn7JXlsdo
+K51jVzzgUqZXK75xvnSD7e5AL3fFRCU5usoU699fxWJTMs8H2z4alRng06MloeXJ
+xrLwQyuLH8BWYFuPj4QxwwQ=
+-----END PRIVATE KEY-----
diff --git a/Tests/certs/server.pem b/Tests/certs/server.pem
new file mode 100644
index 0000000..45ae694
--- /dev/null
+++ b/Tests/certs/server.pem
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Validity
+            Not Before: Nov 28 13:49:28 2017 GMT
+            Not After : Nov 28 13:49:28 2021 GMT
+        Subject: C=DE, O=python-ldap, OU=slapd-test, CN=server cert for localhost
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d3:24:e0:27:65:d3:e7:09:39:b2:82:42:39:5d:
+                    41:ec:ba:4d:71:2f:87:9e:3f:13:1c:57:ef:07:60:
+                    c7:d0:87:e6:f7:e7:80:b2:81:09:d1:72:38:f7:f2:
+                    e4:3a:4b:bd:26:38:8c:82:ad:35:8a:36:b7:9c:56:
+                    b9:d5:d3:1b:b8:a3:5e:80:91:24:6b:90:dd:00:56:
+                    97:d6:93:46:9e:d8:66:9c:70:35:7e:a3:cd:b1:f8:
+                    d0:52:b5:f6:0d:5d:6d:b1:67:56:99:23:21:69:94:
+                    64:d4:cb:14:02:a6:c5:38:c8:25:fb:44:ce:d8:c2:
+                    ad:df:33:a6:fc:7a:84:76:8d:13:46:0b:fb:8c:74:
+                    d3:7f:ed:62:64:1d:f8:49:14:e6:05:a4:f2:7a:bc:
+                    a3:a5:47:73:cf:ab:39:23:f1:64:6e:fe:29:65:eb:
+                    7f:a9:84:70:37:50:45:30:78:a1:b8:0e:86:8f:f3:
+                    93:34:5a:a1:d6:e0:ab:e9:d0:0e:2c:23:9b:8f:60:
+                    8d:a5:3e:b0:ea:51:fe:8b:59:cd:b6:81:4a:5c:14:
+                    53:43:45:e5:98:73:12:e8:6c:2b:00:79:3e:12:aa:
+                    f1:02:f3:70:ef:e7:73:4a:41:2e:b0:b7:8c:cb:7b:
+                    05:46:d7:ef:1c:8f:27:2d:c2:fe:26:3c:06:ad:2f:
+                    cb:83
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: critical
+                TLS Web Server Authentication
+            X509v3 Subject Key Identifier: 
+                98:03:0F:65:1A:34:A9:E1:09:1B:EC:D0:ED:A8:11:E6:AE:85:1F:2C
+            X509v3 Authority Key Identifier: 
+                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+
+            X509v3 Subject Alternative Name: 
+                DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
+    Signature Algorithm: sha256WithRSAEncryption
+         a6:01:8e:6f:0f:db:35:1f:a2:03:f5:39:ca:16:5f:e5:5a:0f:
+         7e:f1:24:8a:b9:6f:78:c1:2c:f7:3a:07:f1:27:46:47:e0:98:
+         a1:ec:23:38:30:b9:bc:66:ac:17:06:36:48:ad:5d:1d:b4:a2:
+         c1:2c:08:55:ff:00:01:04:26:60:38:a6:13:52:7b:d3:88:8a:
+         b1:1f:a4:cd:14:9b:c8:04:77:01:72:6d:fe:b5:8c:3a:25:e2:
+         2b:83:73:4b:2e:c6:6f:20:8b:00:c7:3b:2e:de:62:e9:74:81:
+         c6:a5:f5:b1:f9:db:b9:58:f9:7c:a2:3f:4e:46:93:ae:af:75:
+         01:77:ea:34:4e:82:dc:d3:53:39:c0:b0:f9:8a:86:8d:f5:f2:
+         c3:a0:fa:e4:a9:b3:2c:33:ba:78:d5:ef:12:05:33:4f:29:9b:
+         88:41:52:73:5a:17:7e:bc:66:d0:dc:c7:14:6d:a5:99:78:67:
+         81:36:76:29:63:de:76:d4:eb:ca:5c:82:1b:ae:7d:80:ed:32:
+         69:b0:b7:7a:1d:e1:00:a8:b1:95:d3:4d:d5:e2:8c:f4:30:a7:
+         da:79:bd:f5:bb:7a:8d:c5:ec:1c:16:32:58:92:ad:fc:1c:83:
+         49:ca:8c:f9:6d:d4:f7:2c:98:1a:25:47:36:16:4f:15:46:ea:
+         71:78:f1:51
+-----BEGIN CERTIFICATE-----
+MIID1TCCAr2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
+MTM0OTI4WjBcMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BgNVBAsMCnNsYXBkLXRlc3QxIjAgBgNVBAMMGXNlcnZlciBjZXJ0IGZvciBsb2Nh
+bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTJOAnZdPnCTmy
+gkI5XUHsuk1xL4eePxMcV+8HYMfQh+b354CygQnRcjj38uQ6S70mOIyCrTWKNrec
+VrnV0xu4o16AkSRrkN0AVpfWk0ae2GaccDV+o82x+NBStfYNXW2xZ1aZIyFplGTU
+yxQCpsU4yCX7RM7Ywq3fM6b8eoR2jRNGC/uMdNN/7WJkHfhJFOYFpPJ6vKOlR3PP
+qzkj8WRu/ill63+phHA3UEUweKG4DoaP85M0WqHW4Kvp0A4sI5uPYI2lPrDqUf6L
+Wc22gUpcFFNDReWYcxLobCsAeT4SqvEC83Dv53NKQS6wt4zLewVG1+8cjyctwv4m
+PAatL8uDAgMBAAGjgacwgaQwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw
+FgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFJgDD2UaNKnhCRvs0O2o
+EeauhR8sMB8GA1UdIwQYMBaAFD2A47uUl9vd38gaI4rLK8E9GuaFMCwGA1UdEQQl
+MCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATANBgkqhkiG9w0B
+AQsFAAOCAQEApgGObw/bNR+iA/U5yhZf5VoPfvEkirlveMEs9zoH8SdGR+CYoewj
+ODC5vGasFwY2SK1dHbSiwSwIVf8AAQQmYDimE1J704iKsR+kzRSbyAR3AXJt/rWM
+OiXiK4NzSy7GbyCLAMc7Lt5i6XSBxqX1sfnbuVj5fKI/TkaTrq91AXfqNE6C3NNT
+OcCw+YqGjfXyw6D65KmzLDO6eNXvEgUzTymbiEFSc1oXfrxm0NzHFG2lmXhngTZ2
+KWPedtTrylyCG659gO0yabC3eh3hAKixldNN1eKM9DCn2nm99bt6jcXsHBYyWJKt
+/ByDScqM+W3U9yyYGiVHNhZPFUbqcXjxUQ==
+-----END CERTIFICATE-----
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 6998e73..3a0f7df 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -807,6 +807,35 @@ def test_invalid_controls(self):
                 l.sasl_interactive_bind_s, 'who', 'SASLObject', post=(1,))
         self.assertInvalidControls(l.unbind_ext)
 
+    @unittest.skipUnless(_ldap.TLS_AVAIL, "needs tls")
+    def test_tls_ext(self):
+        l = self._open_conn(bind=False)
+        # StartTLS needs LDAPv3
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        l.set_option(_ldap.OPT_X_TLS_CACERTFILE, self.server.cafile)
+        # re-create TLS context
+        l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
+        l.start_tls_s()
+
+    @unittest.skipUnless(_ldap.TLS_AVAIL, "needs tls")
+    def test_tls_ext_noca(self):
+        l = self._open_conn(bind=False)
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
+        with self.assertRaises(_ldap.CONNECT_ERROR):
+            l.start_tls_s()
+
+    @unittest.skipUnless(_ldap.TLS_AVAIL, "needs tls")
+    def test_tls_ext_clientcert(self):
+        l = self._open_conn(bind=False)
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        l.set_option(_ldap.OPT_X_TLS_CACERTFILE, self.server.cafile)
+        l.set_option(_ldap.OPT_X_TLS_CERTFILE, self.server.clientcert)
+        l.set_option(_ldap.OPT_X_TLS_KEYFILE, self.server.clientkey)
+        l.set_option(_ldap.OPT_X_TLS_REQUIRE_CERT, _ldap.OPT_X_TLS_HARD)
+        l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
+        l.start_tls_s()
+        # TODO verify that client auth actually works
 
 if __name__ == '__main__':
     unittest.main()

From 7405d120c6d7f6e3b5720e6b58cd02901fc75bd2 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 28 Nov 2017 15:49:57 +0100
Subject: [PATCH 626/868] Doc: Fixes for the spelling wordlist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- continously → continUously
- correct capitalization for Heimdal Kerberos
---
 Doc/installing.rst        | 2 +-
 Doc/spelling_wordlist.txt | 3 +--
 Lib/ldif.py               | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index c78bd7f..2ea5594 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -113,7 +113,7 @@ on the local system when building python-ldap:
   It is not possible and not supported to build with prior versions.
 - `OpenSSL`_ (optional)
 - `cyrus-sasl`_ (optional)
-- Kerberos libraries, MIT or heimdal (optional)
+- Kerberos libraries, MIT or Heimdal (optional)
 
 .. _Python: https://www.python.org/
 .. _OpenLDAP: https://www.openldap.org/
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index fcc227f..39df00f 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -27,7 +27,6 @@ changeTypes
 cidict
 clientctrls
 conf
-Continously
 controlType
 controlValue
 criticality
@@ -53,7 +52,7 @@ filterstr
 filterStr
 formatOID
 func
-heimdal
+Heimdal
 hostport
 hrefTarget
 hrefText
diff --git a/Lib/ldif.py b/Lib/ldif.py
index aead2ef..4735bfb 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -395,7 +395,7 @@ def _consume_empty_lines(self):
 
   def parse_entry_records(self):
     """
-    Continously read and parse LDIF entry records
+    Continuously read and parse LDIF entry records
     """
     # Local symbol for better performance
     next_key_and_value = self._next_key_and_value

From 703d32209ba49227edb67d7ca1c3107da6ca8ca5 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 16:07:16 +0100
Subject: [PATCH 627/868] Don't define search path for includes and libs

Compilers' and linkers' default search paths are fine on modern Linux. The
custom search path was wrong on 32bit platforms anyway. When library_dirs is
defined, distutils also adds rpath to the shared library. An rpath
should not be added by default.

I only commented out the configuration stanzes to keep them as example.

Closes: https://github.com/python-ldap/python-ldap/issues/30
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 setup.cfg | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/setup.cfg b/setup.cfg
index 59816b7..7fab8ae 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -5,9 +5,10 @@
 # for wrapping OpenLDAP 2 libs
 [_ldap]
 
-# Define extra include and library dirs if needed
-library_dirs = /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64
-include_dirs = /usr/include /usr/include/sasl /usr/local/include /usr/local/include/sasl
+# Define extra include and library dirs if needed. distutils adds non
+# standard library_dirs as rpath.
+# library_dirs = /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64
+# include_dirs = /usr/include /usr/include/sasl /usr/local/include /usr/local/include/sasl
 
 # These defines needs OpenLDAP built with
 # ./configure --with-cyrus-sasl --with-tls

From 5729d06ff5eda1e30858ffaf19e566e9b5283487 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 16:24:07 +0100
Subject: [PATCH 628/868] Include sasl.h from standard path

<sasl/sasl.h> is the standard include path for sasl.h.
``pkg-config --cflags libsasl2`` agrees with me.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c | 4 ----
 setup.cfg            | 2 +-
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 1c0591c..0aafe49 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -13,11 +13,7 @@
 #include "options.h"
 
 #ifdef HAVE_SASL
-#ifdef __APPLE__
 #include <sasl/sasl.h>
-#else
-#include <sasl.h>
-#endif
 #endif
 
 static void free_attrs(char***, PyObject*);
diff --git a/setup.cfg b/setup.cfg
index 7fab8ae..34699da 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -8,7 +8,7 @@
 # Define extra include and library dirs if needed. distutils adds non
 # standard library_dirs as rpath.
 # library_dirs = /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64
-# include_dirs = /usr/include /usr/include/sasl /usr/local/include /usr/local/include/sasl
+# include_dirs = /usr/include /usr/local/include
 
 # These defines needs OpenLDAP built with
 # ./configure --with-cyrus-sasl --with-tls

From 5a63a08a45e3f2861dbcaf9dbd6bfb714f5163b5 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 28 Nov 2017 15:12:38 +0100
Subject: [PATCH 629/868] Doc: Link to documentation for older versions

---
 Doc/index.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Doc/index.rst b/Doc/index.rst
index f478d10..6d2f1ac 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -45,7 +45,11 @@ The documentation for python-ldap 3.x is hosted at `Read the Docs`_.
 You can switch between versions of the library, or download PDF or HTML
 versions for offline use, using the right sidebar.
 
+Documentation for some older versions is available for download at the
+`GitHub release page`_.
+
 .. _Read the Docs: http://python-ldap.readthedocs.io/en/latest/
+.. _GitHub release page: https://github.com/python-ldap/python-ldap/releases
 
 
 Contents

From 644847f818cbc802b8a4b5663e08810427b86c16 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 28 Nov 2017 21:25:34 +0100
Subject: [PATCH 630/868] Doc: rewordings, syntax fixes, typo fixes

---
 Doc/faq.rst               | 61 ++++++++++++++++++++-------------------
 Doc/index.rst             | 23 +++++++++------
 Doc/installing.rst        | 33 +++++++++++----------
 Doc/spelling_wordlist.txt |  4 +--
 4 files changed, 64 insertions(+), 57 deletions(-)

diff --git a/Doc/faq.rst b/Doc/faq.rst
index 58bb81e..ef479a8 100644
--- a/Doc/faq.rst
+++ b/Doc/faq.rst
@@ -35,41 +35,41 @@ Usage
 
 
 **Q**: My code imports module ``_ldap``.
-That used to work but from version 2.0.0pre that does not work anymore?
+That used to work, but after an upgrade it does not work anymore. Why?
 
-   **A**: Despite some outdated programming examples the extension module
-    ``_ldap`` **MUST NOT** be imported directly unless 
-    you really know what you're doing (e.g. for internal regression testing).
+   **A**: Despite some outdated programming examples, the extension module
+    ``_ldap`` **MUST NOT** be imported directly, unless you really know what
+    you're doing (e.g. for internal regression testing).
 
-    Import ``ldap`` instead which is a Python wrapper around ``_ldap``
+    Import ``ldap`` instead, which is a Python wrapper around ``_ldap``
     providing the full functionality.
 
 **Q**: My script bound to MS Active Directory but a a search operation results
-in an exception :exc:`ldap.OPERATIONS_ERROR` with the diagnostic messages text
-"In order to perform this operation a successful bind must be
-completed on the connection."
+in the exception :exc:`ldap.OPERATIONS_ERROR` with the diagnostic messages text
+“In order to perform this operation a successful bind must be
+completed on the connection.”
 What's happening here?
 
-    **A**: When searching from the domain level MS AD returns referrals (search continuations)
+    **A**: When searching from the domain level, MS AD returns referrals (search continuations)
     for some objects to indicate to the client where to look for these objects.
-    Client-chasing of referrals is a broken concept since LDAPv3 does not specify
+    Client-chasing of referrals is a broken concept, since LDAPv3 does not specify
     which credentials to use when chasing the referral. Windows clients are supposed
-    to simply use their Windows credentials but this does not work in general when
+    to simply use their Windows credentials, but this does not work in general when
     chasing referrals received from and pointing to arbitrary LDAP servers.
 
-    Therefore per default ``libldap`` automatically chases the referrals
+    Therefore, per default, ``libldap`` automatically chases the referrals
     internally with an *anonymous* access which fails with MS AD.
 
-    So best thing is to switch this behaviour off::
+    So, the best thing to do is to switch this behaviour off::
 
       l = ldap.initialize('ldap://foobar')
       l.set_option(ldap.OPT_REFERRALS,0)
 
-**Q**: Why am I seeing ``ldap.SUCCESS`` traceback as output?
+**Q**: Why am I seeing a ``ldap.SUCCESS`` traceback as output?
 
-    **A**: Most likely you are using one of the non-synchronous calls, and probably
+    **A**: Most likely, you are using one of the non-synchronous calls, and probably
     mean to be using a synchronous call
-    (see detailed explanation in :ref:`sending-ldap-requests`.
+    (see detailed explanation in :ref:`sending-ldap-requests`).
 
 **Q**: Can I use LDAPv2 via python-ldap?
 
@@ -87,13 +87,14 @@ Installing
 
 **Q**: Does it work with Windows 32?
 
-    **A**: You can find links to pre-compiled packages for Win32 on the
-    :ref:`Download information` page.
+    **A**: Yes. You can find links to unofficial pre-compiled packages
+    for Windows on the :ref:`installing` page.
 
 
 **Q**: Can python-ldap be built against OpenLDAP 2.3 libs or older?
 
-    **A**: No, for recent python-ldap 2.4.x the OpenLDAP 2.4 client libs or newer are required.
+    **A**: No.
+    The needed minimal version of OpenLDAP is documented in :ref:`build prerequisites`.
     Patched builds of python-ldap linked to older libs are not supported by the
     python-ldap project.
 
@@ -123,8 +124,8 @@ telling Lib/ldap.py and Lib/ldap/schema.py are not found::
          --global-option="-I$(xcrun --show-sdk-path)/usr/include/sasl"
 
 
-**Q**: While importing module ldap some shared lib files are not found.
-Error message looks similar to this::
+**Q**: While importing module ``ldap``, some shared lib files are not found.
+The error message looks similar to this::
 
       ImportError: ld.so.1: /usr/local/bin/python: fatal: liblber.so.2: open failed: No such file or directory
 
@@ -133,9 +134,9 @@ Error message looks similar to this::
     **A1**: You need to make sure that the path to ``liblber.so.2`` and
     ``libldap.so.2`` is in your ``LD_LIBRARY_PATH`` environment variable.
 
-    **A2**: Alternatively if you're on Linux you can add the path to
+    **A2**: Alternatively, if you're on Linux, you can add the path to
     ``liblber.so.2`` and ``libldap.so.2`` to ``/etc/ld.so.conf``
-    and invoke command ``ldconfig`` afterwards.
+    and invoke the command ``ldconfig`` afterwards.
 
 
 
@@ -151,32 +152,32 @@ Historic
 But the python-ldap docs say LDAP libs 2.x are needed. I'm confused!
 
   Short answer:
-      See answer above and :ref:`download information` for
+      See answer above and the :ref:`installing` page for
       a more recent version.
 
   Long answer:
       E.g. some Win32 DLLs floating around for download are based on
       the old Umich LDAP code which is not maintained anymore for
-      ``many`` years! Last Umich 3.3 release was 1997 if I remember correctly.
+      *many* years! Last Umich 3.3 release was 1997 if I remember correctly.
 
       The OpenLDAP project took over the Umich code and started releasing
       OpenLDAP 1.x series mainly fixing bugs and doing some improvements
-      to the database backend. Still only LDAPv2 was supported at server
+      to the database backend. Still, only LDAPv2 was supported at server
       and client side. (Many commercial vendors also derived their products
       from the Umich code.)
 
-      OpenLDAP 2.x is a full-fledged LDAPv3 implementation. Still it has
+      OpenLDAP 2.x is a full-fledged LDAPv3 implementation. It has
       its roots in Umich code but has many more features/improvements.
 
 
-**Q**: While importing module ldap there are undefined references reported.
-Error message looks similar to this::
+**Q**: While importing module ``ldap``, there are undefined references reported.
+The error message looks similar to this::
 
     ImportError: /usr/local/lib/libldap.so.2: undefined symbol: res_query
 
 ..
 
-    **A**: Especially on older Linux systems you might have to explicitly link
+    **A**: Especially on older Linux systems, you might have to explicitly link
     against ``libresolv``.
 
     Tweak ``setup.cfg`` to contain this line::
diff --git a/Doc/index.rst b/Doc/index.rst
index 6d2f1ac..b346145 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -5,30 +5,35 @@ python-ldap
 What is python-ldap?
 --------------------
 
-* python-ldap provides an object-oriented API to access LDAP
-  directory servers from `Python`_ programs.
-* For LDAP operations the module wraps `OpenLDAP`_'s
-  client library *libldap* for that purpose.
-* Additionally the package contains modules for other LDAP-related stuff:
+python-ldap provides an object-oriented API to access `LDAP`_
+directory servers from `Python`_ programs.
 
-  * LDIF
+For LDAP operations the module wraps `OpenLDAP`_'s
+client library, *libldap*.
+
+Additionally, the package contains modules for other LDAP-related stuff:
+
+  * `LDIF`_ parsing and generation
   * LDAP URLs
   * LDAPv3 subschema
 
+.. _LDAP: https://en.wikipedia.org/wiki/Ldap
 .. _Python: https://www.python.org/
 .. _OpenLDAP: https://www.openldap.org/
+.. _LDIF: https://en.wikipedia.org/wiki/LDIF
 
 
 Get it!
 -------
 
-:ref:`Download information` is available for several platforms.
+:ref:`Installation instructions <installing>` are available for
+several platforms.
 
 
 Mailing list
 ------------
 
-Discussion about the use and future of Python-LDAP occurs in
+Discussion about the use and future of python-ldap occurs in
 the ``python-ldap@python.org`` mailing list.
 
 You can `subscribe or unsubscribe`_ to this list or browse the `list archive`_.
@@ -43,7 +48,7 @@ Documentation
 The documentation for python-ldap 3.x is hosted at `Read the Docs`_.
 
 You can switch between versions of the library, or download PDF or HTML
-versions for offline use, using the right sidebar.
+versions for offline use, using the sidebar on the right.
 
 Documentation for some older versions is available for download at the
 `GitHub release page`_.
diff --git a/Doc/installing.rst b/Doc/installing.rst
index 2ea5594..f2dec81 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,4 +1,4 @@
-.. _Download information:
+.. _installing:
 
 Installing python-ldap
 ######################
@@ -7,7 +7,7 @@ Installing from PyPI
 ====================
 
 The preferred point for downloading the “official” source distribution
-is now the `PyPI repository`_ which supports installing via `pip`_.
+is the `PyPI repository`_ which supports installing via `pip`_.
 For example::
 
     python -m pip install python-ldap
@@ -15,7 +15,7 @@ For example::
 .. _PyPI repository: https://pypi.python.org/pypi/python-ldap/
 .. _pip: https://pip.pypa.io/en/stable/
 
-For installing from PyPI, you will need the :ref:`build prerequisites`
+For installing from PyPI, you will need the same :ref:`build prerequisites`
 as when installing from source.
 
 We do not currently provide pre-built packages (wheels).
@@ -94,7 +94,7 @@ From a source repository::
 If you have more than one Python interpreter installed locally, you should
 use the same one you plan to use python-ldap with.
 
-See further instructions can be found in `Setuptools documentation`_.
+Further instructions can be found in `Setuptools documentation`_.
 
 
 .. _Setuptools documentation: https://docs.python.org/3/distributing/index.html
@@ -112,13 +112,13 @@ on the local system when building python-ldap:
 - `OpenLDAP`_ client libs version 2.4.11 or later
   It is not possible and not supported to build with prior versions.
 - `OpenSSL`_ (optional)
-- `cyrus-sasl`_ (optional)
+- `Cyrus SASL`_ (optional)
 - Kerberos libraries, MIT or Heimdal (optional)
 
 .. _Python: https://www.python.org/
 .. _OpenLDAP: https://www.openldap.org/
 .. _OpenSSL: https://www.openssl.org/
-.. _cyrus-sasl: https://www.cyrusimap.org/sasl/
+.. _Cyrus SASL: https://www.cyrusimap.org/sasl/
 
 
 setup.cfg
@@ -126,9 +126,9 @@ setup.cfg
 
 The file setup.cfg allows to set some build and installation
 parameters for reflecting the local installation of required
-software packages. Only section [_ldap] is described here.
-More information about other sections can be found in the
-documentation of Python's DistUtils.
+software packages. Only section ``[_ldap]`` is described here.
+More information about other sections can be found in
+`Setuptools documentation`_.
 
 .. data:: library_dirs
 
@@ -148,9 +148,10 @@ documentation of Python's DistUtils.
 
 .. data:: extra_objects
 
-.. _libs-used-label:
 
 
+.. _libs-used-label:
+
 Libraries used
 ---------------
 
@@ -159,7 +160,7 @@ Libraries used
 .. data:: ldap_r
    :noindex:
 
-   The LDAP protocol library of OpenLDAP. ldap_r is the reentrant version
+   The LDAP protocol library of OpenLDAP. ``ldap_r`` is the reentrant version
    and should be preferred.
 
 .. data:: lber
@@ -170,25 +171,25 @@ Libraries used
 .. data:: sasl2
    :noindex:
 
-   The Cyrus-SASL library if needed and present during build
+   The Cyrus-SASL library (optional)
 
 .. data:: ssl
    :noindex:
 
-   The SSL/TLS library of OpenSSL if needed and present during build
+   The SSL/TLS library of OpenSSL (optional)
 
 .. data:: crypto
    :noindex:
 
-   The basic cryptographic library of OpenSSL if needed and present during build
+   The basic cryptographic library of OpenSSL (optional)
 
 Example
 -------
 
 The following example is for a full-featured build (including SSL and SASL support)
 of python-ldap with OpenLDAP installed in a different prefix directory
-(here /opt/openldap-2.4) and SASL header files found in /usr/include/sasl.
-Debugging symbols are preserved with compile option -g.
+(here ``/opt/openldap-2.4``) and SASL header files found in /usr/include/sasl.
+Debugging symbols are preserved with compile option ``-g``.
 
 ::
 
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index 39df00f..a8b7e16 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -31,7 +31,7 @@ controlType
 controlValue
 criticality
 cryptographic
-cyrus
+Cyrus
 defresult
 dereferenced
 dereferencing
@@ -91,7 +91,7 @@ objectClass
 oc
 oid
 oids
-openldap
+OpenLDAP
 postalAddress
 pre
 previousDN

From 53281640a22acb580338345db476be5c59ee3e74 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 29 Nov 2017 14:37:28 +0100
Subject: [PATCH 631/868] Add test case for SASL EXTERNAL auth

Test cases for EXTERNAL with LDAPI (Unix socket) and TLS client cert
auth.

https://github.com/python-ldap/python-ldap/pull/56
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest.py     |  6 +++
 Tests/t_cext.py      |  1 -
 Tests/t_ldap_sasl.py | 96 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 102 insertions(+), 1 deletion(-)
 create mode 100644 Tests/t_ldap_sasl.py

diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index b5e1507..e0e57c7 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -43,6 +43,11 @@
 TLSCertificateKeyFile "%(serverkey)s"
 # ignore missing client cert but fail with invalid client cert
 TLSVerifyClient try
+
+authz-regexp
+    "C=DE, O=python-ldap, OU=slapd-test, CN=([A-Za-z]+)"
+    "ldap://ou=people,dc=local???($1)"
+
 """
 
 LOCALHOST = '127.0.0.1'
@@ -289,6 +294,7 @@ def _start_slapd(self):
         slapd_args = [
             self.PATH_SLAPD,
             '-f', self._slapd_conf,
+            '-F', self.testrundir,
             '-h', '%s' % ' '.join((self.ldap_uri, self.ldapi_uri)),
         ]
         if self._log.isEnabledFor(logging.DEBUG):
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 3a0f7df..22eb895 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -835,7 +835,6 @@ def test_tls_ext_clientcert(self):
         l.set_option(_ldap.OPT_X_TLS_REQUIRE_CERT, _ldap.OPT_X_TLS_HARD)
         l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
         l.start_tls_s()
-        # TODO verify that client auth actually works
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
new file mode 100644
index 0000000..e689bb6
--- /dev/null
+++ b/Tests/t_ldap_sasl.py
@@ -0,0 +1,96 @@
+# -*- coding: utf-8 -*-
+"""
+Automatic tests for python-ldap's module ldap.sasl
+
+See http://www.python-ldap.org/ for details.
+"""
+import os
+import pwd
+import socket
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+from ldap.ldapobject import SimpleLDAPObject
+import ldap.sasl
+from slapdtest import SlapdTestCase
+
+
+LDIF = """
+dn: {suffix}
+objectClass: dcObject
+objectClass: organization
+dc: {dc}
+o: {dc}
+
+dn: {rootdn}
+objectClass: applicationProcess
+objectClass: simpleSecurityObject
+objectClass: uidObject
+cn: {rootcn}
+userPassword: {rootpw}
+uid: {uid}
+
+dn: cn={certuser},{suffix}
+objectClass: applicationProcess
+cn: {certuser}
+
+"""
+
+
+class TestSasl(SlapdTestCase):
+    ldap_object_class = SimpleLDAPObject
+    # from Tests/certs/client.pem
+    certuser = 'client'
+    certsubject = "cn=client,ou=slapd-test,o=python-ldap,c=de"
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestSasl, cls).setUpClass()
+        ldif = LDIF.format(
+            suffix=cls.server.suffix,
+            rootdn=cls.server.root_dn,
+            rootcn=cls.server.root_cn,
+            rootpw=cls.server.root_pw,
+            dc=cls.server.suffix.split(',')[0][3:],
+            certuser=cls.certuser,
+            uid=os.geteuid(),
+        )
+        cls.server.ldapadd(ldif)
+
+    @unittest.skipUnless(hasattr(socket, 'AF_UNIX'), "needs Unix socket")
+    def test_external_ldapi(self):
+        # EXTERNAL authentication with LDAPI (AF_UNIX)
+        ldap_conn = self.ldap_object_class(self.server.ldapi_uri)
+
+        auth = ldap.sasl.external("some invalid user")
+        with self.assertRaises(ldap.INSUFFICIENT_ACCESS):
+            ldap_conn.sasl_interactive_bind_s("", auth)
+
+        auth = ldap.sasl.external("")
+        ldap_conn.sasl_interactive_bind_s("", auth)
+        self.assertEqual(
+            ldap_conn.whoami_s().lower(),
+            "dn:{}".format(self.server.root_dn.lower())
+        )
+
+    def test_external_tlscert(self):
+        ldap_conn = self.ldap_object_class(self.server.ldap_uri)
+        ldap_conn.set_option(ldap.OPT_X_TLS_CACERTFILE, self.server.cafile)
+        ldap_conn.set_option(ldap.OPT_X_TLS_CERTFILE, self.server.clientcert)
+        ldap_conn.set_option(ldap.OPT_X_TLS_KEYFILE, self.server.clientkey)
+        ldap_conn.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
+        ldap_conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
+        ldap_conn.start_tls_s()
+
+        auth = ldap.sasl.external()
+        ldap_conn.sasl_interactive_bind_s("", auth)
+        self.assertEqual(
+            ldap_conn.whoami_s().lower(),
+            "dn:{}".format(self.certsubject)
+        )
+
+if __name__ == '__main__':
+    unittest.main()
+

From ece47386bc0284d89825ec003e8bfd7a37a797fd Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 29 Nov 2017 14:52:18 +0100
Subject: [PATCH 632/868] Use standard PyVarObject_HEAD_INIT() call

PyType_Ready() takes care of the base type for us. Also check PyType_Ready()
result for error.

https://github.com/python-ldap/python-ldap/pull/47
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c | 5 -----
 Modules/ldapmodule.c | 8 +++-----
 2 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 1c0591c..4800724 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1434,12 +1434,7 @@ static PyMethodDef methods[] = {
 /* type entry */
 
 PyTypeObject LDAP_Type = {
-#if defined(MS_WINDOWS) || defined(__CYGWIN__)
-        /* see http://www.python.org/doc/FAQ.html#3.24 */
         PyVarObject_HEAD_INIT(NULL, 0)
-#else /* ! MS_WINDOWS */
-        PyVarObject_HEAD_INIT(&PyType_Type, 0)
-#endif /* MS_WINDOWS */
         "LDAP",                 /*tp_name*/
         sizeof(LDAPObject),     /*tp_basicsize*/
         0,                      /*tp_itemsize*/
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index ec3a264..bd54313 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -41,9 +41,9 @@ PyObject* init_ldap_module()
 {
 	PyObject *m, *d;
 
-#if defined(MS_WINDOWS) || defined(__CYGWIN__)
-	LDAP_Type.ob_type = &PyType_Type;
-#endif
+	/* Initialize LDAP class */
+	if (PyType_Ready(&LDAP_Type) < 0)
+		return NULL;
 
 	/* Create the module and add the functions */
 #if PY_MAJOR_VERSION >= 3
@@ -59,8 +59,6 @@ PyObject* init_ldap_module()
 	m = Py_InitModule("_ldap", methods);
 #endif
 
-        PyType_Ready(&LDAP_Type);
-
 	/* Add some symbolic constants to the module */
 	d = PyModule_GetDict(m);
 

From d4cfa1f208803cb95a4e2261bd2c3fc132f4b347 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 29 Nov 2017 13:59:55 +0100
Subject: [PATCH 633/868] Doc: Add a contributing guide

All you wanted to know about contributing to python-ldap!

The refleak instructions from INSTALL are merged into contribution
instructions. The file itself is made to link to installation
instructions.

Also add a CONTRIBUTING file that references the new text.
---
 .gitignore                |   3 +
 CONTRIBUTING.rst          |  10 ++
 Doc/contributing.rst      | 266 ++++++++++++++++++++++++++++++++++++++
 Doc/index.rst             |   5 +
 Doc/installing.rst        |   3 +
 Doc/spelling_wordlist.txt |   4 +
 INSTALL                   |  57 +-------
 7 files changed, 294 insertions(+), 54 deletions(-)
 create mode 100644 CONTRIBUTING.rst
 create mode 100644 Doc/contributing.rst

diff --git a/.gitignore b/.gitignore
index 03b366d..4e261ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,6 @@ __pycache__/
 build/
 dist/
 PKG-INFO
+
+# generated in the sample workflow
+/__venv__/
diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
new file mode 100644
index 0000000..0866c8e
--- /dev/null
+++ b/CONTRIBUTING.rst
@@ -0,0 +1,10 @@
+Thank you for your interest in python-ldap!
+
+If you wish to help, detailed instructions are in `Doc/contributing.rst`_,
+and in `online documentation`_.
+
+.. _Doc/contributing.rst: Doc/contributing.rst
+.. _online documentation: http://python-ldap.readthedocs.io/en/latest/contributing.html
+
+
+Open-source veretans should find no surprises there.
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
new file mode 100644
index 0000000..3a904d3
--- /dev/null
+++ b/Doc/contributing.rst
@@ -0,0 +1,266 @@
+.. highlight:: console
+
+Contributing to python-ldap
+***************************
+
+Thank you for your interest in python-ldap!
+If you'd like to contribute (be it code, documentation, maintenance effort,
+or anything else), this guide is for you.
+
+
+Communication
+=============
+
+Always keep in mind that python-ldap is developed and maintained by volunteers.
+We're happy to share our work, and to work with you to make the library better,
+but (until you pay someone), there's obligation to provide assistance.
+
+So, keep it friendly, respectful, and supportive!
+
+
+Mailing list
+------------
+
+Discussion about the use and future of python-ldap occurs in
+the ``python-ldap@python.org`` mailing list.
+
+It's also the channel to use if documentation (including this guide) is not
+clear to you.
+Do try searching around before you ask on the list, though!
+
+You can `subscribe or unsubscribe`_ to this list or browse the `list archive`_.
+
+.. _subscribe or unsubscribe: https://mail.python.org/mailman/listinfo/python-ldap
+.. _list archive: https://mail.python.org/pipermail/python-ldap/
+
+
+Issues
+------
+
+Please report bugs, missing features and other issues to `the bug tracker`_
+at GitHub. You will need a GitHub account for that.
+
+If you prefer not to open a GitHub account, you're always welcome to use the
+mailing list.
+
+
+Security Contact
+----------------
+
+If you found a security issue that should not be discussed publicly,
+please e-mail the maintainer at ``pviktori@redhat.com``.
+If required, write to coordinate a more secure channel.
+
+All other communication should be public.
+
+
+Process for Code contributions
+==============================
+
+If you're used to open-source Python development with Git, here's the gist:
+
+* ``git clone https://github.com/python-ldap/python-ldap``
+* Use GitHub for `the bug tracker`_ and pull requests.
+* Run tests with `tox`_; ignore Python interpreters you don't have locally.
+
+.. _the bug tracker: https://github.com/python-ldap/python-ldap/issues
+.. _tox: https://tox.readthedocs.io/en/latest/
+
+Or, if you prefer to avoid closed-source services:
+
+* ``git clone https://pagure.io/python-ldap``
+* Send bug reports and patches to the mailing list.
+* Run tests with `tox`_; ignore Python interpreters you don't have locally.
+* Read the documentation directly at `Read the Docs`_.
+
+.. _Read the Docs: http://python-ldap.readthedocs.io/
+
+If you're new to some aspect of the project, you're welcome to use (or adapt)
+the workflow below.
+
+
+Sample workflow
+---------------
+
+We assume that, as a user of python-ldap you're not new to software
+development in general, so these instructions are terse.
+If you need additional detail, please do ask on the mailing list.
+
+.. note::
+
+    The following instructions are for Linux.
+    If you can translate them to another system, please contribute your
+    translation!
+
+
+Install `Git`_ and `tox`_.
+
+Clone the repository::
+
+    $ git clone https://github.com/python-ldap/python-ldap
+    $ cd python-ldap
+
+Create a `virtual environment`_ to ensure you in-development python-ldap won't
+affect the rest of your system::
+
+    $ python3 -m venv __venv__
+
+(For Python 2, install `virtualenv`_ and use it instead of ``python3 -m venv``.)
+
+.. _git: https://git-scm.com/
+.. _virtual environment: https://docs.python.org/3/library/venv.html
+.. _virtualenv: https://virtualenv.pypa.io/en/stable/
+
+Activate the virtual environment::
+
+    $ source __venv__/bin/activate
+
+Install python-ldap to it in `editable mode`_::
+
+    (__venv__)$ python -m pip install -e .
+
+This way, importing a Python module from python-ldap will directly
+use the code from your source tree.
+If you change C code, you will still need to recompile
+(using the ``pip install`` command again).
+
+.. _editable mode: https://pip.pypa.io/en/stable/reference/pip_install/#editable-installs
+
+Change the code as desired.
+
+
+To run tests, install and run `tox`_::
+
+    (__venv__)$ python -m pip install tox
+    (__venv__)$ tox --skip-missing-interpreters
+
+This will run tests on all supported versions of Python that you have
+installed, skipping the ones you don't.
+To run a subset of test environments, run for example::
+
+    (__venv__)$ tox -e py27,py36
+
+In addition to ``pyXY`` environments, we have extra environments
+for checking things independent of the Python version:
+
+* ``doc`` checks syntax and spelling of the documentation
+* ``coverage-report`` generates a test coverage report for Python code.
+  It must be used last, e.g. ``tox -e py27,py36,coverage-report``.
+
+
+When your change is ready, commit to Git, and submit a pull request on GitHub.
+You can take a look at the `committer instructions`_ to see what we are looking
+for in a pull request.
+
+If you don't want to open a GitHub account, please send patches as attachments
+to the python-ldap mailing list.
+
+
+.. _additional tests:
+
+Additional tests and scripts
+============================
+
+We use several specialized tools for debugging and maintenance.
+
+Make targets
+------------
+
+``make lcov-open``
+    Generate and view test coverage for C code.
+    Requires ``make`` and ``lcov``.
+
+``make scan-build``
+    Run static analysis. Requires ``clang``.
+
+
+Reference leak tests
+--------------------
+
+Reference leak tests require a *pydebug* build of CPython and `pytest`_ with
+`pytest-leaks`_ plugin. A *pydebug* build has a global reference counter, which
+keeps track of all reference increments and decrements. The leak plugin runs
+each test multiple times and checks if the reference count increases.
+
+.. _pytest: https://docs.pytest.org/en/latest/
+.. _pytest-leaks: https://pypi.python.org/pypi/pytest-leaks
+
+Download and compile the *pydebug* build::
+
+    $ curl -O https://www.python.org/ftp/python/3.6.3/Python-3.6.3.tar.xz
+    $ tar xJf Python-3.6.3.tar.xz
+    $ cd Python-3.6.3
+    $ ./configure --with-pydebug
+    $ make
+
+Create a virtual environment with the *pydebug* build::
+
+    $ ./python -m venv /tmp/refleak
+    $ /tmp/refleak/bin/pip install pytest pytest-leaks
+
+Run reference leak tests::
+
+    $ cd path/to/python-ldap
+    $ /tmp/refleak/bin/pip install --upgrade .
+    $ /tmp/refleak/bin/pytest -v -R: Tests/t_*.py
+
+Run ``/tmp/refleak/bin/pip install --upgrade .`` every time a file outside
+of ``Tests/`` is modified.
+
+
+.. _committer instructions:
+
+Instructions for core committers
+================================
+
+If you have the authority (and responsibility) of merging changes from others,
+remember:
+
+* All code changes need to be reviewed by someone other than the author.
+
+* Tests must always pass. New features without tests shall *not* pass review.
+
+* Make sure commit messages don't use GitHub-specific link syntax.
+  Use the full URL, e.g. ``https://github.com/python-ldap/python-ldap/issues/50``
+  instead of ``#20``.
+
+  * Exception: it's fine to use the short form in the summary line of a merge
+    commit, if the full URL appears later.
+  * It's OK to use shortcuts in GitHub *discussions*, where they are not
+    hashed into immutable history.
+
+* Make a merge commit if the contribution contains several well-isolated
+  separate commits with good descriptions. Use *squash-and-merge* (or
+  *fast-forward* from a command line) for all other cases.
+
+* It's OK to push small changes into a pull request. If you do this, document
+  what you have done (so the contributor can learn for the future), and get
+  their :abbr:`ACK (confirmation)` before merging.
+
+* When squashing, do edit commit messages to add references to the pull request
+  and relevant discussions/issues, and to conform to Git best practices.
+
+  * Consider making the summary line suitable for the CHANGES document,
+    and starting it with a prefix like ``Lib:`` or ``Tests:``.
+
+* Push to Pagure as well.
+
+If you have good reason to break the “rules”, go ahead and break them,
+but mention why.
+
+
+Instructions for release managers
+=================================
+
+If you are tasked with releasing python-ldap, remember to:
+
+* Bump all instances of the version number.
+* Go through all changes since last version, and add them to ``CHANGES``.
+* Run :ref:`additional tests` as appropriate, fix any regressions.
+* Merge all that (using pull requests).
+* Run ``python setup.py sdist``, and smoke-test the resulting package
+  (install in a clean virtual environment, import ``ldap``).
+* Create Git tag ``python-ldap-{version}``, and push it to GitHub and Pagure.
+* Release the ``sdist`` on PyPI.
+* Announce the release on the mailing list.
+  Mention the Git hash.
diff --git a/Doc/index.rst b/Doc/index.rst
index b346145..2c5b24e 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -29,6 +29,10 @@ Get it!
 :ref:`Installation instructions <installing>` are available for
 several platforms.
 
+Source code can be obtained using Git::
+
+    git clone https://github.com/python-ldap/python-ldap
+
 
 Mailing list
 ------------
@@ -66,6 +70,7 @@ Contents
    installing.rst
    reference/index.rst
    resources.rst
+   contributing.rst
    faq.rst
 
 
diff --git a/Doc/installing.rst b/Doc/installing.rst
index f2dec81..5255804 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -81,6 +81,8 @@ You can install directly with pip::
         --global-option="-I$(xcrun --show-sdk-path)/usr/include/sasl"
 
 
+.. _install-source:
+
 Installing from Source
 ======================
 
@@ -109,6 +111,7 @@ The following software packages are required to be installed
 on the local system when building python-ldap:
 
 - `Python`_ version 2.7, or 3.3 or later including its development files
+- C compiler corresponding to your Python version (on Linux, it is usually ``gcc``)
 - `OpenLDAP`_ client libs version 2.4.11 or later
   It is not possible and not supported to build with prior versions.
 - `OpenSSL`_ (optional)
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index a8b7e16..95a5df6 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -29,6 +29,8 @@ clientctrls
 conf
 controlType
 controlValue
+committers
+CPython
 criticality
 cryptographic
 Cyrus
@@ -92,6 +94,7 @@ oc
 oid
 oids
 OpenLDAP
+Pagure
 postalAddress
 pre
 previousDN
@@ -148,3 +151,4 @@ userPassword
 usr
 uuids
 whitespace
+workflow
diff --git a/INSTALL b/INSTALL
index 57b00b7..0475a2f 100644
--- a/INSTALL
+++ b/INSTALL
@@ -1,60 +1,9 @@
-------------------------------
-Installing python-ldap
-------------------------------
-
-Prerequisites:
-
-  Required:
-
-    - Python 2.3 or newer (see http://www.python.org)
-
-    - OpenLDAP 2.4.11+ client libs (see http://www.openldap.org)
-      It is not possible and not supported
-      by the python-ldap project to build with prior versions.
-
-  Optional dependencies of OpenLDAP libs:
-
-    - Cyrus SASL 2.1.x or newer (see http://asg.web.cmu.edu/sasl/sasl-library.html)
-
-    - OpenSSL 0.9.7 or newer (see http://www.openssl.org)
-    
-    - MIT Kerberos or heimdal libs
-
 Quick build instructions:
+
     edit setup.cfg (see Build/ for platform-specific examples)
     python setup.py build
     python setup.py install
 
---------------------
-Reference leak tests
---------------------
-
-Reference leak tests require a pydebug build of CPython and pytest with
-pytest-leaks plugin. A pydebug build has a global reference counter, which
-keeps track of all reference increments and decrements. The leak plugin runs
-each tests multiple times and checks if the reference count increases.
-
-Download and compile pydebug build
-----------------------------------
-
-- curl -O https://www.python.org/ftp/python/3.6.3/Python-3.6.3.tar.xz
-- tar xJf Python-3.6.3.tar.xz
-- cd Python-3.6.3
-- ./configure --with-pydebug
-- make
-
-Create virtual env
-------------------
-
-- ./python -m venv /tmp/refleak
-- /tmp/refleak/bin/pip install pytest pytest-leaks
-
-Run refleak tests
------------------
-
-- cd path/to/python-ldap
-- /tmp/refleak/bin/pip install --upgrade .
-- /tmp/refleak/bin/pytest -v -R: Tests/t_*.py
+Detailed instructions are in Doc/installing.rst, or online at:
 
-Run ``/tmp/refleak/bin/pip install --upgrade .`` every time a file outside
-of ``Tests/`` is modified.
\ No newline at end of file
+    http://python-ldap.readthedocs.io/en/latest/installing.html

From 52ce56b67654c2559112d62d9ea2e9e91024a6b7 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 29 Nov 2017 14:05:28 +0100
Subject: [PATCH 634/868] Doc: Add .build to .gitignore

This directory is created using `make html`.
---
 Doc/.gitignore | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Doc/.gitignore b/Doc/.gitignore
index a485625..5e13421 100644
--- a/Doc/.gitignore
+++ b/Doc/.gitignore
@@ -1 +1,2 @@
-/_build
+/_build/
+/.build/

From a52be29da3740b77d945c2837d9fb75f9c6f5b43 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 29 Nov 2017 14:13:45 +0100
Subject: [PATCH 635/868] Infra: Add a GitHub issue template

---
 .github/ISSUE_TEMPLATE.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .github/ISSUE_TEMPLATE.md

diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
new file mode 100644
index 0000000..41306be
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE.md
@@ -0,0 +1,23 @@
+If you found a bug in python-ldap, or would request a new feature,
+this is the place to let us know.
+
+Please describe the issue and your environment here.
+
+---
+
+Issue description:
+
+
+
+
+
+
+Steps to reproduce: 
+
+
+
+Operating system: 
+
+Python version: 
+
+python-ldap version: 

From 909c26b879ee96876b21f5e295ce4ffe521f2803 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 29 Nov 2017 14:20:31 +0100
Subject: [PATCH 636/868] Doc: Fix link to FreeBSD

---
 Doc/installing.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 5255804..3907539 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -64,8 +64,8 @@ Unofficial packages for Windows are available on
 `Christoph Gohlke's page <https://www.lfd.uci.edu/~gohlke/pythonlibs/>`_.
 
 
-`FreeBSD <https://www.freebsd.org/`_
-------------------------------------
+`FreeBSD <https://www.freebsd.org/>`_
+-------------------------------------
 
 The CVS repository of FreeBSD contains the package
 `py-ldap <https://svnweb.freebsd.org/ports/head/net/py-ldap/>`_

From 7f6b5faf77626ec1de9e48d86a6fc24f6f10591f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 17:52:30 +0100
Subject: [PATCH 637/868] Correct return LDAPerror_TypeError()

LDAPerror_TypeError() returns (PyObject *)NULL. Some functions don't
return a PyObject* so technically it's wrong to return (PyObject *)NULL.
Return NULL instead.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c  | 9 ++++++---
 Modules/ldapcontrol.c | 3 ++-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 4800724..cff9337 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -112,7 +112,8 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
     Py_ssize_t i, len, nstrs;
 
     if (!PyTuple_Check(tup)) {
-        return LDAPerror_TypeError("expected a tuple", tup);
+        LDAPerror_TypeError("expected a tuple", tup);
+        return NULL;
     }
 
     if (no_op) {
@@ -209,13 +210,15 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
     PyObject *item;
 
     if (!PySequence_Check(list)) {
-        return LDAPerror_TypeError("expected list of tuples", list);
+        LDAPerror_TypeError("expected list of tuples", list);
+        return NULL;
     }
 
     len = PySequence_Length(list);
 
     if (len < 0) {
-        return LDAPerror_TypeError("expected list of tuples", list);
+        LDAPerror_TypeError("expected list of tuples", list);
+        return NULL;
     }
 
     lms = PyMem_NEW(LDAPMod *, len + 1);
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 3f5b2c4..b76d33c 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -71,7 +71,8 @@ Tuple_to_LDAPControl( PyObject* tup )
     Py_ssize_t len;
 
     if (!PyTuple_Check(tup)) {
-      return LDAPerror_TypeError("expected a tuple", tup);
+      LDAPerror_TypeError("expected a tuple", tup);
+      return NULL;
     }
 
     if (!PyArg_ParseTuple( tup, "sbO", &oid, &iscritical, &bytes ))

From 67c69e72a347c69f599f504b18e47248109bca4f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 17:56:10 +0100
Subject: [PATCH 638/868] Fix implicit declaration of error functions

ldapcontrol.c was missing include of constants.h that defines LDAPerr()
and LDAPerror().

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/ldapcontrol.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index b76d33c..7d8fbe3 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -4,6 +4,7 @@
 #include "LDAPObject.h"
 #include "ldapcontrol.h"
 #include "berval.h"
+#include "constants.h"
 
 #include "lber.h"
 

From bdbe614a12fed05166b05d055b0e8d49d42c37b8 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 17:57:02 +0100
Subject: [PATCH 639/868] Travis: Turn compiler warnings into fatal errors

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 581013c..5dda5e0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -37,6 +37,14 @@ matrix:
     - python: 3.6
       env: TOXENV=doc
 
+env:
+    global:
+        # -Wno-int-in-bool-context: don't complain about PyMem_MALLOC()
+        # -Werror: turn all warnings into fatal errors
+        - CFLAGS="-Wno-int-in-bool-context -Werror"
+        # pass CFLAGS and WITH_GCOV to tox tasks
+        - TOX_TESTENV_PASSENV="CFLAGS WITH_GCOV"
+
 install:
   - pip install "pip>=7.1.0"
   - pip install tox-travis tox codecov coverage

From 5b2d2f9de64c28cb7b73ca95f45648405bc5a97b Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Nov 2017 18:22:03 +0100
Subject: [PATCH 640/868] Make init_ldap_module definition a strict prototype

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/ldapmodule.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index bd54313..4c2c4ec 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -37,7 +37,7 @@ static PyMethodDef methods[]  = {
 
 
 /* Common initialization code */
-PyObject* init_ldap_module()
+PyObject* init_ldap_module(void)
 {
 	PyObject *m, *d;
 

From de6da53a642dc42c2b893003a3c0ce4e3f5d2ab6 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 29 Nov 2017 15:38:54 +0100
Subject: [PATCH 641/868] Fix declaration after statement for C90

In strict ISO C90 mode and on some platforms (e.g. older MSVC), it is
not allowed to declare new variables after a statement. I also find it
good practice to declare first.

Fixes error: ISO C90 forbids mixed declarations and code
[-Werror=declaration-after-statement]

https://github.com/python-ldap/python-ldap/pull/53
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml          | 3 ++-
 Modules/LDAPObject.c | 6 +++---
 Modules/constants.c  | 3 +--
 Modules/ldapmodule.c | 9 +++++----
 Modules/message.c    | 5 +++--
 5 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 5dda5e0..8154a77 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -41,7 +41,8 @@ env:
     global:
         # -Wno-int-in-bool-context: don't complain about PyMem_MALLOC()
         # -Werror: turn all warnings into fatal errors
-        - CFLAGS="-Wno-int-in-bool-context -Werror"
+        # -Werror=declaration-after-statement: strict ISO C90
+        - CFLAGS="-std=c90 -Wno-int-in-bool-context -Werror -Werror=declaration-after-statement"
         # pass CFLAGS and WITH_GCOV to tox tasks
         - TOX_TESTENV_PASSENV="CFLAGS WITH_GCOV"
 
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 1438700..8c90a65 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -998,6 +998,9 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     int res_msgid = 0;
     char *retoid = 0;
     PyObject *valuestr = NULL;
+    int result = LDAP_SUCCESS;
+    char **refs = NULL;
+    LDAPControl **serverctrls = 0;
 
     if (!PyArg_ParseTuple( args, "|iidiii", &msgid, &all, &timeout, &add_ctrls, &add_intermediates, &add_extop ))
         return NULL;
@@ -1033,9 +1036,6 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     if (msg)
         res_msgid = ldap_msgid(msg);
 
-    int result = LDAP_SUCCESS;
-    char **refs = NULL;
-    LDAPControl **serverctrls = 0;
     if (res_type == LDAP_RES_SEARCH_ENTRY) {
         /* LDAPmessage_to_python will parse entries and read the controls for each entry */
     } else if (res_type == LDAP_RES_SEARCH_REFERENCE) {
diff --git a/Modules/constants.c b/Modules/constants.c
index f0028a0..c2b595c 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -60,12 +60,11 @@ LDAPerror( LDAP *l, char *msg )
     PyObject *info;
     PyObject *str;
     PyObject *pyerrno;
+    char *matched, *error;
 
     /* at first save errno for later use before it gets overwritten by another call */
     myerrno = errno;
 
-    char *matched, *error;
-
     opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
     if (opt_errnum != LDAP_OPT_SUCCESS)
       errnum = opt_errnum;
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 4c2c4ec..18e0696 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -41,10 +41,6 @@ PyObject* init_ldap_module(void)
 {
 	PyObject *m, *d;
 
-	/* Initialize LDAP class */
-	if (PyType_Ready(&LDAP_Type) < 0)
-		return NULL;
-
 	/* Create the module and add the functions */
 #if PY_MAJOR_VERSION >= 3
         static struct PyModuleDef ldap_moduledef = {
@@ -58,6 +54,11 @@ PyObject* init_ldap_module(void)
 #else
 	m = Py_InitModule("_ldap", methods);
 #endif
+        /* Initialize LDAP class */
+        if (PyType_Ready(&LDAP_Type) < 0) {
+		Py_DECREF(m);
+		return NULL;
+	}
 
 	/* Add some symbolic constants to the module */
 	d = PyModule_GetDict(m);
diff --git a/Modules/message.c b/Modules/message.c
index babbd25..b7f3ae7 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -92,10 +92,11 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermedi
 	 ) {
 	     PyObject* valuelist;
 	     PyObject* pyattr;
+	     struct berval **bvals;
+
 	     pyattr = PyUnicode_FromString(attr);
 
-	     struct berval ** bvals =
-	     	ldap_get_values_len( ld, entry, attr );
+	     bvals = ldap_get_values_len( ld, entry, attr );
 
 	     /* Find which list to append to */
 	     if ( PyDict_Contains( attrdict, pyattr ) ) {

From 0d4814533f347469bbd0790b216d1c519c1d011f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 29 Nov 2017 18:01:20 +0100
Subject: [PATCH 642/868] Skip cert auth test when start_tls fails

On Fedora 27, test_external_tlscert fails with CONNECT_ERROR when the
test case is executed with the rest of the suit. It works fine when
executed on its own.

Skip the test on error for now until I have time to investigate.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldap_sasl.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index e689bb6..24c7b20 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -82,7 +82,12 @@ def test_external_tlscert(self):
         ldap_conn.set_option(ldap.OPT_X_TLS_KEYFILE, self.server.clientkey)
         ldap_conn.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
         ldap_conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
-        ldap_conn.start_tls_s()
+        try:
+            ldap_conn.start_tls_s()
+        except ldap.CONNECT_ERROR as e:
+            # TODO: On Fedora 27 OpenLDAP server refuses STARTTLS when test
+            # is executed with other tests,
+            raise unittest.SkipTest("buggy start_tls_s: {}".format(e))
 
         auth = ldap.sasl.external()
         ldap_conn.sasl_interactive_bind_s("", auth)

From 725c6238b2b06e1310cec8b7afbe6b9f9db652a1 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 29 Nov 2017 10:31:46 +0100
Subject: [PATCH 643/868] Add tests for schema urlfetch

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/schema/subentry.py     |  2 +-
 Tests/t_ldap_schema_subentry.py | 50 ++++++++++++++++++++++++++++++++-
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 1c10d21..4e95151 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -452,7 +452,7 @@ def urlfetch(uri,trace_level=0):
   is loaded with urllib.
   """
   uri = uri.strip()
-  if uri.startswith('ldap:') or uri.startswith('ldaps:') or uri.startswith('ldapi:'):
+  if uri.startswith(('ldap:', 'ldaps:', 'ldapi:')):
     import ldapurl
     ldap_url = ldapurl.LDAPUrl(uri)
 
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index ee79072..d406b46 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -7,11 +7,16 @@
 
 import os
 import unittest
-import time
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+import ldap
 
 import ldif
+from ldap.ldapobject import SimpleLDAPObject
 import ldap.schema
 from ldap.schema.models import ObjectClass
+from slapdtest import SlapdTestCase
 
 HERE = os.path.abspath(os.path.dirname(__file__))
 
@@ -44,5 +49,48 @@ def test_subschema_file(self):
                     self.assertEqual(attributetype.oid, oid)
 
 
+class TestSubschemaUrlfetch(unittest.TestSuite):
+    def test_urlfetch_file(self):
+        freeipa_uri = 'file://{}'.format(TEST_SUBSCHEMA_FILES[0])
+        dn, schema = ldap.schema.urlfetch(freeipa_uri)
+        self.assertEqual(dn, 'cn=schema')
+        self.assertIsInstance(schema, ldap.schema.subentry.SubSchema)
+        obj = schema.get_obj(ObjectClass, '2.5.6.9')
+        self.assertEqual(
+            str(obj),
+            "( 2.5.6.9 NAME 'groupOfNames' SUP top STRUCTURAL MUST cn "
+            "MAY ( member $ businessCategory $ seeAlso $ owner $ ou $ o "
+            "$ description ) )"
+        )
+
+
+class TestSubschemaUrlfetchSlapd(SlapdTestCase):
+    ldap_object_class = SimpleLDAPObject
+
+    def assertSlapdSchema(self, dn, schema):
+        self.assertEqual(dn, 'cn=Subschema')
+        self.assertIsInstance(schema, ldap.schema.subentry.SubSchema)
+        obj = schema.get_obj(ObjectClass, '1.3.6.1.1.3.1')
+        self.assertEqual(
+            str(obj),
+            "( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid object' "
+            "SUP top AUXILIARY MUST uid )"
+        )
+        entries = schema.ldap_entry()
+        self.assertIsInstance(entries, dict)
+        self.assertEqual(sorted(entries), [
+            'attributeTypes', 'ldapSyntaxes', 'matchingRuleUse',
+            'matchingRules', 'objectClasses',
+        ])
+
+    def test_urlfetch_ldap(self):
+        dn, schema = ldap.schema.urlfetch(self.server.ldap_uri)
+        self.assertSlapdSchema(dn, schema)
+
+    def test_urlfetch_ldapi(self):
+        dn, schema = ldap.schema.urlfetch(self.server.ldapi_uri)
+        self.assertSlapdSchema(dn, schema)
+
+
 if __name__ == '__main__':
     unittest.main()

From 094624a0f6743869ef0e15e73fbabde5c8d3157f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 30 Nov 2017 08:01:22 +0100
Subject: [PATCH 644/868] Fix urlfetch on Python 2.7

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/schema/subentry.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 4e95151..6091a75 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -456,10 +456,9 @@ def urlfetch(uri,trace_level=0):
     import ldapurl
     ldap_url = ldapurl.LDAPUrl(uri)
 
-    # This is an internal function; don't enable bytes_mode.
-    l=ldap.initialize(ldap_url.initializeUrl(),trace_level,bytes_mode=False)
+    l=ldap.initialize(ldap_url.initializeUrl(),trace_level)
     l.protocol_version = ldap.VERSION3
-    l.simple_bind_s(ldap_url.who or '', ldap_url.cred or '')
+    l.simple_bind_s(ldap_url.who or u'', ldap_url.cred or u'')
     subschemasubentry_dn = l.search_subschemasubentry_s(ldap_url.dn)
     if subschemasubentry_dn is None:
       s_temp = None

From 53fa5b7e65efc0ad42f4f1891e517a3565c3c08e Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Thu, 30 Nov 2017 13:54:41 +0100
Subject: [PATCH 645/868] Use SlapdTestCase in t_bind and t_edit

Both test modules used to set up their own server instance. t_edit
didn't clean up properly. Let's use SlapdTestCase test class everywhere.

https://github.com/python-ldap/python-ldap/pull/58
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_bind.py |  22 +++--------
 Tests/t_edit.py | 100 ++++++++++++++++++++++++------------------------
 2 files changed, 56 insertions(+), 66 deletions(-)

diff --git a/Tests/t_bind.py b/Tests/t_bind.py
index 290deb6..6e9a61c 100644
--- a/Tests/t_bind.py
+++ b/Tests/t_bind.py
@@ -10,25 +10,15 @@
     text_type = str
 
 import ldap, unittest
-from slapdtest import SlapdObject
+from slapdtest import SlapdTestCase
 from ldap.ldapobject import LDAPObject
 
-class TestBinds(unittest.TestCase):
 
-    @classmethod
-    def setUpClass(cls):
-        cls.server = SlapdObject()
-        cls.server.start()
-
-        cls.unicode_val = "abc\U0001f498def"
-        cls.unicode_val_bytes = cls.unicode_val.encode('utf-8')
-
-        cls.dn_unicode = "CN=" + cls.unicode_val
-        cls.dn_bytes = cls.dn_unicode.encode('utf-8')
-
-    @classmethod
-    def tearDownClass(cls):
-        cls.server.stop()
+class TestBinds(SlapdTestCase):
+    unicode_val = "abc\U0001f498def"
+    unicode_val_bytes = unicode_val.encode('utf-8')
+    dn_unicode = "CN=" + unicode_val
+    dn_bytes = dn_unicode.encode('utf-8')
 
     def _get_ldapobject(self, bytes_mode=None):
         l = LDAPObject(self.server.ldap_uri, bytes_mode=bytes_mode)
diff --git a/Tests/t_edit.py b/Tests/t_edit.py
index df4529a..0012c9c 100644
--- a/Tests/t_edit.py
+++ b/Tests/t_edit.py
@@ -10,64 +10,64 @@
     text_type = str
 
 import ldap, unittest
-from slapdtest import SlapdObject
+from slapdtest import SlapdTestCase
 
 from ldap.ldapobject import LDAPObject
 
-server = None
 
+class EditionTests(SlapdTestCase):
 
-class EditionTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        super(EditionTests, cls).setUpClass()
+        base = cls.server.suffix
+        suffix_dc = base.split(',')[0][3:]
 
-    def setUp(self):
-        global server
-        if server is None:
-            server = SlapdObject()
-            server.start()
-            base = server.suffix
-            suffix_dc = base.split(',')[0][3:]
+        # insert some Foo* objects via ldapadd
+        cls.server.ldapadd("\n".join([
+            'dn: '+cls.server.suffix,
+            'objectClass: dcObject',
+            'objectClass: organization',
+            'dc: '+suffix_dc,
+            'o: '+suffix_dc,
+            '',
+            'dn: '+cls.server.root_dn,
+            'objectClass: applicationProcess',
+            'cn: '+cls.server.root_cn,
+            '',
+            "dn: cn=Foo1,"+base,
+            "objectClass: organizationalRole",
+            "cn: Foo1",
+            "",
+            "dn: cn=Foo2,"+base,
+            "objectClass: organizationalRole",
+            "cn: Foo2",
+            "",
+            "dn: cn=Foo3,"+base,
+            "objectClass: organizationalRole",
+            "cn: Foo3",
+            "",
+            "dn: ou=Container,"+base,
+            "objectClass: organizationalUnit",
+            "ou: Container",
+            "",
+            "dn: cn=Foo4,ou=Container,"+base,
+            "objectClass: organizationalRole",
+            "cn: Foo4",
+            "",
+        ])+"\n")
 
-            # insert some Foo* objects via ldapadd
-            server.ldapadd("\n".join([
-                'dn: '+server.suffix,
-                'objectClass: dcObject',
-                'objectClass: organization',
-                'dc: '+suffix_dc,
-                'o: '+suffix_dc,
-                '',
-                'dn: '+server.root_dn,
-                'objectClass: applicationProcess',
-                'cn: '+server.root_cn,
-                '',
-                "dn: cn=Foo1,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo1",
-                "",
-                "dn: cn=Foo2,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo2",
-                "",
-                "dn: cn=Foo3,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo3",
-                "",
-                "dn: ou=Container,"+base,
-                "objectClass: organizationalUnit",
-                "ou: Container",
-                "",
-                "dn: cn=Foo4,ou=Container,"+base,
-                "objectClass: organizationalRole",
-                "cn: Foo4",
-                "",
-            ])+"\n")
+    def setUp(self):
+        self.ldap = LDAPObject(self.server.ldap_uri, bytes_mode=False)
+        self.ldap.protocol_version = 3
+        self.ldap.set_option(ldap.OPT_REFERRALS, 0)
+        self.ldap.simple_bind_s(
+            self.server.root_dn,
+            self.server.root_pw
+        )
 
-        l = LDAPObject(server.ldap_uri, bytes_mode=False)
-        l.protocol_version = 3
-        l.set_option(ldap.OPT_REFERRALS,0)
-        l.simple_bind_s(server.root_dn,
-                server.root_pw)
-        self.ldap = l
-        self.server = server
+    def tearDown(self):
+        self.ldap.unbind()
 
     def test_add_object(self):
         base = self.server.suffix

From e716349e810aeb38195b0a22a630489cc19f7672 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Thu, 30 Nov 2017 14:04:28 +0100
Subject: [PATCH 646/868] Doc: Add dedicated page for bytes_mode

---
 CHANGES                |  13 +++--
 Doc/bytes_mode.rst     | 105 +++++++++++++++++++++++++++++++++++++++++
 Doc/index.rst          |  36 +-------------
 Doc/reference/ldap.rst |   7 ++-
 Lib/ldap/functions.py  |   2 +-
 5 files changed, 121 insertions(+), 42 deletions(-)
 create mode 100644 Doc/bytes_mode.rst

diff --git a/CHANGES b/CHANGES
index 113eb27..28f6f32 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,11 +3,16 @@ Released 3.0.0 xxxx-xx-xx
 
 Changes since 2.4.45:
 
-Mandatory prerequisites:
-- Python 2.7.x or 3.3+
-- pyasn1 0.3.7+ and pyasn1_modules 0.1.5+
+New dependencies (automatically installed when using pip):
+- pyasn1 0.3.7+
+- pyasn1_modules 0.1.5+
 
-Python 3 support is merged from the pyldap fork (https://github.com/pyldap)
+Removed support for Python 2.6.
+
+Python 3 support and bytes_mode:
+- merged from the pyldap fork (https://github.com/pyldap)
+- please see documentation on bytes_mode and text/bytes handling:
+    https://python-ldap.readthedocs.io/en/latest/bytes_mode.html
 
 Infrastructure:
 - Add .gitignore
diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
new file mode 100644
index 0000000..ba31f0c
--- /dev/null
+++ b/Doc/bytes_mode.rst
@@ -0,0 +1,105 @@
+.. _text-bytes:
+
+Bytes/text management
+=====================
+
+Python 3 introduces a hard distinction between *text* (``str``) – sequences of
+characters (formally, *Unicode codepoints*) – and ``bytes`` – sequences of
+8-bit values used to encode *any* kind of data for storage or transmission.
+
+Python 2 has the same distinction between ``str`` (bytes) and
+``unicode`` (text).
+However, values can be implicitly converted between these types as needed,
+e.g. when comparing or writing to disk or the network.
+The implicit encoding and decoding can be a source of subtle bugs when not
+designed and tested adequately.
+
+In python-ldap 2.x (for Python 2), bytes were used for all fields,
+including those guaranteed to be text.
+
+From version 3.0, python-ldap uses text where appropriate.
+On Python 2, the `bytes mode <bytes_mode>`_ setting influences how text is
+handled.
+
+
+What's text, and what's bytes
+-----------------------------
+
+The LDAP protocol states that some fields (distinguished names, relative
+distinguished names, attribute names, queries) be encoded in UTF-8.
+In python-ldap, these are represented as text (``str`` on Python 3,
+``unicode`` on Python 2).
+
+Attribute *values*, on the other hand, **MAY**
+contain any type of data, including text.
+To know what type of data is represented, python-ldap would need access to the
+schema, which is not always available (nor always correct).
+Thus, attribute values are *always* treated as ``bytes``.
+Encoding/decoding to other formats – text, images, etc. – is left to the caller.
+
+
+.. _bytes_mode:
+
+The bytes mode
+--------------
+
+The behavior of python-ldap 3.0 in Python 2 is influenced by a ``bytes_mode``
+argument to :func:`ldap.initialize`.
+The argument can take these values:
+
+``bytes_mode=True``: backwards-compatible
+
+    Text values returned from python-ldap are always bytes (``str``).
+    Text values supplied to python-ldap may be either bytes or Unicode.
+    The encoding for bytes is always assumed to be UTF-8.
+
+    Not available in Python 3.
+
+``bytes_mode=False``: strictly future-compatible
+
+    Text values must be represented as ``unicode``.
+    An error is raised if python-ldap receives a text value as bytes (``str``).
+
+Unspecified: relaxed mode with warnings
+
+    Causes a warning on Python 2.
+
+    Text values returned from python-ldap are always ``unicode``.
+    Text values supplied to python-ldap should be ``unicode``;
+    warnings are emitted when they are not.
+
+Backwards-compatible behavior is not scheduled for removal until Python 2
+itself reaches end of life.
+
+
+Porting recommendations
+-----------------------
+
+Since end of life of Python 2 is coming in a few years,
+projects are strongly urged to make their code compatible with Python 3.
+General instructions for this are provided `in Python documentation`_ and in
+the `Conservative porting guide`_.
+
+.. _in Python documentation: https://docs.python.org/3/howto/pyporting.html
+.. _Conservative porting guide: http://portingguide.readthedocs.io/en/latest/
+
+
+When porting from python-ldap 2.x, users are advised to update their code
+to set ``bytes_mode=False``, and fix any resulting failures.
+
+The typical usage is as follows.
+Note that only the result's *values* are of the ``bytes`` type:
+
+.. code-block:: pycon
+
+    >>> import ldap
+    >>> con = ldap.initialize('ldap://localhost:389', bytes_mode=False)
+    >>> con.simple_bind_s(u'login', u'secret_password')
+    >>> results = con.search_s(u'ou=people,dc=example,dc=org', ldap.SCOPE_SUBTREE, u"(cn=Raphaël)")
+    >>> results
+    [
+        ("cn=Raphaël,ou=people,dc=example,dc=org", {
+            'cn': [b'Rapha\xc3\xabl'],
+            'sn': [b'Barrois'],
+        }),
+    ]
diff --git a/Doc/index.rst b/Doc/index.rst
index 2c5b24e..ef652d9 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -68,47 +68,13 @@ Contents
    :maxdepth: 2
 
    installing.rst
+   bytes_mode.rst
    reference/index.rst
    resources.rst
    contributing.rst
    faq.rst
 
 
-Bytes/text management
----------------------
-
-The LDAP protocol states that some fields (distinguished names, relative distinguished names,
-attribute names, queries) be encoded in UTF-8; some other (mostly attribute *values*) **MAY**
-contain any type of data, and thus be treated as bytes.
-
-In Python 2, ``python-ldap`` used bytes for all fields, including those guaranteed to be text.
-In order to support Python 3, this distinction is made explicit. This is done
-through the ``bytes_mode`` flag to ``ldap.initialize()``.
-
-When porting from ``python-ldap`` 2.x, users are advised to update their code to set ``bytes_mode=False``
-on calls to these methods.
-Under Python 2, ``python-pyldap`` aggressively checks the type of provided arguments, and will raise a ``TypeError``
-for any invalid parameter.
-However, if the ``bytes_mode`` kwarg isn't provided, ``pyldap`` will only
-raise warnings.
-
-The typical usage is as follows; note that only the result's *values* are of the bytes type:
-
-.. code-block:: pycon
-
-    >>> import ldap
-    >>> con = ldap.initialize('ldap://localhost:389', bytes_mode=False)
-    >>> con.simple_bind_s('login', 'secret_password')
-    >>> results = con.search_s('ou=people,dc=example,dc=org', ldap.SCOPE_SUBTREE, "(cn=Raphaël)")
-    >>> results
-    [
-        ("cn=Raphaël,ou=people,dc=example,dc=org", {
-            'cn': [b'Rapha\xc3\xabl'],
-            'sn': [b'Barrois'],
-        }),
-    ]
-
-
 Indices and tables
 ------------------
 
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 8844e59..c28cdec 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -29,7 +29,7 @@ Functions
 
 This module defines the following functions:
 
-.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None]]]) -> LDAPObject object
+.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None]]]]) -> LDAPObject object
 
    Initializes a new connection object for accessing the given LDAP server,
    and return an LDAP object (see :ref:`ldap-objects`) used to perform operations
@@ -48,11 +48,14 @@ This module defines the following functions:
    that nothing is sent on the wire. The error handling in the calling
    application has to correctly handle this behaviour.
 
-   The optional arguments are for generating debug log information:
+   Three optional arguments are for generating debug log information:
    *trace_level* specifies the amount of information being logged,
    *trace_file* specifies a file-like object as target of the debug log and
    *trace_stack_limit* specifies the stack limit of tracebacks in debug log.
 
+   The *bytes_mode* argument specifies text/bytes behavior under Python 2.
+   See :ref:`text-bytes` for a complete documentation.
+
    Possible values for *trace_level* are
    :py:const:`0` for no logging,
    :py:const:`1` for only logging the method calls with arguments,
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index b887037..1588221 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -77,7 +77,7 @@ def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None, b
         File object where to write the trace output to.
         Default is to use stdout.
   bytes_mode
-        Whether to enable "bytes_mode" for backwards compatibility under Py2.
+        Whether to enable :ref:`bytes_mode` for backwards compatibility under Py2.
   """
   return LDAPObject(uri,trace_level,trace_file,trace_stack_limit,bytes_mode)
 

From 47ce0dfb412e0874970412aa1758ed5d7bbf4aed Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 30 Nov 2017 15:39:55 +0100
Subject: [PATCH 647/868] Skip some TLS tests when libldap used NSS

Some TLS tests are broken or flaky when libldap is compiled with NSS as
TLS provider. It currently affects Fedora 27 and older releases.

Fedora issue: https://bugzilla.redhat.com/show_bug.cgi?id=1519167

https://github.com/python-ldap/python-ldap/issues/60

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml          |  4 ++--
 Lib/slapdtest.py     | 39 +++++++++++++++++++++++++++++++++++++++
 Tests/t_cext.py      | 28 ++++++++++++++++------------
 Tests/t_ldap_sasl.py | 10 +++-------
 4 files changed, 60 insertions(+), 21 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 8154a77..ad9cd96 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -43,8 +43,8 @@ env:
         # -Werror: turn all warnings into fatal errors
         # -Werror=declaration-after-statement: strict ISO C90
         - CFLAGS="-std=c90 -Wno-int-in-bool-context -Werror -Werror=declaration-after-statement"
-        # pass CFLAGS and WITH_GCOV to tox tasks
-        - TOX_TESTENV_PASSENV="CFLAGS WITH_GCOV"
+        # pass CFLAGS, CI (for Travis CI) and WITH_GCOV to tox tasks
+        - TOX_TESTENV_PASSENV="CFLAGS CI WITH_GCOV"
 
 install:
   - pip install "pip>=7.1.0"
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index e0e57c7..ee1fbb2 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -18,6 +18,10 @@
 from logging.handlers import SysLogHandler
 import unittest
 
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
 from ldap.compat import quote_plus
 
 # a template string for generating simple slapd.conf file
@@ -52,6 +56,41 @@
 
 LOCALHOST = '127.0.0.1'
 
+
+def identity(test_item):
+    """Identity decorator
+
+    """
+    return test_item
+
+
+def skip_unless_travis(reason):
+    """Skip test unless test case is executed on CI like Travis CI
+    """
+    if os.environ.get('CI', False):
+        return identity
+    else:
+        return unittest.skip(reason)
+
+
+def requires_tls(skip_nss=False):
+    """Decorator for TLS tests
+
+    Tests are not skipped on CI (e.g. Travis CI)
+    
+    :param skip_nss: Skip test when libldap is compiled with NSS as TLS lib
+    """
+    if not ldap.TLS_AVAIL:
+        return skip_unless_travis("test needs ldap.TLS_AVAIL")
+    elif skip_nss and ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS':
+        return skip_unless_travis(
+            "Test doesn't work correctly with Mozilla NSS, see "
+            "https://bugzilla.redhat.com/show_bug.cgi?id=1519167"
+        )
+    else:
+        return identity
+
+
 def combined_logger(
         log_name,
         log_level=logging.WARN,
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 22eb895..be858e9 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -9,7 +9,8 @@
 
 import os
 import unittest
-from slapdtest import SlapdTestCase
+
+from slapdtest import SlapdTestCase, requires_tls
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -717,12 +718,6 @@ def test_sasl(self):
             return
         # TODO
 
-    def test_tls(self):
-        l = self._open_conn()
-        if not self._require_attr(l, 'start_tls_s'):    # HAVE_TLS
-            return
-        # TODO
-
     def test_cancel(self):
         l = self._open_conn()
         if not self._require_attr(l, 'cancel'):         # FEATURE_CANCEL
@@ -807,7 +802,7 @@ def test_invalid_controls(self):
                 l.sasl_interactive_bind_s, 'who', 'SASLObject', post=(1,))
         self.assertInvalidControls(l.unbind_ext)
 
-    @unittest.skipUnless(_ldap.TLS_AVAIL, "needs tls")
+    @requires_tls(skip_nss=True)
     def test_tls_ext(self):
         l = self._open_conn(bind=False)
         # StartTLS needs LDAPv3
@@ -817,15 +812,17 @@ def test_tls_ext(self):
         l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
         l.start_tls_s()
 
-    @unittest.skipUnless(_ldap.TLS_AVAIL, "needs tls")
+    @requires_tls(skip_nss=False)
     def test_tls_ext_noca(self):
         l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
-        l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
-        with self.assertRaises(_ldap.CONNECT_ERROR):
+        with self.assertRaises(_ldap.CONNECT_ERROR) as e:
             l.start_tls_s()
+        # some platforms return '(unknown error code)' as reason
+        if '(unknown error code)' not in str(e.exception):
+            self.assertIn('not trusted', str(e.exception))
 
-    @unittest.skipUnless(_ldap.TLS_AVAIL, "needs tls")
+    @requires_tls(skip_nss=True)
     def test_tls_ext_clientcert(self):
         l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
@@ -836,5 +833,12 @@ def test_tls_ext_clientcert(self):
         l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
         l.start_tls_s()
 
+    @requires_tls(skip_nss=False)
+    def test_tls_packages(self):
+        # libldap has tls_g.c, tls_m.c, and tls_o.c with ldap_int_tls_impl
+        package = _ldap.get_option(_ldap.OPT_X_TLS_PACKAGE)
+        self.assertIn(package, {"GnuTLS", "MozNSS", "OpenSSL"})
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index 24c7b20..9acd051 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -14,7 +14,7 @@
 
 from ldap.ldapobject import SimpleLDAPObject
 import ldap.sasl
-from slapdtest import SlapdTestCase
+from slapdtest import SlapdTestCase, requires_tls
 
 
 LDIF = """
@@ -75,6 +75,7 @@ def test_external_ldapi(self):
             "dn:{}".format(self.server.root_dn.lower())
         )
 
+    @requires_tls(skip_nss=True)
     def test_external_tlscert(self):
         ldap_conn = self.ldap_object_class(self.server.ldap_uri)
         ldap_conn.set_option(ldap.OPT_X_TLS_CACERTFILE, self.server.cafile)
@@ -82,12 +83,7 @@ def test_external_tlscert(self):
         ldap_conn.set_option(ldap.OPT_X_TLS_KEYFILE, self.server.clientkey)
         ldap_conn.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_HARD)
         ldap_conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
-        try:
-            ldap_conn.start_tls_s()
-        except ldap.CONNECT_ERROR as e:
-            # TODO: On Fedora 27 OpenLDAP server refuses STARTTLS when test
-            # is executed with other tests,
-            raise unittest.SkipTest("buggy start_tls_s: {}".format(e))
+        ldap_conn.start_tls_s()
 
         auth = ldap.sasl.external()
         ldap_conn.sasl_interactive_bind_s("", auth)

From db4a6ff6707f836b44e1d31688f14b9249e20055 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Thu, 30 Nov 2017 16:42:40 +0100
Subject: [PATCH 648/868] Infra: Remove nonexistent files from MANIFEST.in

PKG-INFO is generated by setup.py.
There's only one licence file, in the root.

https://github.com/python-ldap/python-ldap/pull/66
---
 MANIFEST.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/MANIFEST.in b/MANIFEST.in
index 469ebdf..8549335 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,6 +1,6 @@
-include MANIFEST.in Makefile CHANGES INSTALL LICENCE README TODO PKG-INFO
+include MANIFEST.in Makefile CHANGES INSTALL LICENCE README TODO
 include tox.ini .coveragerc
-include Modules/*.c Modules/*.h Modules/LICENSE
+include Modules/*.c Modules/*.h
 recursive-include Build *.cfg*
 recursive-include Lib *.py
 recursive-include Demo *.py

From 5618ce50389260e2f54fa4d8f6d03e456fd27a43 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Fri, 1 Dec 2017 15:26:09 +0100
Subject: [PATCH 649/868] Doc: Correct syntax for link to bytes mode

https://github.com/python-ldap/python-ldap/pull/70
---
 Doc/bytes_mode.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index ba31f0c..b18c0ae 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -18,7 +18,7 @@ In python-ldap 2.x (for Python 2), bytes were used for all fields,
 including those guaranteed to be text.
 
 From version 3.0, python-ldap uses text where appropriate.
-On Python 2, the `bytes mode <bytes_mode>`_ setting influences how text is
+On Python 2, the :ref:`bytes mode <bytes_mode>` setting influences how text is
 handled.
 
 

From dcd064f26ef786fef55a6c76d260ce151cbe48b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 1 Dec 2017 15:32:10 +0100
Subject: [PATCH 650/868] Doc: Add a separator between sentences

This rendered as follows:

> OpenLDAP client libs version 2.4.11 or later It is not possible and not supported to build with prior versions.

https://github.com/python-ldap/python-ldap/pull/71
---
 Doc/installing.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 3907539..5d82b7b 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -112,8 +112,8 @@ on the local system when building python-ldap:
 
 - `Python`_ version 2.7, or 3.3 or later including its development files
 - C compiler corresponding to your Python version (on Linux, it is usually ``gcc``)
-- `OpenLDAP`_ client libs version 2.4.11 or later
-  It is not possible and not supported to build with prior versions.
+- `OpenLDAP`_ client libs version 2.4.11 or later;
+  it is not possible and not supported to build with prior versions.
 - `OpenSSL`_ (optional)
 - `Cyrus SASL`_ (optional)
 - Kerberos libraries, MIT or Heimdal (optional)

From ba765af6fd0bbbc382566f524a888c85ef756f3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 1 Dec 2017 15:38:42 +0100
Subject: [PATCH 651/868] Doc: openSUSE typos

https://github.com/python-ldap/python-ldap/pull/72
---
 Doc/installing.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 5d82b7b..b7c57de 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -44,10 +44,10 @@ hit a problem already fixed in recent releases.
 `openSUSE Linux <https://www.opensuse.org/>`_
 ---------------------------------------------
 
-ships with python-ldap and there's an additional
+Ships with python-ldap and there's an additional
 `download repository <http://download.opensuse.org/repositories/devel:/languages:/python/>`_
 which contains builds of latest releases
-(see also `OBS package <https://build.opensuse.org/package/show/devel:languages:python/python-ldap>`_
+(see also `OBS package <https://build.opensuse.org/package/show/devel:languages:python/python-ldap>`_).
 
 `Debian Linux <https://www.debian.org>`_
 ----------------------------------------

From 610f875b8bd9c1d481a6f078effe0004824f026c Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 30 Nov 2017 16:59:58 +0100
Subject: [PATCH 652/868] Update version to 3.0.0b1

---
 Lib/ldap/pkginfo.py | 2 +-
 Lib/ldapurl.py      | 2 +-
 Lib/ldif.py         | 2 +-
 Lib/slapdtest.py    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index da891b3..378700d 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '2.5.2'
+__version__ = '3.0.0b1'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 366e177..9c051a1 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '2.5.2'
+__version__ = '3.0.0b1'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 4735bfb..fe14895 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '2.5.2'
+__version__ = '3.0.0b1'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
index ee1fbb2..cd142f6 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest.py
@@ -7,7 +7,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '2.5.2'
+__version__ = '3.0.0b1'
 
 import os
 import socket

From 86ccb81922748437e8672d150b3a154a1250a3b1 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 1 Dec 2017 13:06:55 +0100
Subject: [PATCH 653/868] Update Changes for 3.0.0b1

---
 CHANGES | 67 ++++++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 45 insertions(+), 22 deletions(-)

diff --git a/CHANGES b/CHANGES
index 28f6f32..b64c263 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,26 +1,39 @@
 ----------------------------------------------------------------
-Released 3.0.0 xxxx-xx-xx
+Released 3.0.0b1 xxxx-xx-xx
 
 Changes since 2.4.45:
+(this list includes changes from 2.5.x)
 
 New dependencies (automatically installed when using pip):
-- pyasn1 0.3.7+
-- pyasn1_modules 0.1.5+
-
-Removed support for Python 2.6.
+* pyasn1 0.3.7+
+* pyasn1_modules 0.1.5+
 
 Python 3 support and bytes_mode:
-- merged from the pyldap fork (https://github.com/pyldap)
-- please see documentation on bytes_mode and text/bytes handling:
+* merged from the pyldap fork (https://github.com/pyldap)
+* please see documentation on bytes_mode and text/bytes handling:
     https://python-ldap.readthedocs.io/en/latest/bytes_mode.html
 
+Removed support for Python 2.6.
+
 Infrastructure:
-- Add .gitignore
-- Re-format README to ReStructured Text
-- Setup for automatic testing using Travis CI
+* Move to Git
+* Don't define search path for includes and libs in the default setup.cfg
+* Include sasl/sasl.h from the standard path
+* Re-format README to ReStructured Text
+* Setup for automatic testing using Travis CI
+* Add coverage reporting for Python and C
+* Add install requires into setup.py
+* Remove distclean.sh in favor of make clean
+* Use `package`, `depends`, `install_requires` in setup.py
+* Add make target for scan-build (static analysis using clang)
 
 Modules/
-(thanks to Michael Ströder)
+* Remove unused LDAPberval helper functions
+* Fix type conversion in page control
+* Fix multiple ref leaks in error-handling code
+* Fix reference leak in result4
+* Fix several compiler warnings
+and, thanks to Michael Ströder:
 * removed unused code schema.c
 * moved code from version.c to ldapmodule.c
 * removed obsolete back-ward compability constants from common.h
@@ -29,7 +42,9 @@ Modules/
 * assume C extension API for Python 2.7+
 
 Lib/
-(thanks to Michael Ströder)
+* Avoid eval() for getting module-level variables to fix running under pytest
+* Compability changes for pyasn1 0.3 or newer
+and, thanks to Michael Ströder:
 * ldap.__version__, ldap.__author__ and ldap.__license__ now
   imported from new sub-module ldap.pkginfo also to setup.py
 * Added safety assertion when importing _ldap:
@@ -37,8 +52,6 @@ Lib/
 * removed stand-alone module dsml
 * slapdtest.SlapdObject.restart() just restarts slapd
   without cleaning any data
-* Compability changes for pyasn1 0.3.x or newer
-  (thanks to Ilya Etingof and Christian Heimes)
 * The methods SSSResponseControl.decodeControlValue() and
   VLVResponseControl.decodeControlValue() now follow the coding
   convention to use camel-cased ASN.1 name as class attribute name.
@@ -60,21 +73,31 @@ Lib/
 Lib/slapdtest.py
 * Automatically try some common locations for SCHEMADIR
 * Ensure server is stopped when the process exits
+* Check for LDAP schema and slapd binaries
 
 Tests/
-(thanks to Michael Ströder)
+* Expand cidict membership test
+* Add test suite for binds
+* Add test suite for edits
+* Add a smoke-check for listall() and attribute_types()
+* Add test case for SASL EXTERNAL auth
+* Add tests for start_tls
+* In CI, treat compiler warnings as fatal errors
+* Added tests for ldap.syncrepl
+and, thanks to Michael Ströder:
 * added explicit reconnect tests for ReconnectLDAPObject
 * scripts do not directly call SlapdTestCase.setUpClass() anymore
 * added LDIF test with folded, base64-encoded attribute
 * added more tests for sub-module ldap.dn
-* added tests for ldap.syncrepl (thanks to Karl Kornel)
 
-Tests/
-(thanks to pyldap contributors):
-* Expand cidict membership test
-* Add test suite for binds
-* Add test suite for edits
-* Add a smoke-check for listall() and attribute_types()
+Doc/
+* Build documentation without the compiled C extension
+* Merge contents from python-ldap.org
+* Move reference documentation in its own section
+* Document return value of {modify,add,delete}_ext_s() as a tuple
+* Add tests for documentation (build & spelling)
+* Link to documentation of old versions
+* Add a contributing guide
 
 ----------------------------------------------------------------
 Released 2.4.45 2017-10-09

From c84b4faf429431cb4d4ef42a156b62d1105f1758 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 1 Dec 2017 15:23:09 +0100
Subject: [PATCH 654/868] Doc: Add warning that 3.0 does not yet exist

---
 Doc/installing.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index b7c57de..d5cbf95 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -3,6 +3,14 @@
 Installing python-ldap
 ######################
 
+.. warning::
+
+    You are reading documentation for an unreleased version.
+
+    Following these instructions will currently get you version 2.5.2,
+    which does not support Python 3.
+
+
 Installing from PyPI
 ====================
 

From cd6f62063db58339dc86b523507c8907181413a2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 10:59:20 +0100
Subject: [PATCH 655/868] Ship documentation in source distribution

Source distributions (sdist) of python-ldap now contain documentation.
This allows users to build and read docs locally. Also fixes tox test
run in sdist.

https://github.com/python-ldap/python-ldap/pull/77
---
 MANIFEST.in | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MANIFEST.in b/MANIFEST.in
index 8549335..f7398fa 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -5,3 +5,5 @@ recursive-include Build *.cfg*
 recursive-include Lib *.py
 recursive-include Demo *.py
 recursive-include Tests *.py *.ldif
+recursive-include Doc *.rst *.py spelling_wordlist.txt Makefile
+prune Doc/.build

From 81ca90a77a667e26446d26223fdcf7e12ba45f15 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 2 Dec 2017 12:51:35 +0100
Subject: [PATCH 656/868] Convert slapdtest to package with data

The slapdtest module has been converted to a package to ship the test
certs as package data.

Closes: https://github.com/python-ldap/python-ldap/issues/76
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/{slapdtest.py => slapdtest/__init__.py} | 15 +++++++--------
 {Tests => Lib/slapdtest}/certs/README       |  0
 {Tests => Lib/slapdtest}/certs/ca.conf      |  0
 {Tests => Lib/slapdtest}/certs/ca.pem       |  0
 {Tests => Lib/slapdtest}/certs/client.conf  |  0
 {Tests => Lib/slapdtest}/certs/client.key   |  0
 {Tests => Lib/slapdtest}/certs/client.pem   |  0
 {Tests => Lib/slapdtest}/certs/gencerts.sh  |  0
 {Tests => Lib/slapdtest}/certs/gennssdb.sh  |  0
 {Tests => Lib/slapdtest}/certs/server.conf  |  0
 {Tests => Lib/slapdtest}/certs/server.key   |  0
 {Tests => Lib/slapdtest}/certs/server.pem   |  0
 MANIFEST.in                                 |  1 +
 setup.py                                    |  3 ++-
 14 files changed, 10 insertions(+), 9 deletions(-)
 rename Lib/{slapdtest.py => slapdtest/__init__.py} (97%)
 rename {Tests => Lib/slapdtest}/certs/README (100%)
 rename {Tests => Lib/slapdtest}/certs/ca.conf (100%)
 rename {Tests => Lib/slapdtest}/certs/ca.pem (100%)
 rename {Tests => Lib/slapdtest}/certs/client.conf (100%)
 rename {Tests => Lib/slapdtest}/certs/client.key (100%)
 rename {Tests => Lib/slapdtest}/certs/client.pem (100%)
 rename {Tests => Lib/slapdtest}/certs/gencerts.sh (100%)
 rename {Tests => Lib/slapdtest}/certs/gennssdb.sh (100%)
 rename {Tests => Lib/slapdtest}/certs/server.conf (100%)
 rename {Tests => Lib/slapdtest}/certs/server.key (100%)
 rename {Tests => Lib/slapdtest}/certs/server.pem (100%)

diff --git a/Lib/slapdtest.py b/Lib/slapdtest/__init__.py
similarity index 97%
rename from Lib/slapdtest.py
rename to Lib/slapdtest/__init__.py
index cd142f6..297bda7 100644
--- a/Lib/slapdtest.py
+++ b/Lib/slapdtest/__init__.py
@@ -24,6 +24,8 @@
 import ldap
 from ldap.compat import quote_plus
 
+HERE = os.path.abspath(os.path.dirname(__file__))
+
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_TEMPLATE = r"""
 serverID %(serverid)s
@@ -191,14 +193,11 @@ def __init__(self):
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
         # TLS certs
-        capath = os.path.abspath(os.path.join(
-            os.getcwd(), 'Tests/certs'
-        ))
-        self.cafile = os.path.join(capath, 'ca.pem')
-        self.servercert = os.path.join(capath, 'server.pem')
-        self.serverkey = os.path.join(capath, 'server.key')
-        self.clientcert = os.path.join(capath, 'client.pem')
-        self.clientkey = os.path.join(capath, 'client.key')
+        self.cafile = os.path.join(HERE, 'certs/ca.pem')
+        self.servercert = os.path.join(HERE, 'certs/server.pem')
+        self.serverkey = os.path.join(HERE, 'certs/server.key')
+        self.clientcert = os.path.join(HERE, 'certs/client.pem')
+        self.clientkey = os.path.join(HERE, 'certs/client.key')
 
     def _check_requirements(self):
         binaries = [
diff --git a/Tests/certs/README b/Lib/slapdtest/certs/README
similarity index 100%
rename from Tests/certs/README
rename to Lib/slapdtest/certs/README
diff --git a/Tests/certs/ca.conf b/Lib/slapdtest/certs/ca.conf
similarity index 100%
rename from Tests/certs/ca.conf
rename to Lib/slapdtest/certs/ca.conf
diff --git a/Tests/certs/ca.pem b/Lib/slapdtest/certs/ca.pem
similarity index 100%
rename from Tests/certs/ca.pem
rename to Lib/slapdtest/certs/ca.pem
diff --git a/Tests/certs/client.conf b/Lib/slapdtest/certs/client.conf
similarity index 100%
rename from Tests/certs/client.conf
rename to Lib/slapdtest/certs/client.conf
diff --git a/Tests/certs/client.key b/Lib/slapdtest/certs/client.key
similarity index 100%
rename from Tests/certs/client.key
rename to Lib/slapdtest/certs/client.key
diff --git a/Tests/certs/client.pem b/Lib/slapdtest/certs/client.pem
similarity index 100%
rename from Tests/certs/client.pem
rename to Lib/slapdtest/certs/client.pem
diff --git a/Tests/certs/gencerts.sh b/Lib/slapdtest/certs/gencerts.sh
similarity index 100%
rename from Tests/certs/gencerts.sh
rename to Lib/slapdtest/certs/gencerts.sh
diff --git a/Tests/certs/gennssdb.sh b/Lib/slapdtest/certs/gennssdb.sh
similarity index 100%
rename from Tests/certs/gennssdb.sh
rename to Lib/slapdtest/certs/gennssdb.sh
diff --git a/Tests/certs/server.conf b/Lib/slapdtest/certs/server.conf
similarity index 100%
rename from Tests/certs/server.conf
rename to Lib/slapdtest/certs/server.conf
diff --git a/Tests/certs/server.key b/Lib/slapdtest/certs/server.key
similarity index 100%
rename from Tests/certs/server.key
rename to Lib/slapdtest/certs/server.key
diff --git a/Tests/certs/server.pem b/Lib/slapdtest/certs/server.pem
similarity index 100%
rename from Tests/certs/server.pem
rename to Lib/slapdtest/certs/server.pem
diff --git a/MANIFEST.in b/MANIFEST.in
index f7398fa..687d2b0 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -5,5 +5,6 @@ recursive-include Build *.cfg*
 recursive-include Lib *.py
 recursive-include Demo *.py
 recursive-include Tests *.py *.ldif
+recursive-include Lib/slapdtest *.pem *.key *.conf *.sh README
 recursive-include Doc *.rst *.py spelling_wordlist.txt Makefile
 prune Doc/.build
diff --git a/setup.py b/setup.py
index f09d9c3..3d7d338 100644
--- a/setup.py
+++ b/setup.py
@@ -175,13 +175,14 @@ class OpenLDAP2:
   py_modules = [
     'ldapurl',
     'ldif',
-    'slapdtest',
+
   ],
   packages = [
     'ldap',
     'ldap.controls',
     'ldap.extop',
     'ldap.schema',
+    'slapdtest',
   ],
   package_dir = {'': 'Lib',},
   data_files = LDAP_CLASS.extra_files,

From e89b035a2127f75b4aab0059d1e0ce806403f6f5 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 2 Dec 2017 13:03:08 +0100
Subject: [PATCH 657/868] Prolong certs to be valid for 10 years

Now that we ship the certs as part of the package, make them valid for a
longer time. CA validity is one day longer than certs, which are one day
longer valid than CRL.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest/certs/ca.conf     |   4 +-
 Lib/slapdtest/certs/ca.pem      | 104 +++++++++++++++---------------
 Lib/slapdtest/certs/client.key  |  52 +++++++--------
 Lib/slapdtest/certs/client.pem  | 106 +++++++++++++++----------------
 Lib/slapdtest/certs/gencerts.sh |   1 +
 Lib/slapdtest/certs/server.key  |  52 +++++++--------
 Lib/slapdtest/certs/server.pem  | 108 ++++++++++++++++----------------
 7 files changed, 214 insertions(+), 213 deletions(-)

diff --git a/Lib/slapdtest/certs/ca.conf b/Lib/slapdtest/certs/ca.conf
index 4fb2e2b..5046b0d 100644
--- a/Lib/slapdtest/certs/ca.conf
+++ b/Lib/slapdtest/certs/ca.conf
@@ -32,7 +32,7 @@ serial = $tmpdir/$ca.crt.srl
 crlnumber = $tmpdir/$ca.crl.srl
 database = $tmpdir/$ca.db
 unique_subject = no
-default_days = 1461
+default_days = 3652
 default_md = sha256
 policy = match_pol
 email_in_dn = no
@@ -40,7 +40,7 @@ preserve = no
 name_opt = $name_opt
 cert_opt = ca_default
 copy_extensions = none
-default_crl_days = 365
+default_crl_days = 3651
 
 [match_pol]
 countryName = match
diff --git a/Lib/slapdtest/certs/ca.pem b/Lib/slapdtest/certs/ca.pem
index ffd6a5e..cf2ff33 100644
--- a/Lib/slapdtest/certs/ca.pem
+++ b/Lib/slapdtest/certs/ca.pem
@@ -5,31 +5,31 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Validity
-            Not Before: Nov 28 13:49:28 2017 GMT
-            Not After : Nov 28 13:49:28 2021 GMT
+            Not Before: Dec  2 11:57:47 2017 GMT
+            Not After : Sep  4 11:57:47 2027 GMT
         Subject: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:b4:bd:47:78:d9:62:4e:8e:ae:18:53:b8:8e:9f:
-                    0b:13:ea:f2:59:c0:1d:7f:0b:5c:5a:ed:c8:b8:cd:
-                    ff:66:94:c4:40:d5:cd:4c:da:06:d2:35:1c:6a:c5:
-                    76:70:6d:f0:81:8a:25:e4:35:c8:d5:79:17:3e:35:
-                    ec:2b:97:73:77:6c:04:7f:1f:0b:b5:f3:fd:1a:cd:
-                    76:2c:5c:17:45:6a:6d:c4:d1:6c:f8:09:ba:a0:f8:
-                    57:44:d7:b4:1c:a4:be:a4:4b:e4:76:34:1c:b1:0b:
-                    12:42:7e:79:e4:01:e0:5f:8f:6c:03:2d:2a:b6:4e:
-                    72:85:f1:b9:ac:d5:22:a7:0a:fc:5a:0c:e5:75:8f:
-                    9f:20:c2:14:ab:53:6a:b0:e6:8a:0d:f4:97:53:7f:
-                    f7:79:29:dd:ea:df:ae:39:6f:59:d8:b3:8e:da:bf:
-                    08:cd:03:ea:2a:91:33:c9:6f:21:a6:56:06:10:c1:
-                    40:4b:31:95:b0:47:2a:1e:2f:7d:eb:9b:f1:d4:27:
-                    af:1a:5d:bf:0f:b4:f5:d5:b8:1d:04:61:fa:06:af:
-                    49:6f:ff:99:88:f3:44:16:ed:3b:f1:c8:ea:31:0a:
-                    f3:f5:97:7a:17:08:e5:e8:8f:dd:1d:c8:8f:55:bf:
-                    47:93:9a:be:84:99:6f:f3:99:61:5d:b7:13:56:34:
-                    04:91
+                    00:af:1f:cf:0f:c5:95:66:2d:eb:85:cc:21:fc:0d:
+                    0f:44:d8:2f:a8:85:08:ef:60:67:57:fa:0b:c5:e4:
+                    b3:fb:f1:6f:cb:30:7a:47:0d:a7:f1:b5:37:81:5f:
+                    f6:39:28:e2:f9:4d:6c:2e:a6:5c:0e:3c:db:4d:c9:
+                    2a:64:ce:0d:15:30:c7:75:52:b8:74:c5:0b:00:4c:
+                    2f:94:1b:dd:fb:83:2c:58:02:73:b0:86:3a:6a:aa:
+                    55:f2:d5:49:99:17:a5:e2:44:ec:dd:62:5f:8d:ce:
+                    77:29:0b:8d:87:23:e2:4b:d6:1c:25:f3:06:a9:ee:
+                    33:6f:ac:ed:22:9e:35:ec:55:e7:1b:38:68:7e:46:
+                    e3:c3:42:ac:06:0b:0a:7a:84:c9:3d:ef:3d:a5:6e:
+                    e9:10:24:c3:28:fe:1f:4a:9a:23:8a:3c:db:0a:66:
+                    5d:07:f8:c5:17:68:53:e4:0e:37:33:c4:d2:ad:58:
+                    62:6b:8a:87:ab:73:eb:bc:2b:ac:07:69:84:8d:e3:
+                    c4:a9:78:9b:6c:1e:03:63:df:b4:96:18:bd:3c:2e:
+                    be:7f:2c:d5:a8:f8:12:b9:ab:27:52:b0:de:38:62:
+                    3c:54:a7:f3:aa:37:a3:11:12:b2:a7:6f:8d:96:10:
+                    ce:01:cb:25:24:a6:51:18:93:69:9b:9e:5c:8a:ff:
+                    fe:89
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -37,44 +37,44 @@ Certificate:
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
             X509v3 Subject Key Identifier: 
-                3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+                3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
             X509v3 Authority Key Identifier: 
-                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+                keyid:3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
 
     Signature Algorithm: sha256WithRSAEncryption
-         03:d2:e6:f5:e4:1d:99:2e:df:02:b9:5b:f7:e0:82:ca:39:76:
-         5c:8f:3d:f1:5f:d4:bd:1b:4b:4f:35:4b:5d:f6:21:8b:c0:87:
-         23:de:7e:9d:93:1b:67:60:6d:df:7b:95:f0:6a:87:94:5c:f9:
-         a3:62:50:7b:68:02:b0:5c:d2:4b:f9:b1:97:ba:24:84:47:6e:
-         e1:e9:d6:e0:fa:2f:f7:9b:c5:67:3a:eb:8e:bc:b7:8f:31:7d:
-         5c:ba:91:ce:9d:2c:91:85:32:74:e7:e9:ba:07:61:7c:8b:55:
-         69:db:f9:7b:1d:ef:55:fc:bf:58:fc:99:66:9c:9e:92:35:75:
-         53:0a:31:e1:34:8a:cf:bc:79:b0:0e:ac:bf:aa:f0:e3:74:88:
-         f2:a6:5c:38:ad:21:31:ea:cd:e2:57:01:6b:9e:0b:24:62:78:
-         ac:6a:88:ba:ae:be:20:27:63:ab:3b:e9:2c:c0:5c:81:c5:e7:
-         e6:fe:a7:09:30:b4:28:65:51:6f:1b:1d:22:f8:30:7d:87:ae:
-         da:28:99:5c:8b:15:f0:b7:45:d0:1d:3b:ad:c5:29:4a:ed:11:
-         68:c4:af:28:a3:0b:9f:1b:c8:86:56:80:3d:6b:d3:1f:c6:b0:
-         3d:4a:39:1c:10:57:2d:22:df:d7:7b:ad:7d:f9:12:47:bb:33:
-         29:61:14:c4
+         0a:e7:dc:38:ce:03:dd:a8:99:11:d0:24:be:ef:1a:18:9d:7c:
+         95:75:4a:4a:29:44:23:28:fc:66:d5:81:ce:05:c2:c0:6b:71:
+         d6:8d:33:a9:53:a6:1c:f1:4e:50:ae:a3:b1:72:d6:69:53:ad:
+         a9:62:a9:45:27:68:17:35:41:97:ec:e9:65:91:62:12:ed:eb:
+         45:3a:9b:cc:09:bc:e3:ad:22:6b:13:6b:b0:67:ef:ce:01:83:
+         5e:6c:95:e2:b3:73:b9:69:9a:33:49:f9:5f:52:4e:39:94:c9:
+         db:93:6f:d8:ba:10:92:ce:fa:12:6b:bc:31:ff:c1:67:70:63:
+         07:dc:53:7a:3a:a3:51:20:15:44:cf:1c:a9:cd:b7:30:1d:8e:
+         55:93:8a:56:8c:3d:e9:8b:ae:0c:77:8d:5c:8b:fd:22:d8:4c:
+         3e:e4:76:e8:d9:e8:c3:98:f4:98:ff:02:60:95:8e:3e:26:7a:
+         e2:fe:2c:0a:a4:52:8d:4c:3d:dd:4c:fd:2f:2c:db:83:4c:2b:
+         25:24:37:78:9a:07:27:52:f9:1c:c0:65:65:cb:50:77:b4:2d:
+         fa:f4:af:bb:42:1c:43:65:c6:01:6e:f1:4b:fe:b8:4a:3c:29:
+         8b:b6:84:1e:17:99:61:98:65:fe:f2:e9:ce:bb:ac:87:69:cb:
+         e6:13:42:bf
 -----BEGIN CERTIFICATE-----
 MIIDijCCAnKgAwIBAgIBATANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
 MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
-BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
-MTM0OTI4WjBWMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMjAyMTE1NzQ3WhcNMjcwOTA0
+MTE1NzQ3WjBWMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
 BgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNVBAMME1B5dGhvbiBMREFQIFRlc3QgQ0Ew
-ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0vUd42WJOjq4YU7iOnwsT
-6vJZwB1/C1xa7ci4zf9mlMRA1c1M2gbSNRxqxXZwbfCBiiXkNcjVeRc+Newrl3N3
-bAR/Hwu18/0azXYsXBdFam3E0Wz4Cbqg+FdE17QcpL6kS+R2NByxCxJCfnnkAeBf
-j2wDLSq2TnKF8bms1SKnCvxaDOV1j58gwhSrU2qw5ooN9JdTf/d5Kd3q3645b1nY
-s47avwjNA+oqkTPJbyGmVgYQwUBLMZWwRyoeL33rm/HUJ68aXb8PtPXVuB0EYfoG
-r0lv/5mI80QW7TvxyOoxCvP1l3oXCOXoj90dyI9Vv0eTmr6EmW/zmWFdtxNWNASR
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvH88PxZVmLeuFzCH8DQ9E
+2C+ohQjvYGdX+gvF5LP78W/LMHpHDafxtTeBX/Y5KOL5TWwuplwOPNtNySpkzg0V
+MMd1Urh0xQsATC+UG937gyxYAnOwhjpqqlXy1UmZF6XiROzdYl+NzncpC42HI+JL
+1hwl8wap7jNvrO0injXsVecbOGh+RuPDQqwGCwp6hMk97z2lbukQJMMo/h9KmiOK
+PNsKZl0H+MUXaFPkDjczxNKtWGJrioerc+u8K6wHaYSN48SpeJtsHgNj37SWGL08
+Lr5/LNWo+BK5qydSsN44YjxUp/OqN6MRErKnb42WEM4ByyUkplEYk2mbnlyK//6J
 AgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1Ud
-DgQWBBQ9gOO7lJfb3d/IGiOKyyvBPRrmhTAfBgNVHSMEGDAWgBQ9gOO7lJfb3d/I
-GiOKyyvBPRrmhTANBgkqhkiG9w0BAQsFAAOCAQEAA9Lm9eQdmS7fArlb9+CCyjl2
-XI898V/UvRtLTzVLXfYhi8CHI95+nZMbZ2Bt33uV8GqHlFz5o2JQe2gCsFzSS/mx
-l7okhEdu4enW4Pov95vFZzrrjry3jzF9XLqRzp0skYUydOfpugdhfItVadv5ex3v
-Vfy/WPyZZpyekjV1Uwox4TSKz7x5sA6sv6rw43SI8qZcOK0hMerN4lcBa54LJGJ4
-rGqIuq6+ICdjqzvpLMBcgcXn5v6nCTC0KGVRbxsdIvgwfYeu2iiZXIsV8LdF0B07
-rcUpSu0RaMSvKKMLnxvIhlaAPWvTH8awPUo5HBBXLSLf13utffkSR7szKWEUxA==
+DgQWBBQ7HzL0/lfRb0mRVfIk8QpmO6Xu1DAfBgNVHSMEGDAWgBQ7HzL0/lfRb0mR
+VfIk8QpmO6Xu1DANBgkqhkiG9w0BAQsFAAOCAQEACufcOM4D3aiZEdAkvu8aGJ18
+lXVKSilEIyj8ZtWBzgXCwGtx1o0zqVOmHPFOUK6jsXLWaVOtqWKpRSdoFzVBl+zp
+ZZFiEu3rRTqbzAm8460iaxNrsGfvzgGDXmyV4rNzuWmaM0n5X1JOOZTJ25Nv2LoQ
+ks76Emu8Mf/BZ3BjB9xTejqjUSAVRM8cqc23MB2OVZOKVow96YuuDHeNXIv9IthM
+PuR26Nnow5j0mP8CYJWOPiZ64v4sCqRSjUw93Uz9Lyzbg0wrJSQ3eJoHJ1L5HMBl
+ZctQd7Qt+vSvu0IcQ2XGAW7xS/64Sjwpi7aEHheZYZhl/vLpzrush2nL5hNCvw==
 -----END CERTIFICATE-----
diff --git a/Lib/slapdtest/certs/client.key b/Lib/slapdtest/certs/client.key
index 81c3e76..70600ba 100644
--- a/Lib/slapdtest/certs/client.key
+++ b/Lib/slapdtest/certs/client.key
@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4aZb1WfASk2JR
-VAwFMMQCJNkbBDj7d8QdqSMa32jgTG8m/0N5RYGhdIi6zVeO2GmrSDuRd9Lv5hqu
-6ZgFI/rRCYSZHrIe6MXSOs6ZZKHIeQYkZcKa7Eg1FWQPBS51FJjYcotoHj5uxyKZ
-pOBMC63qODgq77G4zcqIKVswKS34KAIwvBAAUmTMtyMOOEh8oZm4V4ILpFFNBfs9
-CcyKMcAtCiFXOYZQ0G16ExzT560FMxMmCHd8HkevhfgFlKZb9/bsHNb+tvBwTQNm
-eUl4gnPDJk6YLBGIscBImvSRJu8o07aZBvAZvRhPa5iX/mtnlg0pDQ9jiGFK24qB
-VPQKtwHjAgMBAAECggEBAIYO7Fir6uP2FHD+4kYbr0HHu7PyG+JirETLoeN1KW50
-4hC9XDWam6PdbVAu2knTdO248uTK8KLI6fjhg0upXjn761LMh7wEh1pOucW07A8q
-O5bWCuRIhC1iwXxRzfX65SnkCwfDhKtPRA3hV9SwYNt1xw8fdFjd8S+OsOWP6gUN
-A33rBN6L44zfabZmcIO4DvSjDP4zoOL640uFg9dyf2yHzFI+q4mZgMK2iW5TZILl
-pNfdQF/hZsqrme+kzUyEtQHzLxGk1twYlFubePS0K1wzXRw6OqFRA0+pYNYP+JmJ
-bQs1k/e/y5qRiD9+UzR3MOTASl9BWDu9KCK1LF5pqYECgYEA7SD43REkVmQkFinf
-Re1kfOTkqCub1t4veTZBqVBNCF10fnQwPk1UQ2PShum1iJun6S3P0NzJP/svGc0N
-m44XJaD8QHnXdsDkHGx36/Cj15+VYpGvSpkPUgVQk4Q82n29Y3v8/xR6xqhXiB2N
-kuWHig8WIrrc690mUlL1NLQvH+ECgYEAxxaggQXlBTdDSMj2x3Y/0TJlkese2Oet
-JxWu6xGfjrsjMxZj1c5C3ESeKws3Z1eH9nk3AVzJ/q/+2SyCM3lM+eFz6dAtKVDB
-Olly4YhxoEZDgW4JXMVLP8d7xNDxWk9y7UitpvfDJ8J0hf//y9KR2jnokkfSKScN
-AsqrMe7+6kMCgYEAgndztV3rGkU6vZ8II1c7xKPDUuu7cHsKr6w0cE2oNIQGxlRy
-/rRZOkK/4E7R/Hl35wm3n3j6mWNARPfXFtEU1zU91NO0wrfaSfE8AeqCmu5IqNTz
-Fx4jmcMm1CMbwDMScpwTVN0VuBuDHXb1H+99pW4rhaw+RN+GaCEQnJDOpMECgYBv
-UTOFcOpRNEkm1VdGx9N/ARLRuAmTdlbW18TqIvx4LiLMWeSQk7fGuYdGwgrEeajI
-I5ah6GP5SCbS/5P9fAGSZoENZx0ZUNH58jHN8SC3YRI1uHT7rkUY8E1ACyQoPuwf
-yNdv2HECNjQ5CJ7aNG7g+igUQpw77l3UBcYbMWrPSQKBgG+R+nFGbjJ7oHyvJyJI
-C3rlD6vay9BoXmjA05dCO36zDcq5xZqwLnQmYkFgBw+RwvwV8gbBirG7GEpy0rdt
-5YbHwiI6fMfLsXocU9f86o2dhhpA2o42ig3mfe8X3LteWtmRfJ3BtHbW2ZWS8Kvx
-MnZGm64AmjWV5oJb7e5jpgu6
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDGxvbMEbahViK4
+P6aoWUkciIf1dEYTBuU8M1eShREUZ3Ytq/ee425pXRyxxDrAa8ygRjqs7tauwhgA
+KNuPRGyw7hyZ1Ku4vQObwX9rzyHQ6Fj606U4HHbYfAVb0AF7OzLbhNH3isCRtNcm
+EUSYG1Nkfn9zQkV4pz2KJM4ePt4GyGJV0NhRUdHdwgsWiuRt2EIRPwLXdkf/4svm
+2EahAJax+SMaZYe/lg9w9SBxl6DTaF9lFpoPqzeW+KnXCmE8e+qSWea8EjkzIRXa
+4KJ/EnUMP2fUL+Je2agGF2YfCId9YvLTQV8YDv7Im1Sp0sbIUDoWX14GDUbZ8cBr
+wfOyI0TfAgMBAAECggEATWv1eGp1zcU05Lq1+OA938U1316YZJTM+HOu6jy1+FKL
+7yIJ4nMG8Db6FCswDv5txwdTl0O3jn2+x2Eik1y9UPSNY0U4VU4Zd7MYJC+bJjk5
+XwjMU1yS1aMIm0gbK5pVJrdG6Lm8Y4QiQIt9Qhlyk7PJhGUNlf7ds06+kX0/ETiO
+vx5SatExeKu5F+JRnGFdAN0106SF5vBum+UbrgOSnJmfwX5VoOXARD21ppxgMzAr
+JyGBpgBgy++GpV15gXGuA7DVMIADdHw8hV4OuBLjpkUL+ntArjhpUi7TP7VU3WKR
+uUmvLm9CX1l8O/xZMpt9N1+o71a//7asnz8AMtT6cQKBgQD4FgefUkVnXDA1xKDW
+1JbArVQeHiLGlRdLakRUY/HdGj72YgAOLt3UsrON4VQXl0C6rks/8HKCFaMexBlF
+OecJNWsEVgBEAfsQ+NvrApOQsTszc8Zqna0Kqe2vA0VNa+SAzdHzhBbFcaVkzXJb
+JB7M0/OIt5IaqXg6Y5eX2eZF1QKBgQDNHkIoJ/2hYtlSgXpGaniM+0XemQJgJXig
+edAQdGKKfqwmjSFjByDM01ZaidMu5fEkeGhMRE73IbwNw0pWsMXylD6bI6+sk7yQ
+biM+fslFEEDbgSJe41Jy2eerh5am+dnrMWNhd7QZV1K6tmaqrIzkmIV21/EPXIPp
+BNHO8GV14wKBgGOybrO/GzcTXChvcXeEDWU3AqPr1mvZhHgBJ56GX69MGdtnvL/2
+Y51Th0bQM7wbQ58B5im21j2itl/pzIH+Z/NSbURbz1WFOkEy0SYbbfPq1XCy6Rz1
+apHrgiIf/VzErBp7HBFxlrkYF7Bvw7IOzPXhg3AA3Y0rZ66HUWdr4NdVAoGBAJfC
+E2Bydgy5feC1OypuC9MC9abDviY0kxLoDTCfa2jcX7IGKPWDiJkCo5lI7557Mfax
+vzjuMR5XLzNfkdih4VKgq9FMjeU5SQHy+tB6LZ+Tbuj4md1qgs3GuskGAEh6Auko
+GUc7sVwuZ18NJNiR4Ywf7F8JVajv4gi9MB3Tbr3RAoGARSnVu+6rYSQTyEqvbsaB
+gIW7Ezea5q06GcQF072nk3tNSXuU/52YMlodAJ1UfFPbBAtaa7wEFN8oRG1IyKON
+MGyf6RD8GoInJjaDihkdCsR28RkchwymG1UMPnPzqRxSAb7da5YuMR8PEioVbL68
+dxhsgNi1Wtc2nGqN96qufG0=
 -----END PRIVATE KEY-----
diff --git a/Lib/slapdtest/certs/client.pem b/Lib/slapdtest/certs/client.pem
index 8133c6d..33b95a7 100644
--- a/Lib/slapdtest/certs/client.pem
+++ b/Lib/slapdtest/certs/client.pem
@@ -5,31 +5,31 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Validity
-            Not Before: Nov 28 13:49:28 2017 GMT
-            Not After : Nov 28 13:49:28 2021 GMT
+            Not Before: Dec  2 11:57:48 2017 GMT
+            Not After : Dec  2 11:57:48 2027 GMT
         Subject: C=DE, O=python-ldap, OU=slapd-test, CN=client
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:b8:69:96:f5:59:f0:12:93:62:51:54:0c:05:30:
-                    c4:02:24:d9:1b:04:38:fb:77:c4:1d:a9:23:1a:df:
-                    68:e0:4c:6f:26:ff:43:79:45:81:a1:74:88:ba:cd:
-                    57:8e:d8:69:ab:48:3b:91:77:d2:ef:e6:1a:ae:e9:
-                    98:05:23:fa:d1:09:84:99:1e:b2:1e:e8:c5:d2:3a:
-                    ce:99:64:a1:c8:79:06:24:65:c2:9a:ec:48:35:15:
-                    64:0f:05:2e:75:14:98:d8:72:8b:68:1e:3e:6e:c7:
-                    22:99:a4:e0:4c:0b:ad:ea:38:38:2a:ef:b1:b8:cd:
-                    ca:88:29:5b:30:29:2d:f8:28:02:30:bc:10:00:52:
-                    64:cc:b7:23:0e:38:48:7c:a1:99:b8:57:82:0b:a4:
-                    51:4d:05:fb:3d:09:cc:8a:31:c0:2d:0a:21:57:39:
-                    86:50:d0:6d:7a:13:1c:d3:e7:ad:05:33:13:26:08:
-                    77:7c:1e:47:af:85:f8:05:94:a6:5b:f7:f6:ec:1c:
-                    d6:fe:b6:f0:70:4d:03:66:79:49:78:82:73:c3:26:
-                    4e:98:2c:11:88:b1:c0:48:9a:f4:91:26:ef:28:d3:
-                    b6:99:06:f0:19:bd:18:4f:6b:98:97:fe:6b:67:96:
-                    0d:29:0d:0f:63:88:61:4a:db:8a:81:54:f4:0a:b7:
-                    01:e3
+                    00:c6:c6:f6:cc:11:b6:a1:56:22:b8:3f:a6:a8:59:
+                    49:1c:88:87:f5:74:46:13:06:e5:3c:33:57:92:85:
+                    11:14:67:76:2d:ab:f7:9e:e3:6e:69:5d:1c:b1:c4:
+                    3a:c0:6b:cc:a0:46:3a:ac:ee:d6:ae:c2:18:00:28:
+                    db:8f:44:6c:b0:ee:1c:99:d4:ab:b8:bd:03:9b:c1:
+                    7f:6b:cf:21:d0:e8:58:fa:d3:a5:38:1c:76:d8:7c:
+                    05:5b:d0:01:7b:3b:32:db:84:d1:f7:8a:c0:91:b4:
+                    d7:26:11:44:98:1b:53:64:7e:7f:73:42:45:78:a7:
+                    3d:8a:24:ce:1e:3e:de:06:c8:62:55:d0:d8:51:51:
+                    d1:dd:c2:0b:16:8a:e4:6d:d8:42:11:3f:02:d7:76:
+                    47:ff:e2:cb:e6:d8:46:a1:00:96:b1:f9:23:1a:65:
+                    87:bf:96:0f:70:f5:20:71:97:a0:d3:68:5f:65:16:
+                    9a:0f:ab:37:96:f8:a9:d7:0a:61:3c:7b:ea:92:59:
+                    e6:bc:12:39:33:21:15:da:e0:a2:7f:12:75:0c:3f:
+                    67:d4:2f:e2:5e:d9:a8:06:17:66:1f:08:87:7d:62:
+                    f2:d3:41:5f:18:0e:fe:c8:9b:54:a9:d2:c6:c8:50:
+                    3a:16:5f:5e:06:0d:46:d9:f1:c0:6b:c1:f3:b2:23:
+                    44:df
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -39,45 +39,45 @@ Certificate:
             X509v3 Extended Key Usage: critical
                 TLS Web Client Authentication
             X509v3 Subject Key Identifier: 
-                C5:E2:E2:72:A6:55:C1:FB:D3:4B:11:01:D0:A0:AE:99:B6:8F:F1:39
+                67:63:38:F4:B4:BC:F3:6B:BC:74:0E:7C:27:C9:BB:C2:CC:58:AC:16
             X509v3 Authority Key Identifier: 
-                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+                keyid:3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
 
     Signature Algorithm: sha256WithRSAEncryption
-         11:76:03:a3:a6:9d:4e:3e:74:93:50:3b:31:d5:c7:d0:a8:34:
-         84:01:6b:a2:08:cd:89:11:57:97:a2:e9:83:f0:a6:ef:03:8c:
-         b2:8d:31:8f:ee:b3:c9:8c:49:1f:e4:fc:21:58:8d:22:c2:17:
-         96:2e:b1:d1:64:03:d6:48:70:41:65:22:38:bf:9f:00:dd:a8:
-         82:a0:df:22:e0:9a:1b:27:16:4b:db:7f:b0:fe:9f:a8:80:90:
-         69:ad:35:be:e6:95:fe:f9:64:96:0a:d8:d7:8e:aa:63:fb:9a:
-         d5:d0:e9:cb:8c:f3:08:c0:0c:26:72:c9:c6:29:5c:cf:3c:9e:
-         e2:38:37:5a:16:2f:70:82:0b:e6:80:27:90:bd:81:b4:58:52:
-         6c:4e:b7:77:fc:49:76:7a:4f:6c:ee:ff:02:1f:f4:49:6e:78:
-         c3:fa:cd:ee:d3:e7:e5:05:a4:16:97:48:16:44:9f:81:1c:ac:
-         a9:30:0e:1d:ea:15:32:d7:2b:1e:68:92:0a:9c:5b:b2:27:57:
-         d3:21:3e:76:71:94:2d:da:76:61:aa:64:99:b7:54:1c:ba:e2:
-         a5:b3:21:a4:a8:36:fe:5d:a3:73:6a:5e:77:af:ab:9a:d9:62:
-         00:f0:fd:90:1e:b6:cc:57:5d:92:0d:16:16:97:78:48:27:fc:
-         d9:2d:55:4d
+         76:24:42:6b:33:4f:d6:59:07:48:5b:04:9c:3c:d3:3f:63:80:
+         75:4d:78:d7:d5:85:b1:77:81:31:a3:91:cb:c9:a3:8c:0e:00:
+         28:08:74:71:6c:fc:83:8c:80:ec:1c:e8:ee:83:e0:7f:49:3b:
+         f3:42:33:5a:1f:68:0c:a5:41:42:ce:bf:77:29:07:f2:18:a7:
+         81:17:d7:76:47:04:d9:8a:dd:e8:5a:26:26:ea:a4:76:70:e1:
+         f1:fa:e1:db:bc:f2:24:b2:37:a8:58:2f:e3:66:89:77:02:55:
+         87:ef:3c:1f:66:ce:4e:86:b3:4c:57:43:86:7f:4c:ab:5a:33:
+         dd:ca:e3:2f:3b:af:b4:43:5a:53:8b:e0:12:da:e7:c0:13:76:
+         b2:68:d5:14:f8:1a:07:ce:8a:87:5c:91:bd:35:d7:83:c6:2a:
+         a4:e0:92:50:01:b9:c2:fa:69:06:5c:8a:80:ee:9c:24:f9:49:
+         64:e3:59:c1:a6:69:29:ce:b7:89:20:a9:7c:d6:9f:df:2a:d1:
+         a4:98:2a:6d:7b:93:6a:52:e3:ae:de:1a:d8:f3:2e:cf:02:7e:
+         ba:9a:fa:f4:b3:b5:6e:9a:23:10:70:53:53:30:d5:8a:32:35:
+         01:52:58:6d:9d:f5:8e:bb:b9:76:bd:41:16:88:26:f8:d3:ce:
+         70:03:c8:59
 -----BEGIN CERTIFICATE-----
 MIIDkjCCAnqgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
 MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
-BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
-MTM0OTI4WjBJMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMjAyMTE1NzQ4WhcNMjcxMjAy
+MTE1NzQ4WjBJMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
 BgNVBAsMCnNsYXBkLXRlc3QxDzANBgNVBAMMBmNsaWVudDCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBALhplvVZ8BKTYlFUDAUwxAIk2RsEOPt3xB2pIxrf
-aOBMbyb/Q3lFgaF0iLrNV47YaatIO5F30u/mGq7pmAUj+tEJhJkesh7oxdI6zplk
-och5BiRlwprsSDUVZA8FLnUUmNhyi2gePm7HIpmk4EwLreo4OCrvsbjNyogpWzAp
-LfgoAjC8EABSZMy3Iw44SHyhmbhXggukUU0F+z0JzIoxwC0KIVc5hlDQbXoTHNPn
-rQUzEyYId3weR6+F+AWUplv39uwc1v628HBNA2Z5SXiCc8MmTpgsEYixwEia9JEm
-7yjTtpkG8Bm9GE9rmJf+a2eWDSkND2OIYUrbioFU9Aq3AeMCAwEAAaN4MHYwDAYD
+AQEBBQADggEPADCCAQoCggEBAMbG9swRtqFWIrg/pqhZSRyIh/V0RhMG5TwzV5KF
+ERRndi2r957jbmldHLHEOsBrzKBGOqzu1q7CGAAo249EbLDuHJnUq7i9A5vBf2vP
+IdDoWPrTpTgcdth8BVvQAXs7MtuE0feKwJG01yYRRJgbU2R+f3NCRXinPYokzh4+
+3gbIYlXQ2FFR0d3CCxaK5G3YQhE/Atd2R//iy+bYRqEAlrH5Ixplh7+WD3D1IHGX
+oNNoX2UWmg+rN5b4qdcKYTx76pJZ5rwSOTMhFdrgon8SdQw/Z9Qv4l7ZqAYXZh8I
+h31i8tNBXxgO/sibVKnSxshQOhZfXgYNRtnxwGvB87IjRN8CAwEAAaN4MHYwDAYD
 VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
-AwIwHQYDVR0OBBYEFMXi4nKmVcH700sRAdCgrpm2j/E5MB8GA1UdIwQYMBaAFD2A
-47uUl9vd38gaI4rLK8E9GuaFMA0GCSqGSIb3DQEBCwUAA4IBAQARdgOjpp1OPnST
-UDsx1cfQqDSEAWuiCM2JEVeXoumD8KbvA4yyjTGP7rPJjEkf5PwhWI0iwheWLrHR
-ZAPWSHBBZSI4v58A3aiCoN8i4JobJxZL23+w/p+ogJBprTW+5pX++WSWCtjXjqpj
-+5rV0OnLjPMIwAwmcsnGKVzPPJ7iODdaFi9wggvmgCeQvYG0WFJsTrd3/El2ek9s
-7v8CH/RJbnjD+s3u0+flBaQWl0gWRJ+BHKypMA4d6hUy1yseaJIKnFuyJ1fTIT52
-cZQt2nZhqmSZt1QcuuKlsyGkqDb+XaNzal53r6ua2WIA8P2QHrbMV12SDRYWl3hI
-J/zZLVVN
+AwIwHQYDVR0OBBYEFGdjOPS0vPNrvHQOfCfJu8LMWKwWMB8GA1UdIwQYMBaAFDsf
+MvT+V9FvSZFV8iTxCmY7pe7UMA0GCSqGSIb3DQEBCwUAA4IBAQB2JEJrM0/WWQdI
+WwScPNM/Y4B1TXjX1YWxd4Exo5HLyaOMDgAoCHRxbPyDjIDsHOjug+B/STvzQjNa
+H2gMpUFCzr93KQfyGKeBF9d2RwTZit3oWiYm6qR2cOHx+uHbvPIksjeoWC/jZol3
+AlWH7zwfZs5OhrNMV0OGf0yrWjPdyuMvO6+0Q1pTi+AS2ufAE3ayaNUU+BoHzoqH
+XJG9NdeDxiqk4JJQAbnC+mkGXIqA7pwk+Ulk41nBpmkpzreJIKl81p/fKtGkmCpt
+e5NqUuOu3hrY8y7PAn66mvr0s7VumiMQcFNTMNWKMjUBUlhtnfWOu7l2vUEWiCb4
+085wA8hZ
 -----END CERTIFICATE-----
diff --git a/Lib/slapdtest/certs/gencerts.sh b/Lib/slapdtest/certs/gencerts.sh
index 6edafa0..7a971a3 100755
--- a/Lib/slapdtest/certs/gencerts.sh
+++ b/Lib/slapdtest/certs/gencerts.sh
@@ -29,6 +29,7 @@ openssl ca -selfsign \
     -in $CATMPDIR/ca.csr \
     -out $CAOUTDIR/ca.pem \
     -extensions ca_ext \
+    -days 3563 \
     -batch
 
 # server cert
diff --git a/Lib/slapdtest/certs/server.key b/Lib/slapdtest/certs/server.key
index 081dc2f..a48ee56 100644
--- a/Lib/slapdtest/certs/server.key
+++ b/Lib/slapdtest/certs/server.key
@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDTJOAnZdPnCTmy
-gkI5XUHsuk1xL4eePxMcV+8HYMfQh+b354CygQnRcjj38uQ6S70mOIyCrTWKNrec
-VrnV0xu4o16AkSRrkN0AVpfWk0ae2GaccDV+o82x+NBStfYNXW2xZ1aZIyFplGTU
-yxQCpsU4yCX7RM7Ywq3fM6b8eoR2jRNGC/uMdNN/7WJkHfhJFOYFpPJ6vKOlR3PP
-qzkj8WRu/ill63+phHA3UEUweKG4DoaP85M0WqHW4Kvp0A4sI5uPYI2lPrDqUf6L
-Wc22gUpcFFNDReWYcxLobCsAeT4SqvEC83Dv53NKQS6wt4zLewVG1+8cjyctwv4m
-PAatL8uDAgMBAAECggEACB8+BCX1nciMEKLUG1LMC2grPHRgmiTA/nEff8AoT4w6
-xUSBfdxa3VSwflE4mEl7kDHSreAt1BBAxeHMKj6BrXuTUgzDQuQCrFWoZ5eousmG
-QPRMCoAQlI0GrnfTbDYw1wcrnJ5uVZpgupLJRUTXB1UjqOO/tTTf7VsWTFYGLG00
-8OeIenTGX0E1mVW9ERYCSYEtMfhQhSS3dhPmMm5VV6muIxv4ym6r2uodCY7ocxGA
-JmI9F22xovH8CUtzoRbh0o4Y9VUVkKcMDl35+hya8c0BH4Vh22hnYgiyUkS1pBgY
-GiX/rmU4FxkzLDrLLMB8cf+rzh+aOKjNupZ2dbNgsQKBgQDu3DLRHhUJEUcoK6Gb
-ltVK179WsT1Me1Y/qiZ2SgGsXmSZFK+8cYLvXUI7Epz2Du2DwAb1J+sItie5QQ9g
-o6eymTS7DuQ6MFS1UmC8PfSNjT/dFd/sVIEFJRcNkVC4CpJCnE4MQOUb6OIT8YnR
-+HNDNMWc5+ab1OeFxMWRSrP52wKBgQDiS4oFkhfPtaxVyUHuiR0+0icjCGehWSM0
-eNoiX561HtBrYCZYp6kg1JMSLBSJPRaHi78td3z+6iDvE6HQtwrLq/LNd2CRJ80U
-rkGjsItpZYfnJVMmK6Y4KksGlvYqWshWb8Zp0o+LPRb6g0TxZrbOGv7yD8FjaZwq
-wlGxleIJeQKBgDDR+uT5BA2lZWjVeiOF8bRpYmdCtKe0Mc2zZkcZGzxy0pbjPoQC
-o2NvKUFPrZsxM+SQ1Bs5fHV8XaQkoxL6gCUl4Tw2b/lgtX+WBcWT2C8yZpI2jV0N
-bI1zpkGUqO3k4z4QGnewr+NDdyniXWv4Hv7mg1ltoJnLK0MRE9x9a0mvAoGBAIi4
-8w8ikVhhf1nlWvxvw0etWRAFh/coD+koC0MxWoY7s9jsIr71rW20gZc9Irs4OWBz
-wnIJ+29YrcVEq0ObE96yaORS9/k7fuC719S6WcC4I0A4gOBTBv5wLxwwIVK9vsTa
-i5psKWYK5tM8dG8Vi+VC0j4V3tXdfQkolosg74yhAoGAOLj21q7nNk+ExGAOesmR
-qykxwIXxbHxDIfmEJJVE6OJMRvubr8WgaiSG0ptWBeiHDnldUS436difn7JXlsdo
-K51jVzzgUqZXK75xvnSD7e5AL3fFRCU5usoU699fxWJTMs8H2z4alRng06MloeXJ
-xrLwQyuLH8BWYFuPj4QxwwQ=
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDAgcI7Pj89Aw4r
+rb+N8j3t1ynJgXRhQNxbxQcQmUCi8AtpGKNXu+aM9u2HxZ677ALfhsEivtQA5QKz
+Ll5G2G2IQa7uzgIco73OL/kMZIJt7sKfnvfACtSoOlD0IyOzVEEu0AVA7hMHb6Ul
+I0mCNfdk2FWFbc1nUmIAEBhIODbFoNW+Rc6lz94NsUqArDayvWpAsXkUbubQikpi
+KNX1OpOOC9GUbEhwI/G90ZnUg9STk/2oxsvwLlYdOhGhpyfl53tTu7eLMBriMxFl
+UTvkY1GUgPj0fA/giWtCerGOyeKu1hFlbS4LjborsfrlyYPwfwTg3YL4hVnt9fF0
+rpjzY1mlAgMBAAECggEAJY6rSEeiqtKXxynEv3rNXkOmIWwiOn8e/sB32mMr2x4d
++8kUxR8hocrjGKQTjfJDtTxjHdZBIlOLrU2UkxnSdMzrxidm/hNsCngNjL9nOu9k
+BSRMjakPSCrodFkOtAPyG6H2BG7uQ3siqxYxVzgUJhaWyMtdUZUfDYgWVLCy7udU
+5ML/OTOi7virueMmshjXoyrDug9OpiEMKiLu3ndAaDk/26m05ePAXB6TjW8SFw1B
+qn7cITSG0G5MZ9pOw0KwT9irY1SdppBHVWIg7dkYWRCni0BPCFewastU+GVKH5PJ
++dYSvafhkEGD1bBu484KN9yX1BcHV41ZKR8pGgMM2QKBgQD3/0R2vZsTxoO1CHNI
+IT7nBnuPIOP45iTFm/SNRY7e4dhQBy6HM6JD3Sr6Iksm8jRoboz+tnAso6l6QHRS
+842uqBiOHdnka2RslDmrEun1lJv1MWuPM8JN0o8pYjVG/IRtaAFnYSEk72UoNy2h
+bHC4OGFNwMbAadVm7DK5OiMfXwKBgQDGuBRxz7jkVZoMbbaeIqmGZAIejWkJweDZ
+AK+txM+6Sg+Li14t190N3Xf6tyyidKhUAEWaINzLjZB+luxNaDXtxqWzLYHCwQKA
+qfrjWVeZOS1clLya7jwl1jJqBtBiGKHv9eRL21hgX/9gX3odxqFMvX3vm6L7F1q1
+5CNApW0ZewKBgGO8qNcsWBLy8oM7G8n1fOvCwqyEaMrwG/fRSeALCnN+1tUQnljH
+nkm2yBMC+cB3Bja9xzylOKXrSDyfcWjvBJsqhX2aacggnKnCTxMLL0aR9sr8jipw
+gYN03Bijo5Oh+MxbWL0v5fmJweATmOljyE1+dzui/QvjRGz5L0kpJXj3AoGBAIa4
+3+t1B4WN312TuB4no8Tf4mvyNQcPcS/Nfk0RxD8o3Lcfal8sHMq8ng3Ux6bv7frd
+IFLo+qfpts+L5HJqNz2X0ljSfkmZ7udp1hTySigwEmfU0rU61H5WZGFrczU+O/Ni
+Qj+HWrgj/Q/KSxEKy+oqAcpDOtB+Odpc6+V1Aa0nAoGBAItWHP9UjTNFqOfyjZhG
+qaUiZd1S2KyRR0l/lVcn+rJ46Yg5i+lMGwHMF1xPyWH4ELz+QCUX3doOI4yB2ikg
+XXFcc8/bqgaR4AfOvP98T86s7+f33kaAKZsgyAFB2cjo+fz8ArTz+GjPeHbiOPaR
+Ra7+BVwl9GE0+bCdirq+99GO
 -----END PRIVATE KEY-----
diff --git a/Lib/slapdtest/certs/server.pem b/Lib/slapdtest/certs/server.pem
index 45ae694..7e75059 100644
--- a/Lib/slapdtest/certs/server.pem
+++ b/Lib/slapdtest/certs/server.pem
@@ -5,31 +5,31 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Validity
-            Not Before: Nov 28 13:49:28 2017 GMT
-            Not After : Nov 28 13:49:28 2021 GMT
+            Not Before: Dec  2 11:57:48 2017 GMT
+            Not After : Dec  2 11:57:48 2027 GMT
         Subject: C=DE, O=python-ldap, OU=slapd-test, CN=server cert for localhost
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:d3:24:e0:27:65:d3:e7:09:39:b2:82:42:39:5d:
-                    41:ec:ba:4d:71:2f:87:9e:3f:13:1c:57:ef:07:60:
-                    c7:d0:87:e6:f7:e7:80:b2:81:09:d1:72:38:f7:f2:
-                    e4:3a:4b:bd:26:38:8c:82:ad:35:8a:36:b7:9c:56:
-                    b9:d5:d3:1b:b8:a3:5e:80:91:24:6b:90:dd:00:56:
-                    97:d6:93:46:9e:d8:66:9c:70:35:7e:a3:cd:b1:f8:
-                    d0:52:b5:f6:0d:5d:6d:b1:67:56:99:23:21:69:94:
-                    64:d4:cb:14:02:a6:c5:38:c8:25:fb:44:ce:d8:c2:
-                    ad:df:33:a6:fc:7a:84:76:8d:13:46:0b:fb:8c:74:
-                    d3:7f:ed:62:64:1d:f8:49:14:e6:05:a4:f2:7a:bc:
-                    a3:a5:47:73:cf:ab:39:23:f1:64:6e:fe:29:65:eb:
-                    7f:a9:84:70:37:50:45:30:78:a1:b8:0e:86:8f:f3:
-                    93:34:5a:a1:d6:e0:ab:e9:d0:0e:2c:23:9b:8f:60:
-                    8d:a5:3e:b0:ea:51:fe:8b:59:cd:b6:81:4a:5c:14:
-                    53:43:45:e5:98:73:12:e8:6c:2b:00:79:3e:12:aa:
-                    f1:02:f3:70:ef:e7:73:4a:41:2e:b0:b7:8c:cb:7b:
-                    05:46:d7:ef:1c:8f:27:2d:c2:fe:26:3c:06:ad:2f:
-                    cb:83
+                    00:c0:81:c2:3b:3e:3f:3d:03:0e:2b:ad:bf:8d:f2:
+                    3d:ed:d7:29:c9:81:74:61:40:dc:5b:c5:07:10:99:
+                    40:a2:f0:0b:69:18:a3:57:bb:e6:8c:f6:ed:87:c5:
+                    9e:bb:ec:02:df:86:c1:22:be:d4:00:e5:02:b3:2e:
+                    5e:46:d8:6d:88:41:ae:ee:ce:02:1c:a3:bd:ce:2f:
+                    f9:0c:64:82:6d:ee:c2:9f:9e:f7:c0:0a:d4:a8:3a:
+                    50:f4:23:23:b3:54:41:2e:d0:05:40:ee:13:07:6f:
+                    a5:25:23:49:82:35:f7:64:d8:55:85:6d:cd:67:52:
+                    62:00:10:18:48:38:36:c5:a0:d5:be:45:ce:a5:cf:
+                    de:0d:b1:4a:80:ac:36:b2:bd:6a:40:b1:79:14:6e:
+                    e6:d0:8a:4a:62:28:d5:f5:3a:93:8e:0b:d1:94:6c:
+                    48:70:23:f1:bd:d1:99:d4:83:d4:93:93:fd:a8:c6:
+                    cb:f0:2e:56:1d:3a:11:a1:a7:27:e5:e7:7b:53:bb:
+                    b7:8b:30:1a:e2:33:11:65:51:3b:e4:63:51:94:80:
+                    f8:f4:7c:0f:e0:89:6b:42:7a:b1:8e:c9:e2:ae:d6:
+                    11:65:6d:2e:0b:8d:ba:2b:b1:fa:e5:c9:83:f0:7f:
+                    04:e0:dd:82:f8:85:59:ed:f5:f1:74:ae:98:f3:63:
+                    59:a5
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -39,48 +39,48 @@ Certificate:
             X509v3 Extended Key Usage: critical
                 TLS Web Server Authentication
             X509v3 Subject Key Identifier: 
-                98:03:0F:65:1A:34:A9:E1:09:1B:EC:D0:ED:A8:11:E6:AE:85:1F:2C
+                1B:78:45:40:0D:50:8A:8B:3B:C1:0A:F8:3F:7A:48:7B:A6:3C:28:09
             X509v3 Authority Key Identifier: 
-                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+                keyid:3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
 
             X509v3 Subject Alternative Name: 
                 DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
     Signature Algorithm: sha256WithRSAEncryption
-         a6:01:8e:6f:0f:db:35:1f:a2:03:f5:39:ca:16:5f:e5:5a:0f:
-         7e:f1:24:8a:b9:6f:78:c1:2c:f7:3a:07:f1:27:46:47:e0:98:
-         a1:ec:23:38:30:b9:bc:66:ac:17:06:36:48:ad:5d:1d:b4:a2:
-         c1:2c:08:55:ff:00:01:04:26:60:38:a6:13:52:7b:d3:88:8a:
-         b1:1f:a4:cd:14:9b:c8:04:77:01:72:6d:fe:b5:8c:3a:25:e2:
-         2b:83:73:4b:2e:c6:6f:20:8b:00:c7:3b:2e:de:62:e9:74:81:
-         c6:a5:f5:b1:f9:db:b9:58:f9:7c:a2:3f:4e:46:93:ae:af:75:
-         01:77:ea:34:4e:82:dc:d3:53:39:c0:b0:f9:8a:86:8d:f5:f2:
-         c3:a0:fa:e4:a9:b3:2c:33:ba:78:d5:ef:12:05:33:4f:29:9b:
-         88:41:52:73:5a:17:7e:bc:66:d0:dc:c7:14:6d:a5:99:78:67:
-         81:36:76:29:63:de:76:d4:eb:ca:5c:82:1b:ae:7d:80:ed:32:
-         69:b0:b7:7a:1d:e1:00:a8:b1:95:d3:4d:d5:e2:8c:f4:30:a7:
-         da:79:bd:f5:bb:7a:8d:c5:ec:1c:16:32:58:92:ad:fc:1c:83:
-         49:ca:8c:f9:6d:d4:f7:2c:98:1a:25:47:36:16:4f:15:46:ea:
-         71:78:f1:51
+         ad:08:3f:7d:b1:09:a1:a5:6c:c3:58:80:1d:e5:33:a5:bb:c0:
+         33:39:95:aa:88:ee:c4:8e:38:3b:59:a7:0e:39:74:6c:fe:11:
+         33:5e:fa:50:cb:20:4b:67:b7:c9:5e:96:a7:9e:d8:47:46:e1:
+         ab:fe:5d:8b:9a:2d:1a:1b:43:08:f9:93:0f:2a:e3:ce:83:4a:
+         94:cd:02:f0:8e:25:f2:41:0d:55:10:f5:4c:5b:39:8b:77:5e:
+         ab:78:16:64:a1:48:d5:e1:f6:69:9a:0f:d8:30:a6:cc:92:4d:
+         81:df:46:74:ab:cf:1d:b7:d4:01:b9:6d:d5:f4:14:b8:d5:54:
+         84:79:11:42:69:55:7f:74:ce:01:96:2f:3f:51:23:b3:11:fb:
+         72:dc:4c:b9:a3:89:ef:31:e4:c0:49:06:fa:8d:09:71:e1:c1:
+         74:a9:ed:f8:96:87:67:16:b5:5d:16:5d:59:70:ff:1c:b5:a1:
+         6c:d2:22:11:3a:0e:6f:76:9b:69:cb:f3:85:a7:79:ad:53:f5:
+         34:e8:87:cc:dd:09:51:25:e0:28:ee:79:a0:a3:dc:0a:dd:f0:
+         1b:e3:c9:5f:14:d3:95:f5:12:4d:23:95:45:2c:3c:32:94:ad:
+         ce:1e:a0:5f:e6:e8:28:c6:f9:c7:fb:57:06:ad:0b:eb:86:ca:
+         0e:d2:a8:67
 -----BEGIN CERTIFICATE-----
 MIID1TCCAr2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
 MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
-BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
-MTM0OTI4WjBcMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMjAyMTE1NzQ4WhcNMjcxMjAy
+MTE1NzQ4WjBcMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
 BgNVBAsMCnNsYXBkLXRlc3QxIjAgBgNVBAMMGXNlcnZlciBjZXJ0IGZvciBsb2Nh
-bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTJOAnZdPnCTmy
-gkI5XUHsuk1xL4eePxMcV+8HYMfQh+b354CygQnRcjj38uQ6S70mOIyCrTWKNrec
-VrnV0xu4o16AkSRrkN0AVpfWk0ae2GaccDV+o82x+NBStfYNXW2xZ1aZIyFplGTU
-yxQCpsU4yCX7RM7Ywq3fM6b8eoR2jRNGC/uMdNN/7WJkHfhJFOYFpPJ6vKOlR3PP
-qzkj8WRu/ill63+phHA3UEUweKG4DoaP85M0WqHW4Kvp0A4sI5uPYI2lPrDqUf6L
-Wc22gUpcFFNDReWYcxLobCsAeT4SqvEC83Dv53NKQS6wt4zLewVG1+8cjyctwv4m
-PAatL8uDAgMBAAGjgacwgaQwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw
-FgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFJgDD2UaNKnhCRvs0O2o
-EeauhR8sMB8GA1UdIwQYMBaAFD2A47uUl9vd38gaI4rLK8E9GuaFMCwGA1UdEQQl
+bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAgcI7Pj89Aw4r
+rb+N8j3t1ynJgXRhQNxbxQcQmUCi8AtpGKNXu+aM9u2HxZ677ALfhsEivtQA5QKz
+Ll5G2G2IQa7uzgIco73OL/kMZIJt7sKfnvfACtSoOlD0IyOzVEEu0AVA7hMHb6Ul
+I0mCNfdk2FWFbc1nUmIAEBhIODbFoNW+Rc6lz94NsUqArDayvWpAsXkUbubQikpi
+KNX1OpOOC9GUbEhwI/G90ZnUg9STk/2oxsvwLlYdOhGhpyfl53tTu7eLMBriMxFl
+UTvkY1GUgPj0fA/giWtCerGOyeKu1hFlbS4LjborsfrlyYPwfwTg3YL4hVnt9fF0
+rpjzY1mlAgMBAAGjgacwgaQwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw
+FgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFBt4RUANUIqLO8EK+D96
+SHumPCgJMB8GA1UdIwQYMBaAFDsfMvT+V9FvSZFV8iTxCmY7pe7UMCwGA1UdEQQl
 MCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATANBgkqhkiG9w0B
-AQsFAAOCAQEApgGObw/bNR+iA/U5yhZf5VoPfvEkirlveMEs9zoH8SdGR+CYoewj
-ODC5vGasFwY2SK1dHbSiwSwIVf8AAQQmYDimE1J704iKsR+kzRSbyAR3AXJt/rWM
-OiXiK4NzSy7GbyCLAMc7Lt5i6XSBxqX1sfnbuVj5fKI/TkaTrq91AXfqNE6C3NNT
-OcCw+YqGjfXyw6D65KmzLDO6eNXvEgUzTymbiEFSc1oXfrxm0NzHFG2lmXhngTZ2
-KWPedtTrylyCG659gO0yabC3eh3hAKixldNN1eKM9DCn2nm99bt6jcXsHBYyWJKt
-/ByDScqM+W3U9yyYGiVHNhZPFUbqcXjxUQ==
+AQsFAAOCAQEArQg/fbEJoaVsw1iAHeUzpbvAMzmVqojuxI44O1mnDjl0bP4RM176
+UMsgS2e3yV6Wp57YR0bhq/5di5otGhtDCPmTDyrjzoNKlM0C8I4l8kENVRD1TFs5
+i3deq3gWZKFI1eH2aZoP2DCmzJJNgd9GdKvPHbfUAblt1fQUuNVUhHkRQmlVf3TO
+AZYvP1EjsxH7ctxMuaOJ7zHkwEkG+o0JceHBdKnt+JaHZxa1XRZdWXD/HLWhbNIi
+EToOb3abacvzhad5rVP1NOiHzN0JUSXgKO55oKPcCt3wG+PJXxTTlfUSTSOVRSw8
+MpStzh6gX+boKMb5x/tXBq0L64bKDtKoZw==
 -----END CERTIFICATE-----

From 289ba45ebcd6d6041f87354bb784b6a7e1c358d0 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 1 Dec 2017 18:03:21 +0100
Subject: [PATCH 658/868] slapdtest: Don't have code in __init__

---
 Lib/slapdtest/__init__.py   | 507 +----------------------------------
 Lib/slapdtest/_slapdtest.py | 512 ++++++++++++++++++++++++++++++++++++
 2 files changed, 514 insertions(+), 505 deletions(-)
 create mode 100644 Lib/slapdtest/_slapdtest.py

diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 297bda7..a1acd2b 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,510 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-from __future__ import unicode_literals
-
 __version__ = '3.0.0b1'
 
-import os
-import socket
-import time
-import subprocess
-import logging
-import atexit
-from logging.handlers import SysLogHandler
-import unittest
-
-# Switch off processing .ldaprc or ldap.conf before importing _ldap
-os.environ['LDAPNOINIT'] = '1'
-
-import ldap
-from ldap.compat import quote_plus
-
-HERE = os.path.abspath(os.path.dirname(__file__))
-
-# a template string for generating simple slapd.conf file
-SLAPD_CONF_TEMPLATE = r"""
-serverID %(serverid)s
-moduleload back_%(database)s
-include "%(schema_prefix)s/core.schema"
-loglevel %(loglevel)s
-allow bind_v2
-
-authz-regexp
-  "gidnumber=%(root_gid)s\\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth"
-  "%(rootdn)s"
-
-database %(database)s
-directory "%(directory)s"
-suffix "%(suffix)s"
-rootdn "%(rootdn)s"
-rootpw "%(rootpw)s"
-
-TLSCACertificateFile "%(cafile)s"
-TLSCertificateFile "%(servercert)s"
-TLSCertificateKeyFile "%(serverkey)s"
-# ignore missing client cert but fail with invalid client cert
-TLSVerifyClient try
-
-authz-regexp
-    "C=DE, O=python-ldap, OU=slapd-test, CN=([A-Za-z]+)"
-    "ldap://ou=people,dc=local???($1)"
-
-"""
-
-LOCALHOST = '127.0.0.1'
-
-
-def identity(test_item):
-    """Identity decorator
-
-    """
-    return test_item
-
-
-def skip_unless_travis(reason):
-    """Skip test unless test case is executed on CI like Travis CI
-    """
-    if os.environ.get('CI', False):
-        return identity
-    else:
-        return unittest.skip(reason)
-
-
-def requires_tls(skip_nss=False):
-    """Decorator for TLS tests
-
-    Tests are not skipped on CI (e.g. Travis CI)
-    
-    :param skip_nss: Skip test when libldap is compiled with NSS as TLS lib
-    """
-    if not ldap.TLS_AVAIL:
-        return skip_unless_travis("test needs ldap.TLS_AVAIL")
-    elif skip_nss and ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS':
-        return skip_unless_travis(
-            "Test doesn't work correctly with Mozilla NSS, see "
-            "https://bugzilla.redhat.com/show_bug.cgi?id=1519167"
-        )
-    else:
-        return identity
-
-
-def combined_logger(
-        log_name,
-        log_level=logging.WARN,
-        sys_log_format='%(levelname)s %(message)s',
-        console_log_format='%(asctime)s %(levelname)s %(message)s',
-    ):
-    """
-    Returns a combined SysLogHandler/StreamHandler logging instance
-    with formatters
-    """
-    if 'LOGLEVEL' in os.environ:
-        log_level = os.environ['LOGLEVEL']
-        try:
-            log_level = int(log_level)
-        except ValueError:
-            pass
-    # for writing to syslog
-    new_logger = logging.getLogger(log_name)
-    if sys_log_format and os.path.exists('/dev/log'):
-        my_syslog_formatter = logging.Formatter(
-            fmt=' '.join((log_name, sys_log_format)))
-        my_syslog_handler = logging.handlers.SysLogHandler(
-            address='/dev/log',
-            facility=SysLogHandler.LOG_DAEMON,
-        )
-        my_syslog_handler.setFormatter(my_syslog_formatter)
-        new_logger.addHandler(my_syslog_handler)
-    if console_log_format:
-        my_stream_formatter = logging.Formatter(fmt=console_log_format)
-        my_stream_handler = logging.StreamHandler()
-        my_stream_handler.setFormatter(my_stream_formatter)
-        new_logger.addHandler(my_stream_handler)
-    new_logger.setLevel(log_level)
-    return new_logger  # end of combined_logger()
-
-
-class SlapdObject(object):
-    """
-    Controller class for a slapd instance, OpenLDAP's server.
-
-    This class creates a temporary data store for slapd, runs it
-    listening on a private Unix domain socket and TCP port,
-    and initializes it with a top-level entry and the root user.
-
-    When a reference to an instance of this class is lost, the slapd
-    server is shut down.
-    """
-    slapd_conf_template = SLAPD_CONF_TEMPLATE
-    database = 'mdb'
-    suffix = 'dc=slapd-test,dc=python-ldap,dc=org'
-    root_cn = 'Manager'
-    root_dn = 'cn=%s,%s' % (root_cn, suffix)
-    root_pw = 'password'
-    slapd_loglevel = 'stats stats2'
-    # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
-    cli_sasl_external = True
-    local_host = '127.0.0.1'
-    testrunsubdirs = (
-        'schema',
-    )
-    openldap_schema_files = (
-        'core.schema',
-    )
-
-    TMPDIR = os.environ.get('TMP', os.getcwd())
-    SBINDIR = os.environ.get('SBIN', '/usr/sbin')
-    BINDIR = os.environ.get('BIN', '/usr/bin')
-    if 'SCHEMA' in os.environ:
-        SCHEMADIR = os.environ['SCHEMA']
-    elif os.path.isdir("/etc/openldap/schema"):
-        SCHEMADIR = "/etc/openldap/schema"
-    elif os.path.isdir("/etc/ldap/schema"):
-        SCHEMADIR = "/etc/ldap/schema"
-    else:
-        SCHEMADIR = None
-    PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
-    PATH_LDAPDELETE = os.path.join(BINDIR, 'ldapdelete')
-    PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
-    PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
-    PATH_SLAPD = os.environ.get('SLAPD', os.path.join(SBINDIR, 'slapd'))
-    PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
-
-    # time in secs to wait before trying to access slapd via LDAP (again)
-    _start_sleep = 1.5
-
-    # create loggers once, multiple calls mess up refleak tests
-    _log = combined_logger('python-ldap-test')
-
-    def __init__(self):
-        self._proc = None
-        self._port = self._avail_tcp_port()
-        self.server_id = self._port % 4096
-        self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test-%d' % self._port)
-        self._schema_prefix = os.path.join(self.testrundir, 'schema')
-        self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
-        self._db_directory = os.path.join(self.testrundir, "openldap-data")
-        self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
-        ldapi_path = os.path.join(self.testrundir, 'ldapi')
-        self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
-        # TLS certs
-        self.cafile = os.path.join(HERE, 'certs/ca.pem')
-        self.servercert = os.path.join(HERE, 'certs/server.pem')
-        self.serverkey = os.path.join(HERE, 'certs/server.key')
-        self.clientcert = os.path.join(HERE, 'certs/client.pem')
-        self.clientkey = os.path.join(HERE, 'certs/client.key')
-
-    def _check_requirements(self):
-        binaries = [
-            self.PATH_LDAPADD, self.PATH_LDAPMODIFY, self.PATH_LDAPWHOAMI,
-            self.PATH_SLAPD, self.PATH_SLAPTEST
-        ]
-        for binary in binaries:
-            if not os.path.isfile(binary):
-                raise ValueError('Binary {} is missing.'.format(binary))
-        if self.SCHEMADIR is None:
-            raise ValueError('SCHEMADIR is None, ldap schemas are missing.')
-
-    def setup_rundir(self):
-        """
-        creates rundir structure
-
-        for setting up a custom directory structure you have to override
-        this method
-        """
-        os.mkdir(self.testrundir)
-        os.mkdir(self._db_directory)
-        self._create_sub_dirs(self.testrunsubdirs)
-        self._ln_schema_files(self.openldap_schema_files, self.SCHEMADIR)
-
-    def _cleanup_rundir(self):
-        """
-        Recursively delete whole directory specified by `path'
-        """
-        # cleanup_rundir() is called in atexit handler. Until Python 3.4,
-        # the rest of the world is already destroyed.
-        import os, os.path
-        if not os.path.exists(self.testrundir):
-            return
-        self._log.debug('clean-up %s', self.testrundir)
-        for dirpath, dirnames, filenames in os.walk(
-                self.testrundir,
-                topdown=False
-            ):
-            for filename in filenames:
-                self._log.debug('remove %s', os.path.join(dirpath, filename))
-                os.remove(os.path.join(dirpath, filename))
-            for dirname in dirnames:
-                self._log.debug('rmdir %s', os.path.join(dirpath, dirname))
-                os.rmdir(os.path.join(dirpath, dirname))
-        os.rmdir(self.testrundir)
-        self._log.info('cleaned-up %s', self.testrundir)
-
-    def _avail_tcp_port(self):
-        """
-        find an available port for TCP connection
-        """
-        sock = socket.socket()
-        try:
-            sock.bind((self.local_host, 0))
-            port = sock.getsockname()[1]
-        finally:
-            sock.close()
-        self._log.info('Found available port %d', port)
-        return port
-
-    def gen_config(self):
-        """
-        generates a slapd.conf and returns it as one string
-
-        for generating specific static configuration files you have to
-        override this method
-        """
-        config_dict = {
-            'serverid': hex(self.server_id),
-            'schema_prefix':self._schema_prefix,
-            'loglevel': self.slapd_loglevel,
-            'database': self.database,
-            'directory': self._db_directory,
-            'suffix': self.suffix,
-            'rootdn': self.root_dn,
-            'rootpw': self.root_pw,
-            'root_uid': os.getuid(),
-            'root_gid': os.getgid(),
-            'cafile': self.cafile,
-            'servercert': self.servercert,
-            'serverkey': self.serverkey,
-        }
-        return self.slapd_conf_template % config_dict
-
-    def _create_sub_dirs(self, dir_names):
-        """
-        create sub-directories beneath self.testrundir
-        """
-        for dname in dir_names:
-            dir_name = os.path.join(self.testrundir, dname)
-            self._log.debug('Create directory %s', dir_name)
-            os.mkdir(dir_name)
-
-    def _ln_schema_files(self, file_names, source_dir):
-        """
-        write symbolic links to original schema files
-        """
-        for fname in file_names:
-            ln_source = os.path.join(source_dir, fname)
-            ln_target = os.path.join(self._schema_prefix, fname)
-            self._log.debug('Create symlink %s -> %s', ln_source, ln_target)
-            os.symlink(ln_source, ln_target)
-
-    def _write_config(self):
-        """Writes the slapd.conf file out, and returns the path to it."""
-        self._log.debug('Writing config to %s', self._slapd_conf)
-        with open(self._slapd_conf, 'w') as config_file:
-            config_file.write(self.gen_config())
-        self._log.info('Wrote config to %s', self._slapd_conf)
-
-    def _test_config(self):
-        self._log.debug('testing config %s', self._slapd_conf)
-        popen_list = [
-            self.PATH_SLAPTEST,
-            "-f", self._slapd_conf,
-            '-u',
-        ]
-        if self._log.isEnabledFor(logging.DEBUG):
-            popen_list.append('-v')
-            popen_list.extend(['-d', 'config'])
-        else:
-            popen_list.append('-Q')
-        proc = subprocess.Popen(popen_list)
-        if proc.wait() != 0:
-            raise RuntimeError("configuration test failed")
-        self._log.info("config ok: %s", self._slapd_conf)
-
-    def _start_slapd(self):
-        """
-        Spawns/forks the slapd process
-        """
-        slapd_args = [
-            self.PATH_SLAPD,
-            '-f', self._slapd_conf,
-            '-F', self.testrundir,
-            '-h', '%s' % ' '.join((self.ldap_uri, self.ldapi_uri)),
-        ]
-        if self._log.isEnabledFor(logging.DEBUG):
-            slapd_args.extend(['-d', '-1'])
-        else:
-            slapd_args.extend(['-d', '0'])
-        self._log.info('starting slapd: %r', ' '.join(slapd_args))
-        self._proc = subprocess.Popen(slapd_args)
-        # Waits until the LDAP server socket is open, or slapd crashed
-        while 1:
-            if self._proc.poll() is not None:
-                self._stopped()
-                raise RuntimeError("slapd exited before opening port")
-            time.sleep(self._start_sleep)
-            try:
-                self._log.debug("slapd connection check to %s", self.ldapi_uri)
-                self.ldapwhoami()
-            except RuntimeError:
-                pass
-            else:
-                return
-
-    def start(self):
-        """
-        Starts the slapd server process running, and waits for it to come up.
-        """
-
-        if self._proc is None:
-            self._check_requirements()
-            # prepare directory structure
-            atexit.register(self.stop)
-            self._cleanup_rundir()
-            self.setup_rundir()
-            self._write_config()
-            self._test_config()
-            self._start_slapd()
-            self._log.debug(
-                'slapd with pid=%d listening on %s and %s',
-                self._proc.pid, self.ldap_uri, self.ldapi_uri
-            )
-
-    def stop(self):
-        """
-        Stops the slapd server, and waits for it to terminate and cleans up
-        """
-        if self._proc is not None:
-            self._log.debug('stopping slapd with pid %d', self._proc.pid)
-            self._proc.terminate()
-            self.wait()
-        self._cleanup_rundir()
-        if hasattr(atexit, 'unregister'):
-            # Python 3
-            atexit.unregister(self.stop)
-        elif hasattr(atexit, '_exithandlers'):
-            # Python 2, can be None during process shutdown
-            try:
-                atexit._exithandlers.remove(self.stop)
-            except ValueError:
-                pass
-
-    def restart(self):
-        """
-        Restarts the slapd server with same data
-        """
-        self._proc.terminate()
-        self.wait()
-        self._start_slapd()
-
-    def wait(self):
-        """Waits for the slapd process to terminate by itself."""
-        if self._proc:
-            self._proc.wait()
-            self._stopped()
-
-    def _stopped(self):
-        """Called when the slapd server is known to have terminated"""
-        if self._proc is not None:
-            self._log.info('slapd[%d] terminated', self._proc.pid)
-            self._proc = None
-
-    def _cli_auth_args(self):
-        if self.cli_sasl_external:
-            authc_args = [
-                '-Y', 'EXTERNAL',
-            ]
-            if not self._log.isEnabledFor(logging.DEBUG):
-                authc_args.append('-Q')
-        else:
-            authc_args = [
-                '-x',
-                '-D', self.root_dn,
-                '-w', self.root_pw,
-            ]
-        return authc_args
-
-    def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None, stdin_data=None):
-        args = [
-            ldapcommand,
-            '-H', ldap_uri or self.ldapi_uri,
-        ] + self._cli_auth_args() + (extra_args or [])
-        self._log.debug('Run command: %r', ' '.join(args))
-        proc = subprocess.Popen(
-            args, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE
-        )
-        self._log.debug('stdin_data=%r', stdin_data)
-        stdout_data, stderr_data = proc.communicate(stdin_data)
-        if stdout_data is not None:
-            self._log.debug('stdout_data=%r', stdout_data)
-        if stderr_data is not None:
-            self._log.debug('stderr_data=%r', stderr_data)
-        if proc.wait() != 0:
-            raise RuntimeError(
-                '{!r} process failed:\n{!r}\n{!r}'.format(
-                    args, stdout_data, stderr_data
-                )
-            )
-        return stdout_data, stderr_data
-
-    def ldapwhoami(self, extra_args=None):
-        """
-        Runs ldapwhoami on this slapd instance
-        """
-        self._cli_popen(self.PATH_LDAPWHOAMI, extra_args=extra_args)
-
-    def ldapadd(self, ldif, extra_args=None):
-        """
-        Runs ldapadd on this slapd instance, passing it the ldif content
-        """
-        self._cli_popen(self.PATH_LDAPADD, extra_args=extra_args,
-                        stdin_data=ldif.encode('utf-8'))
-
-    def ldapmodify(self, ldif, extra_args=None):
-        """
-        Runs ldapadd on this slapd instance, passing it the ldif content
-        """
-        self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args,
-                        stdin_data=ldif.encode('utf-8'))
-
-    def ldapdelete(self, dn, recursive=False, extra_args=None):
-        """
-        Runs ldapdelete on this slapd instance, deleting 'dn'
-        """
-        if extra_args is None:
-            extra_args = []
-        if recursive:
-            extra_args.append('-r')
-        extra_args.append(dn)
-        self._cli_popen(self.PATH_LDAPDELETE, extra_args=extra_args)
-
-
-class SlapdTestCase(unittest.TestCase):
-    """
-    test class which also clones or initializes a running slapd
-    """
-
-    server_class = SlapdObject
-    server = None
-    ldap_object_class = None
-
-    def _open_ldap_conn(self, who=None, cred=None, **kwargs):
-        """
-        return a LDAPObject instance after simple bind
-        """
-        ldap_conn = self.ldap_object_class(self.server.ldap_uri, **kwargs)
-        ldap_conn.protocol_version = 3
-        #ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
-        ldap_conn.simple_bind_s(who or self.server.root_dn, cred or self.server.root_pw)
-        return ldap_conn
-
-    @classmethod
-    def setUpClass(cls):
-        cls.server = cls.server_class()
-        cls.server.start()
-        cls.server = cls.server
-
-    @classmethod
-    def tearDownClass(cls):
-        cls.server.stop()
+from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
+from slapdtest._slapdtest import skip_unless_ci, requires_tls
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
new file mode 100644
index 0000000..884a1ee
--- /dev/null
+++ b/Lib/slapdtest/_slapdtest.py
@@ -0,0 +1,512 @@
+# -*- coding: utf-8 -*-
+"""
+slapdtest - module for spawning test instances of OpenLDAP's slapd server
+
+See https://www.python-ldap.org/ for details.
+"""
+
+from __future__ import unicode_literals
+
+import os
+import socket
+import time
+import subprocess
+import logging
+import atexit
+from logging.handlers import SysLogHandler
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
+from ldap.compat import quote_plus
+
+HERE = os.path.abspath(os.path.dirname(__file__))
+
+# a template string for generating simple slapd.conf file
+SLAPD_CONF_TEMPLATE = r"""
+serverID %(serverid)s
+moduleload back_%(database)s
+include "%(schema_prefix)s/core.schema"
+loglevel %(loglevel)s
+allow bind_v2
+
+authz-regexp
+  "gidnumber=%(root_gid)s\\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth"
+  "%(rootdn)s"
+
+database %(database)s
+directory "%(directory)s"
+suffix "%(suffix)s"
+rootdn "%(rootdn)s"
+rootpw "%(rootpw)s"
+
+TLSCACertificateFile "%(cafile)s"
+TLSCertificateFile "%(servercert)s"
+TLSCertificateKeyFile "%(serverkey)s"
+# ignore missing client cert but fail with invalid client cert
+TLSVerifyClient try
+
+authz-regexp
+    "C=DE, O=python-ldap, OU=slapd-test, CN=([A-Za-z]+)"
+    "ldap://ou=people,dc=local???($1)"
+
+"""
+
+LOCALHOST = '127.0.0.1'
+
+
+def identity(test_item):
+    """Identity decorator
+
+    """
+    return test_item
+
+
+def skip_unless_travis(reason):
+    """Skip test unless test case is executed on CI like Travis CI
+    """
+    if os.environ.get('CI', False):
+        return identity
+    else:
+        return unittest.skip(reason)
+
+
+def requires_tls(skip_nss=False):
+    """Decorator for TLS tests
+
+    Tests are not skipped on CI (e.g. Travis CI)
+    
+    :param skip_nss: Skip test when libldap is compiled with NSS as TLS lib
+    """
+    if not ldap.TLS_AVAIL:
+        return skip_unless_travis("test needs ldap.TLS_AVAIL")
+    elif skip_nss and ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS':
+        return skip_unless_travis(
+            "Test doesn't work correctly with Mozilla NSS, see "
+            "https://bugzilla.redhat.com/show_bug.cgi?id=1519167"
+        )
+    else:
+        return identity
+
+
+def combined_logger(
+        log_name,
+        log_level=logging.WARN,
+        sys_log_format='%(levelname)s %(message)s',
+        console_log_format='%(asctime)s %(levelname)s %(message)s',
+    ):
+    """
+    Returns a combined SysLogHandler/StreamHandler logging instance
+    with formatters
+    """
+    if 'LOGLEVEL' in os.environ:
+        log_level = os.environ['LOGLEVEL']
+        try:
+            log_level = int(log_level)
+        except ValueError:
+            pass
+    # for writing to syslog
+    new_logger = logging.getLogger(log_name)
+    if sys_log_format and os.path.exists('/dev/log'):
+        my_syslog_formatter = logging.Formatter(
+            fmt=' '.join((log_name, sys_log_format)))
+        my_syslog_handler = logging.handlers.SysLogHandler(
+            address='/dev/log',
+            facility=SysLogHandler.LOG_DAEMON,
+        )
+        my_syslog_handler.setFormatter(my_syslog_formatter)
+        new_logger.addHandler(my_syslog_handler)
+    if console_log_format:
+        my_stream_formatter = logging.Formatter(fmt=console_log_format)
+        my_stream_handler = logging.StreamHandler()
+        my_stream_handler.setFormatter(my_stream_formatter)
+        new_logger.addHandler(my_stream_handler)
+    new_logger.setLevel(log_level)
+    return new_logger  # end of combined_logger()
+
+
+class SlapdObject(object):
+    """
+    Controller class for a slapd instance, OpenLDAP's server.
+
+    This class creates a temporary data store for slapd, runs it
+    listening on a private Unix domain socket and TCP port,
+    and initializes it with a top-level entry and the root user.
+
+    When a reference to an instance of this class is lost, the slapd
+    server is shut down.
+    """
+    slapd_conf_template = SLAPD_CONF_TEMPLATE
+    database = 'mdb'
+    suffix = 'dc=slapd-test,dc=python-ldap,dc=org'
+    root_cn = 'Manager'
+    root_dn = 'cn=%s,%s' % (root_cn, suffix)
+    root_pw = 'password'
+    slapd_loglevel = 'stats stats2'
+    # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
+    cli_sasl_external = True
+    local_host = '127.0.0.1'
+    testrunsubdirs = (
+        'schema',
+    )
+    openldap_schema_files = (
+        'core.schema',
+    )
+
+    TMPDIR = os.environ.get('TMP', os.getcwd())
+    SBINDIR = os.environ.get('SBIN', '/usr/sbin')
+    BINDIR = os.environ.get('BIN', '/usr/bin')
+    if 'SCHEMA' in os.environ:
+        SCHEMADIR = os.environ['SCHEMA']
+    elif os.path.isdir("/etc/openldap/schema"):
+        SCHEMADIR = "/etc/openldap/schema"
+    elif os.path.isdir("/etc/ldap/schema"):
+        SCHEMADIR = "/etc/ldap/schema"
+    else:
+        SCHEMADIR = None
+    PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
+    PATH_LDAPDELETE = os.path.join(BINDIR, 'ldapdelete')
+    PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
+    PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
+    PATH_SLAPD = os.environ.get('SLAPD', os.path.join(SBINDIR, 'slapd'))
+    PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
+
+    # time in secs to wait before trying to access slapd via LDAP (again)
+    _start_sleep = 1.5
+
+    # create loggers once, multiple calls mess up refleak tests
+    _log = combined_logger('python-ldap-test')
+
+    def __init__(self):
+        self._proc = None
+        self._port = self._avail_tcp_port()
+        self.server_id = self._port % 4096
+        self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test-%d' % self._port)
+        self._schema_prefix = os.path.join(self.testrundir, 'schema')
+        self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
+        self._db_directory = os.path.join(self.testrundir, "openldap-data")
+        self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
+        ldapi_path = os.path.join(self.testrundir, 'ldapi')
+        self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
+        # TLS certs
+        self.cafile = os.path.join(HERE, 'certs/ca.pem')
+        self.servercert = os.path.join(HERE, 'certs/server.pem')
+        self.serverkey = os.path.join(HERE, 'certs/server.key')
+        self.clientcert = os.path.join(HERE, 'certs/client.pem')
+        self.clientkey = os.path.join(HERE, 'certs/client.key')
+
+    def _check_requirements(self):
+        binaries = [
+            self.PATH_LDAPADD, self.PATH_LDAPMODIFY, self.PATH_LDAPWHOAMI,
+            self.PATH_SLAPD, self.PATH_SLAPTEST
+        ]
+        for binary in binaries:
+            if not os.path.isfile(binary):
+                raise ValueError('Binary {} is missing.'.format(binary))
+        if self.SCHEMADIR is None:
+            raise ValueError('SCHEMADIR is None, ldap schemas are missing.')
+
+    def setup_rundir(self):
+        """
+        creates rundir structure
+
+        for setting up a custom directory structure you have to override
+        this method
+        """
+        os.mkdir(self.testrundir)
+        os.mkdir(self._db_directory)
+        self._create_sub_dirs(self.testrunsubdirs)
+        self._ln_schema_files(self.openldap_schema_files, self.SCHEMADIR)
+
+    def _cleanup_rundir(self):
+        """
+        Recursively delete whole directory specified by `path'
+        """
+        # cleanup_rundir() is called in atexit handler. Until Python 3.4,
+        # the rest of the world is already destroyed.
+        import os, os.path
+        if not os.path.exists(self.testrundir):
+            return
+        self._log.debug('clean-up %s', self.testrundir)
+        for dirpath, dirnames, filenames in os.walk(
+                self.testrundir,
+                topdown=False
+            ):
+            for filename in filenames:
+                self._log.debug('remove %s', os.path.join(dirpath, filename))
+                os.remove(os.path.join(dirpath, filename))
+            for dirname in dirnames:
+                self._log.debug('rmdir %s', os.path.join(dirpath, dirname))
+                os.rmdir(os.path.join(dirpath, dirname))
+        os.rmdir(self.testrundir)
+        self._log.info('cleaned-up %s', self.testrundir)
+
+    def _avail_tcp_port(self):
+        """
+        find an available port for TCP connection
+        """
+        sock = socket.socket()
+        try:
+            sock.bind((self.local_host, 0))
+            port = sock.getsockname()[1]
+        finally:
+            sock.close()
+        self._log.info('Found available port %d', port)
+        return port
+
+    def gen_config(self):
+        """
+        generates a slapd.conf and returns it as one string
+
+        for generating specific static configuration files you have to
+        override this method
+        """
+        config_dict = {
+            'serverid': hex(self.server_id),
+            'schema_prefix':self._schema_prefix,
+            'loglevel': self.slapd_loglevel,
+            'database': self.database,
+            'directory': self._db_directory,
+            'suffix': self.suffix,
+            'rootdn': self.root_dn,
+            'rootpw': self.root_pw,
+            'root_uid': os.getuid(),
+            'root_gid': os.getgid(),
+            'cafile': self.cafile,
+            'servercert': self.servercert,
+            'serverkey': self.serverkey,
+        }
+        return self.slapd_conf_template % config_dict
+
+    def _create_sub_dirs(self, dir_names):
+        """
+        create sub-directories beneath self.testrundir
+        """
+        for dname in dir_names:
+            dir_name = os.path.join(self.testrundir, dname)
+            self._log.debug('Create directory %s', dir_name)
+            os.mkdir(dir_name)
+
+    def _ln_schema_files(self, file_names, source_dir):
+        """
+        write symbolic links to original schema files
+        """
+        for fname in file_names:
+            ln_source = os.path.join(source_dir, fname)
+            ln_target = os.path.join(self._schema_prefix, fname)
+            self._log.debug('Create symlink %s -> %s', ln_source, ln_target)
+            os.symlink(ln_source, ln_target)
+
+    def _write_config(self):
+        """Writes the slapd.conf file out, and returns the path to it."""
+        self._log.debug('Writing config to %s', self._slapd_conf)
+        with open(self._slapd_conf, 'w') as config_file:
+            config_file.write(self.gen_config())
+        self._log.info('Wrote config to %s', self._slapd_conf)
+
+    def _test_config(self):
+        self._log.debug('testing config %s', self._slapd_conf)
+        popen_list = [
+            self.PATH_SLAPTEST,
+            "-f", self._slapd_conf,
+            '-u',
+        ]
+        if self._log.isEnabledFor(logging.DEBUG):
+            popen_list.append('-v')
+            popen_list.extend(['-d', 'config'])
+        else:
+            popen_list.append('-Q')
+        proc = subprocess.Popen(popen_list)
+        if proc.wait() != 0:
+            raise RuntimeError("configuration test failed")
+        self._log.info("config ok: %s", self._slapd_conf)
+
+    def _start_slapd(self):
+        """
+        Spawns/forks the slapd process
+        """
+        slapd_args = [
+            self.PATH_SLAPD,
+            '-f', self._slapd_conf,
+            '-F', self.testrundir,
+            '-h', '%s' % ' '.join((self.ldap_uri, self.ldapi_uri)),
+        ]
+        if self._log.isEnabledFor(logging.DEBUG):
+            slapd_args.extend(['-d', '-1'])
+        else:
+            slapd_args.extend(['-d', '0'])
+        self._log.info('starting slapd: %r', ' '.join(slapd_args))
+        self._proc = subprocess.Popen(slapd_args)
+        # Waits until the LDAP server socket is open, or slapd crashed
+        while 1:
+            if self._proc.poll() is not None:
+                self._stopped()
+                raise RuntimeError("slapd exited before opening port")
+            time.sleep(self._start_sleep)
+            try:
+                self._log.debug("slapd connection check to %s", self.ldapi_uri)
+                self.ldapwhoami()
+            except RuntimeError:
+                pass
+            else:
+                return
+
+    def start(self):
+        """
+        Starts the slapd server process running, and waits for it to come up.
+        """
+
+        if self._proc is None:
+            self._check_requirements()
+            # prepare directory structure
+            atexit.register(self.stop)
+            self._cleanup_rundir()
+            self.setup_rundir()
+            self._write_config()
+            self._test_config()
+            self._start_slapd()
+            self._log.debug(
+                'slapd with pid=%d listening on %s and %s',
+                self._proc.pid, self.ldap_uri, self.ldapi_uri
+            )
+
+    def stop(self):
+        """
+        Stops the slapd server, and waits for it to terminate and cleans up
+        """
+        if self._proc is not None:
+            self._log.debug('stopping slapd with pid %d', self._proc.pid)
+            self._proc.terminate()
+            self.wait()
+        self._cleanup_rundir()
+        if hasattr(atexit, 'unregister'):
+            # Python 3
+            atexit.unregister(self.stop)
+        elif hasattr(atexit, '_exithandlers'):
+            # Python 2, can be None during process shutdown
+            try:
+                atexit._exithandlers.remove(self.stop)
+            except ValueError:
+                pass
+
+    def restart(self):
+        """
+        Restarts the slapd server with same data
+        """
+        self._proc.terminate()
+        self.wait()
+        self._start_slapd()
+
+    def wait(self):
+        """Waits for the slapd process to terminate by itself."""
+        if self._proc:
+            self._proc.wait()
+            self._stopped()
+
+    def _stopped(self):
+        """Called when the slapd server is known to have terminated"""
+        if self._proc is not None:
+            self._log.info('slapd[%d] terminated', self._proc.pid)
+            self._proc = None
+
+    def _cli_auth_args(self):
+        if self.cli_sasl_external:
+            authc_args = [
+                '-Y', 'EXTERNAL',
+            ]
+            if not self._log.isEnabledFor(logging.DEBUG):
+                authc_args.append('-Q')
+        else:
+            authc_args = [
+                '-x',
+                '-D', self.root_dn,
+                '-w', self.root_pw,
+            ]
+        return authc_args
+
+    def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None, stdin_data=None):
+        args = [
+            ldapcommand,
+            '-H', ldap_uri or self.ldapi_uri,
+        ] + self._cli_auth_args() + (extra_args or [])
+        self._log.debug('Run command: %r', ' '.join(args))
+        proc = subprocess.Popen(
+            args, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE
+        )
+        self._log.debug('stdin_data=%r', stdin_data)
+        stdout_data, stderr_data = proc.communicate(stdin_data)
+        if stdout_data is not None:
+            self._log.debug('stdout_data=%r', stdout_data)
+        if stderr_data is not None:
+            self._log.debug('stderr_data=%r', stderr_data)
+        if proc.wait() != 0:
+            raise RuntimeError(
+                '{!r} process failed:\n{!r}\n{!r}'.format(
+                    args, stdout_data, stderr_data
+                )
+            )
+        return stdout_data, stderr_data
+
+    def ldapwhoami(self, extra_args=None):
+        """
+        Runs ldapwhoami on this slapd instance
+        """
+        self._cli_popen(self.PATH_LDAPWHOAMI, extra_args=extra_args)
+
+    def ldapadd(self, ldif, extra_args=None):
+        """
+        Runs ldapadd on this slapd instance, passing it the ldif content
+        """
+        self._cli_popen(self.PATH_LDAPADD, extra_args=extra_args,
+                        stdin_data=ldif.encode('utf-8'))
+
+    def ldapmodify(self, ldif, extra_args=None):
+        """
+        Runs ldapadd on this slapd instance, passing it the ldif content
+        """
+        self._cli_popen(self.PATH_LDAPMODIFY, extra_args=extra_args,
+                        stdin_data=ldif.encode('utf-8'))
+
+    def ldapdelete(self, dn, recursive=False, extra_args=None):
+        """
+        Runs ldapdelete on this slapd instance, deleting 'dn'
+        """
+        if extra_args is None:
+            extra_args = []
+        if recursive:
+            extra_args.append('-r')
+        extra_args.append(dn)
+        self._cli_popen(self.PATH_LDAPDELETE, extra_args=extra_args)
+
+
+class SlapdTestCase(unittest.TestCase):
+    """
+    test class which also clones or initializes a running slapd
+    """
+
+    server_class = SlapdObject
+    server = None
+    ldap_object_class = None
+
+    def _open_ldap_conn(self, who=None, cred=None, **kwargs):
+        """
+        return a LDAPObject instance after simple bind
+        """
+        ldap_conn = self.ldap_object_class(self.server.ldap_uri, **kwargs)
+        ldap_conn.protocol_version = 3
+        #ldap_conn.set_option(ldap.OPT_REFERRALS, 0)
+        ldap_conn.simple_bind_s(who or self.server.root_dn, cred or self.server.root_pw)
+        return ldap_conn
+
+    @classmethod
+    def setUpClass(cls):
+        cls.server = cls.server_class()
+        cls.server.start()
+        cls.server = cls.server
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.stop()

From 53fd80a2da59520391e738634f7191e3973a427e Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 1 Dec 2017 18:03:40 +0100
Subject: [PATCH 659/868] slapdtest: Use "CI" instead of "Travis" in function
 name

We want this to work on any kind of CI, not just the one we use now.
---
 Lib/slapdtest/_slapdtest.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 884a1ee..2900581 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -64,7 +64,7 @@ def identity(test_item):
     return test_item
 
 
-def skip_unless_travis(reason):
+def skip_unless_ci(reason):
     """Skip test unless test case is executed on CI like Travis CI
     """
     if os.environ.get('CI', False):
@@ -81,9 +81,9 @@ def requires_tls(skip_nss=False):
     :param skip_nss: Skip test when libldap is compiled with NSS as TLS lib
     """
     if not ldap.TLS_AVAIL:
-        return skip_unless_travis("test needs ldap.TLS_AVAIL")
+        return skip_unless_ci("test needs ldap.TLS_AVAIL")
     elif skip_nss and ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS':
-        return skip_unless_travis(
+        return skip_unless_ci(
             "Test doesn't work correctly with Mozilla NSS, see "
             "https://bugzilla.redhat.com/show_bug.cgi?id=1519167"
         )

From 04e6f18eed7e2453dc5639bcac09c5182d2626e1 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 4 Dec 2017 11:10:55 +0100
Subject: [PATCH 660/868] Announce that slapdtest is now a package

---
 CHANGES | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index b64c263..05283bf 100644
--- a/CHANGES
+++ b/CHANGES
@@ -70,10 +70,11 @@ and, thanks to Michael Ströder:
 * module ldif now uses functions b64encode() and b64decode()
 * fixed pickling and restoring of ReconnectLDAPObject
 
-Lib/slapdtest.py
+Lib/slapdtest
 * Automatically try some common locations for SCHEMADIR
 * Ensure server is stopped when the process exits
 * Check for LDAP schema and slapd binaries
+* slapdtest is now a package and includes testing certificates
 
 Tests/
 * Expand cidict membership test

From 9524dd362fb70d9d5bfdd75694c0b6a8c17fa4f1 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 11:32:11 +0100
Subject: [PATCH 661/868] Fix memory leak in whoami_s

l_ldap_whoami_s() did not free the berval struct from ldap_whoami_s().

https://github.com/python-ldap/python-ldap/pull/84
Closes: https://github.com/python-ldap/python-ldap/issues/80
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 CHANGES              | 1 +
 Modules/LDAPObject.c | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index b64c263..dfe4e4d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -33,6 +33,7 @@ Modules/
 * Fix multiple ref leaks in error-handling code
 * Fix reference leak in result4
 * Fix several compiler warnings
+* Fix memory leak in whoami
 and, thanks to Michael Ströder:
 * removed unused code schema.c
 * moved code from version.c to ldapmodule.c
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 8c90a65..815fe42 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1227,10 +1227,13 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
     LDAPControl_List_DEL( server_ldcs );
     LDAPControl_List_DEL( client_ldcs );
 
-    if ( ldaperror!=LDAP_SUCCESS )
+    if ( ldaperror!=LDAP_SUCCESS ) {
+        ber_bvfree(bvalue);
         return LDAPerror( self->ldap, "ldap_whoami_s" );
+    }
 
     result = LDAPberval_to_unicode_object(bvalue);
+    ber_bvfree(bvalue);
 
     return result;
 }

From c86b8e9419db8d7b7752fc0a6d8bb79c9da6ba41 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 11:51:03 +0100
Subject: [PATCH 662/868] Fix error handling of LDAPControl_to_List() (#89)

LDAPControls_to_List() may have returned a partly filled list
in case Py_BuildValue() fails.
In case of an error, DECREF the list and return NULL.

https://github.com/python-ldap/python-ldap/pull/89
Closes: https://github.com/python-ldap/python-ldap/issues/22
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 CHANGES               |  1 +
 Modules/ldapcontrol.c | 21 ++++++++++-----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 58dbde9..6cbb845 100644
--- a/CHANGES
+++ b/CHANGES
@@ -34,6 +34,7 @@ Modules/
 * Fix reference leak in result4
 * Fix several compiler warnings
 * Fix memory leak in whoami
+* Fix internal error handling of LDAPControl_to_List()
 and, thanks to Michael Ströder:
 * removed unused code schema.c
 * moved code from version.c to ldapmodule.c
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 7d8fbe3..5cd30f9 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -172,22 +172,21 @@ LDAPControls_to_List(LDAPControl **ldcs)
     if (tmp)
         while (*tmp++) num_ctrls++;
 
-    if (!(res = PyList_New(num_ctrls)))
-        goto endlbl;
+    if ((res = PyList_New(num_ctrls)) == NULL) {
+        return NULL;
+    }
 
     for (i = 0; i < num_ctrls; i++) {
-        if (!(pyctrl = Py_BuildValue("sbO&", ldcs[i]->ldctl_oid,
-                                     ldcs[i]->ldctl_iscritical,
-                                     LDAPberval_to_object,
-                                     &ldcs[i]->ldctl_value))) {
-            goto endlbl;
+        pyctrl = Py_BuildValue("sbO&",
+                               ldcs[i]->ldctl_oid,
+                               ldcs[i]->ldctl_iscritical,
+                               LDAPberval_to_object, &ldcs[i]->ldctl_value);
+        if (pyctrl == NULL) {
+            Py_DECREF(res);
+            return NULL;
         }
         PyList_SET_ITEM(res, i, pyctrl);
     }
-    Py_INCREF(res);
-
- endlbl:
-    Py_XDECREF(res);
     return res;
 }
 

From 9f86c0653fe3944ce7aea14a2f34afc91c84521d Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 11:51:03 +0100
Subject: [PATCH 663/868] Fix two memory leaks in encode_assertion_control

encode_assertion_control was leaking a LDAP* struct and BER data values
on every call. Both data structures are now properly freed and the GIL
is released around ldap_create() and ldap_unbind_s().

Closes: https://github.com/python-ldap/python-ldap/issues/79
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 CHANGES               |  1 +
 Modules/ldapcontrol.c | 25 ++++++++++++++++++++-----
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6cbb845..884c1d0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -35,6 +35,7 @@ Modules/
 * Fix several compiler warnings
 * Fix memory leak in whoami
 * Fix internal error handling of LDAPControl_to_List()
+* Fix two memory leaks and release GIL in encode_assertion_control
 and, thanks to Michael Ströder:
 * removed unused code schema.c
 * moved code from version.c to ldapmodule.c
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 5cd30f9..9522d57 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -343,16 +343,33 @@ encode_assertion_control(PyObject *self, PyObject *args)
         goto endlbl;
     }
 
+    /* XXX: ldap_create() is a nasty and slow hack. It's creating a full blown
+     * LDAP object just to encode assertion controls.
+     */
+    Py_BEGIN_ALLOW_THREADS
     err = ldap_create(&ld);
+    Py_END_ALLOW_THREADS
+
     if (err != LDAP_SUCCESS)
     	return LDAPerror(ld, "ldap_create");
 
     err = ldap_create_assertion_control_value(ld,assertion_filterstr,&ctrl_val);
-    if (err != LDAP_SUCCESS)
-    	return LDAPerror(ld, "ldap_create_assertion_control_value");
 
-    res = LDAPberval_to_object(&ctrl_val);
+    if (err != LDAP_SUCCESS) {
+        LDAPerror(ld, "ldap_create_assertion_control_value");
+        Py_BEGIN_ALLOW_THREADS
+        ldap_unbind_ext(ld, NULL, NULL);
+        Py_END_ALLOW_THREADS
+        return NULL;
+    }
+    Py_BEGIN_ALLOW_THREADS
+    ldap_unbind_ext(ld, NULL, NULL);
+    Py_END_ALLOW_THREADS
 
+    res = LDAPberval_to_object(&ctrl_val);
+    if (ctrl_val.bv_val != NULL) {
+        ber_memfree(ctrl_val.bv_val);
+    }
     endlbl:
 
     return res;
@@ -371,5 +388,3 @@ LDAPinit_control(PyObject *d)
 {
     LDAPadd_methods(d, methods);
 }
-
-

From c5ad8025632fb5e5e84cced5a0f8c7ddda1e8dae Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 13:33:27 +0100
Subject: [PATCH 664/868] Run tests without SASL and TLS bindings

Also fixes tests when _ldap extension is compiled without SASL support.

https://github.com/python-ldap/python-ldap/pull/91
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml                 |  8 ++++++++
 Doc/contributing.rst        |  2 ++
 Lib/slapdtest/__init__.py   |  2 +-
 Lib/slapdtest/_slapdtest.py | 24 ++++++++++++++++++------
 Tests/t_cext.py             | 15 +++++++++++++++
 Tests/t_ldap_sasl.py        |  3 ++-
 Tests/t_ldapobject.py       |  4 +++-
 tox.ini                     | 24 +++++++++++++++++++++++-
 8 files changed, 72 insertions(+), 10 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index ad9cd96..960f6db 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -34,6 +34,14 @@ matrix:
       env:
         - TOXENV=py36
         - WITH_GCOV=1
+    - python: 2.7
+      env:
+        - TOXENV=py2-nosasltls
+        - WITH_GCOV=1
+    - python: 3.6
+      env:
+        - TOXENV=py3-nosasltls
+        - WITH_GCOV=1
     - python: 3.6
       env: TOXENV=doc
 
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index 3a904d3..aa6097d 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -146,6 +146,8 @@ for checking things independent of the Python version:
 * ``doc`` checks syntax and spelling of the documentation
 * ``coverage-report`` generates a test coverage report for Python code.
   It must be used last, e.g. ``tox -e py27,py36,coverage-report``.
+* ``py2-nosasltls`` and ``py3-nosasltls`` check functionality without
+  SASL and TLS bindings compiled in.
 
 
 When your change is ready, commit to Git, and submit a pull request on GitHub.
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index a1acd2b..d7d19fd 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -8,4 +8,4 @@
 __version__ = '3.0.0b1'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
-from slapdtest._slapdtest import skip_unless_ci, requires_tls
+from slapdtest._slapdtest import skip_unless_ci, requires_sasl, requires_tls
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 2900581..5ba6464 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -64,13 +64,16 @@ def identity(test_item):
     return test_item
 
 
-def skip_unless_ci(reason):
+def skip_unless_ci(reason, feature=None):
     """Skip test unless test case is executed on CI like Travis CI
     """
-    if os.environ.get('CI', False):
-        return identity
-    else:
+    if not os.environ.get('CI', False):
+        return unittest.skip(reason)
+    elif feature in os.environ.get('CI_DISABLED', '').split(':'):
         return unittest.skip(reason)
+    else:
+        # Don't skip on Travis
+        return identity
 
 
 def requires_tls(skip_nss=False):
@@ -81,16 +84,25 @@ def requires_tls(skip_nss=False):
     :param skip_nss: Skip test when libldap is compiled with NSS as TLS lib
     """
     if not ldap.TLS_AVAIL:
-        return skip_unless_ci("test needs ldap.TLS_AVAIL")
+        return skip_unless_ci("test needs ldap.TLS_AVAIL", feature='TLS')
     elif skip_nss and ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS':
         return skip_unless_ci(
             "Test doesn't work correctly with Mozilla NSS, see "
-            "https://bugzilla.redhat.com/show_bug.cgi?id=1519167"
+            "https://bugzilla.redhat.com/show_bug.cgi?id=1519167",
+            feature="NSS"
         )
     else:
         return identity
 
 
+def requires_sasl():
+    if not ldap.SASL_AVAIL:
+        return skip_unless_ci(
+            "test needs ldap.SASL_AVAIL", feature='SASL')
+    else:
+        return identity
+
+
 def combined_logger(
         log_name,
         log_level=logging.WARN,
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index be858e9..4ef5d0e 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -212,6 +212,21 @@ def test_constants(self):
         self.assertNotNone(_ldap.URL_ERR_BADSCOPE)
         self.assertNotNone(_ldap.URL_ERR_MEM)
 
+    def test_test_flags(self):
+        # test flag, see slapdtest and tox.ini
+        disabled = os.environ.get('CI_DISABLED')
+        if not disabled:
+            self.skipTest("No CI_DISABLED env var")
+        disabled = set(disabled.split(':'))
+        if 'TLS' in disabled:
+            self.assertFalse(_ldap.TLS_AVAIL)
+        else:
+            self.assertFalse(_ldap.TLS_AVAIL)
+        if 'SASL' in disabled:
+            self.assertFalse(_ldap.SASL_AVAIL)
+        else:
+            self.assertFalse(_ldap.SASL_AVAIL)
+
     def test_simple_bind(self):
         l = self._open_conn()
 
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index 9acd051..2fa4dbc 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -14,7 +14,7 @@
 
 from ldap.ldapobject import SimpleLDAPObject
 import ldap.sasl
-from slapdtest import SlapdTestCase, requires_tls
+from slapdtest import SlapdTestCase, requires_sasl, requires_tls
 
 
 LDIF = """
@@ -39,6 +39,7 @@
 """
 
 
+@requires_sasl()
 class TestSasl(SlapdTestCase):
     ldap_object_class = SimpleLDAPObject
     # from Tests/certs/client.pem
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index d55d018..9b6a090 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -19,7 +19,7 @@
 import os
 import unittest
 import pickle
-from slapdtest import SlapdTestCase
+from slapdtest import SlapdTestCase, requires_sasl
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -298,6 +298,7 @@ def test005_invalid_credentials(self):
         else:
             self.fail("expected INVALID_CREDENTIALS, got %r" % r)
 
+    @requires_sasl()
     def test006_sasl_extenal_bind_s(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s()
@@ -322,6 +323,7 @@ class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
 
     ldap_object_class = ReconnectLDAPObject
 
+    @requires_sasl()
     def test101_reconnect_sasl_external(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s()
diff --git a/tox.ini b/tox.ini
index 51f8981..6d984c0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,8 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py33,py34,py35,py36,doc,coverage-report
+envlist = py27,py33,py34,py35,py36,{py2,py3}-nosasltls,doc,coverage-report
+minver = 1.8
 
 [testenv]
 deps = coverage
@@ -21,9 +22,30 @@ commands = {envpython} -bb -Werror \
 
 [testenv:py27]
 # No warnings with Python 2.7
+passenv = {[testenv]passenv}
 commands = {envpython} \
     -m coverage run --parallel setup.py test
 
+[testenv:py2-nosasltls]
+basepython = python2
+deps = {[testenv]deps}
+passenv = {[testenv]passenv}
+setenv =
+    CI_DISABLED=TLS:SASL
+# rebuild without SASL and TLS
+commands = {envpython} \
+    -m coverage run --parallel setup.py \
+        clean --all \
+        build_ext -UHAVE_SASL,HAVE_TLS \
+        test
+
+[testenv:py3-nosasltls]
+basepython = python3
+deps = {[testenv]deps}
+passenv = {[testenv]passenv}
+setenv = {[testenv:py2-nosasltls]setenv}
+commands = {[testenv:py2-nosasltls]commands}
+
 [testenv:coverage-report]
 deps = coverage
 skip_install = true

From 6f5320597a3043e0cd6c6f4f4ce492a59aca8917 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 13:28:29 +0100
Subject: [PATCH 665/868] Modules: Use LDAPControls_to_List in LDAP_get_option
 instead of inlining it

---
 Modules/options.c | 26 +++-----------------------
 1 file changed, 3 insertions(+), 23 deletions(-)

diff --git a/Modules/options.c b/Modules/options.c
index ac1eab6..f5bae42 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -180,10 +180,9 @@ LDAP_get_option(LDAPObject *self, int option)
     struct timeval *tv;
     LDAPAPIInfo apiinfo;
     LDAPControl **lcs;
-    LDAPControl *lc;
     char *strval;
-    PyObject *extensions, *v, *tup;
-    Py_ssize_t i, num_extensions, num_controls;
+    PyObject *extensions, *v;
+    Py_ssize_t i, num_extensions;
     LDAP *ld;
 
     ld = self ? self->ldap : NULL;
@@ -352,27 +351,8 @@ LDAP_get_option(LDAPObject *self, int option)
 	    if (res != LDAP_OPT_SUCCESS)
 		return option_error(res, "ldap_get_option");
 
-            if (lcs == NULL)
-                return PyList_New(0);
-            
-            /* Get the number of controls */
-            num_controls = 0;
-            while (lcs[num_controls])
-                num_controls++;
-
-            /* We'll build a list of controls, with each control a tuple */
-            v = PyList_New(num_controls);
-            for (i = 0; i < num_controls; i++) {
-                lc = lcs[i];
-                tup = Py_BuildValue("(sbs)", 
-                                    lc->ldctl_oid,
-                                    lc->ldctl_iscritical,
-                                    lc->ldctl_value.bv_val);
-                PyList_SET_ITEM(v, i, tup);
-            }
-            
+            v = LDAPControls_to_List(lcs);
             ldap_controls_free(lcs);
-
             return v;
             
     default:

From dcb5c0052b5f83508c1c406d8ad0b23e4f5a3e6a Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sun, 3 Dec 2017 14:18:57 +0100
Subject: [PATCH 666/868] Allow set_option() to set timeout to infinity

OPT_TIMEOUT and OPT_NETWORK_TIMEOUT now support -1 to set default back
to infinity.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 CHANGES                |  1 +
 Doc/reference/ldap.rst |  6 ++++++
 Modules/options.c      | 14 ++++++++++++--
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 884c1d0..df35179 100644
--- a/CHANGES
+++ b/CHANGES
@@ -36,6 +36,7 @@ Modules/
 * Fix memory leak in whoami
 * Fix internal error handling of LDAPControl_to_List()
 * Fix two memory leaks and release GIL in encode_assertion_control
+* Allow set_option() to set timeouts to infinity
 and, thanks to Michael Ströder:
 * removed unused code schema.c
 * moved code from version.c to ldapmodule.c
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index c28cdec..1f7ae5b 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -156,6 +156,9 @@ following option identifiers are defined as constants:
 
 .. py:data:: OPT_NETWORK_TIMEOUT
 
+   .. versionchanged:: 3.0
+      A timeout of ``-1`` resets timeout to infinity.
+
 .. py:data:: OPT_PROTOCOL_VERSION
 
    Sets the LDAP protocol version used for a connection. This is mapped to
@@ -180,6 +183,9 @@ following option identifiers are defined as constants:
 
 .. py:data:: OPT_TIMEOUT
 
+   .. versionchanged:: 3.0
+      A timeout of ``-1`` resets timeout to infinity.
+
 .. py:data:: OPT_URI
 
 .. _ldap-sasl-options:
diff --git a/Modules/options.c b/Modules/options.c
index f5bae42..647f859 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -140,10 +140,20 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 	    if (!PyArg_Parse(value, "d:set_option", &doubleval))
 		return 0;
             if (doubleval >= 0) {
-	        set_timeval_from_double( &tv, doubleval );
+                set_timeval_from_double( &tv, doubleval );
+                ptr = &tv;
+            } else if (doubleval == -1) {
+                /* -1 is infinity timeout */
+                tv.tv_sec = -1;
+                tv.tv_usec = 0;
                 ptr = &tv;
             } else {
-    	        ptr = NULL;
+                PyErr_Format(
+                    PyExc_ValueError,
+                    "timeout must be >= 0 or -1 for infinity, got %d",
+                    option
+                );
+                return 0;
             }
 	    break;
     case LDAP_OPT_SERVER_CONTROLS:

From 2aa8bca4aadc6a22a7ae0075a2b3b4d56cdf24df Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 4 Dec 2017 11:17:17 +0100
Subject: [PATCH 667/868] Add tests for get/set options

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/__init__.py       |   1 +
 Tests/t_ldap_options.py | 106 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 Tests/t_ldap_options.py

diff --git a/Tests/__init__.py b/Tests/__init__.py
index 8ceb63b..d654573 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -22,3 +22,4 @@
 from . import t_ldap_schema_subentry
 from . import t_untested_mods
 from . import t_ldap_controls_libldap
+from . import t_ldap_options
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
new file mode 100644
index 0000000..798ae46
--- /dev/null
+++ b/Tests/t_ldap_options.py
@@ -0,0 +1,106 @@
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
+from ldap.controls import RequestControlTuples
+from ldap.controls.pagedresults import SimplePagedResultsControl
+from ldap.controls.openldap import SearchNoOpControl
+from slapdtest import requires_tls
+
+
+SENTINEL = object()
+
+TEST_CTRL = RequestControlTuples([
+    # with BER data
+    SimplePagedResultsControl(criticality=0, size=5, cookie=b'cookie'),
+    # value-less
+    SearchNoOpControl(criticality=1),
+])
+TEST_CTRL_EXPECTED = [
+    TEST_CTRL[0],
+    # get_option returns empty bytes
+    (TEST_CTRL[1][0], TEST_CTRL[1][1], b''),
+]
+
+
+class TestGlobalOptions(unittest.TestCase):
+    def _check_option(self, option, value, expected=SENTINEL,
+                      nonevalue=None):
+        old = ldap.get_option(option)
+        try:
+            ldap.set_option(option, value)
+            new = ldap.get_option(option)
+            if expected is SENTINEL:
+                self.assertEqual(new, value)
+            else:
+                self.assertEqual(new, expected)
+        finally:
+            ldap.set_option(option, old if old is not None else nonevalue)
+            self.assertEqual(ldap.get_option(option), old)
+
+    def test_invalid(self):
+        with self.assertRaises(ValueError):
+            ldap.get_option(-1)
+        with self.assertRaises(ValueError):
+            ldap.set_option(-1, '')
+
+    def test_timeout(self):
+        self._check_option(ldap.OPT_TIMEOUT, 0, nonevalue=-1)
+        self._check_option(ldap.OPT_TIMEOUT, 10.5, nonevalue=-1)
+        with self.assertRaises(ValueError):
+            self._check_option(ldap.OPT_TIMEOUT, -5, nonevalue=-1)
+        with self.assertRaises(TypeError):
+            ldap.set_option(ldap.OPT_TIMEOUT, object)
+
+    def test_network_timeout(self):
+        self._check_option(ldap.OPT_NETWORK_TIMEOUT, 0, nonevalue=-1)
+        self._check_option(ldap.OPT_NETWORK_TIMEOUT, 10.5, nonevalue=-1)
+        with self.assertRaises(ValueError):
+            self._check_option(ldap.OPT_NETWORK_TIMEOUT, -5, nonevalue=-1)
+
+    def _test_controls(self, option):
+        self._check_option(option, [])
+        self._check_option(option, TEST_CTRL, TEST_CTRL_EXPECTED)
+        self._check_option(option, tuple(TEST_CTRL), TEST_CTRL_EXPECTED)
+        with self.assertRaises(TypeError):
+            ldap.set_option(option, object)
+
+        with self.assertRaises(TypeError):
+            # must contain a tuple
+            ldap.set_option(option, [list(TEST_CTRL[0])])
+        with self.assertRaises(TypeError):
+            # data must be bytes or None
+            ldap.set_option(
+                option,
+                [TEST_CTRL[0][0], TEST_CTRL[0][1], u'data']
+            )
+
+    def test_client_controls(self):
+        self._test_controls(ldap.OPT_CLIENT_CONTROLS)
+
+    def test_server_controls(self):
+        self._test_controls(ldap.OPT_SERVER_CONTROLS)
+
+    def test_uri(self):
+        self._check_option(ldap.OPT_URI, "ldapi:///path/to/socket")
+        with self.assertRaises(TypeError):
+            ldap.set_option(ldap.OPT_URI, object)
+
+    @requires_tls()
+    def test_cafile(self):
+        # None or a distribution or OS-specific path
+        ldap.get_option(ldap.OPT_X_TLS_CACERTFILE)
+
+    def test_readonly(self):
+        value = ldap.get_option(ldap.OPT_API_INFO)
+        self.assertIsInstance(value, dict)
+        with self.assertRaises(ValueError) as e:
+            ldap.set_option(ldap.OPT_API_INFO, value)
+        self.assertIn('read-only', str(e.exception))
+
+
+if __name__ == '__main__':
+    unittest.main()

From ed0f6edf0406dbb6824e680c3d8a5a8381f5f0bb Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 4 Dec 2017 13:51:47 +0100
Subject: [PATCH 668/868] Accept more error messages in test_tls_ext_noca

OpenSSL 1.0, 1.1, and NSS return different error messages for untrusted
certificate and missing CA.

https://github.com/python-ldap/python-ldap/pull/92
Closes: https://github.com/python-ldap/python-ldap/issues/87
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_cext.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 4ef5d0e..c48a9c3 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -833,9 +833,16 @@ def test_tls_ext_noca(self):
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
         with self.assertRaises(_ldap.CONNECT_ERROR) as e:
             l.start_tls_s()
-        # some platforms return '(unknown error code)' as reason
-        if '(unknown error code)' not in str(e.exception):
-            self.assertIn('not trusted', str(e.exception))
+        # known resaons:
+        # Ubuntu on Travis: '(unknown error code)'
+        # OpenSSL 1.1: error:1416F086:SSL routines:\
+        #    tls_process_server_certificate:certificate verify failed
+        # NSS: TLS error -8172:Peer's certificate issuer has \
+        #    been marked as not trusted by the user.
+        msg = str(e.exception)
+        candidates = ('certificate', 'tls', '(unknown error code)')
+        if not any(s in msg.lower() for s in candidates):
+            self.fail(msg)
 
     @requires_tls(skip_nss=True)
     def test_tls_ext_clientcert(self):

From edbb3784070284cffc6ad6024b4245a757bef085 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 4 Dec 2017 10:04:57 +0100
Subject: [PATCH 669/868] Add valgrind target to check for memory leaks

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 CHANGES                   |  1 +
 Doc/contributing.rst      |  4 +++-
 Doc/spelling_wordlist.txt |  1 +
 Makefile                  | 16 ++++++++++++++-
 Misc/python-ldap.supp     | 41 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 61 insertions(+), 2 deletions(-)
 create mode 100644 Misc/python-ldap.supp

diff --git a/CHANGES b/CHANGES
index df35179..f75659d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -26,6 +26,7 @@ Infrastructure:
 * Remove distclean.sh in favor of make clean
 * Use `package`, `depends`, `install_requires` in setup.py
 * Add make target for scan-build (static analysis using clang)
+* Add make target and suppression file for Valgrind (memory checker)
 
 Modules/
 * Remove unused LDAPberval helper functions
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index aa6097d..114541f 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -168,13 +168,15 @@ We use several specialized tools for debugging and maintenance.
 Make targets
 ------------
 
-``make lcov-open``
+``make lcov lcov-open``
     Generate and view test coverage for C code.
     Requires ``make`` and ``lcov``.
 
 ``make scan-build``
     Run static analysis. Requires ``clang``.
 
+``make valgrind``
+    Run Valgrind to check for memory leaks. Requires ``valgrind``
 
 Reference leak tests
 --------------------
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index 95a5df6..70c07e6 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -150,5 +150,6 @@ userApplications
 userPassword
 usr
 uuids
+Valgrind
 whitespace
 workflow
diff --git a/Makefile b/Makefile
index 1ee3eda..f648d95 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ LCOV_REPORT=build/lcov_report
 LCOV_REPORT_OPTIONS=--show-details -no-branch-coverage \
 	--title "python-ldap LCOV report"
 SCAN_REPORT=build/scan_report
+PYTHON_SUPP=/usr/share/doc/python3-devel/valgrind-python.supp
 
 .NOTPARALLEL:
 
@@ -18,6 +19,9 @@ clean:
 	    -delete
 	find . -depth -name __pycache__ -exec rm -rf {} \;
 
+build:
+	mkdir -p build
+
 # LCOV report (measuring test coverage for C code)
 .PHONY: lcov-clean lcov-coverage lcov-report lcov-open lcov
 lcov-clean:
@@ -27,7 +31,7 @@ lcov-clean:
 lcov-coverage:
 	WITH_GCOV=1 tox -e py27,py36
 
-$(LCOV_INFO):
+$(LCOV_INFO): build
 	lcov --capture --directory build --output-file $(LCOV_INFO)
 
 $(LCOV_REPORT): $(LCOV_INFO)
@@ -49,3 +53,13 @@ scan-build:
 	scan-build -o $(SCAN_REPORT) --html-title="python-ldap scan report" \
 		-analyze-headers --view \
 		$(PYTHON) setup.py clean --all build
+
+# valgrind memory checker
+.PHONY: valgrind
+valgrind: build
+	valgrind --leak-check=full \
+	    --suppressions=$(PYTHON_SUPP) \
+	    --suppressions=Misc/python-ldap.supp \
+	    --gen-suppressions=all \
+	    --log-file=build/valgrind.log \
+	    $(PYTHON) setup.py test
diff --git a/Misc/python-ldap.supp b/Misc/python-ldap.supp
new file mode 100644
index 0000000..de70446
--- /dev/null
+++ b/Misc/python-ldap.supp
@@ -0,0 +1,41 @@
+# Valgrind suppression file for Python 3.6.
+
+{
+   Ignore libldap memory leak, https://github.com/python-ldap/python-ldap/issues/82
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:ber_memalloc_x
+   fun:ber_flatten
+   fun:ldap_cancel
+   fun:l_ldap_cancel
+   ...
+}
+
+{
+   Known leak in SASL interaction, https://github.com/python-ldap/python-ldap/issues/81
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:strdup
+   fun:interaction
+   fun:py_ldap_sasl_interaction
+   fun:ldap_int_sasl_bind
+   fun:ldap_sasl_interactive_bind
+   fun:ldap_sasl_interactive_bind_s
+   fun:l_ldap_sasl_interactive_bind_s
+   ...
+}
+
+{
+   Ignore possible leaks in exception initialization
+   Memcheck:Leak
+   match-leak-kinds: possible
+   fun:malloc
+   fun:PyObject_Malloc
+   ...
+   fun:PyErr_NewException
+   fun:LDAPinit_constants
+   fun:init_ldap_module
+   ...
+}

From 4657710b445dcc54112034b1907acea64f2e9b98 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 5 Dec 2017 13:40:48 +0100
Subject: [PATCH 670/868] Use uniform shebang in all demos

Demo scripts used different style of shebangs. The shebang
"#!/usr/bin/env python" is preferred because it works nicely in virtual
envs.

https://github.com/python-ldap/python-ldap/pull/97
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Demo/pyasn1/sessiontrack.py | 2 +-
 Demo/pyasn1/syncrepl.py     | 2 +-
 Demo/simplebrowse.py        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
index 91909a3..33dddda 100644
--- a/Demo/pyasn1/sessiontrack.py
+++ b/Demo/pyasn1/sessiontrack.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 """
 demo_track_ldap_session.py
diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index e4c62e8..3614792 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 """
 This script implements a syncrepl consumer which syncs data from an OpenLDAP
diff --git a/Demo/simplebrowse.py b/Demo/simplebrowse.py
index aa88f67..d13c368 100644
--- a/Demo/simplebrowse.py
+++ b/Demo/simplebrowse.py
@@ -1,4 +1,4 @@
-#! python
+#!/usr/bin/env python
 
 #
 # simple LDAP server browsing example

From c4bcf1d88784f23d070a863cdaab1b59b25d91f8 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Tue, 5 Dec 2017 13:41:25 +0100
Subject: [PATCH 671/868] Add the 3.0.0b1 release date to CHANGES

Also, put this in the release checklist
---
 CHANGES              | 2 +-
 Doc/contributing.rst | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index df35179..5c46505 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 ----------------------------------------------------------------
-Released 3.0.0b1 xxxx-xx-xx
+Released 3.0.0b1 2017-12-04
 
 Changes since 2.4.45:
 (this list includes changes from 2.5.x)
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index aa6097d..c87ccf3 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -259,6 +259,7 @@ If you are tasked with releasing python-ldap, remember to:
 * Bump all instances of the version number.
 * Go through all changes since last version, and add them to ``CHANGES``.
 * Run :ref:`additional tests` as appropriate, fix any regressions.
+* Change the release date in ``CHANGES``.
 * Merge all that (using pull requests).
 * Run ``python setup.py sdist``, and smoke-test the resulting package
   (install in a clean virtual environment, import ``ldap``).

From c85f4326eea13bdf6af13039c15447a416b3abb9 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 5 Dec 2017 14:03:24 +0100
Subject: [PATCH 672/868] Check suppression file in `make valgrind`; improve
 make target docs

This should make things easier to use for people with different
configurations.
---
 Doc/contributing.rst | 22 ++++++++++++++++++++--
 Makefile             |  8 +++++++-
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index 114541f..0cfb51b 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -168,15 +168,33 @@ We use several specialized tools for debugging and maintenance.
 Make targets
 ------------
 
+Make targets currently use the ``python3`` executable.
+Specify a different one using, for example::
+
+    make PYTHON=/usr/local/bin/python
+
+Notable targets are:
+
 ``make lcov lcov-open``
     Generate and view test coverage for C code.
-    Requires ``make`` and ``lcov``.
+    Requires LCOV_.
 
 ``make scan-build``
     Run static analysis. Requires ``clang``.
 
 ``make valgrind``
-    Run Valgrind to check for memory leaks. Requires ``valgrind``
+    Run Valgrind_ to check for memory leaks. Requires ``valgrind`` and
+    a Python suppression file, which you can specify as ``PYTHON_SUPP``, e.g.::
+
+        make valgrind PYTHON_SUPP=/your/path/to/valgrind-python.supp
+
+    The suppression file is ``Misc/valgrind-python.supp`` in the Python
+    source distribution, and it's frequently packaged together with
+    Python development headers.
+
+.. _LCOV: https://github.com/linux-test-project/lcov
+.. _Valgrind: http://valgrind.org/
+
 
 Reference leak tests
 --------------------
diff --git a/Makefile b/Makefile
index f648d95..150981c 100644
--- a/Makefile
+++ b/Makefile
@@ -56,7 +56,13 @@ scan-build:
 
 # valgrind memory checker
 .PHONY: valgrind
-valgrind: build
+$(PYTHON_SUPP):
+	@ >&2 echo "valgrind-python.supp not found"
+	@ >&2 echo "install Python development files and run:"
+	@ >&2 echo "    $(MAKE) valgrind PYTHON_SUPP=/your/path/to/valgrind-python.supp"
+	exit 1;
+
+valgrind: build $(PYTHON_SUPP)
 	valgrind --leak-check=full \
 	    --suppressions=$(PYTHON_SUPP) \
 	    --suppressions=Misc/python-ldap.supp \

From eb9dbc1bb956aac4767cff2a52f39f9de29f31b0 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 5 Dec 2017 15:32:41 +0100
Subject: [PATCH 673/868] Fix error reporting of LDAPObject.set_option()

Fix error reporting of LDAPObject.set_option()

The method LDAPObject.set_option() did not signal an exception in case
the set option failed. The bug was caused by checking for the wrong
error value. The internal C function LDAP_set_option() returns ``1`` for
sucess and ``0`` for error, but LDAPObject.set_option() was checking for
``-1``.

Add some tests for LDAPObject.set_option() and LDAPObject.get_option().

https://github.com/python-ldap/python-ldap/pull/101
Closes: https://github.com/python-ldap/python-ldap/issues/100
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c    |   2 +-
 Tests/t_ldap_options.py | 110 ++++++++++++++++++++++++++++++----------
 2 files changed, 85 insertions(+), 27 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 815fe42..cd81655 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1273,7 +1273,7 @@ l_ldap_set_option(PyObject* self, PyObject *args)
 
     if (!PyArg_ParseTuple(args, "iO:set_option", &option, &value))
         return NULL;
-    if (LDAP_set_option((LDAPObject *)self, option, value) == -1)
+    if (!LDAP_set_option((LDAPObject *)self, option, value))
         return NULL;
     Py_INCREF(Py_None);
     return Py_None;
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
index 798ae46..f0bcc21 100644
--- a/Tests/t_ldap_options.py
+++ b/Tests/t_ldap_options.py
@@ -8,8 +8,8 @@
 from ldap.controls import RequestControlTuples
 from ldap.controls.pagedresults import SimplePagedResultsControl
 from ldap.controls.openldap import SearchNoOpControl
-from slapdtest import requires_tls
-
+from ldap.ldapobject import SimpleLDAPObject
+from slapdtest import SlapdTestCase, requires_tls
 
 SENTINEL = object()
 
@@ -26,54 +26,68 @@
 ]
 
 
-class TestGlobalOptions(unittest.TestCase):
+class BaseTestOptions(object):
+    """Common tests for getting/setting options
+
+    Used in subclasses below
+    """
+
+    def get_option(self, option):
+        raise NotImplementedError()
+
+    def set_option(self, option, value):
+        raise NotImplementedError()
+
     def _check_option(self, option, value, expected=SENTINEL,
                       nonevalue=None):
-        old = ldap.get_option(option)
+        old = self.get_option(option)
         try:
-            ldap.set_option(option, value)
-            new = ldap.get_option(option)
+            self.set_option(option, value)
+            new = self.get_option(option)
             if expected is SENTINEL:
                 self.assertEqual(new, value)
             else:
                 self.assertEqual(new, expected)
         finally:
-            ldap.set_option(option, old if old is not None else nonevalue)
-            self.assertEqual(ldap.get_option(option), old)
+            self.set_option(
+                option,
+                old if old is not None else nonevalue
+            )
+            self.assertEqual(self.get_option(option), old)
 
     def test_invalid(self):
         with self.assertRaises(ValueError):
-            ldap.get_option(-1)
+            self.get_option(-1)
         with self.assertRaises(ValueError):
-            ldap.set_option(-1, '')
+            self.set_option(-1, '')
 
-    def test_timeout(self):
-        self._check_option(ldap.OPT_TIMEOUT, 0, nonevalue=-1)
-        self._check_option(ldap.OPT_TIMEOUT, 10.5, nonevalue=-1)
+    def _test_timeout(self, option):
+        self._check_option(option, 10.5, nonevalue=-1)
+        self._check_option(option, 0, nonevalue=-1)
         with self.assertRaises(ValueError):
-            self._check_option(ldap.OPT_TIMEOUT, -5, nonevalue=-1)
+            self._check_option(option, -5, nonevalue=-1)
         with self.assertRaises(TypeError):
-            ldap.set_option(ldap.OPT_TIMEOUT, object)
+            self.set_option(option, object)
+
+    def test_timeout(self):
+        self._test_timeout(ldap.OPT_TIMEOUT)
 
     def test_network_timeout(self):
-        self._check_option(ldap.OPT_NETWORK_TIMEOUT, 0, nonevalue=-1)
-        self._check_option(ldap.OPT_NETWORK_TIMEOUT, 10.5, nonevalue=-1)
-        with self.assertRaises(ValueError):
-            self._check_option(ldap.OPT_NETWORK_TIMEOUT, -5, nonevalue=-1)
+        self._test_timeout(ldap.OPT_NETWORK_TIMEOUT)
 
     def _test_controls(self, option):
         self._check_option(option, [])
         self._check_option(option, TEST_CTRL, TEST_CTRL_EXPECTED)
         self._check_option(option, tuple(TEST_CTRL), TEST_CTRL_EXPECTED)
         with self.assertRaises(TypeError):
-            ldap.set_option(option, object)
+            self.set_option(option, object)
 
         with self.assertRaises(TypeError):
             # must contain a tuple
-            ldap.set_option(option, [list(TEST_CTRL[0])])
+            self.set_option(option, [list(TEST_CTRL[0])])
         with self.assertRaises(TypeError):
             # data must be bytes or None
-            ldap.set_option(
+            self.set_option(
                 option,
                 [TEST_CTRL[0][0], TEST_CTRL[0][1], u'data']
             )
@@ -87,20 +101,64 @@ def test_server_controls(self):
     def test_uri(self):
         self._check_option(ldap.OPT_URI, "ldapi:///path/to/socket")
         with self.assertRaises(TypeError):
-            ldap.set_option(ldap.OPT_URI, object)
+            self.set_option(ldap.OPT_URI, object)
 
     @requires_tls()
     def test_cafile(self):
         # None or a distribution or OS-specific path
-        ldap.get_option(ldap.OPT_X_TLS_CACERTFILE)
+        self.get_option(ldap.OPT_X_TLS_CACERTFILE)
 
     def test_readonly(self):
-        value = ldap.get_option(ldap.OPT_API_INFO)
+        value = self.get_option(ldap.OPT_API_INFO)
         self.assertIsInstance(value, dict)
         with self.assertRaises(ValueError) as e:
-            ldap.set_option(ldap.OPT_API_INFO, value)
+            self.set_option(ldap.OPT_API_INFO, value)
         self.assertIn('read-only', str(e.exception))
 
 
+class TestGlobalOptions(BaseTestOptions, unittest.TestCase):
+    """Test setting/getting options globally
+    """
+
+    def get_option(self, option):
+        return ldap.get_option(option)
+
+    def set_option(self, option, value):
+        return ldap.set_option(option, value)
+
+
+class TestLDAPObjectOptions(BaseTestOptions, SlapdTestCase):
+    """Test setting/getting connection-specific options
+    """
+
+    ldap_object_class = SimpleLDAPObject
+
+    def setUp(self):
+        self.conn = self._open_ldap_conn(
+            who=self.server.root_dn,
+            cred=self.server.root_pw
+        )
+
+    def tearDown(self):
+        self.conn.unbind_s()
+        self.conn = None
+
+    def get_option(self, option):
+        return self.conn.get_option(option)
+
+    def set_option(self, option, value):
+        return self.conn.set_option(option, value)
+
+    # test is failing with:
+    # pyasn1.error.SubstrateUnderrunError: Short octet stream on tag decoding
+    @unittest.expectedFailure
+    def test_client_controls(self):
+        self._test_controls(ldap.OPT_CLIENT_CONTROLS)
+
+    @unittest.expectedFailure
+    def test_server_controls(self):
+        self._test_controls(ldap.OPT_SERVER_CONTROLS)
+
+
 if __name__ == '__main__':
     unittest.main()

From a8b2748dfdb6e74d708667255adb6f4bfccadf78 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 5 Dec 2017 13:45:38 +0100
Subject: [PATCH 674/868] Support None for set_option(OPT_NETWORK_TIMEOUT)

The setter for network timeout and timeout options now support None as
value. None is mapped to infinity.

Closes: https://github.com/python-ldap/python-ldap/issues/95
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap.rst  |  6 ++++--
 Modules/options.c       | 48 +++++++++++++++++++++++++++--------------
 Tests/t_ldap_options.py | 46 +++++++++++++++++++++++++++++++--------
 3 files changed, 73 insertions(+), 27 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 1f7ae5b..82bc31c 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -157,7 +157,7 @@ following option identifiers are defined as constants:
 .. py:data:: OPT_NETWORK_TIMEOUT
 
    .. versionchanged:: 3.0
-      A timeout of ``-1`` resets timeout to infinity.
+      A timeout of ``-1`` or ``None`` resets timeout to infinity.
 
 .. py:data:: OPT_PROTOCOL_VERSION
 
@@ -184,7 +184,7 @@ following option identifiers are defined as constants:
 .. py:data:: OPT_TIMEOUT
 
    .. versionchanged:: 3.0
-      A timeout of ``-1`` resets timeout to infinity.
+      A timeout of ``-1`` or ``None`` resets timeout to infinity.
 
 .. py:data:: OPT_URI
 
@@ -1125,6 +1125,8 @@ These attributes are mutable unless described as read-only.
    This option is mapped to option constant :py:const:`OPT_NETWORK_TIMEOUT`
    and used in the underlying OpenLDAP client lib.
 
+   .. versionchanged:: 3.0.0
+      A timeout of ``-1`` or ``None`` resets timeout to infinity.
 
 .. py:attribute:: LDAPObject.protocol_version -> int
 
diff --git a/Modules/options.c b/Modules/options.c
index 647f859..ea841a3 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -136,26 +136,42 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 	    break;
     case LDAP_OPT_TIMEOUT:
     case LDAP_OPT_NETWORK_TIMEOUT:
-	    /* Float valued timeval options */
-	    if (!PyArg_Parse(value, "d:set_option", &doubleval))
-		return 0;
-            if (doubleval >= 0) {
-                set_timeval_from_double( &tv, doubleval );
-                ptr = &tv;
-            } else if (doubleval == -1) {
-                /* -1 is infinity timeout */
-                tv.tv_sec = -1;
-                tv.tv_usec = 0;
-                ptr = &tv;
-            } else {
+        /* Float valued timeval options, 'd' also handles int/long */
+        if (!PyArg_Parse(value, "d:set_option", &doubleval)) {
+            /* clear error and try again with None */
+            PyErr_Clear();
+            if (PyNone_Check(value)) {
+                /* None is mapped to infinity timeout */
+                doubleval = -1;
+            }
+            else {
                 PyErr_Format(
-                    PyExc_ValueError,
-                    "timeout must be >= 0 or -1 for infinity, got %d",
-                    option
+                    PyExc_TypeError,
+                    "A float or None is expected for timeout, got %.100s",
+                    Py_TYPE(value)->tp_name
                 );
                 return 0;
             }
-	    break;
+        }
+
+        if (doubleval >= 0) {
+            set_timeval_from_double( &tv, doubleval );
+            ptr = &tv;
+        } else if (doubleval == -1) {
+            /* -1 is infinity timeout */
+            tv.tv_sec = -1;
+            tv.tv_usec = 0;
+            ptr = &tv;
+        } else {
+            PyErr_Format(
+                PyExc_ValueError,
+                "timeout must be >= 0 or -1/None for infinity, got %d",
+                option
+            );
+            return 0;
+        }
+        break;
+
     case LDAP_OPT_SERVER_CONTROLS:
     case LDAP_OPT_CLIENT_CONTROLS:
             if (!LDAPControls_from_object(value, &controls))
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
index f0bcc21..1e682f2 100644
--- a/Tests/t_ldap_options.py
+++ b/Tests/t_ldap_options.py
@@ -38,8 +38,7 @@ def get_option(self, option):
     def set_option(self, option, value):
         raise NotImplementedError()
 
-    def _check_option(self, option, value, expected=SENTINEL,
-                      nonevalue=None):
+    def _check_option(self, option, value, expected=SENTINEL):
         old = self.get_option(option)
         try:
             self.set_option(option, value)
@@ -49,10 +48,7 @@ def _check_option(self, option, value, expected=SENTINEL,
             else:
                 self.assertEqual(new, expected)
         finally:
-            self.set_option(
-                option,
-                old if old is not None else nonevalue
-            )
+            self.set_option(option, old)
             self.assertEqual(self.get_option(option), old)
 
     def test_invalid(self):
@@ -62,12 +58,20 @@ def test_invalid(self):
             self.set_option(-1, '')
 
     def _test_timeout(self, option):
-        self._check_option(option, 10.5, nonevalue=-1)
-        self._check_option(option, 0, nonevalue=-1)
+        self._check_option(option, 10.5)
+        self._check_option(option, 0)
         with self.assertRaises(ValueError):
-            self._check_option(option, -5, nonevalue=-1)
+            self._check_option(option, -5)
         with self.assertRaises(TypeError):
             self.set_option(option, object)
+        old = self.get_option(option)
+        try:
+            self.set_option(option, None)
+            self.assertEqual(self.get_option(option), None)
+            self.set_option(option, -1)
+            self.assertEqual(self.get_option(option), None)
+        finally:
+            self.set_option(option, old)
 
     def test_timeout(self):
         self._test_timeout(ldap.OPT_TIMEOUT)
@@ -149,6 +153,30 @@ def get_option(self, option):
     def set_option(self, option, value):
         return self.conn.set_option(option, value)
 
+    def test_network_timeout_attribute(self):
+        option = ldap.OPT_NETWORK_TIMEOUT
+        old = self.get_option(option)
+        try:
+            self.assertEqual(self.conn.network_timeout, old)
+
+            self.conn.network_timeout = 5
+            self.assertEqual(self.conn.network_timeout, 5)
+            self.assertEqual(self.get_option(option), 5)
+
+            self.conn.network_timeout = -1
+            self.assertEqual(self.conn.network_timeout, None)
+            self.assertEqual(self.get_option(option), None)
+
+            self.conn.network_timeout = 10.5
+            self.assertEqual(self.conn.network_timeout, 10.5)
+            self.assertEqual(self.get_option(option), 10.5)
+
+            self.conn.network_timeout = None
+            self.assertEqual(self.conn.network_timeout, None)
+            self.assertEqual(self.get_option(option), None)
+        finally:
+            self.set_option(option, old)
+
     # test is failing with:
     # pyasn1.error.SubstrateUnderrunError: Short octet stream on tag decoding
     @unittest.expectedFailure

From 4389d9b1787bada7de9ebabc27fbcdc2dd4701df Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 5 Dec 2017 14:53:43 +0100
Subject: [PATCH 675/868] Use custom ldap.LDAPBytesWarning class

Under Python 2, python-ldap now uses custom ldap.LDAPBytesWarning
instead of BytesWarning to emit warnings in default bytes mode.

Closes: https://github.com/python-ldap/python-ldap/issues/99
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/bytes_mode.rst     | 19 ++++++++++++++++++-
 Lib/ldap/__init__.py   |  2 +-
 Lib/ldap/ldapobject.py | 11 +++++++++--
 Tests/t_ldapobject.py  | 37 ++++++++++++++++++++++++++++++++++++-
 4 files changed, 64 insertions(+), 5 deletions(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index b18c0ae..62ab496 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -66,7 +66,9 @@ Unspecified: relaxed mode with warnings
 
     Text values returned from python-ldap are always ``unicode``.
     Text values supplied to python-ldap should be ``unicode``;
-    warnings are emitted when they are not.
+    warnings of type :class:`ldap.LDAPBytesWarning` are emitted when they
+    are not. :class:`ldap.LDAPBytesWarning` is a subclass of
+    :class:`BytesWarning`.
 
 Backwards-compatible behavior is not scheduled for removal until Python 2
 itself reaches end of life.
@@ -103,3 +105,18 @@ Note that only the result's *values* are of the ``bytes`` type:
             'sn': [b'Barrois'],
         }),
     ]
+
+
+Filter warning
+--------------
+
+The bytes mode warnings can be filtered out and ignored with a
+simple filter.
+
+.. code-block:: python
+
+   import warnings
+   import ldap
+
+   if hasattr(ldap, 'LDAPBytesWarning'):
+       warnings.simplefilter('ignore', ldap.LDAPBytesWarning)
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 7cb16b0..3a86095 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -86,7 +86,7 @@ def release(self):
 
 from ldap.functions import open,initialize,init,get_option,set_option,escape_str,strf_secs,strp_secs
 
-from ldap.ldapobject import NO_UNIQUE_ENTRY
+from ldap.ldapobject import NO_UNIQUE_ENTRY, LDAPBytesWarning
 
 from ldap.dn import explode_dn,explode_rdn,str2dn,dn2str
 del str2dn
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index c5e62bd..f37ef24 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -14,6 +14,7 @@
   'LDAPObject',
   'SimpleLDAPObject',
   'ReconnectLDAPObject',
+  'LDAPBytesWarning'
 ]
 
 
@@ -37,6 +38,12 @@
 else:
   text_type = str
 
+
+class LDAPBytesWarning(BytesWarning):
+  """python-ldap bytes mode warning
+  """
+
+
 class NO_UNIQUE_ENTRY(ldap.NO_SUCH_OBJECT):
   """
   Exception raised if a LDAP search returned more than entry entry
@@ -84,7 +91,7 @@ def __init__(
         "Under Python 2, python-ldap uses bytes by default. "
         "This will be removed in Python 3 (no bytes for DN/RDN/field names). "
         "Please call initialize(..., bytes_mode=False) explicitly.",
-        BytesWarning,
+        LDAPBytesWarning,
         stacklevel=2,
       )
       bytes_mode = True
@@ -122,7 +129,7 @@ def _bytesify_input(self, value):
           warnings.warn(
             "Received non-bytes value %r with default (disabled) bytes mode; please choose an explicit "
             "option for bytes_mode on your LDAP connection" % (value,),
-            BytesWarning,
+            LDAPBytesWarning,
             stacklevel=6,
           )
           return value.encode('utf-8')
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 9b6a090..835512b 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -19,6 +19,7 @@
 import os
 import unittest
 import pickle
+import warnings
 from slapdtest import SlapdTestCase, requires_sasl
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
@@ -314,7 +315,41 @@ def test007_timeout(self):
         l.abandon(m)
         with self.assertRaises(ldap.TIMEOUT):
             result = l.result(m, timeout=0.001)
-        
+
+    def assertIsSubclass(self, cls, other):
+        self.assertTrue(
+            issubclass(cls, other),
+            cls.__mro__
+        )
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_ldapbyteswarning(self):
+        self.assertIsSubclass(ldap.LDAPBytesWarning, BytesWarning)
+        self.assertIsSubclass(ldap.LDAPBytesWarning, Warning)
+        self.assertIsInstance(self.server.suffix, text_type)
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('default')
+            conn = self._get_bytes_ldapobject(explicit=False)
+            result = conn.search_s(
+                self.server.suffix,
+                ldap.SCOPE_SUBTREE,
+                b'(cn=Foo*)',
+                attrlist=[b'*'],
+            )
+            self.assertEqual(len(result), 4)
+
+        # ReconnectLDAP only emits one warning
+        self.assertGreaterEqual(len(w), 1, w)
+        msg = w[-1]
+        self.assertIs(msg.category, ldap.LDAPBytesWarning)
+        self.assertEqual(
+            text_type(msg.message),
+            "Received non-bytes value u'%s' with default (disabled) bytes "
+            "mode; please choose an explicit option for bytes_mode on your "
+            "LDAP connection" % self.server.suffix
+        )
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From a28d2be28f45303a65c60d4f458cc5370455c634 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 7 Dec 2017 11:24:41 +0100
Subject: [PATCH 676/868] Remove workaround for OpenLDAP NSS issue

The NSS issue has been fixed in Fedora update openldap-2.4.45-2.fc26 and
openldap-2.4.45-4.fc27. Fedora users can now execute all tests.

Includes documentation for build requirements and minimum versions on
Fedora.

See: https://bugzilla.redhat.com/show_bug.cgi?id=1520990
Closes: https://github.com/python-ldap/python-ldap/issues/60
Closes: https://github.com/python-ldap/python-ldap/issues/51
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/installing.rst          | 23 +++++++++++++++++++++++
 Lib/slapdtest/_slapdtest.py | 10 +---------
 Tests/t_cext.py             |  8 ++++----
 Tests/t_ldap_sasl.py        |  2 +-
 4 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index d5cbf95..a5e0892 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -132,6 +132,29 @@ on the local system when building python-ldap:
 .. _Cyrus SASL: https://www.cyrusimap.org/sasl/
 
 
+Debian
+------
+
+Packages for building and testing::
+
+    apt-get install build-essential python3-dev python2.7-dev libldap2-dev \
+        libsasl2-dev slapd ldap-utils python-tox valgrind
+
+
+Fedora
+------
+
+Packages for building and testing::
+
+    dnf install "@C Development Tools and Libraries" openldap-devel \
+        python2-devel python3-devel python3-tox valgrind clang-analyzer
+
+.. note::
+
+   ``openldap-2.4.45-2`` (Fedora 26), ``openldap-2.4.45-4`` (Fedora 27) or
+   newer are required.
+
+
 setup.cfg
 =========
 
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 5ba6464..f3f096c 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -76,21 +76,13 @@ def skip_unless_ci(reason, feature=None):
         return identity
 
 
-def requires_tls(skip_nss=False):
+def requires_tls():
     """Decorator for TLS tests
 
     Tests are not skipped on CI (e.g. Travis CI)
-    
-    :param skip_nss: Skip test when libldap is compiled with NSS as TLS lib
     """
     if not ldap.TLS_AVAIL:
         return skip_unless_ci("test needs ldap.TLS_AVAIL", feature='TLS')
-    elif skip_nss and ldap.get_option(ldap.OPT_X_TLS_PACKAGE) == 'MozNSS':
-        return skip_unless_ci(
-            "Test doesn't work correctly with Mozilla NSS, see "
-            "https://bugzilla.redhat.com/show_bug.cgi?id=1519167",
-            feature="NSS"
-        )
     else:
         return identity
 
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index c48a9c3..d8233dc 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -817,7 +817,7 @@ def test_invalid_controls(self):
                 l.sasl_interactive_bind_s, 'who', 'SASLObject', post=(1,))
         self.assertInvalidControls(l.unbind_ext)
 
-    @requires_tls(skip_nss=True)
+    @requires_tls()
     def test_tls_ext(self):
         l = self._open_conn(bind=False)
         # StartTLS needs LDAPv3
@@ -827,7 +827,7 @@ def test_tls_ext(self):
         l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
         l.start_tls_s()
 
-    @requires_tls(skip_nss=False)
+    @requires_tls()
     def test_tls_ext_noca(self):
         l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
@@ -844,7 +844,7 @@ def test_tls_ext_noca(self):
         if not any(s in msg.lower() for s in candidates):
             self.fail(msg)
 
-    @requires_tls(skip_nss=True)
+    @requires_tls()
     def test_tls_ext_clientcert(self):
         l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
@@ -855,7 +855,7 @@ def test_tls_ext_clientcert(self):
         l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
         l.start_tls_s()
 
-    @requires_tls(skip_nss=False)
+    @requires_tls()
     def test_tls_packages(self):
         # libldap has tls_g.c, tls_m.c, and tls_o.c with ldap_int_tls_impl
         package = _ldap.get_option(_ldap.OPT_X_TLS_PACKAGE)
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index 2fa4dbc..7f472cc 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -76,7 +76,7 @@ def test_external_ldapi(self):
             "dn:{}".format(self.server.root_dn.lower())
         )
 
-    @requires_tls(skip_nss=True)
+    @requires_tls()
     def test_external_tlscert(self):
         ldap_conn = self.ldap_object_class(self.server.ldap_uri)
         ldap_conn.set_option(ldap.OPT_X_TLS_CACERTFILE, self.server.cafile)

From 829027081d8cb1891732b8d7d631bfcc827fe213 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 5 Dec 2017 16:07:08 +0100
Subject: [PATCH 677/868] Doc: LDAPBytesWarning doc improvements

- Make filtering note apply to both causes of the warning
- Add formal class documentation
- Add cross-references
---
 Doc/bytes_mode.rst     | 14 +++++++++-----
 Doc/reference/ldap.rst | 12 ++++++++++++
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index 62ab496..c775b27 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -66,9 +66,11 @@ Unspecified: relaxed mode with warnings
 
     Text values returned from python-ldap are always ``unicode``.
     Text values supplied to python-ldap should be ``unicode``;
-    warnings of type :class:`ldap.LDAPBytesWarning` are emitted when they
-    are not. :class:`ldap.LDAPBytesWarning` is a subclass of
-    :class:`BytesWarning`.
+    warnings are emitted when they are not.
+
+    The warnings are of type :class:`~ldap.LDAPBytesWarning`, which
+    is a subclass of :class:`BytesWarning` designed to be easily
+    :ref:`filtered out <filter-bytes-warning>` if needed.
 
 Backwards-compatible behavior is not scheduled for removal until Python 2
 itself reaches end of life.
@@ -107,8 +109,10 @@ Note that only the result's *values* are of the ``bytes`` type:
     ]
 
 
-Filter warning
---------------
+.. _filter-bytes-warning:
+
+Filtering warnings
+------------------
 
 The bytes mode warnings can be filtered out and ignored with a
 simple filter.
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 1f7ae5b..4b163da 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -564,6 +564,18 @@ The above exceptions are raised when a result code from an underlying API
 call does not indicate success.
 
 
+Warnings
+========
+
+.. py:class:: LDAPBytesWarning
+
+    Raised when bytes/text mismatch in non-strict bytes mode.
+
+    See :ref:`bytes_mode` for details.
+
+    .. versionadded:: 3.0.0
+
+
 .. _ldap-objects:
 
 LDAPObject classes

From 12f193efaeae7c82a62f4b723a5e221dac26adef Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 7 Dec 2017 21:02:29 +0100
Subject: [PATCH 678/868] In timeout options, reword the message only of
 TypeError

---
 Modules/options.c       | 30 ++++++++++++++++--------------
 Tests/t_ldap_options.py |  2 ++
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/Modules/options.c b/Modules/options.c
index ea841a3..ee606d4 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -136,20 +136,22 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 	    break;
     case LDAP_OPT_TIMEOUT:
     case LDAP_OPT_NETWORK_TIMEOUT:
-        /* Float valued timeval options, 'd' also handles int/long */
-        if (!PyArg_Parse(value, "d:set_option", &doubleval)) {
-            /* clear error and try again with None */
-            PyErr_Clear();
-            if (PyNone_Check(value)) {
-                /* None is mapped to infinity timeout */
-                doubleval = -1;
-            }
-            else {
-                PyErr_Format(
-                    PyExc_TypeError,
-                    "A float or None is expected for timeout, got %.100s",
-                    Py_TYPE(value)->tp_name
-                );
+        /* Float valued timeval options */
+        if (value == Py_None) {
+            /* None is mapped to infinity timeout */
+            doubleval = -1;
+        } else {
+            /* 'd' handles int/long */
+            if (!PyArg_Parse(value, "d:set_option", &doubleval)) {
+                if (PyErr_ExceptionMatches(PyExc_TypeError)) {
+                    /* TypeError: mention either float or None is expected */
+                    PyErr_Clear();
+                    PyErr_Format(
+                        PyExc_TypeError,
+                        "A float or None is expected for timeout, got %.100s",
+                        Py_TYPE(value)->tp_name
+                    );
+                }
                 return 0;
             }
         }
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
index 1e682f2..a681a9b 100644
--- a/Tests/t_ldap_options.py
+++ b/Tests/t_ldap_options.py
@@ -64,6 +64,8 @@ def _test_timeout(self, option):
             self._check_option(option, -5)
         with self.assertRaises(TypeError):
             self.set_option(option, object)
+        with self.assertRaises(OverflowError):
+            self._check_option(option, 10**1000)
         old = self.get_option(option)
         try:
             self.set_option(option, None)

From baa091f0ae1a9cd36d60caea1b58ccdaa957267f Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 11 Dec 2017 11:53:36 +0100
Subject: [PATCH 679/868] Change memory handling in attrs_from_List()

attrs_from_List() no longer uses internal buffers of bytes/str PyObject*
to maintain memory. Instead it creates its own copies, which are then
passed to ldap_search_ext() and then cleaned up.

The modification is required for Python 3.7. PyUnicode_AsUTF8() returns
const char* but ldap_search_ext() does not use const.

https://github.com/python-ldap/python-ldap/pull/106
Closes: https://github.com/python-ldap/python-ldap/issues/105
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml          |  8 ++++++
 Modules/LDAPObject.c | 67 ++++++++++++++++++++++++++++----------------
 2 files changed, 51 insertions(+), 24 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 960f6db..00eb629 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -34,6 +34,10 @@ matrix:
       env:
         - TOXENV=py36
         - WITH_GCOV=1
+    - python: 3.7-dev
+      env:
+        - TOXENV=py37
+        - WITH_GCOV=1
     - python: 2.7
       env:
         - TOXENV=py2-nosasltls
@@ -44,6 +48,10 @@ matrix:
         - WITH_GCOV=1
     - python: 3.6
       env: TOXENV=doc
+  allow_failures:
+     - env:
+        - TOXENV=py37
+        - WITH_GCOV=1
 
 env:
     global:
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index cd81655..addbe96 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -16,7 +16,7 @@
 #include <sasl/sasl.h>
 #endif
 
-static void free_attrs(char***, PyObject*);
+static void free_attrs(char***);
 
 /* constructor */
 
@@ -248,13 +248,10 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
  */
 
 int
-attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
+attrs_from_List( PyObject *attrlist, char***attrsp) {
 
     char **attrs = NULL;
-    Py_ssize_t i, len;
-    PyObject *item;
-
-    *seq = NULL;
+    PyObject *seq = NULL;
 
     if (attrlist == Py_None) {
         /* None means a NULL attrlist */
@@ -268,8 +265,16 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
             "expected *list* of strings, not a string", attrlist);
         goto error;
     } else {
-        *seq = PySequence_Fast(attrlist, "expected list of strings or None");
-        if (*seq == NULL)
+        PyObject *item = NULL;
+        Py_ssize_t i, len, strlen;
+#if PY_MAJOR_VERSION >= 3
+        const char *str;
+#else
+        char *str;
+#endif
+
+        seq = PySequence_Fast(attrlist, "expected list of strings or None");
+        if (seq == NULL)
             goto error;
 
         len = PySequence_Length(attrlist);
@@ -280,25 +285,36 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
 
         for (i = 0; i < len; i++) {
             attrs[i] = NULL;
-            item = PySequence_Fast_GET_ITEM(*seq, i);
+            item = PySequence_Fast_GET_ITEM(seq, i);
             if (item == NULL)
                 goto error;
 #if PY_MAJOR_VERSION == 2
-            /* Encoded by Python to UTF-8 */
+            /* Encoded in Python to UTF-8 */
             if (!PyBytes_Check(item)) {
                 LDAPerror_TypeError("expected bytes in list", item);
                 goto error;
             }
-            attrs[i] = PyBytes_AsString(item);
+            if (PyBytes_AsStringAndSize(item, &str, &strlen) == -1) {
+                goto error;
+            }
 #else
             if (!PyUnicode_Check(item)) {
                 LDAPerror_TypeError("expected string in list", item);
                 goto error;
             }
-            attrs[i] = PyUnicode_AsUTF8(item);
+            str = PyUnicode_AsUTF8AndSize(item, &strlen);
 #endif
+            /* Make a copy. PyBytes_AsString* / PyUnicode_AsUTF8* return
+             * internal values that must be treated like const char. Python
+             * 3.7 actually returns a const char.
+             */
+            attrs[i] = (char *)PyMem_NEW(char *, strlen + 1);
+            if (attrs[i] == NULL)
+                goto nomem;
+            memcpy(attrs[i], str, strlen + 1);
         }
         attrs[len] = NULL;
+        Py_DECREF(seq);
     }
 
     *attrsp = attrs;
@@ -307,22 +323,26 @@ attrs_from_List( PyObject *attrlist, char***attrsp, PyObject** seq) {
 nomem:
     PyErr_NoMemory();
 error:
-    free_attrs(&attrs, *seq);
+    Py_XDECREF(seq);
+    free_attrs(&attrs);
     return 0;
 }
 
 /* free memory allocated from above routine */
 
 static void
-free_attrs( char*** attrsp, PyObject* seq ) {
+free_attrs( char*** attrsp) {
     char **attrs = *attrsp;
+    char **p;
 
-    if (attrs != NULL) {
-        PyMem_DEL(attrs);
-        *attrsp = NULL;
-    }
+    if (attrs == NULL)
+        return;
 
-    Py_XDECREF(seq);
+    *attrsp = NULL;
+    for (p = attrs; *p != NULL; p++) {
+        PyMem_DEL(*p);
+    }
+    PyMem_DEL(attrs);
 }
 
 /*------------------------------------------------------------
@@ -1130,7 +1150,6 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
 
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    PyObject *attrs_seq = NULL;
     LDAPControl** server_ldcs = NULL;
     LDAPControl** client_ldcs = NULL;
 
@@ -1148,7 +1167,7 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
                            &serverctrls, &clientctrls, &timeout, &sizelimit )) return NULL;
     if (not_valid(self)) return NULL;
 
-    if (!attrs_from_List( attrlist, &attrs, &attrs_seq ))
+    if (!attrs_from_List( attrlist, &attrs ))
          return NULL;
 
     if (timeout >= 0) {
@@ -1160,14 +1179,14 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
-            free_attrs( &attrs,  attrs_seq);
+            free_attrs( &attrs );
             return NULL;
         }
     }
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            free_attrs( &attrs,  attrs_seq);
+            free_attrs( &attrs );
             LDAPControl_List_DEL( server_ldcs );
             return NULL;
         }
@@ -1178,7 +1197,7 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
                              server_ldcs, client_ldcs, tvp, sizelimit, &msgid );
     LDAP_END_ALLOW_THREADS( self );
 
-    free_attrs( &attrs,  attrs_seq);
+    free_attrs( &attrs );
     LDAPControl_List_DEL( server_ldcs );
     LDAPControl_List_DEL( client_ldcs );
 

From dc7a3fe05a3ac7491fbaa5ec70437b4dfb2c84b2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 11 Dec 2017 11:53:52 +0100
Subject: [PATCH 680/868] Rename ldap.async to ldap.asyncsearch

Python 3.7 introduces `async` as a keyword. The old import path is still
available for backwards compatibility.

https://github.com/python-ldap/python-ldap/pull/107
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap-async.rst |  55 ++++---
 Doc/spelling_wordlist.txt    |   1 +
 Lib/ldap/async.py            | 286 ++---------------------------------
 Lib/ldap/asyncsearch.py      | 283 ++++++++++++++++++++++++++++++++++
 Tests/t_ldap_asyncsearch.py  |  25 +++
 Tests/t_untested_mods.py     |   3 +-
 6 files changed, 353 insertions(+), 300 deletions(-)
 create mode 100644 Lib/ldap/asyncsearch.py
 create mode 100644 Tests/t_ldap_asyncsearch.py

diff --git a/Doc/reference/ldap-async.rst b/Doc/reference/ldap-async.rst
index 59a34f4..76245f6 100644
--- a/Doc/reference/ldap-async.rst
+++ b/Doc/reference/ldap-async.rst
@@ -1,49 +1,60 @@
-**************************************************************
-:py:mod:`ldap.async` Stream-processing of large search results
-**************************************************************
+********************************************************************
+:py:mod:`ldap.asyncsearch` Stream-processing of large search results
+********************************************************************
 
-.. py:module:: ldap.async
+.. py:module:: ldap.asyncsearch
    :synopsis: Framework for stream-processing of large search results.
 
 With newer Python versions one might want to consider using
 :py:mod:`ldap.resiter` instead.
 
 
+.. versionchanged:: 3.0
+   In Python 3.7 ``async`` is a reserved keyword. The module
+   :py:mod:`ldap.async` has been renamed to :py:mod:`ldap.asyncsearch`. The
+   old name :py:mod:`ldap.async` is still available for backwards
+   compatibility.
+
+.. deprecated:: 3.0
+   The old name :py:mod:`ldap.async` is deprecated, but will not be removed
+   until Python 3.6 reaches end-of-life.
+
+
 Classes
 =======
 
-.. autoclass:: ldap.async.AsyncSearchHandler
+.. autoclass:: ldap.asyncsearch.AsyncSearchHandler
    :members:
 
-.. autoclass:: ldap.async.List
+.. autoclass:: ldap.asyncsearch.List
    :members:
 
-.. autoclass:: ldap.async.Dict
+.. autoclass:: ldap.asyncsearch.Dict
    :members:
 
-.. autoclass:: ldap.async.IndexedDict
+.. autoclass:: ldap.asyncsearch.IndexedDict
    :members:
 
-.. autoclass:: ldap.async.LDIFWriter
+.. autoclass:: ldap.asyncsearch.LDIFWriter
    :members:
 
-.. _ldap.async-example:
+.. _ldap.asyncsearch-example:
 
 Examples
 ========
 
-.. _ldap.async-example.List:
+.. _ldap.asyncsearch-example.List:
 
-Using ldap.async.List
-^^^^^^^^^^^^^^^^^^^^^
+Using ldap.asyncsearch.List
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-This example demonstrates how to use class ldap.async.List for
+This example demonstrates how to use class ldap.asyncsearch.List for
 retrieving partial search results even though the exception
 :exc:`ldap.SIZELIMIT_EXCEEDED` was raised because a server side limit was hit. ::
 
-   import sys,ldap,ldap.async
+   import sys,ldap,ldap.asyncsearch
 
-   s = ldap.async.List(
+   s = ldap.asyncsearch.List(
      ldap.initialize('ldap://localhost'),
    )
 
@@ -67,17 +78,17 @@ retrieving partial search results even though the exception
      )
    )
 
-.. _ldap.async-example.LDIFWriter:
+.. _ldap.asyncsearch-example.LDIFWriter:
 
-Using ldap.async.LDIFWriter
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Using ldap.asyncsearch.LDIFWriter
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-This example demonstrates how to use class ldap.async.LDIFWriter
+This example demonstrates how to use class ldap.asyncsearch.LDIFWriter
 for writing search results as LDIF to stdout. ::
 
-   import sys,ldap,ldap.async
+   import sys,ldap,ldap.asyncsearch
 
-   s = ldap.async.LDIFWriter(
+   s = ldap.asyncsearch.LDIFWriter(
      ldap.initialize('ldap://localhost:1390'),
      sys.stdout
    )
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index 70c07e6..925ddc3 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -1,5 +1,6 @@
 args
 async
+asyncsearch
 attr
 attrlist
 attrList
diff --git a/Lib/ldap/async.py b/Lib/ldap/async.py
index 23c5660..1d4505b 100644
--- a/Lib/ldap/async.py
+++ b/Lib/ldap/async.py
@@ -1,283 +1,15 @@
 """
-ldap.async - handle async LDAP operations
+ldap.asyncsearch - handle async LDAP search operations
 
 See https://www.python-ldap.org/ for details.
 """
+import warnings
 
-import ldap
+from ldap.asyncsearch import *
+from ldap.asyncsearch import __version__
 
-from ldap import __version__
-
-SEARCH_RESULT_TYPES = set([
-  ldap.RES_SEARCH_ENTRY,
-  ldap.RES_SEARCH_RESULT,
-  ldap.RES_SEARCH_REFERENCE,
-])
-
-ENTRY_RESULT_TYPES = set([
-  ldap.RES_SEARCH_ENTRY,
-  ldap.RES_SEARCH_RESULT,
-])
-
-
-class WrongResultType(Exception):
-
-  def __init__(self,receivedResultType,expectedResultTypes):
-    self.receivedResultType = receivedResultType
-    self.expectedResultTypes = expectedResultTypes
-    Exception.__init__(self)
-
-  def __str__(self):
-    return 'Received wrong result type %s (expected one of %s).' % (
-      self.receivedResultType,
-      ', '.join(self.expectedResultTypes),
-    )
-
-
-class AsyncSearchHandler:
-  """
-  Class for stream-processing LDAP search results
-
-  Arguments:
-
-  l
-    LDAPObject instance
-  """
-
-  def __init__(self,l):
-    self._l = l
-    self._msgId = None
-    self._afterFirstResult = 1
-
-  def startSearch(
-    self,
-    searchRoot,
-    searchScope,
-    filterStr,
-    attrList=None,
-    attrsOnly=0,
-    timeout=-1,
-    sizelimit=0,
-    serverctrls=None,
-    clientctrls=None
-  ):
-    """
-    searchRoot
-        See parameter base of method LDAPObject.search()
-    searchScope
-        See parameter scope of method LDAPObject.search()
-    filterStr
-        See parameter filter of method LDAPObject.search()
-    attrList=None
-        See parameter attrlist of method LDAPObject.search()
-    attrsOnly
-        See parameter attrsonly of method LDAPObject.search()
-    timeout
-        Maximum time the server shall use for search operation
-    sizelimit
-        Maximum number of entries a server should return
-        (request client-side limit)
-    serverctrls
-        list of server-side LDAP controls
-    clientctrls
-        list of client-side LDAP controls
-    """
-    self._msgId = self._l.search_ext(
-      searchRoot,searchScope,filterStr,
-      attrList,attrsOnly,serverctrls,clientctrls,timeout,sizelimit
-    )
-    self._afterFirstResult = 1
-    return # startSearch()
-
-  def preProcessing(self):
-    """
-    Do anything you want after starting search but
-    before receiving and processing results
-    """
-
-  def afterFirstResult(self):
-    """
-    Do anything you want right after successfully receiving but before
-    processing first result
-    """
-
-  def postProcessing(self):
-    """
-    Do anything you want after receiving and processing all results
-    """
-
-  def processResults(self,ignoreResultsNumber=0,processResultsCount=0,timeout=-1):
-    """
-    ignoreResultsNumber
-        Don't process the first ignoreResultsNumber results.
-    processResultsCount
-        If non-zero this parameters indicates the number of results
-        processed is limited to processResultsCount.
-    timeout
-        See parameter timeout of ldap.LDAPObject.result()
-    """
-    self.preProcessing()
-    result_counter = 0
-    end_result_counter = ignoreResultsNumber+processResultsCount
-    go_ahead = 1
-    partial = 0
-    self.beginResultsDropped = 0
-    self.endResultBreak = result_counter
-    try:
-      result_type,result_list = None,None
-      while go_ahead:
-        while result_type is None and not result_list:
-          result_type,result_list,result_msgid,result_serverctrls = self._l.result3(self._msgId,0,timeout)
-          if self._afterFirstResult:
-            self.afterFirstResult()
-            self._afterFirstResult = 0
-        if not result_list:
-          break
-        if result_type not in SEARCH_RESULT_TYPES:
-          raise WrongResultType(result_type,SEARCH_RESULT_TYPES)
-        # Loop over list of search results
-        for result_item in result_list:
-          if result_counter<ignoreResultsNumber:
-            self.beginResultsDropped = self.beginResultsDropped+1
-          elif processResultsCount==0 or result_counter<end_result_counter:
-            self._processSingleResult(result_type,result_item)
-          else:
-            go_ahead = 0 # break-out from while go_ahead
-            partial = 1
-            break # break-out from this for-loop
-          result_counter = result_counter+1
-        result_type,result_list = None,None
-        self.endResultBreak = result_counter
-    finally:
-      if partial and self._msgId!=None:
-        self._l.abandon(self._msgId)
-    self.postProcessing()
-    return partial # processResults()
-
-  def _processSingleResult(self,resultType,resultItem):
-    """
-    Process single entry
-
-    resultType
-        result type
-    resultItem
-        Single item of a result list
-    """
-    pass
-
-
-class List(AsyncSearchHandler):
-  """
-  Class for collecting all search results.
-
-  This does not seem to make sense in the first place but think
-  of retrieving exactly a certain portion of the available search
-  results.
-  """
-
-  def __init__(self,l):
-    AsyncSearchHandler.__init__(self,l)
-    self.allResults = []
-
-  def _processSingleResult(self,resultType,resultItem):
-    self.allResults.append((resultType,resultItem))
-
-
-class Dict(AsyncSearchHandler):
-  """
-  Class for collecting all search results into a dictionary {dn:entry}
-  """
-
-  def __init__(self,l):
-    AsyncSearchHandler.__init__(self,l)
-    self.allEntries = {}
-
-  def _processSingleResult(self,resultType,resultItem):
-    if resultType in ENTRY_RESULT_TYPES:
-      # Search continuations are ignored
-      dn,entry = resultItem
-      self.allEntries[dn] = entry
-
-
-class IndexedDict(Dict):
-  """
-  Class for collecting all search results into a dictionary {dn:entry}
-  and maintain case-sensitive equality indexes to entries
-  """
-
-  def __init__(self,l,indexed_attrs=None):
-    Dict.__init__(self,l)
-    self.indexed_attrs = indexed_attrs or tuple()
-    self.index = {}.fromkeys(self.indexed_attrs,{})
-
-  def _processSingleResult(self,resultType,resultItem):
-    if resultType in ENTRY_RESULT_TYPES:
-      # Search continuations are ignored
-      dn,entry = resultItem
-      self.allEntries[dn] = entry
-      for a in self.indexed_attrs:
-        if a in entry:
-          for v in entry[a]:
-            try:
-              self.index[a][v].append(dn)
-            except KeyError:
-              self.index[a][v] = [ dn ]
-
-
-class FileWriter(AsyncSearchHandler):
-  """
-  Class for writing a stream of LDAP search results to a file object
-
-  Arguments:
-  l
-    LDAPObject instance
-  f
-    File object instance where the LDIF data is written to
-  """
-
-  def __init__(self,l,f,headerStr='',footerStr=''):
-    AsyncSearchHandler.__init__(self,l)
-    self._f = f
-    self.headerStr = headerStr
-    self.footerStr = footerStr
-
-  def preProcessing(self):
-    """
-    The headerStr is written to output after starting search but
-    before receiving and processing results.
-    """
-    self._f.write(self.headerStr)
-
-  def postProcessing(self):
-    """
-    The footerStr is written to output after receiving and
-    processing results.
-    """
-    self._f.write(self.footerStr)
-
-
-class LDIFWriter(FileWriter):
-  """
-  Class for writing a stream LDAP search results to a LDIF file
-
-  Arguments:
-
-  l
-    LDAPObject instance
-  writer_obj
-    Either a file-like object or a ldif.LDIFWriter instance used for output
-  """
-
-  def __init__(self,l,writer_obj,headerStr='',footerStr=''):
-    import ldif
-    if isinstance(writer_obj,ldif.LDIFWriter):
-      self._ldif_writer = writer_obj
-    else:
-      self._ldif_writer = ldif.LDIFWriter(writer_obj)
-    FileWriter.__init__(self,l,self._ldif_writer._output_file,headerStr,footerStr)
-
-  def _processSingleResult(self,resultType,resultItem):
-    if resultType in ENTRY_RESULT_TYPES:
-      # Search continuations are ignored
-      dn,entry = resultItem
-      self._ldif_writer.unparse(dn,entry)
+warnings.warn(
+    "'ldap.async module' is deprecated, import 'ldap.asyncsearch' instead.",
+    DeprecationWarning,
+    stacklevel=2
+)
diff --git a/Lib/ldap/asyncsearch.py b/Lib/ldap/asyncsearch.py
new file mode 100644
index 0000000..97b3fff
--- /dev/null
+++ b/Lib/ldap/asyncsearch.py
@@ -0,0 +1,283 @@
+"""
+ldap.asyncsearch - handle async LDAP search operations
+
+See https://www.python-ldap.org/ for details.
+"""
+
+import ldap
+
+from ldap import __version__
+
+SEARCH_RESULT_TYPES = set([
+  ldap.RES_SEARCH_ENTRY,
+  ldap.RES_SEARCH_RESULT,
+  ldap.RES_SEARCH_REFERENCE,
+])
+
+ENTRY_RESULT_TYPES = set([
+  ldap.RES_SEARCH_ENTRY,
+  ldap.RES_SEARCH_RESULT,
+])
+
+
+class WrongResultType(Exception):
+
+  def __init__(self,receivedResultType,expectedResultTypes):
+    self.receivedResultType = receivedResultType
+    self.expectedResultTypes = expectedResultTypes
+    Exception.__init__(self)
+
+  def __str__(self):
+    return 'Received wrong result type %s (expected one of %s).' % (
+      self.receivedResultType,
+      ', '.join(self.expectedResultTypes),
+    )
+
+
+class AsyncSearchHandler:
+  """
+  Class for stream-processing LDAP search results
+
+  Arguments:
+
+  l
+    LDAPObject instance
+  """
+
+  def __init__(self,l):
+    self._l = l
+    self._msgId = None
+    self._afterFirstResult = 1
+
+  def startSearch(
+    self,
+    searchRoot,
+    searchScope,
+    filterStr,
+    attrList=None,
+    attrsOnly=0,
+    timeout=-1,
+    sizelimit=0,
+    serverctrls=None,
+    clientctrls=None
+  ):
+    """
+    searchRoot
+        See parameter base of method LDAPObject.search()
+    searchScope
+        See parameter scope of method LDAPObject.search()
+    filterStr
+        See parameter filter of method LDAPObject.search()
+    attrList=None
+        See parameter attrlist of method LDAPObject.search()
+    attrsOnly
+        See parameter attrsonly of method LDAPObject.search()
+    timeout
+        Maximum time the server shall use for search operation
+    sizelimit
+        Maximum number of entries a server should return
+        (request client-side limit)
+    serverctrls
+        list of server-side LDAP controls
+    clientctrls
+        list of client-side LDAP controls
+    """
+    self._msgId = self._l.search_ext(
+      searchRoot,searchScope,filterStr,
+      attrList,attrsOnly,serverctrls,clientctrls,timeout,sizelimit
+    )
+    self._afterFirstResult = 1
+    return # startSearch()
+
+  def preProcessing(self):
+    """
+    Do anything you want after starting search but
+    before receiving and processing results
+    """
+
+  def afterFirstResult(self):
+    """
+    Do anything you want right after successfully receiving but before
+    processing first result
+    """
+
+  def postProcessing(self):
+    """
+    Do anything you want after receiving and processing all results
+    """
+
+  def processResults(self,ignoreResultsNumber=0,processResultsCount=0,timeout=-1):
+    """
+    ignoreResultsNumber
+        Don't process the first ignoreResultsNumber results.
+    processResultsCount
+        If non-zero this parameters indicates the number of results
+        processed is limited to processResultsCount.
+    timeout
+        See parameter timeout of ldap.LDAPObject.result()
+    """
+    self.preProcessing()
+    result_counter = 0
+    end_result_counter = ignoreResultsNumber+processResultsCount
+    go_ahead = 1
+    partial = 0
+    self.beginResultsDropped = 0
+    self.endResultBreak = result_counter
+    try:
+      result_type,result_list = None,None
+      while go_ahead:
+        while result_type is None and not result_list:
+          result_type,result_list,result_msgid,result_serverctrls = self._l.result3(self._msgId,0,timeout)
+          if self._afterFirstResult:
+            self.afterFirstResult()
+            self._afterFirstResult = 0
+        if not result_list:
+          break
+        if result_type not in SEARCH_RESULT_TYPES:
+          raise WrongResultType(result_type,SEARCH_RESULT_TYPES)
+        # Loop over list of search results
+        for result_item in result_list:
+          if result_counter<ignoreResultsNumber:
+            self.beginResultsDropped = self.beginResultsDropped+1
+          elif processResultsCount==0 or result_counter<end_result_counter:
+            self._processSingleResult(result_type,result_item)
+          else:
+            go_ahead = 0 # break-out from while go_ahead
+            partial = 1
+            break # break-out from this for-loop
+          result_counter = result_counter+1
+        result_type,result_list = None,None
+        self.endResultBreak = result_counter
+    finally:
+      if partial and self._msgId!=None:
+        self._l.abandon(self._msgId)
+    self.postProcessing()
+    return partial # processResults()
+
+  def _processSingleResult(self,resultType,resultItem):
+    """
+    Process single entry
+
+    resultType
+        result type
+    resultItem
+        Single item of a result list
+    """
+    pass
+
+
+class List(AsyncSearchHandler):
+  """
+  Class for collecting all search results.
+
+  This does not seem to make sense in the first place but think
+  of retrieving exactly a certain portion of the available search
+  results.
+  """
+
+  def __init__(self,l):
+    AsyncSearchHandler.__init__(self,l)
+    self.allResults = []
+
+  def _processSingleResult(self,resultType,resultItem):
+    self.allResults.append((resultType,resultItem))
+
+
+class Dict(AsyncSearchHandler):
+  """
+  Class for collecting all search results into a dictionary {dn:entry}
+  """
+
+  def __init__(self,l):
+    AsyncSearchHandler.__init__(self,l)
+    self.allEntries = {}
+
+  def _processSingleResult(self,resultType,resultItem):
+    if resultType in ENTRY_RESULT_TYPES:
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self.allEntries[dn] = entry
+
+
+class IndexedDict(Dict):
+  """
+  Class for collecting all search results into a dictionary {dn:entry}
+  and maintain case-sensitive equality indexes to entries
+  """
+
+  def __init__(self,l,indexed_attrs=None):
+    Dict.__init__(self,l)
+    self.indexed_attrs = indexed_attrs or tuple()
+    self.index = {}.fromkeys(self.indexed_attrs,{})
+
+  def _processSingleResult(self,resultType,resultItem):
+    if resultType in ENTRY_RESULT_TYPES:
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self.allEntries[dn] = entry
+      for a in self.indexed_attrs:
+        if a in entry:
+          for v in entry[a]:
+            try:
+              self.index[a][v].append(dn)
+            except KeyError:
+              self.index[a][v] = [ dn ]
+
+
+class FileWriter(AsyncSearchHandler):
+  """
+  Class for writing a stream of LDAP search results to a file object
+
+  Arguments:
+  l
+    LDAPObject instance
+  f
+    File object instance where the LDIF data is written to
+  """
+
+  def __init__(self,l,f,headerStr='',footerStr=''):
+    AsyncSearchHandler.__init__(self,l)
+    self._f = f
+    self.headerStr = headerStr
+    self.footerStr = footerStr
+
+  def preProcessing(self):
+    """
+    The headerStr is written to output after starting search but
+    before receiving and processing results.
+    """
+    self._f.write(self.headerStr)
+
+  def postProcessing(self):
+    """
+    The footerStr is written to output after receiving and
+    processing results.
+    """
+    self._f.write(self.footerStr)
+
+
+class LDIFWriter(FileWriter):
+  """
+  Class for writing a stream LDAP search results to a LDIF file
+
+  Arguments:
+
+  l
+    LDAPObject instance
+  writer_obj
+    Either a file-like object or a ldif.LDIFWriter instance used for output
+  """
+
+  def __init__(self,l,writer_obj,headerStr='',footerStr=''):
+    import ldif
+    if isinstance(writer_obj,ldif.LDIFWriter):
+      self._ldif_writer = writer_obj
+    else:
+      self._ldif_writer = ldif.LDIFWriter(writer_obj)
+    FileWriter.__init__(self,l,self._ldif_writer._output_file,headerStr,footerStr)
+
+  def _processSingleResult(self,resultType,resultItem):
+    if resultType in ENTRY_RESULT_TYPES:
+      # Search continuations are ignored
+      dn,entry = resultItem
+      self._ldif_writer.unparse(dn,entry)
diff --git a/Tests/t_ldap_asyncsearch.py b/Tests/t_ldap_asyncsearch.py
new file mode 100644
index 0000000..8b46966
--- /dev/null
+++ b/Tests/t_ldap_asyncsearch.py
@@ -0,0 +1,25 @@
+import importlib
+import os
+import unittest
+import warnings
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap.asyncsearch
+
+
+class TestLdapAsyncSearch(unittest.TestCase):
+    def test_deprecated(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('once', DeprecationWarning)
+            old = importlib.import_module('ldap.async')
+        self.assertEqual(len(w), 1)
+        diff = set(dir(ldap.asyncsearch)).difference(dir(old))
+        self.assertEqual(diff, set())
+
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/Tests/t_untested_mods.py b/Tests/t_untested_mods.py
index 7595a78..7f0f30d 100644
--- a/Tests/t_untested_mods.py
+++ b/Tests/t_untested_mods.py
@@ -1,5 +1,5 @@
 # modules without any tests
-import ldap.async
+
 import ldap.controls.deref
 import ldap.controls.openldap
 import ldap.controls.ppolicy
@@ -9,6 +9,7 @@
 import ldap.controls.sessiontrack
 import ldap.controls.sss
 import ldap.controls.vlv
+import ldap.constants
 import ldap.logger
 import ldap.resiter
 import ldap.syncrepl

From 5f4cc86deb9361308ca6735cf13f0c9b2cad90b3 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 11 Dec 2017 13:29:19 +0100
Subject: [PATCH 681/868] Provide build deps for Alpine and CentOS

Provide build deps for Alpine and CentOS

Also updates build deps for Fedora and Debian,
and format the shell commands nicely.

See: https://github.com/pyldap/pyldap/issues/91#issuecomment-350098897

https://github.com/python-ldap/python-ldap/pull/113
Some changes by Petr Viktorin
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/installing.rst | 38 ++++++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index a5e0892..01d39c7 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -1,3 +1,5 @@
+.. highlight:: console
+
 .. _installing:
 
 Installing python-ldap
@@ -18,7 +20,7 @@ The preferred point for downloading the “official” source distribution
 is the `PyPI repository`_ which supports installing via `pip`_.
 For example::
 
-    python -m pip install python-ldap
+    $ python -m pip install python-ldap
 
 .. _PyPI repository: https://pypi.python.org/pypi/python-ldap/
 .. _pip: https://pip.pypa.io/en/stable/
@@ -83,8 +85,8 @@ Mac OS X
 
 You can install directly with pip::
 
-    xcode-select --install
-    pip install python-ldap \
+    $ xcode-select --install
+    $ pip install python-ldap \
         --global-option=build_ext \
         --global-option="-I$(xcrun --show-sdk-path)/usr/include/sasl"
 
@@ -98,8 +100,8 @@ Installing from Source
 python-ldap is built and installed using the Python setuptools.
 From a source repository::
 
-    python -m pip install setuptools
-    python setup.py install
+    $ python -m pip install setuptools
+    $ python setup.py install
 
 If you have more than one Python interpreter installed locally, you should
 use the same one you plan to use python-ldap with.
@@ -132,22 +134,38 @@ on the local system when building python-ldap:
 .. _Cyrus SASL: https://www.cyrusimap.org/sasl/
 
 
+Alpine
+------
+
+Packages for building::
+
+    # apk add build-base openldap-dev python2-dev python3-dev
+
+CentOS
+------
+
+Packages for building::
+
+   # yum groupinstall "Development tools"
+   # yum install openldap-devel python-devel
+
 Debian
 ------
 
 Packages for building and testing::
 
-    apt-get install build-essential python3-dev python2.7-dev libldap2-dev \
-        libsasl2-dev slapd ldap-utils python-tox valgrind
-
+   # apt-get install build-essential python3-dev python2.7-dev \
+       libldap2-dev libsasl2-dev slapd ldap-utils python-tox \
+       lcov valgrind
 
 Fedora
 ------
 
 Packages for building and testing::
 
-    dnf install "@C Development Tools and Libraries" openldap-devel \
-        python2-devel python3-devel python3-tox valgrind clang-analyzer
+   # dnf install "@C Development Tools and Libraries" openldap-devel \
+       python2-devel python3-devel python3-tox \
+       lcov clang-analyzer valgrind
 
 .. note::
 

From 44f7ba266a5ae2cf12dfe60d37c1764de3fade9f Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 11 Dec 2017 14:10:07 +0100
Subject: [PATCH 682/868] Make valgrind check more useful

* make valgrind now fails when valgrind detects a definitive memory leak
* suppress a known memory leak in OpenLDAP's NSS module

https://github.com/python-ldap/python-ldap/pull/111
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Makefile              | 10 +++++++++-
 Misc/python-ldap.supp | 10 ++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 150981c..e4ff75a 100644
--- a/Makefile
+++ b/Makefile
@@ -63,9 +63,17 @@ $(PYTHON_SUPP):
 	exit 1;
 
 valgrind: build $(PYTHON_SUPP)
-	valgrind --leak-check=full \
+	valgrind \
+	    --leak-check=full \
+	    --track-fds=yes \
 	    --suppressions=$(PYTHON_SUPP) \
 	    --suppressions=Misc/python-ldap.supp \
 	    --gen-suppressions=all \
 	    --log-file=build/valgrind.log \
 	    $(PYTHON) setup.py test
+
+	@grep -A7 "blocks are definitely lost" build/valgrind.log; \
+	if [ $$? == 0 ]; then \
+	    echo "Found definitive leak, see build/valgrind.log"; \
+	    exit 1; \
+	fi
diff --git a/Misc/python-ldap.supp b/Misc/python-ldap.supp
index de70446..3267fd0 100644
--- a/Misc/python-ldap.supp
+++ b/Misc/python-ldap.supp
@@ -27,6 +27,16 @@
    ...
 }
 
+{
+   NSS backend leaks one string during first initialization
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:PL_strdup
+   fun:tlsm_init
+   ...
+}
+
 {
    Ignore possible leaks in exception initialization
    Memcheck:Leak

From 2ad72f26e809aeb6e014663f545384f8ee50ae61 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 11 Dec 2017 14:20:57 +0100
Subject: [PATCH 683/868] Minimal configuration for pytest

Configure setup.cfg for pytest

python-ldap uses a non-standard configuration for tests.

Also, fix test class:
TestSubschemaUrlfetch must be a subclass of TestCase, not TestSuite.

https://github.com/python-ldap/python-ldap/pull/114
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .gitignore                      | 1 +
 Doc/contributing.rst            | 2 +-
 Tests/t_ldap_schema_subentry.py | 3 ++-
 setup.cfg                       | 8 ++++++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4e261ca..962248f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ __pycache__/
 .tox
 .coverage*
 !.coveragerc
+/.cache
 
 # shared libs installed by 'setup.py test'
 /Lib/*.so*
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index 45c40f3..abefc4a 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -224,7 +224,7 @@ Run reference leak tests::
 
     $ cd path/to/python-ldap
     $ /tmp/refleak/bin/pip install --upgrade .
-    $ /tmp/refleak/bin/pytest -v -R: Tests/t_*.py
+    $ /tmp/refleak/bin/pytest -v -R:
 
 Run ``/tmp/refleak/bin/pip install --upgrade .`` every time a file outside
 of ``Tests/`` is modified.
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index d406b46..3c07d35 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -25,6 +25,7 @@
     os.path.join(HERE, 'data', 'subschema-openldap-all.ldif'),
 )
 
+
 class TestSubschemaLDIF(unittest.TestCase):
     """
     test ldap.schema.SubSchema with subschema subentries read from LDIF files
@@ -49,7 +50,7 @@ def test_subschema_file(self):
                     self.assertEqual(attributetype.oid, oid)
 
 
-class TestSubschemaUrlfetch(unittest.TestSuite):
+class TestSubschemaUrlfetch(unittest.TestCase):
     def test_urlfetch_file(self):
         freeipa_uri = 'file://{}'.format(TEST_SUBSCHEMA_FILES[0])
         dn, schema = ldap.schema.urlfetch(freeipa_uri)
diff --git a/setup.cfg b/setup.cfg
index 34699da..374dd42 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -35,3 +35,11 @@ packager = python-ldap team
 distribution_name = openSUSE 11.x
 release = 1
 doc_files = CHANGES README INSTALL TODO Demo/
+
+# pytest, https://docs.pytest.org/en/latest/customize.html
+[tool:pytest]
+testpaths = Tests
+python_files = t_*.py
+filterwarnings =
+    error
+    ignore::ldap.LDAPBytesWarning

From e5e34fcca7482921897e4c757b8658945fc455ba Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Mon, 11 Dec 2017 16:08:59 +0100
Subject: [PATCH 684/868] Doc: Move sample workflow out of the main document

The Contributing docs were too long to read.
Move the longness out, which should emphasize you'll be fine with
the usual Git workflows.

https://github.com/python-ldap/python-ldap/pull/115
---
 Doc/contributing.rst    | 91 ++++-------------------------------------
 Doc/sample_workflow.rst | 85 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 94 insertions(+), 82 deletions(-)
 create mode 100644 Doc/sample_workflow.rst

diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index abefc4a..70856c4 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -8,6 +8,12 @@ If you'd like to contribute (be it code, documentation, maintenance effort,
 or anything else), this guide is for you.
 
 
+.. toctree::
+   :hidden:
+
+   sample_workflow.rst
+
+
 Communication
 =============
 
@@ -54,8 +60,8 @@ If required, write to coordinate a more secure channel.
 All other communication should be public.
 
 
-Process for Code contributions
-==============================
+Contributing code
+=================
 
 If you're used to open-source Python development with Git, here's the gist:
 
@@ -76,86 +82,7 @@ Or, if you prefer to avoid closed-source services:
 .. _Read the Docs: http://python-ldap.readthedocs.io/
 
 If you're new to some aspect of the project, you're welcome to use (or adapt)
-the workflow below.
-
-
-Sample workflow
----------------
-
-We assume that, as a user of python-ldap you're not new to software
-development in general, so these instructions are terse.
-If you need additional detail, please do ask on the mailing list.
-
-.. note::
-
-    The following instructions are for Linux.
-    If you can translate them to another system, please contribute your
-    translation!
-
-
-Install `Git`_ and `tox`_.
-
-Clone the repository::
-
-    $ git clone https://github.com/python-ldap/python-ldap
-    $ cd python-ldap
-
-Create a `virtual environment`_ to ensure you in-development python-ldap won't
-affect the rest of your system::
-
-    $ python3 -m venv __venv__
-
-(For Python 2, install `virtualenv`_ and use it instead of ``python3 -m venv``.)
-
-.. _git: https://git-scm.com/
-.. _virtual environment: https://docs.python.org/3/library/venv.html
-.. _virtualenv: https://virtualenv.pypa.io/en/stable/
-
-Activate the virtual environment::
-
-    $ source __venv__/bin/activate
-
-Install python-ldap to it in `editable mode`_::
-
-    (__venv__)$ python -m pip install -e .
-
-This way, importing a Python module from python-ldap will directly
-use the code from your source tree.
-If you change C code, you will still need to recompile
-(using the ``pip install`` command again).
-
-.. _editable mode: https://pip.pypa.io/en/stable/reference/pip_install/#editable-installs
-
-Change the code as desired.
-
-
-To run tests, install and run `tox`_::
-
-    (__venv__)$ python -m pip install tox
-    (__venv__)$ tox --skip-missing-interpreters
-
-This will run tests on all supported versions of Python that you have
-installed, skipping the ones you don't.
-To run a subset of test environments, run for example::
-
-    (__venv__)$ tox -e py27,py36
-
-In addition to ``pyXY`` environments, we have extra environments
-for checking things independent of the Python version:
-
-* ``doc`` checks syntax and spelling of the documentation
-* ``coverage-report`` generates a test coverage report for Python code.
-  It must be used last, e.g. ``tox -e py27,py36,coverage-report``.
-* ``py2-nosasltls`` and ``py3-nosasltls`` check functionality without
-  SASL and TLS bindings compiled in.
-
-
-When your change is ready, commit to Git, and submit a pull request on GitHub.
-You can take a look at the `committer instructions`_ to see what we are looking
-for in a pull request.
-
-If you don't want to open a GitHub account, please send patches as attachments
-to the python-ldap mailing list.
+our :ref:`sample workflow <sample workflow>`.
 
 
 .. _additional tests:
diff --git a/Doc/sample_workflow.rst b/Doc/sample_workflow.rst
new file mode 100644
index 0000000..97e51c6
--- /dev/null
+++ b/Doc/sample_workflow.rst
@@ -0,0 +1,85 @@
+
+.. _sample workflow:
+
+Sample workflow for python-ldap development
+-------------------------------------------
+
+This document will guide you through the process of contributing a change
+to python-ldap.
+
+We assume that, as a user of python-ldap, you're not new to software
+development in general, so these instructions are terse.
+If you need additional detail, please do ask on the mailing list.
+
+.. note::
+
+    The following instructions are for Linux.
+    If you can translate them to another system, please contribute your
+    translation!
+
+
+Install `Git`_, `tox`_ and the :ref:`build prerequisites`.
+
+.. _tox: https://tox.readthedocs.io/en/latest/
+
+Clone the repository::
+
+    $ git clone https://github.com/python-ldap/python-ldap
+    $ cd python-ldap
+
+Create a `virtual environment`_ to ensure you in-development python-ldap won't
+affect the rest of your system::
+
+    $ python3 -m venv __venv__
+
+(For Python 2, install `virtualenv`_ and use it instead of ``python3 -m venv``.)
+
+.. _git: https://git-scm.com/
+.. _virtual environment: https://docs.python.org/3/library/venv.html
+.. _virtualenv: https://virtualenv.pypa.io/en/stable/
+
+Activate the virtual environment::
+
+    $ source __venv__/bin/activate
+
+Install python-ldap to it in `editable mode`_::
+
+    (__venv__)$ python -m pip install -e .
+
+This way, importing a Python module from python-ldap will directly
+use the code from your source tree.
+If you change C code, you will still need to recompile
+(using the ``pip install`` command again).
+
+.. _editable mode: https://pip.pypa.io/en/stable/reference/pip_install/#editable-installs
+
+Change the code as desired.
+
+
+To run tests, install and run `tox`_::
+
+    (__venv__)$ python -m pip install tox
+    (__venv__)$ tox --skip-missing-interpreters
+
+This will run tests on all supported versions of Python that you have
+installed, skipping the ones you don't.
+To run a subset of test environments, run for example::
+
+    (__venv__)$ tox -e py27,py36
+
+In addition to ``pyXY`` environments, we have extra environments
+for checking things independent of the Python version:
+
+* ``doc`` checks syntax and spelling of the documentation
+* ``coverage-report`` generates a test coverage report for Python code.
+  It must be used last, e.g. ``tox -e py27,py36,coverage-report``.
+* ``py2-nosasltls`` and ``py3-nosasltls`` check functionality without
+  SASL and TLS bindings compiled in.
+
+
+When your change is ready, commit to Git, and submit a pull request on GitHub.
+You can take a look at the :ref:`committer instructions` to see what we are looking
+for in a pull request.
+
+If you don't want to open a GitHub account, please send patches as attachments
+to the python-ldap mailing list.

From c09142a4afe00645f6ebde7c680d3e2d682374ca Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 11 Dec 2017 14:33:35 +0100
Subject: [PATCH 685/868] Bump version to 3.0.0b2

---
 Lib/ldap/pkginfo.py       | 2 +-
 Lib/ldapurl.py            | 2 +-
 Lib/ldif.py               | 2 +-
 Lib/slapdtest/__init__.py | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index 378700d..4325aac 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.0.0b1'
+__version__ = '3.0.0b2'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 9c051a1..262b6b0 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b1'
+__version__ = '3.0.0b2'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index fe14895..adb5759 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.0.0b1'
+__version__ = '3.0.0b2'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index d7d19fd..a2a875f 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b1'
+__version__ = '3.0.0b2'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import skip_unless_ci, requires_sasl, requires_tls

From 673957dfcbf3769778c184db296ad601e669c70d Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 11 Dec 2017 14:32:19 +0100
Subject: [PATCH 686/868] Update CHANGES for 3.0.0b2

---
 CHANGES | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/CHANGES b/CHANGES
index dc9aab2..3241046 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,37 @@
+----------------------------------------------------------------
+Released 3.0.0b2 2017-12-11
+
+Changes since 3.0.0b1:
+
+The module `ldap.async` is renamed to `ldap.asyncsearch`, due to
+`async` becoming a keyword in Python 3.7.
+The old module name is deprecated, but will be available as long
+as Python 3.6 is supported.
+
+Lib/
+* Use custom ldap.LDAPBytesWarning class
+* Rename ldap.async to ldap.asyncsearch
+
+Modules/
+* Support None for set_option(OPT_TIMEOUT) and OPT_NETWORK_TIMEOUT
+* Fix error reporting of LDAPObject.set_option()
+* Change memory handling in attrs_from_List()
+
+Test/
+* Remove workaround for OpenLDAP NSS issue
+
+Demo/
+* Use uniform shebang in all demos
+
+Doc/
+* Provide build deps for Alpine and CentOS
+* Move sample workflow out of the main Contributing guide
+
+Infrastructure:
+* Add valgrind target to check for memory leaks
+* Minimal configuration for pytest
+
+
 ----------------------------------------------------------------
 Released 3.0.0b1 2017-12-04
 

From bb802b60d93c988b570541a980bf66b7e6b342d4 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Mon, 11 Dec 2017 21:38:55 -0800
Subject: [PATCH 687/868] Prefer literals throughout project

- Use a dict literal instead of calling dict().
- Use a list literal instead of calling list().
- Use a set literal instead of calling set().
- Use a tuple literal instead of calling tuple().
- Use dict comprehension

These syntax expressions are available by all supported Python versions.
Literals are always faster than calling the constructor. More idiomatic
with wider Python community.
---
 Demo/pyasn1/syncrepl.py      |  6 +++---
 Lib/ldap/asyncsearch.py      | 10 +++++-----
 Lib/ldap/controls/deref.py   |  6 +++---
 Lib/ldap/controls/psearch.py |  2 +-
 Lib/ldap/ldapobject.py       | 16 ++++++++--------
 Lib/ldap/schema/models.py    |  4 ++--
 Lib/ldap/syncrepl.py         |  2 +-
 Lib/ldif.py                  |  2 +-
 Tests/t_ldap_syncrepl.py     |  2 +-
 setup.py                     | 14 +++++++-------
 10 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 3614792..61d63ad 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -45,9 +45,9 @@ def __init__(self, db_path, *args, **kwargs):
         if db_path:
             self.__data = shelve.open(db_path, 'c')
         else:
-            self.__data = dict()
+            self.__data = {}
         # We need this for later internal use
-        self.__presentUUIDs = dict()
+        self.__presentUUIDs = {}
 
     def close_db(self):
         # Close the data store properly to avoid corruption
@@ -64,7 +64,7 @@ def syncrepl_entry(self, dn, attributes, uuid):
         logger.debug('dn=%r attributes=%r uuid=%r', dn, attributes, uuid)
         # First we determine the type of change we have here
         # (and store away the previous data for later if needed)
-        previous_attributes = dict()
+        previous_attributes = {}
         if uuid in self.__data:
             change_type = 'modify'
             previous_attributes = self.__data[uuid]
diff --git a/Lib/ldap/asyncsearch.py b/Lib/ldap/asyncsearch.py
index 97b3fff..80b5b2a 100644
--- a/Lib/ldap/asyncsearch.py
+++ b/Lib/ldap/asyncsearch.py
@@ -8,16 +8,16 @@
 
 from ldap import __version__
 
-SEARCH_RESULT_TYPES = set([
+SEARCH_RESULT_TYPES = {
   ldap.RES_SEARCH_ENTRY,
   ldap.RES_SEARCH_RESULT,
   ldap.RES_SEARCH_REFERENCE,
-])
+}
 
-ENTRY_RESULT_TYPES = set([
+ENTRY_RESULT_TYPES = {
   ldap.RES_SEARCH_ENTRY,
   ldap.RES_SEARCH_RESULT,
-])
+}
 
 
 class WrongResultType(Exception):
@@ -207,7 +207,7 @@ class IndexedDict(Dict):
 
   def __init__(self,l,indexed_attrs=None):
     Dict.__init__(self,l)
-    self.indexed_attrs = indexed_attrs or tuple()
+    self.indexed_attrs = indexed_attrs or ()
     self.index = {}.fromkeys(self.indexed_attrs,{})
 
   def _processSingleResult(self,resultType,resultItem):
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index 762ab85..b927f1a 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -107,10 +107,10 @@ def decodeControlValue(self,encodedControlValue):
     self.derefRes = {}
     for deref_res in decodedValue:
       deref_attr,deref_val,deref_vals = deref_res[0],deref_res[1],deref_res[2]
-      partial_attrs_dict = dict([
-        (str(tv[0]),map(str,tv[1]))
+      partial_attrs_dict = {
+        str(tv[0]): map(str,tv[1])
         for tv in deref_vals or []
-      ])
+      }
       try:
         self.derefRes[str(deref_attr)].append((str(deref_val),partial_attrs_dict))
       except KeyError:
diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
index 74e40a3..002a88e 100644
--- a/Lib/ldap/controls/psearch.py
+++ b/Lib/ldap/controls/psearch.py
@@ -32,7 +32,7 @@
   'modify':4,
   'modDN':8,
 }
-CHANGE_TYPES_STR = dict([(v,k) for k,v in CHANGE_TYPES_INT.items()])
+CHANGE_TYPES_STR = {v: k for k,v in CHANGE_TYPES_INT.items()}
 
 
 class PersistentSearchControl(RequestControl):
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index f37ef24..daa4fba 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -227,10 +227,10 @@ def _bytesify_result_value(self, result_value):
       return result_value
     if hasattr(result_value, 'items'):
       # It's a attribute_name: [values] dict
-      return dict(
-        (self._maybe_rebytesify_text(key), value)
+      return {
+        self._maybe_rebytesify_text(key): value
         for (key, value) in result_value.items()
-      )
+      }
     elif isinstance(result_value, bytes):
       return result_value
     else:
@@ -991,13 +991,13 @@ class ReconnectLDAPObject(SimpleLDAPObject):
   application.
   """
 
-  __transient_attrs__ = set([
+  __transient_attrs__ = {
     '_l',
     '_ldap_object_lock',
     '_trace_file',
     '_reconnect_lock',
     '_last_bind',
-  ])
+  }
 
   def __init__(
     self,uri,
@@ -1025,11 +1025,11 @@ def __init__(
 
   def __getstate__(self):
     """return data representation for pickled object"""
-    state = dict([
-        (k,v)
+    state = {
+        k: v
         for k,v in self.__dict__.items()
         if k not in self.__transient_attrs__
-    ])
+    }
     state['_last_bind'] = self._last_bind[0].__name__, self._last_bind[1], self._last_bind[2]
     return state
 
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index c0391b4..84054f8 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -11,7 +11,7 @@
 
 from ldap.schema.tokenizer import split_tokens,extract_tokens
 
-NOT_HUMAN_READABLE_LDAP_SYNTAXES = set([
+NOT_HUMAN_READABLE_LDAP_SYNTAXES = {
   '1.3.6.1.4.1.1466.115.121.1.4',  # Audio
   '1.3.6.1.4.1.1466.115.121.1.5',  # Binary
   '1.3.6.1.4.1.1466.115.121.1.8',  # Certificate
@@ -21,7 +21,7 @@
   '1.3.6.1.4.1.1466.115.121.1.28', # JPEG
   '1.3.6.1.4.1.1466.115.121.1.40', # Octet String
   '1.3.6.1.4.1.1466.115.121.1.49', # Supported Algorithm
-])
+}
 
 
 class SchemaElement:
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 35d4c45..0de5cec 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -323,7 +323,7 @@ def __init__(self, encodedMessage):
                     self.newcookie = str(comp)
                     return
 
-                val = dict()
+                val = {}
 
                 cookie = comp.getComponentByName('cookie')
                 if cookie.hasValue():
diff --git a/Lib/ldif.py b/Lib/ldif.py
index adb5759..0e78fb1 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -69,7 +69,7 @@ def list_dict(l):
   """
   return a dictionary with all items of l being the keys of the dictionary
   """
-  return dict([(i,None) for i in l])
+  return {i: None for i in l}
 
 
 class LDIFWriter:
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 831c063..faa6856 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -247,7 +247,7 @@ def syncrepl_present(self, uuids, refreshDeletes=False):
             self.present.extend(uuids)
 
         elif (uuids is None) and (refreshDeletes is False):
-            deleted_uuids = list()
+            deleted_uuids = []
             for uuid in self.uuid_dn.keys():
                 if uuid not in self.present:
                     deleted_uuids.append(uuid)
diff --git a/setup.py b/setup.py
index 3d7d338..0afa555 100644
--- a/setup.py
+++ b/setup.py
@@ -71,18 +71,18 @@ class OpenLDAP2:
 # setup() in a fashion that doesn't break compatibility  to
 # distutils. This still allows 'normal' builds where either
 # Python > 2.3.5 or setuptools (or both ;o) are not available.
-kwargs = dict()
+kwargs = {}
 if has_setuptools:
-  kwargs = dict(
-    include_package_data = True,
-    install_requires = [
+  kwargs = {
+    'include_package_data': True,
+    'install_requires': [
         'setuptools',
         'pyasn1 >= 0.3.7',
         'pyasn1_modules >= 0.1.5',
     ],
-    zip_safe = False,
-    python_requires = '>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
-  )
+    'zip_safe': False,
+    'python_requires': '>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
+  }
 
 setup(
   #-- Package description

From 4ad46bb0c666d1b04222c1c5f55e1566c8763d60 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Tue, 12 Dec 2017 01:29:47 -0800
Subject: [PATCH 688/868] Always use https with all readthedocs links

https://github.com/python-ldap/python-ldap/pull/119
---
 CONTRIBUTING.rst         | 2 +-
 Doc/bytes_mode.rst       | 2 +-
 Doc/contributing.rst     | 2 +-
 Doc/index.rst            | 2 +-
 INSTALL                  | 2 +-
 Tests/t_ldap_syncrepl.py | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CONTRIBUTING.rst b/CONTRIBUTING.rst
index 0866c8e..7fd68fc 100644
--- a/CONTRIBUTING.rst
+++ b/CONTRIBUTING.rst
@@ -4,7 +4,7 @@ If you wish to help, detailed instructions are in `Doc/contributing.rst`_,
 and in `online documentation`_.
 
 .. _Doc/contributing.rst: Doc/contributing.rst
-.. _online documentation: http://python-ldap.readthedocs.io/en/latest/contributing.html
+.. _online documentation: https://python-ldap.readthedocs.io/en/latest/contributing.html
 
 
 Open-source veretans should find no surprises there.
diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index c775b27..bbd83db 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -85,7 +85,7 @@ General instructions for this are provided `in Python documentation`_ and in
 the `Conservative porting guide`_.
 
 .. _in Python documentation: https://docs.python.org/3/howto/pyporting.html
-.. _Conservative porting guide: http://portingguide.readthedocs.io/en/latest/
+.. _Conservative porting guide: https://portingguide.readthedocs.io/en/latest/
 
 
 When porting from python-ldap 2.x, users are advised to update their code
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index 70856c4..c45e9c9 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -79,7 +79,7 @@ Or, if you prefer to avoid closed-source services:
 * Run tests with `tox`_; ignore Python interpreters you don't have locally.
 * Read the documentation directly at `Read the Docs`_.
 
-.. _Read the Docs: http://python-ldap.readthedocs.io/
+.. _Read the Docs: https://python-ldap.readthedocs.io/
 
 If you're new to some aspect of the project, you're welcome to use (or adapt)
 our :ref:`sample workflow <sample workflow>`.
diff --git a/Doc/index.rst b/Doc/index.rst
index ef652d9..fcf9005 100644
--- a/Doc/index.rst
+++ b/Doc/index.rst
@@ -57,7 +57,7 @@ versions for offline use, using the sidebar on the right.
 Documentation for some older versions is available for download at the
 `GitHub release page`_.
 
-.. _Read the Docs: http://python-ldap.readthedocs.io/en/latest/
+.. _Read the Docs: https://python-ldap.readthedocs.io/en/latest/
 .. _GitHub release page: https://github.com/python-ldap/python-ldap/releases
 
 
diff --git a/INSTALL b/INSTALL
index 0475a2f..b9b13d2 100644
--- a/INSTALL
+++ b/INSTALL
@@ -6,4 +6,4 @@ Quick build instructions:
 
 Detailed instructions are in Doc/installing.rst, or online at:
 
-    http://python-ldap.readthedocs.io/en/latest/installing.html
+    https://python-ldap.readthedocs.io/en/latest/installing.html
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index faa6856..539ff3a 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -241,7 +241,7 @@ def syncrepl_present(self, uuids, refreshDeletes=False):
         """
         The 'present' message from the LDAP server is the most complicated
         part of the refresh phase.  Suggest looking here for more info:
-        http://syncrepl-client.readthedocs.io/en/latest/client.html
+        https://syncrepl-client.readthedocs.io/en/latest/client.html
         """
         if (uuids is not None) and (refreshDeletes is False):
             self.present.extend(uuids)

From e80cc61139183951ed2b59317bebf14a7ec736e7 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Tue, 12 Dec 2017 19:25:18 -0800
Subject: [PATCH 689/868] Fix remaining links that can be https

---
 Demo/resiter.py               | 2 +-
 Doc/installing.rst            | 2 +-
 Lib/ldap/controls/openldap.py | 2 +-
 Tests/t_ldap_sasl.py          | 2 +-
 Tests/t_ldap_syncrepl.py      | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Demo/resiter.py b/Demo/resiter.py
index d6796ba..96e9c90 100644
--- a/Demo/resiter.py
+++ b/Demo/resiter.py
@@ -2,7 +2,7 @@
 Demo for using ldap.resiter.ResultProcessor
 written by Michael Stroeder <michael@stroeder.com>
 
-See http://www.python-ldap.org for details.
+See https://www.python-ldap.org for details.
 """
 from __future__ import print_function
 
diff --git a/Doc/installing.rst b/Doc/installing.rst
index 01d39c7..efbab70 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -55,7 +55,7 @@ hit a problem already fixed in recent releases.
 ---------------------------------------------
 
 Ships with python-ldap and there's an additional
-`download repository <http://download.opensuse.org/repositories/devel:/languages:/python/>`_
+`download repository <https://download.opensuse.org/repositories/devel:/languages:/python/>`_
 which contains builds of latest releases
 (see also `OBS package <https://build.opensuse.org/package/show/devel:languages:python/python-ldap>`_).
 
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 7108c63..5da2dd3 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -23,7 +23,7 @@ class SearchNoOpControl(ValueLessRequestControl,ResponseControl):
   No-op control attached to search operations implementing sort of a
   count operation
 
-  see http://www.openldap.org/its/index.cgi?findid=6598
+  see https://www.openldap.org/its/index.cgi?findid=6598
   """
   controlType = '1.3.6.1.4.1.4203.666.5.18'
 
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index 7f472cc..af6ed51 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -2,7 +2,7 @@
 """
 Automatic tests for python-ldap's module ldap.sasl
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 """
 import os
 import pwd
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 539ff3a..0581e50 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -2,7 +2,7 @@
 """
 Automatic tests for python-ldap's module ldap.syncrepl
 
-See http://www.python-ldap.org/ for details.
+See https://www.python-ldap.org/ for details.
 """
 
 

From f94619f75856bc8b6a1cf7f48adee47ec82246a9 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 13 Dec 2017 02:50:19 -0800
Subject: [PATCH 690/868] Drop distutils workaround and simplify setup.py

Modern Python installations contain setuptools. It is reasonable to
expect it to exist. Simplifies setup.py and removes the large comment
explaining the workaround.

https://github.com/python-ldap/python-ldap/pull/123
---
 setup.py | 34 ++++++++--------------------------
 1 file changed, 8 insertions(+), 26 deletions(-)

diff --git a/setup.py b/setup.py
index 0afa555..2f6bd89 100644
--- a/setup.py
+++ b/setup.py
@@ -5,13 +5,7 @@
 """
 
 import sys,os
-
-has_setuptools = False
-try:
-  from setuptools import setup, Extension
-  has_setuptools = True
-except ImportError:
-  from distutils.core import setup, Extension
+from setuptools import setup, Extension
 
 if sys.version_info[0] == 2 and sys.version_info[1] < 7:
     raise RuntimeError('This software requires Python 2.7 or 3.x.')
@@ -66,24 +60,6 @@ class OpenLDAP2:
 #-- Let distutils/setuptools do the rest
 name = 'python-ldap'
 
-# Python 2.3.6+ and setuptools are needed to build eggs, so
-# let's handle setuptools' additional  keyword arguments to
-# setup() in a fashion that doesn't break compatibility  to
-# distutils. This still allows 'normal' builds where either
-# Python > 2.3.5 or setuptools (or both ;o) are not available.
-kwargs = {}
-if has_setuptools:
-  kwargs = {
-    'include_package_data': True,
-    'install_requires': [
-        'setuptools',
-        'pyasn1 >= 0.3.7',
-        'pyasn1_modules >= 0.1.5',
-    ],
-    'zip_safe': False,
-    'python_requires': '>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
-  }
-
 setup(
   #-- Package description
   name = name,
@@ -186,6 +162,12 @@ class OpenLDAP2:
   ],
   package_dir = {'': 'Lib',},
   data_files = LDAP_CLASS.extra_files,
+  include_package_data=True,
+  install_requires=[
+    'pyasn1 >= 0.3.7',
+    'pyasn1_modules >= 0.1.5',
+  ],
+  zip_safe=False,
+  python_requires='>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
   test_suite = 'Tests',
-  **kwargs
 )

From 5b8b265f9bcf9fbe1003190cdf19090a14bc7e64 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 13 Dec 2017 11:53:00 +0100
Subject: [PATCH 691/868] Run Travis tests with PyPy

To my surprose, python-ldap works just fine with PyPy2. For Python 3,
PyPy-5.9 (Python 3.5) is required. Fedora's and Ubuntu's PyPy 5.5 is
too old (Python 3.3).

https://github.com/python-ldap/python-ldap/pull/122
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml |  5 +++++
 tox.ini     | 11 +++++++++++
 2 files changed, 16 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 00eb629..22559b7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -34,6 +34,9 @@ matrix:
       env:
         - TOXENV=py36
         - WITH_GCOV=1
+    - python: pypy
+      env:
+        - TOXENV=pypy
     - python: 3.7-dev
       env:
         - TOXENV=py37
@@ -52,6 +55,8 @@ matrix:
      - env:
         - TOXENV=py37
         - WITH_GCOV=1
+     - env:
+        - TOXENV=pypy
 
 env:
     global:
diff --git a/tox.ini b/tox.ini
index 6d984c0..95fee06 100644
--- a/tox.ini
+++ b/tox.ini
@@ -46,6 +46,17 @@ passenv = {[testenv]passenv}
 setenv = {[testenv:py2-nosasltls]setenv}
 commands = {[testenv:py2-nosasltls]commands}
 
+[testenv:pypy]
+# PyPy doesn't have working setup.py test
+deps = pytest
+commands = {envpython} -m pytest
+
+[testenv:pypy35]
+# PyPy-5.9.0
+basepython = pypy3.5
+deps = {[testenv:pypy]deps}
+commands = {[testenv:pypy]commands}
+
 [testenv:coverage-report]
 deps = coverage
 skip_install = true

From 8f2cded7ffd3ef68f3f96d8432757b60c62b1607 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 13 Dec 2017 11:53:52 +0100
Subject: [PATCH 692/868] Run clean --all in all tox targets (#121)

The second full tox run fails because 'py27' target is picking up C
object files from 'py2-nosasltls'. Each target needs to clean up and
start from scratch.

https://github.com/python-ldap/python-ldap/pull/121
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 tox.ini | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tox.ini b/tox.ini
index 95fee06..fcfc628 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,7 +18,9 @@ passenv = WITH_GCOV
 commands = {envpython} -bb -Werror \
     "-Wignore:the imp module is deprecated:DeprecationWarning" \
     "-Wignore:the imp module is deprecated:PendingDeprecationWarning" \
-    -m coverage run --parallel setup.py test
+    -m coverage run --parallel setup.py \
+        clean --all \
+        test
 
 [testenv:py27]
 # No warnings with Python 2.7

From 9dff16169ffa82414588e0b64b3bdd059ce59abc Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 13 Dec 2017 04:41:24 -0800
Subject: [PATCH 693/868] Doc deprecated functions for removal in 3.1

- ldap.open()
- ldap.init()
- ldif.CreateLDIF()
- ldif.ParseLDIF()
---
 Doc/reference/ldap.rst | 15 ++++++++++++++-
 Doc/reference/ldif.rst | 12 ++++++++++++
 Lib/ldap/functions.py  |  7 ++++++-
 Lib/ldif.py            | 17 +++++++++++++++--
 4 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 277520e..2099414 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -73,8 +73,21 @@ This module defines the following functions:
    string containing solely the host name. *port* is an integer specifying the
    port where the LDAP server is  listening (default is 389).
 
-   Note: Using this function is deprecated.
+   .. deprecated:: 3.0
 
+      ``ldap.open()`` is deprecated. It will be removed in version 3.1. Use
+      :func:`ldap.initialize()` with a URI like ``'ldap://<hostname>:<port>'``
+      instead.
+
+.. py:function:: init(host [, port=PORT]) -> LDAPObject object
+
+   Alias of :func:`ldap.open()`.
+
+   .. deprecated:: 3.0
+
+      ``ldap.init()`` is deprecated. It will be removed in version 3.1. Use
+      :func:`ldap.initialize()` with a URI like ``'ldap://<hostname>:<port>'``
+      instead.
 
 .. py:function:: get_option(option) -> int|string
 
diff --git a/Doc/reference/ldif.rst b/Doc/reference/ldif.rst
index 1a9eabc..64afbb0 100644
--- a/Doc/reference/ldif.rst
+++ b/Doc/reference/ldif.rst
@@ -22,8 +22,20 @@ Functions
 
 .. autofunction:: ldif.CreateLDIF
 
+   .. deprecated:: 3.0
+
+      ``ldif.CreateLDIF()`` is deprecated. It will be removed in version 3.1.
+      Use :meth:`ldif.LDIFWriter.unparse` with a file or ``io.StringIO``
+      instead.
+
 .. autofunction:: ldif.ParseLDIF
 
+   .. deprecated:: 3.0
+
+      ``ldif.ParseLDIF()`` is deprecated. It will be removed in version 3.1.
+      Use the ``all_records`` attribute of the returned value of
+      ``ldif.LDIFRecordList.parse()`` instead.
+
 
 Classes
 ^^^^^^^
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 1588221..3dfeee4 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -101,7 +101,12 @@ def open(host,port=389,trace_level=0,trace_file=sys.stdout,trace_stack_limit=Non
         Whether to enable "bytes_mode" for backwards compatibility under Py2.
   """
   import warnings
-  warnings.warn('ldap.open() is deprecated! Use ldap.initialize() instead.', DeprecationWarning,2)
+  warnings.warn(
+    'ldap.open() is deprecated. Use ldap.initialize() instead. It will be '
+    'removed in python-ldap 3.1.',
+    category=DeprecationWarning,
+    stacklevel=2,
+  )
   return initialize('ldap://%s:%d' % (host,port),trace_level,trace_file,trace_stack_limit,bytes_mode)
 
 init = open
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 0e78fb1..16fb8c3 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -23,6 +23,7 @@
 import re
 from base64 import b64encode, b64decode
 from io import StringIO
+import warnings
 
 from ldap.compat import urlparse, urlopen
 
@@ -209,7 +210,7 @@ def unparse(self,dn,record):
 def CreateLDIF(dn,record,base64_attrs=None,cols=76):
   """
   Create LDIF single formatted record including trailing empty line.
-  This is a compatibility function. Use is deprecated!
+  This is a compatibility function.
 
   dn
         string-representation of distinguished name
@@ -222,6 +223,12 @@ def CreateLDIF(dn,record,base64_attrs=None,cols=76):
         Specifies how many columns a line may have before it's
         folded into many lines.
   """
+  warnings.warn(
+    'ldif.CreateLDIF() is deprecated. Use LDIFWriter.unparse() instead. It '
+    'will be removed in python-ldap 3.1',
+    category=DeprecationWarning,
+    stacklevel=2,
+  )
   f = StringIO()
   ldif_writer = LDIFWriter(f,base64_attrs,cols,'\n')
   ldif_writer.unparse(dn,record)
@@ -633,8 +640,14 @@ def handle(self,dn,entry):
 def ParseLDIF(f,ignore_attrs=None,maxentries=0):
   """
   Parse LDIF records read from file.
-  This is a compatibility function. Use is deprecated!
+  This is a compatibility function.
   """
+  warnings.warn(
+    'ldif.ParseLDIF() is deprecated. Use LDIFRecordList.parse() instead. It '
+    'will be removed in python-ldap 3.1',
+    category=DeprecationWarning,
+    stacklevel=2,
+  )
   ldif_parser = LDIFRecordList(
     f,ignored_attr_types=ignore_attrs,max_entries=maxentries,process_url_schemes=0
   )

From cf24a545de3e70740db76cde0c94384ddb6348c7 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 13 Dec 2017 16:05:46 +0100
Subject: [PATCH 694/868] Add pragma: no cover to avoid spurious cov changes

"pragma: no cover" was added to two helper functions in slapdtest to
avoid spurious changes in coverage whenever slapd has a hick up.

https://github.com/python-ldap/python-ldap/pull/129
Closes: https://github.com/python-ldap/python-ldap/issues/127
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest/_slapdtest.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index f3f096c..ef627ef 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -344,7 +344,9 @@ def _start_slapd(self):
         self._log.info('starting slapd: %r', ' '.join(slapd_args))
         self._proc = subprocess.Popen(slapd_args)
         # Waits until the LDAP server socket is open, or slapd crashed
-        while 1:
+        # no cover to avoid spurious coverage changes, see
+        # https://github.com/python-ldap/python-ldap/issues/127
+        while 1:  # pragma: no cover
             if self._proc.poll() is not None:
                 self._stopped()
                 raise RuntimeError("slapd exited before opening port")
@@ -430,7 +432,9 @@ def _cli_auth_args(self):
             ]
         return authc_args
 
-    def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None, stdin_data=None):
+    # no cover to avoid spurious coverage changes
+    def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None,
+                   stdin_data=None):  # pragma: no-cover
         args = [
             ldapcommand,
             '-H', ldap_uri or self.ldapi_uri,

From a3723bc588efe808cb9b9b233499a5c151c490ef Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 6 Dec 2017 14:49:08 +0100
Subject: [PATCH 695/868] When raising LDAPBytesWarning, walk the stack to
 determine stacklevel

Closes: https://github.com/python-ldap/python-ldap/issues/108
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Some simplification by: Petr Viktorin
---
 Lib/ldap/ldapobject.py | 21 +++++++++++++-
 Modules/ldapmodule.c   |  7 +++++
 Tests/t_ldapobject.py  | 63 +++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 89 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index daa4fba..1929a92 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -39,6 +39,9 @@
   text_type = str
 
 
+# See SimpleLDAPObject._bytesify_input
+_LDAP_WARN_SKIP_FRAME = True
+
 class LDAPBytesWarning(BytesWarning):
   """python-ldap bytes mode warning
   """
@@ -126,11 +129,27 @@ def _bytesify_input(self, value):
         if self.bytes_mode_hardfail:
           raise TypeError("All provided fields *must* be bytes when bytes mode is on; got %r" % (value,))
         else:
+          # Raise LDAPBytesWarning.
+          # Call stacks with _bytesify_input tend to be complicated, so
+          # getting a useful stacklevel is tricky.
+          # We walk stack frames, ignoring all functions in this file
+          # and in the _ldap extension, based on a marker in globals().
+          stacklevel = 0
+          try:
+            getframe = sys._getframe
+          except AttributeError:
+            pass
+          else:
+            frame = sys._getframe(stacklevel)
+            # walk up the stacks until we leave the file
+            while frame and frame.f_globals.get('_LDAP_WARN_SKIP_FRAME'):
+                stacklevel += 1
+                frame = frame.f_back
           warnings.warn(
             "Received non-bytes value %r with default (disabled) bytes mode; please choose an explicit "
             "option for bytes_mode on your LDAP connection" % (value,),
             LDAPBytesWarning,
-            stacklevel=6,
+            stacklevel=stacklevel+1,
           )
           return value.encode('utf-8')
     else:
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 18e0696..d5edd82 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -72,6 +72,13 @@ PyObject* init_ldap_module(void)
 	LDAPinit_functions(d);
 	LDAPinit_control(d);
 
+    /* Marker for LDAPBytesWarning stack walking
+     * see SimpleLDAPObject._bytesify_input in ldapobject.py
+     */
+    if (PyModule_AddIntConstant(m, "_LDAP_WARN_SKIP_FRAME", 1) != 0) {
+        return NULL;
+    }
+
 	/* Check for errors */
 	if (PyErr_Occurred())
 		Py_FatalError("can't initialize module _ldap");
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 835512b..f833fec 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -16,8 +16,11 @@
     PY2 = False
     text_type = str
 
+import contextlib
+import linecache
 import os
 import unittest
+import warnings
 import pickle
 import warnings
 from slapdtest import SlapdTestCase, requires_sasl
@@ -329,7 +332,7 @@ def test_ldapbyteswarning(self):
         self.assertIsInstance(self.server.suffix, text_type)
         with warnings.catch_warnings(record=True) as w:
             warnings.resetwarnings()
-            warnings.simplefilter('default')
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
             conn = self._get_bytes_ldapobject(explicit=False)
             result = conn.search_s(
                 self.server.suffix,
@@ -350,6 +353,64 @@ def test_ldapbyteswarning(self):
             "LDAP connection" % self.server.suffix
         )
 
+    @contextlib.contextmanager
+    def catch_byteswarnings(self, *args, **kwargs):
+        with warnings.catch_warnings(record=True) as w:
+            conn = self._get_bytes_ldapobject(*args, **kwargs)
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            yield conn, w
+
+    def _test_byteswarning_level_search(self, methodname):
+        with self.catch_byteswarnings(explicit=False) as (conn, w):
+            method = getattr(conn, methodname)
+            result = method(
+                self.server.suffix.encode('utf-8'),
+                ldap.SCOPE_SUBTREE,
+                '(cn=Foo*)',
+                attrlist=['*'],  # CORRECT LINE
+            )
+            self.assertEqual(len(result), 4)
+
+        self.assertEqual(len(w), 2, w)
+
+        def _normalize(filename):
+            # Python 2 likes to report the ".pyc" file in warnings,
+            # tracebacks or __file__.
+            # Use the corresponding ".py" in that case.
+            if filename.endswith('.pyc'):
+                return filename[:-1]
+            return filename
+
+        self.assertIs(w[0].category, ldap.LDAPBytesWarning)
+        self.assertIn(
+            u"Received non-bytes value u'(cn=Foo*)'",
+            text_type(w[0].message)
+        )
+        self.assertEqual(_normalize(w[1].filename), _normalize(__file__))
+        self.assertEqual(_normalize(w[0].filename), _normalize(__file__))
+        self.assertIn(
+            'CORRECT LINE',
+            linecache.getline(w[0].filename, w[0].lineno)
+        )
+
+        self.assertIs(w[1].category, ldap.LDAPBytesWarning)
+        self.assertIn(
+            u"Received non-bytes value u'*'",
+            text_type(w[1].message)
+        )
+        self.assertIn(_normalize(w[1].filename), _normalize(__file__))
+        self.assertIn(
+            'CORRECT LINE',
+            linecache.getline(w[1].filename, w[1].lineno)
+        )
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_byteswarning_level_search(self):
+        self._test_byteswarning_level_search('search_s')
+        self._test_byteswarning_level_search('search_st')
+        self._test_byteswarning_level_search('search_ext_s')
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From db98910a3a3c3ece9a9f1e351ad1e4c957841b7e Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 13 Dec 2017 15:51:02 +0100
Subject: [PATCH 696/868] Use stack walking for LDAPBytesWarning also in
 initialize()

---
 Lib/ldap/functions.py  |  3 ++
 Lib/ldap/ldapobject.py | 53 +++++++++++++++++-----------------
 Modules/ldapmodule.c   |  2 +-
 Tests/t_ldapobject.py  | 65 +++++++++++++++++++++++-------------------
 4 files changed, 66 insertions(+), 57 deletions(-)

diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 3dfeee4..8c7580e 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -27,6 +27,9 @@
   # Tracing is only supported in debugging mode
   import traceback
 
+# See _raise_byteswarning in ldapobject.py
+_LDAP_WARN_SKIP_FRAME = True
+
 
 def _ldap_function_call(lock,func,*args,**kwargs):
   """
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 1929a92..4aa61db 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -46,6 +46,26 @@ class LDAPBytesWarning(BytesWarning):
   """python-ldap bytes mode warning
   """
 
+def _raise_byteswarning(message):
+    """Raise LDAPBytesWarning
+    """
+
+    # Call stacks that raise the warning tend to be complicated, so
+    # getting a useful stacklevel is tricky.
+    # We walk stack frames, ignoring functions in uninteresting files,
+    # based on the _LDAP_WARN_SKIP_FRAME marker in globals().
+    stacklevel = 2
+    try:
+        getframe = sys._getframe
+    except AttributeError:
+        pass
+    else:
+        frame = sys._getframe(stacklevel)
+        while frame and frame.f_globals.get('_LDAP_WARN_SKIP_FRAME'):
+            stacklevel += 1
+            frame = frame.f_back
+    warnings.warn(message, LDAPBytesWarning, stacklevel=stacklevel+1)
+
 
 class NO_UNIQUE_ENTRY(ldap.NO_SUCH_OBJECT):
   """
@@ -90,13 +110,10 @@ def __init__(
     # By default, raise a TypeError when receiving invalid args
     self.bytes_mode_hardfail = True
     if bytes_mode is None and PY2:
-      warnings.warn(
+      _raise_byteswarning(
         "Under Python 2, python-ldap uses bytes by default. "
         "This will be removed in Python 3 (no bytes for DN/RDN/field names). "
-        "Please call initialize(..., bytes_mode=False) explicitly.",
-        LDAPBytesWarning,
-        stacklevel=2,
-      )
+        "Please call initialize(..., bytes_mode=False) explicitly.")
       bytes_mode = True
       # Disable hard failure when running in backwards compatibility mode.
       self.bytes_mode_hardfail = False
@@ -129,28 +146,10 @@ def _bytesify_input(self, value):
         if self.bytes_mode_hardfail:
           raise TypeError("All provided fields *must* be bytes when bytes mode is on; got %r" % (value,))
         else:
-          # Raise LDAPBytesWarning.
-          # Call stacks with _bytesify_input tend to be complicated, so
-          # getting a useful stacklevel is tricky.
-          # We walk stack frames, ignoring all functions in this file
-          # and in the _ldap extension, based on a marker in globals().
-          stacklevel = 0
-          try:
-            getframe = sys._getframe
-          except AttributeError:
-            pass
-          else:
-            frame = sys._getframe(stacklevel)
-            # walk up the stacks until we leave the file
-            while frame and frame.f_globals.get('_LDAP_WARN_SKIP_FRAME'):
-                stacklevel += 1
-                frame = frame.f_back
-          warnings.warn(
-            "Received non-bytes value %r with default (disabled) bytes mode; please choose an explicit "
-            "option for bytes_mode on your LDAP connection" % (value,),
-            LDAPBytesWarning,
-            stacklevel=stacklevel+1,
-          )
+          _raise_byteswarning(
+            "Received non-bytes value %r with default (disabled) bytes mode; "
+            "please choose an explicit "
+            "option for bytes_mode on your LDAP connection" % (value,))
           return value.encode('utf-8')
     else:
       if not isinstance(value, text_type):
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index d5edd82..f37c1b8 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -73,7 +73,7 @@ PyObject* init_ldap_module(void)
 	LDAPinit_control(d);
 
     /* Marker for LDAPBytesWarning stack walking
-     * see SimpleLDAPObject._bytesify_input in ldapobject.py
+     * See _raise_byteswarning in ldapobject.py
      */
     if (PyModule_AddIntConstant(m, "_LDAP_WARN_SKIP_FRAME", 1) != 0) {
         return NULL;
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index f833fec..e417fc1 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -361,6 +361,25 @@ def catch_byteswarnings(self, *args, **kwargs):
             warnings.simplefilter('always', ldap.LDAPBytesWarning)
             yield conn, w
 
+    def _check_byteswarning(self, warning, expected_message):
+        self.assertIs(warning.category, ldap.LDAPBytesWarning)
+        self.assertIn(expected_message, text_type(warning.message))
+
+        def _normalize(filename):
+            # Python 2 likes to report the ".pyc" file in warnings,
+            # tracebacks or __file__.
+            # Use the corresponding ".py" in that case.
+            if filename.endswith('.pyc'):
+                return filename[:-1]
+            return filename
+
+        # Assert warning points to a line marked CORRECT LINE in this file
+        self.assertEquals(_normalize(warning.filename), _normalize(__file__))
+        self.assertIn(
+            'CORRECT LINE',
+            linecache.getline(warning.filename, warning.lineno)
+        )
+
     def _test_byteswarning_level_search(self, methodname):
         with self.catch_byteswarnings(explicit=False) as (conn, w):
             method = getattr(conn, methodname)
@@ -374,36 +393,11 @@ def _test_byteswarning_level_search(self, methodname):
 
         self.assertEqual(len(w), 2, w)
 
-        def _normalize(filename):
-            # Python 2 likes to report the ".pyc" file in warnings,
-            # tracebacks or __file__.
-            # Use the corresponding ".py" in that case.
-            if filename.endswith('.pyc'):
-                return filename[:-1]
-            return filename
-
-        self.assertIs(w[0].category, ldap.LDAPBytesWarning)
-        self.assertIn(
-            u"Received non-bytes value u'(cn=Foo*)'",
-            text_type(w[0].message)
-        )
-        self.assertEqual(_normalize(w[1].filename), _normalize(__file__))
-        self.assertEqual(_normalize(w[0].filename), _normalize(__file__))
-        self.assertIn(
-            'CORRECT LINE',
-            linecache.getline(w[0].filename, w[0].lineno)
-        )
+        self._check_byteswarning(
+            w[0], u"Received non-bytes value u'(cn=Foo*)'")
 
-        self.assertIs(w[1].category, ldap.LDAPBytesWarning)
-        self.assertIn(
-            u"Received non-bytes value u'*'",
-            text_type(w[1].message)
-        )
-        self.assertIn(_normalize(w[1].filename), _normalize(__file__))
-        self.assertIn(
-            'CORRECT LINE',
-            linecache.getline(w[1].filename, w[1].lineno)
-        )
+        self._check_byteswarning(
+            w[1], u"Received non-bytes value u'*'")
 
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
     def test_byteswarning_level_search(self):
@@ -411,6 +405,19 @@ def test_byteswarning_level_search(self):
         self._test_byteswarning_level_search('search_st')
         self._test_byteswarning_level_search('search_ext_s')
 
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_byteswarning_initialize(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            bytes_uri = self.server.ldap_uri.decode('utf-8')
+            self.ldap_object_class(bytes_uri)  # CORRECT LINE
+
+        self.assertEqual(len(w), 1, w)
+
+        self._check_byteswarning(
+            w[0], u"Under Python 2, python-ldap uses bytes by default.")
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From c1007fa93caadc5f354a21b5c089c781ea0fe47b Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 13 Dec 2017 18:09:39 +0100
Subject: [PATCH 697/868] More / fixed pragma: no cover

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/constants.py       | 2 +-
 Lib/slapdtest/_slapdtest.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index 4c109ac..9eb5ceb 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -366,7 +366,7 @@ class Str(Constant):
 )
 
 
-def print_header():
+def print_header():  # pragma: no cover
     """Print the C header file to standard output"""
 
     print('/*')
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index ef627ef..4c7a9e4 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -434,7 +434,7 @@ def _cli_auth_args(self):
 
     # no cover to avoid spurious coverage changes
     def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None,
-                   stdin_data=None):  # pragma: no-cover
+                   stdin_data=None):  # pragma: no cover
         args = [
             ldapcommand,
             '-H', ldap_uri or self.ldapi_uri,

From 5197e586541726ccddbfff3d653d4c64e295e25e Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Fri, 15 Dec 2017 13:06:26 +0100
Subject: [PATCH 698/868] Add reproducer for NSS callback issue

The new test case simply creates 10 connections and calls start_tls_s()
after OPT_X_TLS_NEWCTX.

https://github.com/python-ldap/python-ldap/pull/134
See: https://github.com/python-ldap/python-ldap/issues/60
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldapobject.py | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index e417fc1..62591d7 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -23,7 +23,7 @@
 import warnings
 import pickle
 import warnings
-from slapdtest import SlapdTestCase, requires_sasl
+from slapdtest import SlapdTestCase, requires_sasl, requires_tls
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -418,6 +418,20 @@ def test_byteswarning_initialize(self):
         self._check_byteswarning(
             w[0], u"Under Python 2, python-ldap uses bytes by default.")
 
+    @requires_tls()
+    def test_multiple_starttls(self):
+        # Test for openldap does not re-register nss shutdown callbacks
+        # after nss_Shutdown is called
+        # https://github.com/python-ldap/python-ldap/issues/60
+        # https://bugzilla.redhat.com/show_bug.cgi?id=1520990
+        for _ in range(10):
+            l = self.ldap_object_class(self.server.ldap_uri)
+            l.set_option(ldap.OPT_X_TLS_CACERTFILE, self.server.cafile)
+            l.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
+            l.start_tls_s()
+            l.simple_bind_s(self.server.root_dn, self.server.root_pw)
+            self.assertEqual(l.whoami_s(), 'dn:' + self.server.root_dn)
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From be5a3445ac8bf8460be858160e27ea9ca11b641e Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Mon, 18 Dec 2017 04:18:41 -0800
Subject: [PATCH 699/868] Remove unnecessary bool() call

Inequalities already return return a boolean. Coercing to a bool again
is a noop.

https://github.com/python-ldap/python-ldap/pull/135
---
 Lib/ldap/ldapobject.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 4aa61db..bc78fb7 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -32,7 +32,7 @@
 
 from ldap import LDAPError
 
-PY2 = bool(sys.version_info[0] <= 2)
+PY2 = sys.version_info[0] <= 2
 if PY2:
   text_type = unicode
 else:

From 0625e19f16a434604f9bb50b76baed2ca8889ffc Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Mon, 18 Dec 2017 04:23:11 -0800
Subject: [PATCH 700/868] Call str.lower() as a method

More idiomatic Python.

https://github.com/python-ldap/python-ldap/pull/139
---
 Lib/ldap/modlist.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index a853500..e1dfe44 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -51,9 +51,9 @@ def modifyModlist(
   modlist = []
   attrtype_lower_map = {}
   for a in old_entry.keys():
-    attrtype_lower_map[str.lower(a)]=a
+    attrtype_lower_map[a.lower()]=a
   for attrtype in new_entry.keys():
-    attrtype_lower = str.lower(attrtype)
+    attrtype_lower = attrtype.lower()
     if attrtype_lower in ignore_attr_types:
       # This attribute type is ignored
       continue

From ab930631760d61da34d0df7ba8eb5c79ebaaffe4 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Mon, 18 Dec 2017 05:14:44 -0800
Subject: [PATCH 701/868] Remove override of UserDict.get() to avoid
 reimplementation

Reimplements the parent class implementation. Can simplify classes by
removing it.

https://github.com/python-ldap/python-ldap/pull/136
---
 Lib/ldap/cidict.py        | 6 ------
 Lib/ldap/schema/models.py | 6 ------
 2 files changed, 12 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index fdfba4b..f7e8d39 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -44,12 +44,6 @@ def has_key(self,key):
   def __contains__(self,key):
     return IterableUserDict.__contains__(self, key.lower())
 
-  def get(self,key,failobj=None):
-    try:
-      return self[key]
-    except KeyError:
-      return failobj
-
   def keys(self):
     return self._keys.values()
 
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 84054f8..c1362a9 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -679,12 +679,6 @@ def has_key(self,nameoroid):
     k = self._at2key(nameoroid)
     return k in self.data
 
-  def get(self,nameoroid,failobj):
-    try:
-      return self[nameoroid]
-    except KeyError:
-      return failobj
-
   def keys(self):
     return self._keytuple2attrtype.values()
 

From aa0a07bf443f673c3a3d3d57e8e9df7f9af30e51 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 18 Dec 2017 08:50:35 +0100
Subject: [PATCH 702/868] Make LDAPI optional

LDAPI is LDAP over Unix Domain Socket, also referred as LDAP IPC.
AF_UNIX is only supported on POSIX compatible operating systems. Don't
bind to LDAPI socket and skip LDAPI specific tests, e.g. SASL EXTERNAL
with SO_PEERCRED.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest/__init__.py       |  3 ++-
 Lib/slapdtest/_slapdtest.py     | 47 ++++++++++++++++++++++++++-------
 Tests/t_ldap_sasl.py            |  5 ++--
 Tests/t_ldap_schema_subentry.py |  3 ++-
 Tests/t_ldapobject.py           | 14 +++++-----
 tox.ini                         |  4 +--
 6 files changed, 55 insertions(+), 21 deletions(-)

diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index a2a875f..306eaf7 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -8,4 +8,5 @@
 __version__ = '3.0.0b2'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
-from slapdtest._slapdtest import skip_unless_ci, requires_sasl, requires_tls
+from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls
+from slapdtest._slapdtest import skip_unless_ci
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 4c7a9e4..09ec154 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -56,6 +56,12 @@
 
 LOCALHOST = '127.0.0.1'
 
+CI_DISABLED = set(os.environ.get('CI_DISABLED', '').split(':'))
+if 'LDAPI' in CI_DISABLED:
+    HAVE_LDAPI = False
+else:
+    HAVE_LDAPI = hasattr(socket, 'AF_UNIX')
+
 
 def identity(test_item):
     """Identity decorator
@@ -69,7 +75,7 @@ def skip_unless_ci(reason, feature=None):
     """
     if not os.environ.get('CI', False):
         return unittest.skip(reason)
-    elif feature in os.environ.get('CI_DISABLED', '').split(':'):
+    elif feature in CI_DISABLED:
         return unittest.skip(reason)
     else:
         # Don't skip on Travis
@@ -95,6 +101,14 @@ def requires_sasl():
         return identity
 
 
+def requires_ldapi():
+    if not HAVE_LDAPI:
+        return skip_unless_ci(
+            "test needs ldapi support (AF_UNIX)", feature='LDAPI')
+    else:
+        return identity
+
+
 def combined_logger(
         log_name,
         log_level=logging.WARN,
@@ -149,8 +163,6 @@ class SlapdObject(object):
     root_dn = 'cn=%s,%s' % (root_cn, suffix)
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
-    # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
-    cli_sasl_external = True
     local_host = '127.0.0.1'
     testrunsubdirs = (
         'schema',
@@ -192,8 +204,17 @@ def __init__(self):
         self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
-        ldapi_path = os.path.join(self.testrundir, 'ldapi')
-        self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
+        if HAVE_LDAPI:
+            ldapi_path = os.path.join(self.testrundir, 'ldapi')
+            self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
+            self.default_ldap_uri = self.ldapi_uri
+            # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
+            self.cli_sasl_external = True
+        else:
+            self.ldapi_uri = None
+            self.default_ldap_uri = self.ldap_uri
+            # Use simple bind via LDAP uri
+            self.cli_sasl_external = False
         # TLS certs
         self.cafile = os.path.join(HERE, 'certs/ca.pem')
         self.servercert = os.path.join(HERE, 'certs/server.pem')
@@ -331,11 +352,14 @@ def _start_slapd(self):
         """
         Spawns/forks the slapd process
         """
+        urls = [self.ldap_uri]
+        if self.ldapi_uri:
+            urls.append(self.ldapi_uri)
         slapd_args = [
             self.PATH_SLAPD,
             '-f', self._slapd_conf,
             '-F', self.testrundir,
-            '-h', '%s' % ' '.join((self.ldap_uri, self.ldapi_uri)),
+            '-h', '%s' % ' '.join(urls),
         ]
         if self._log.isEnabledFor(logging.DEBUG):
             slapd_args.extend(['-d', '-1'])
@@ -346,18 +370,21 @@ def _start_slapd(self):
         # Waits until the LDAP server socket is open, or slapd crashed
         # no cover to avoid spurious coverage changes, see
         # https://github.com/python-ldap/python-ldap/issues/127
-        while 1:  # pragma: no cover
+        for _ in range(10):  # pragma: no cover
             if self._proc.poll() is not None:
                 self._stopped()
                 raise RuntimeError("slapd exited before opening port")
             time.sleep(self._start_sleep)
             try:
-                self._log.debug("slapd connection check to %s", self.ldapi_uri)
+                self._log.debug(
+                    "slapd connection check to %s", self.default_ldap_uri
+                )
                 self.ldapwhoami()
             except RuntimeError:
                 pass
             else:
                 return
+        raise RuntimeError("slapd did not start properly")
 
     def start(self):
         """
@@ -435,9 +462,11 @@ def _cli_auth_args(self):
     # no cover to avoid spurious coverage changes
     def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None,
                    stdin_data=None):  # pragma: no cover
+        if ldap_uri is None:
+            ldap_uri = self.default_ldap_uri
         args = [
             ldapcommand,
-            '-H', ldap_uri or self.ldapi_uri,
+            '-H', ldap_uri,
         ] + self._cli_auth_args() + (extra_args or [])
         self._log.debug('Run command: %r', ' '.join(args))
         proc = subprocess.Popen(
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index af6ed51..828fe77 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -14,7 +14,8 @@
 
 from ldap.ldapobject import SimpleLDAPObject
 import ldap.sasl
-from slapdtest import SlapdTestCase, requires_sasl, requires_tls
+from slapdtest import SlapdTestCase
+from slapdtest import requires_ldapi, requires_sasl, requires_tls
 
 
 LDIF = """
@@ -60,7 +61,7 @@ def setUpClass(cls):
         )
         cls.server.ldapadd(ldif)
 
-    @unittest.skipUnless(hasattr(socket, 'AF_UNIX'), "needs Unix socket")
+    @requires_ldapi()
     def test_external_ldapi(self):
         # EXTERNAL authentication with LDAPI (AF_UNIX)
         ldap_conn = self.ldap_object_class(self.server.ldapi_uri)
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 3c07d35..4e1e09b 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -16,7 +16,7 @@
 from ldap.ldapobject import SimpleLDAPObject
 import ldap.schema
 from ldap.schema.models import ObjectClass
-from slapdtest import SlapdTestCase
+from slapdtest import SlapdTestCase, requires_ldapi
 
 HERE = os.path.abspath(os.path.dirname(__file__))
 
@@ -88,6 +88,7 @@ def test_urlfetch_ldap(self):
         dn, schema = ldap.schema.urlfetch(self.server.ldap_uri)
         self.assertSlapdSchema(dn, schema)
 
+    @requires_ldapi()
     def test_urlfetch_ldapi(self):
         dn, schema = ldap.schema.urlfetch(self.server.ldapi_uri)
         self.assertSlapdSchema(dn, schema)
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 62591d7..5075468 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -22,8 +22,8 @@
 import unittest
 import warnings
 import pickle
-import warnings
-from slapdtest import SlapdTestCase, requires_sasl, requires_tls
+from slapdtest import SlapdTestCase
+from slapdtest import requires_ldapi, requires_sasl, requires_tls
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -303,6 +303,7 @@ def test005_invalid_credentials(self):
             self.fail("expected INVALID_CREDENTIALS, got %r" % r)
 
     @requires_sasl()
+    @requires_ldapi()
     def test006_sasl_extenal_bind_s(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s()
@@ -441,6 +442,7 @@ class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     ldap_object_class = ReconnectLDAPObject
 
     @requires_sasl()
+    @requires_ldapi()
     def test101_reconnect_sasl_external(self):
         l = self.ldap_object_class(self.server.ldapi_uri)
         l.sasl_external_bind_s()
@@ -450,7 +452,7 @@ def test101_reconnect_sasl_external(self):
         self.assertEqual(l.whoami_s(), authz_id)
 
     def test102_reconnect_simple_bind(self):
-        l = self.ldap_object_class(self.server.ldapi_uri)
+        l = self.ldap_object_class(self.server.ldap_uri)
         bind_dn = 'cn=user1,'+self.server.suffix
         l.simple_bind_s(bind_dn, 'user1_pw')
         self.assertEqual(l.whoami_s(), 'dn:'+bind_dn)
@@ -458,7 +460,7 @@ def test102_reconnect_simple_bind(self):
         self.assertEqual(l.whoami_s(), 'dn:'+bind_dn)
 
     def test103_reconnect_get_state(self):
-        l1 = self.ldap_object_class(self.server.ldapi_uri)
+        l1 = self.ldap_object_class(self.server.ldap_uri)
         bind_dn = 'cn=user1,'+self.server.suffix
         l1.simple_bind_s(bind_dn, 'user1_pw')
         self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
@@ -477,7 +479,7 @@ def test103_reconnect_get_state(self):
                 str('_start_tls'): 0,
                 str('_trace_level'): 0,
                 str('_trace_stack_limit'): 5,
-                str('_uri'): self.server.ldapi_uri,
+                str('_uri'): self.server.ldap_uri,
                 str('bytes_mode'): l1.bytes_mode,
                 str('bytes_mode_hardfail'): l1.bytes_mode_hardfail,
                 str('timeout'): -1,
@@ -485,7 +487,7 @@ def test103_reconnect_get_state(self):
         )
 
     def test104_reconnect_restore(self):
-        l1 = self.ldap_object_class(self.server.ldapi_uri)
+        l1 = self.ldap_object_class(self.server.ldap_uri)
         bind_dn = 'cn=user1,'+self.server.suffix
         l1.simple_bind_s(bind_dn, 'user1_pw')
         self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
diff --git a/tox.ini b/tox.ini
index fcfc628..58e3cf6 100644
--- a/tox.ini
+++ b/tox.ini
@@ -33,8 +33,8 @@ basepython = python2
 deps = {[testenv]deps}
 passenv = {[testenv]passenv}
 setenv =
-    CI_DISABLED=TLS:SASL
-# rebuild without SASL and TLS
+    CI_DISABLED=LDAPI:SASL:TLS
+# rebuild without SASL and TLS, run without LDAPI
 commands = {envpython} \
     -m coverage run --parallel setup.py \
         clean --all \

From 50e9c2e320c61d39202c8e23a14bc0b4eed13346 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 18 Dec 2017 08:51:06 +0100
Subject: [PATCH 703/868] Remove unused import of pwd module

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldap_sasl.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index 828fe77..d104468 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -5,7 +5,6 @@
 See https://www.python-ldap.org/ for details.
 """
 import os
-import pwd
 import socket
 import unittest
 

From f01b66e5ed26b2a80c6c1010f249241100354d50 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 18 Dec 2017 08:57:59 +0100
Subject: [PATCH 704/868] Use PATH to lookup test binaries

Instead of hard-coded paths /usr/bin and /usr/sbin, the SlapdObject test
helper now uses PATH env var to find test binaries. For slapd server
binary, sbin paths are automatically added to lookup PATH in case they
are missing.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest/_slapdtest.py | 77 +++++++++++++++++++++++++++++--------
 1 file changed, 62 insertions(+), 15 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 09ec154..ebc5441 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -9,6 +9,7 @@
 
 import os
 import socket
+import sys
 import time
 import subprocess
 import logging
@@ -109,6 +110,46 @@ def requires_ldapi():
         return identity
 
 
+def _which(cmd):
+    """Specialized which command based on shutil.which() from Python 3.6.
+
+    * simplified
+    * always adds /sbin directories to path
+    """
+
+    def _access_check(fn):
+        return (os.path.exists(fn) and os.access(fn, os.F_OK | os.X_OK)
+                and not os.path.isdir(fn))
+
+    # Path with directory part skips PATH lookup.
+    if os.path.dirname(cmd):
+        if _access_check(cmd):
+            return cmd
+        return None
+
+    path = os.environ.get("PATH", os.defpath).split(os.pathsep)
+
+    if sys.platform == 'win32':
+        if os.curdir not in path:
+            path.insert(0, os.curdir)
+        # include path extension (.exe)
+        pathext = os.environ.get("PATHEXT", "").split(os.pathsep)
+        files = [cmd + ext for ext in pathext]
+    else:
+        # always include sbin for slapd binary
+        for sbin in ['/usr/local/sbin', '/sbin', '/usr/sbin']:
+            if sbin not in path:
+                path.append(sbin)
+        files = [cmd]
+
+    for directory in path:
+        for name in files:
+            name = os.path.join(directory, name)
+            if _access_check(name):
+                return name
+    return None
+
+
 def combined_logger(
         log_name,
         log_level=logging.WARN,
@@ -172,8 +213,6 @@ class SlapdObject(object):
     )
 
     TMPDIR = os.environ.get('TMP', os.getcwd())
-    SBINDIR = os.environ.get('SBIN', '/usr/sbin')
-    BINDIR = os.environ.get('BIN', '/usr/bin')
     if 'SCHEMA' in os.environ:
         SCHEMADIR = os.environ['SCHEMA']
     elif os.path.isdir("/etc/openldap/schema"):
@@ -182,12 +221,14 @@ class SlapdObject(object):
         SCHEMADIR = "/etc/ldap/schema"
     else:
         SCHEMADIR = None
-    PATH_LDAPADD = os.path.join(BINDIR, 'ldapadd')
-    PATH_LDAPDELETE = os.path.join(BINDIR, 'ldapdelete')
-    PATH_LDAPMODIFY = os.path.join(BINDIR, 'ldapmodify')
-    PATH_LDAPWHOAMI = os.path.join(BINDIR, 'ldapwhoami')
-    PATH_SLAPD = os.environ.get('SLAPD', os.path.join(SBINDIR, 'slapd'))
-    PATH_SLAPTEST = os.path.join(SBINDIR, 'slaptest')
+    # _check_requirements turns paths into absolute paths
+    PATH_LDAPADD = 'ldapadd'
+    PATH_LDAPDELETE = 'ldapdelete'
+    PATH_LDAPMODIFY = 'ldapmodify'
+    PATH_LDAPWHOAMI = 'ldapwhoami'
+    # The following two binaries are usually in /usr/sbin.
+    PATH_SLAPD = os.environ.get('SLAPD', 'slapd')
+    PATH_SLAPTEST = 'slaptest'
 
     # time in secs to wait before trying to access slapd via LDAP (again)
     _start_sleep = 1.5
@@ -223,13 +264,19 @@ def __init__(self):
         self.clientkey = os.path.join(HERE, 'certs/client.key')
 
     def _check_requirements(self):
-        binaries = [
-            self.PATH_LDAPADD, self.PATH_LDAPMODIFY, self.PATH_LDAPWHOAMI,
-            self.PATH_SLAPD, self.PATH_SLAPTEST
+        names = [
+            "PATH_LDAPADD", "PATH_LDAPMODIFY", "PATH_LDAPDELETE",
+            "PATH_LDAPWHOAMI", "PATH_SLAPD", "PATH_SLAPTEST",
         ]
-        for binary in binaries:
-            if not os.path.isfile(binary):
-                raise ValueError('Binary {} is missing.'.format(binary))
+        for name in names:
+            value = getattr(self, name)
+            binary = _which(value)
+            if binary is None:
+                raise ValueError(
+                    "Command '{}' not found in PATH".format(value)
+                )
+            else:
+                setattr(self, name, binary)
         if self.SCHEMADIR is None:
             raise ValueError('SCHEMADIR is None, ldap schemas are missing.')
 
@@ -359,7 +406,7 @@ def _start_slapd(self):
             self.PATH_SLAPD,
             '-f', self._slapd_conf,
             '-F', self.testrundir,
-            '-h', '%s' % ' '.join(urls),
+            '-h', ' '.join(urls),
         ]
         if self._log.isEnabledFor(logging.DEBUG):
             slapd_args.extend(['-d', '-1'])

From 02915b3f5bfe0f93d92cdeb26778d8c3efa56d25 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 19 Dec 2017 14:26:39 +0100
Subject: [PATCH 705/868] slapdtest: Set and check command paths in __init__

Make SlapdObject.PATH_* instance attributes, rather than class
ones. Set them in __init__.
Move checking them from start() to __init__(), so the check becomes
simply error handling.

Put a straight-up copy of Python's shutil.which() in
ldap.compat -- it is a temporary backport, not a modified fork.
---
 Lib/ldap/compat.py          |  70 +++++++++++++++++++++++
 Lib/slapdtest/_slapdtest.py | 109 ++++++++++++++----------------------
 2 files changed, 113 insertions(+), 66 deletions(-)

diff --git a/Lib/ldap/compat.py b/Lib/ldap/compat.py
index de0e110..cbfeef5 100644
--- a/Lib/ldap/compat.py
+++ b/Lib/ldap/compat.py
@@ -1,6 +1,7 @@
 """Compatibility wrappers for Py2/Py3."""
 
 import sys
+import os
 
 if sys.version_info[0] < 3:
     from UserDict import UserDict, IterableUserDict
@@ -41,3 +42,72 @@ def reraise(exc_type, exc_value, exc_traceback):
         """
         # In Python 3, all exception info is contained in one object.
         raise exc_value
+
+try:
+    from shutil import which
+except ImportError:
+    # shutil.which() from Python 3.6
+    # "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
+    # 2011, 2012, 2013, 2014, 2015, 2016, 2017 Python Software Foundation;
+    # All Rights Reserved"
+    def which(cmd, mode=os.F_OK | os.X_OK, path=None):
+        """Given a command, mode, and a PATH string, return the path which
+        conforms to the given mode on the PATH, or None if there is no such
+        file.
+
+        `mode` defaults to os.F_OK | os.X_OK. `path` defaults to the result
+        of os.environ.get("PATH"), or can be overridden with a custom search
+        path.
+
+        """
+        # Check that a given file can be accessed with the correct mode.
+        # Additionally check that `file` is not a directory, as on Windows
+        # directories pass the os.access check.
+        def _access_check(fn, mode):
+            return (os.path.exists(fn) and os.access(fn, mode)
+                    and not os.path.isdir(fn))
+
+        # If we're given a path with a directory part, look it up directly rather
+        # than referring to PATH directories. This includes checking relative to the
+        # current directory, e.g. ./script
+        if os.path.dirname(cmd):
+            if _access_check(cmd, mode):
+                return cmd
+            return None
+
+        if path is None:
+            path = os.environ.get("PATH", os.defpath)
+        if not path:
+            return None
+        path = path.split(os.pathsep)
+
+        if sys.platform == "win32":
+            # The current directory takes precedence on Windows.
+            if not os.curdir in path:
+                path.insert(0, os.curdir)
+
+            # PATHEXT is necessary to check on Windows.
+            pathext = os.environ.get("PATHEXT", "").split(os.pathsep)
+            # See if the given file matches any of the expected path extensions.
+            # This will allow us to short circuit when given "python.exe".
+            # If it does match, only test that one, otherwise we have to try
+            # others.
+            if any(cmd.lower().endswith(ext.lower()) for ext in pathext):
+                files = [cmd]
+            else:
+                files = [cmd + ext for ext in pathext]
+        else:
+            # On other platforms you don't have things like PATHEXT to tell you
+            # what file suffixes are executable, so just pass on cmd as-is.
+            files = [cmd]
+
+        seen = set()
+        for dir in path:
+            normdir = os.path.normcase(dir)
+            if not normdir in seen:
+                seen.add(normdir)
+                for thefile in files:
+                    name = os.path.join(dir, thefile)
+                    if _access_check(name, mode):
+                        return name
+        return None
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index ebc5441..484eb54 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -21,7 +21,7 @@
 os.environ['LDAPNOINIT'] = '1'
 
 import ldap
-from ldap.compat import quote_plus
+from ldap.compat import quote_plus, which
 
 HERE = os.path.abspath(os.path.dirname(__file__))
 
@@ -109,46 +109,14 @@ def requires_ldapi():
     else:
         return identity
 
-
-def _which(cmd):
-    """Specialized which command based on shutil.which() from Python 3.6.
-
-    * simplified
-    * always adds /sbin directories to path
-    """
-
-    def _access_check(fn):
-        return (os.path.exists(fn) and os.access(fn, os.F_OK | os.X_OK)
-                and not os.path.isdir(fn))
-
-    # Path with directory part skips PATH lookup.
-    if os.path.dirname(cmd):
-        if _access_check(cmd):
-            return cmd
-        return None
-
-    path = os.environ.get("PATH", os.defpath).split(os.pathsep)
-
-    if sys.platform == 'win32':
-        if os.curdir not in path:
-            path.insert(0, os.curdir)
-        # include path extension (.exe)
-        pathext = os.environ.get("PATHEXT", "").split(os.pathsep)
-        files = [cmd + ext for ext in pathext]
-    else:
-        # always include sbin for slapd binary
-        for sbin in ['/usr/local/sbin', '/sbin', '/usr/sbin']:
-            if sbin not in path:
-                path.append(sbin)
-        files = [cmd]
-
-    for directory in path:
-        for name in files:
-            name = os.path.join(directory, name)
-            if _access_check(name):
-                return name
-    return None
-
+def _add_sbin(path):
+    """Add /sbin and related directories to a command search path"""
+    directories = path.split(os.pathsep)
+    if sys.platform != 'win32':
+        for sbin in '/usr/local/sbin', '/sbin', '/usr/sbin':
+            if sbin not in directories:
+                directories.append(sbin)
+    return os.pathsep.join(directories)
 
 def combined_logger(
         log_name,
@@ -221,14 +189,9 @@ class SlapdObject(object):
         SCHEMADIR = "/etc/ldap/schema"
     else:
         SCHEMADIR = None
-    # _check_requirements turns paths into absolute paths
-    PATH_LDAPADD = 'ldapadd'
-    PATH_LDAPDELETE = 'ldapdelete'
-    PATH_LDAPMODIFY = 'ldapmodify'
-    PATH_LDAPWHOAMI = 'ldapwhoami'
-    # The following two binaries are usually in /usr/sbin.
-    PATH_SLAPD = os.environ.get('SLAPD', 'slapd')
-    PATH_SLAPTEST = 'slaptest'
+
+    BIN_PATH = os.environ.get('BIN', os.environ.get('PATH', os.defpath))
+    SBIN_PATH = os.environ.get('SBIN', _add_sbin(BIN_PATH))
 
     # time in secs to wait before trying to access slapd via LDAP (again)
     _start_sleep = 1.5
@@ -256,6 +219,12 @@ def __init__(self):
             self.default_ldap_uri = self.ldap_uri
             # Use simple bind via LDAP uri
             self.cli_sasl_external = False
+
+        self._find_commands()
+
+        if self.SCHEMADIR is None:
+            raise ValueError('SCHEMADIR is None, ldap schemas are missing.')
+
         # TLS certs
         self.cafile = os.path.join(HERE, 'certs/ca.pem')
         self.servercert = os.path.join(HERE, 'certs/server.pem')
@@ -263,22 +232,31 @@ def __init__(self):
         self.clientcert = os.path.join(HERE, 'certs/client.pem')
         self.clientkey = os.path.join(HERE, 'certs/client.key')
 
-    def _check_requirements(self):
-        names = [
-            "PATH_LDAPADD", "PATH_LDAPMODIFY", "PATH_LDAPDELETE",
-            "PATH_LDAPWHOAMI", "PATH_SLAPD", "PATH_SLAPTEST",
-        ]
-        for name in names:
-            value = getattr(self, name)
-            binary = _which(value)
-            if binary is None:
-                raise ValueError(
-                    "Command '{}' not found in PATH".format(value)
-                )
-            else:
-                setattr(self, name, binary)
-        if self.SCHEMADIR is None:
-            raise ValueError('SCHEMADIR is None, ldap schemas are missing.')
+    def _find_commands(self):
+        self.PATH_LDAPADD = self._find_command('ldapadd')
+        self.PATH_LDAPDELETE = self._find_command('ldapdelete')
+        self.PATH_LDAPMODIFY = self._find_command('ldapmodify')
+        self.PATH_LDAPWHOAMI = self._find_command('ldapwhoami')
+
+        self.PATH_SLAPD = os.environ.get('SLAPD', None)
+        if not self.PATH_SLAPD:
+            self.PATH_SLAPD = self._find_command('slapd', in_sbin=True)
+        self.PATH_SLAPTEST = self._find_command('slaptest', in_sbin=True)
+
+    def _find_command(self, cmd, in_sbin=False):
+        if in_sbin:
+            path = self.SBIN_PATH
+            var_name = 'SBIN'
+        else:
+            path = self.BIN_PATH
+            var_name = 'BIN'
+        command = which(cmd, path=path)
+        if command is None:
+            raise ValueError(
+                "Command '{}' not found. Set the {} environment variable to "
+                "override slapdtest's search path.".format(value, var_name)
+            )
+        return command
 
     def setup_rundir(self):
         """
@@ -439,7 +417,6 @@ def start(self):
         """
 
         if self._proc is None:
-            self._check_requirements()
             # prepare directory structure
             atexit.register(self.stop)
             self._cleanup_rundir()

From 9fb933872d27365a30dc07fc55e3233c38c88420 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Wed, 20 Dec 2017 12:38:25 +0100
Subject: [PATCH 706/868] Show argument name instead of content in
 LDAPBytesWarning

Based on earlier patch by Christian Heimes
https://github.com/python-ldap/python-ldap/pull/145
Fixes: https://github.com/python-ldap/python-ldap/issues/132
Fixes: https://github.com/python-ldap/python-ldap/issues/144
---
 Lib/ldap/ldapobject.py | 66 +++++++++++++++++++++---------------------
 Tests/t_ldapobject.py  |  8 ++---
 2 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index bc78fb7..f65e09a 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -122,7 +122,7 @@ def __init__(
     # On by default on Py2, off on Py3.
     self.bytes_mode = bytes_mode
 
-  def _bytesify_input(self, value):
+  def _bytesify_input(self, arg_name, value):
     """Adapt a value following bytes_mode in Python 2.
 
     In Python 3, returns the original value unmodified.
@@ -147,9 +147,9 @@ def _bytesify_input(self, value):
           raise TypeError("All provided fields *must* be bytes when bytes mode is on; got %r" % (value,))
         else:
           _raise_byteswarning(
-            "Received non-bytes value %r with default (disabled) bytes mode; "
+            "Received non-bytes value for '{}' with default (disabled) bytes mode; "
             "please choose an explicit "
-            "option for bytes_mode on your LDAP connection" % (value,))
+            "option for bytes_mode on your LDAP connection".format(arg_name))
           return value.encode('utf-8')
     else:
       if not isinstance(value, text_type):
@@ -157,22 +157,7 @@ def _bytesify_input(self, value):
       assert not isinstance(value, bytes)
       return value.encode('utf-8')
 
-  def _bytesify_inputs(self, *values):
-    """Adapt values following bytes_mode.
-
-    Applies _bytesify_input on each arg.
-
-    Usage:
-    >>> a, b, c = self._bytesify_inputs(a, b, c)
-    """
-    if not PY2:
-      return values
-    return (
-      self._bytesify_input(value)
-      for value in values
-    )
-
-  def _bytesify_modlist(self, modlist, with_opcode):
+  def _bytesify_modlist(self, arg_name, modlist, with_opcode):
     """Adapt a modlist according to bytes_mode.
 
     A modlist is a tuple of (op, attr, value), where:
@@ -184,12 +169,12 @@ def _bytesify_modlist(self, modlist, with_opcode):
       return modlist
     if with_opcode:
       return tuple(
-        (op, self._bytesify_input(attr), val)
+        (op, self._bytesify_input(arg_name, attr), val)
         for op, attr, val in modlist
       )
     else:
       return tuple(
-        (self._bytesify_input(attr), val)
+        (self._bytesify_input(arg_name, attr), val)
         for attr, val in modlist
       )
 
@@ -398,8 +383,9 @@ def add_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
         The parameter modlist is similar to the one passed to modify(),
         except that no operation integer need be included in the tuples.
     """
-    dn = self._bytesify_input(dn)
-    modlist = self._bytesify_modlist(modlist, with_opcode=False)
+    if PY2:
+        dn = self._bytesify_input('dn', dn)
+        modlist = self._bytesify_modlist('modlist', modlist, with_opcode=False)
     return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def add_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
@@ -424,7 +410,9 @@ def simple_bind(self,who='',cred='',serverctrls=None,clientctrls=None):
     """
     simple_bind([who='' [,cred='']]) -> int
     """
-    who, cred = self._bytesify_inputs(who, cred)
+    if PY2:
+        who = self._bytesify_input('who', who)
+        cred = self._bytesify_input('cred', cred)
     return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def simple_bind_s(self,who='',cred='',serverctrls=None,clientctrls=None):
@@ -501,7 +489,9 @@ def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
         A design bug in the library prevents value from containing
         nul characters.
     """
-    dn, attr = self._bytesify_inputs(dn, attr)
+    if PY2:
+        dn = self._bytesify_input('dn', dn)
+        attr = self._bytesify_input('attr', attr)
     return self._ldap_call(self._l.compare_ext,dn,attr,value,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
@@ -532,7 +522,7 @@ def delete_ext(self,dn,serverctrls=None,clientctrls=None):
         form returns the message id of the initiated request, and the
         result can be obtained from a subsequent call to result().
     """
-    dn = self._bytesify_input(dn)
+    dn = self._bytesify_input('dn', dn)
     return self._ldap_call(self._l.delete_ext,dn,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def delete_ext_s(self,dn,serverctrls=None,clientctrls=None):
@@ -581,8 +571,9 @@ def modify_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
     """
     modify_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
     """
-    dn = self._bytesify_input(dn)
-    modlist = self._bytesify_modlist(modlist, with_opcode=True)
+    if PY2:
+        dn = self._bytesify_input('dn', dn)
+        modlist = self._bytesify_modlist('modlist', modlist, with_opcode=True)
     return self._ldap_call(self._l.modify_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def modify_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
@@ -636,7 +627,10 @@ def modrdn_s(self,dn,newrdn,delold=1):
     return self.rename_s(dn,newrdn,None,delold)
 
   def passwd(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
-    user, oldpw, newpw = self._bytesify_inputs(user, oldpw, newpw)
+    if PY2:
+        user = self._bytesify_input('user', user)
+        oldpw = self._bytesify_input('oldpw', oldpw)
+        newpw = self._bytesify_input('newpw', newpw)
     return self._ldap_call(self._l.passwd,user,oldpw,newpw,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def passwd_s(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
@@ -658,7 +652,10 @@ def rename(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls
         This actually corresponds to the rename* routines in the
         LDAP-EXT C API library.
     """
-    dn, newrdn, newsuperior = self._bytesify_inputs(dn, newrdn, newsuperior)
+    if PY2:
+        dn = self._bytesify_input('dn', dn)
+        newrdn = self._bytesify_input('newrdn', newrdn)
+        newsuperior = self._bytesify_input('newsuperior', newsuperior)
     return self._ldap_call(self._l.rename,dn,newrdn,newsuperior,delold,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def rename_s(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls=None):
@@ -796,9 +793,12 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
         The amount of search results retrieved can be limited with the
         sizelimit parameter if non-zero.
     """
-    base, filterstr = self._bytesify_inputs(base, filterstr)
-    if attrlist is not None:
-      attrlist = tuple(self._bytesify_inputs(*attrlist))
+    if PY2:
+        base = self._bytesify_input('base', base)
+        filterstr = self._bytesify_input('filterstr', filterstr)
+        if attrlist is not None:
+            attrlist = tuple(self._bytesify_input('attrlist', a)
+                             for a in attrlist)
     return self._ldap_call(
       self._l.search_ext,
       base,scope,filterstr,
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 62591d7..b51b4cc 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -348,9 +348,9 @@ def test_ldapbyteswarning(self):
         self.assertIs(msg.category, ldap.LDAPBytesWarning)
         self.assertEqual(
             text_type(msg.message),
-            "Received non-bytes value u'%s' with default (disabled) bytes "
+            "Received non-bytes value for 'base' with default (disabled) bytes "
             "mode; please choose an explicit option for bytes_mode on your "
-            "LDAP connection" % self.server.suffix
+            "LDAP connection"
         )
 
     @contextlib.contextmanager
@@ -394,10 +394,10 @@ def _test_byteswarning_level_search(self, methodname):
         self.assertEqual(len(w), 2, w)
 
         self._check_byteswarning(
-            w[0], u"Received non-bytes value u'(cn=Foo*)'")
+            w[0], u"Received non-bytes value for 'filterstr'")
 
         self._check_byteswarning(
-            w[1], u"Received non-bytes value u'*'")
+            w[1], u"Received non-bytes value for 'attrlist'")
 
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
     def test_byteswarning_level_search(self):

From a484bc60274b826bbf45d4fe78f14e553c4c384e Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 19 Dec 2017 11:56:17 +0100
Subject: [PATCH 707/868] Add recent changes to release notes

---
 CHANGES | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/CHANGES b/CHANGES
index 3241046..9384819 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,29 @@
+----------------------------------------------------------------
+Released 3.0.0b3 2017-12-20
+
+Changes since 3.0.0b2:
+
+The functions `ldap.open()`, `ldap.init()`, `ldif.CreateLDIF()`
+and `ldif.ParseLDIF()`, which were deprecated for over a decade,
+are scheduled for removal in python-ldap 3.1.
+
+Infrastructure:
+* Require setuptools to build
+* Start running automatic tests on PyPy
+
+Lib/
+* When raising LDAPBytesWarning, give helpful code locations
+* Use modern Python idioms in several places
+* Avoid reimplementing UserDict.get() in cidict and models.Entry
+
+Doc/
+* Use https links
+
+Test/
+* Add reproducer for openldap's NSS shutdown/restart issue
+* Make testing on non-Linux platforms easier
+
+
 ----------------------------------------------------------------
 Released 3.0.0b2 2017-12-11
 

From 7846ba138e89c7cc6b4a8cee57fd1409273022e3 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 19 Dec 2017 11:57:09 +0100
Subject: [PATCH 708/868] Bump version to 3.0.0b3

---
 Lib/ldap/pkginfo.py       | 2 +-
 Lib/ldapurl.py            | 2 +-
 Lib/ldif.py               | 2 +-
 Lib/slapdtest/__init__.py | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index 4325aac..dec5a9c 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.0.0b2'
+__version__ = '3.0.0b3'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 262b6b0..374336d 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b2'
+__version__ = '3.0.0b3'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 16fb8c3..a9ece64 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.0.0b2'
+__version__ = '3.0.0b3'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 306eaf7..d268874 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b2'
+__version__ = '3.0.0b3'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls

From b32bcafe5007192e7f1c0d1259dda3b11b9eb1d7 Mon Sep 17 00:00:00 2001
From: Alexandre Figura <a.figura@syseleven.de>
Date: Fri, 29 Dec 2017 17:28:58 +0100
Subject: [PATCH 709/868] Document all_records attribute of class
 LDIFRecordList

The current documentation of this attribute was not displayed on the online doc.
---
 Lib/ldif.py | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/Lib/ldif.py b/Lib/ldif.py
index a9ece64..96b1651 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -577,8 +577,10 @@ def parse_change_records(self):
 
 class LDIFRecordList(LDIFParser):
   """
-  Collect all records of LDIF input into a single list.
-  of 2-tuples (dn,entry). It can be a memory hog!
+  Collect all records of a LDIF file. It can be a memory hog!
+
+  Records are stored in :attr:`.all_records` as a single list
+  of 2-tuples (dn, entry), after calling :meth:`.parse`.
   """
 
   def __init__(
@@ -586,20 +588,15 @@ def __init__(
     input_file,
     ignored_attr_types=None,max_entries=0,process_url_schemes=None
   ):
-    """
-    See LDIFParser.__init__()
-
-    Additional Parameters:
-    all_records
-        List instance for storing parsed records
-    """
     LDIFParser.__init__(self,input_file,ignored_attr_types,max_entries,process_url_schemes)
+
+    #: List storing parsed records.
     self.all_records = []
     self.all_modify_changes = []
 
   def handle(self,dn,entry):
     """
-    Append single record to dictionary of all records.
+    Append a single record to the list of all records (:attr:`.all_records`).
     """
     self.all_records.append((dn,entry))
 

From cf9494362b7a4c11d1e669e5d95011cfb6eb4cc0 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Fri, 5 Jan 2018 16:56:09 +0100
Subject: [PATCH 710/868] Refactor syncrepl tests to run with bytes_mode

https://github.com/python-ldap/python-ldap/pull/150
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldap_syncrepl.py | 118 ++++++++++++++++++---------------------
 1 file changed, 53 insertions(+), 65 deletions(-)

diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 0581e50..8c4eb34 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -7,8 +7,14 @@
 
 
 import os
-import unittest
 import shelve
+import sys
+import unittest
+
+if sys.version_info[0] <= 2:
+    PY2 = True
+else:
+    PY2 = False
 
 from slapdtest import SlapdObject, SlapdTestCase
 
@@ -125,9 +131,9 @@ class SyncreplClient(SimpleLDAPObject, SyncreplConsumer):
     Needs to be separate, because once an LDAP client starts a syncrepl
     search, it can't be used for anything else.
     """
-    server_class = SyncreplProvider
 
-    def __init__(self, uri, dn, password, storage=None):
+    def __init__(self, uri, dn, password, storage=None, filterstr=None,
+                 **kwargs):
         """
         Set up our object by creating a search client, connecting, and binding.
         """
@@ -146,11 +152,11 @@ def __init__(self, uri, dn, password, storage=None):
         self.data['cookie'] = None
         self.present = []
         self.refresh_done = False
+        self.filterstr = filterstr
 
-        SimpleLDAPObject.__init__(self, uri)
+        SimpleLDAPObject.__init__(self, uri, **kwargs)
         self.simple_bind_s(dn, password)
 
-
     def unbind_s(self):
         """
         In addition to unbinding from LDAP, we need to close the shelf.
@@ -161,7 +167,6 @@ def unbind_s(self):
             self.dn_attrs.close()
         SimpleLDAPObject.unbind_s(self)
 
-
     def search(self, search_base, search_mode):
         """
         Start a syncrepl search operation, given a base DN and search mode.
@@ -170,17 +175,15 @@ def search(self, search_base, search_mode):
             search_base,
             ldap.SCOPE_SUBTREE,
             mode=search_mode,
-            filterstr='(objectClass=*)'
+            filterstr=self.filterstr
         )
 
-
     def cancel(self):
         """
         A simple wrapper to call parent class with syncrepl search ID.
         """
         SimpleLDAPObject.cancel(self, self.search_id)
 
-
     def poll(self, timeout=None, all=0):
         """
         Take the params, add the syncrepl search ID, and call the proper poll.
@@ -191,28 +194,24 @@ def poll(self, timeout=None, all=0):
             all=all
         )
 
-
     def syncrepl_get_cookie(self):
         """
         Pull cookie from storage, if one exists.
         """
         return self.data['cookie']
 
-
     def syncrepl_set_cookie(self, cookie):
         """
         Update stored cookie.
         """
         self.data['cookie'] = cookie
 
-
     def syncrepl_refreshdone(self):
         """
         Just update a variable.
         """
         self.refresh_done = True
 
-
     def syncrepl_delete(self, uuids):
         """
         Delete the given items from both maps.
@@ -221,7 +220,6 @@ def syncrepl_delete(self, uuids):
             del self.dn_attrs[self.uuid_dn[uuid]]
             del self.uuid_dn[uuid]
 
-
     def syncrepl_entry(self, dn, attrs, uuid):
         """
         Handles adds and changes (including DN changes).
@@ -236,7 +234,6 @@ def syncrepl_entry(self, dn, attrs, uuid):
         self.uuid_dn[uuid] = dn
         self.dn_attrs[dn] = attrs
 
-
     def syncrepl_present(self, uuids, refreshDeletes=False):
         """
         The 'present' message from the LDAP server is the most complicated
@@ -262,7 +259,7 @@ def syncrepl_present(self, uuids, refreshDeletes=False):
             pass
 
 
-class Test00_Syncrepl(SlapdTestCase):
+class BaseSyncreplTests(object):
     """
     This is a test of all the basic Syncrepl operations.  It covers starting a
     search (both types of search), doing the refresh part of the search,
@@ -275,7 +272,7 @@ class Test00_Syncrepl(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        super(Test00_Syncrepl, cls).setUpClass()
+        super(BaseSyncreplTests, cls).setUpClass()
         # insert some Foo* objects via ldapadd
         cls.server.ldapadd(
             LDIF_TEMPLATE % {
@@ -287,57 +284,39 @@ def setUpClass(cls):
             }
         )
 
-
     def setUp(self):
-        try:
-            self._ldap_conn
-        except AttributeError:
-            # open local LDAP connection
-            self._ldap_conn = self._open_ldap_conn()
-
+        super(BaseSyncreplTests, self).setUp()
+        self.tester = None
+        self.suffix = None
 
     def tearDown(self):
         self.tester.unbind_s()
+        super(BaseSyncreplTests, self).tearDown()
 
+    def create_client(self):
+        raise NotImplementedError
 
     def test_refreshOnly_search(self):
         '''
         Test to see if we can initialize a syncrepl search.
         '''
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn,
-            self.server.root_pw
-        )
         self.tester.search(
-            self.server.suffix,
+            self.suffix,
             'refreshOnly'
         )
 
-
     def test_refreshAndPersist_search(self):
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn,
-            self.server.root_pw
-        )
         self.tester.search(
-            self.server.suffix,
+            self.suffix,
             'refreshAndPersist'
         )
 
-
     def test_refreshOnly_poll_full(self):
         """
         Test doing a full refresh cycle, and check what we got.
         """
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn,
-            self.server.root_pw
-        )
         self.tester.search(
-            self.server.suffix,
+            self.suffix,
             'refreshOnly'
         )
         poll_result = self.tester.poll(
@@ -347,18 +326,12 @@ def test_refreshOnly_poll_full(self):
         self.assertFalse(poll_result)
         self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
-
     def test_refreshAndPersist_poll_only(self):
         """
         Test the refresh part of refresh-and-persist, and check what we got.
         """
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn,
-            self.server.root_pw
-        )
         self.tester.search(
-            self.server.suffix,
+            self.suffix,
             'refreshAndPersist'
         )
 
@@ -372,18 +345,12 @@ def test_refreshAndPersist_poll_only(self):
 
         self.assertEqual(self.tester.dn_attrs, LDAP_ENTRIES)
 
-
     def test_refreshAndPersist_timeout(self):
         """
         Make sure refreshAndPersist can handle a search with timeouts.
         """
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn,
-            self.server.root_pw
-        )
         self.tester.search(
-            self.server.suffix,
+            self.suffix,
             'refreshAndPersist'
         )
 
@@ -407,18 +374,12 @@ def test_refreshAndPersist_timeout(self):
             timeout=1
         )
 
-
     def test_refreshAndPersist_cancelled(self):
         """
         Make sure refreshAndPersist can handle cancelling a syncrepl search.
         """
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn,
-            self.server.root_pw
-        )
         self.tester.search(
-            self.server.suffix,
+            self.suffix,
             'refreshAndPersist'
         )
 
@@ -463,5 +424,32 @@ def test_refreshAndPersist_cancelled(self):
     # should pick it up during the persist phase.
 
 
+class TestSyncrepl(BaseSyncreplTests, SlapdTestCase):
+    def setUp(self):
+        super(TestSyncrepl, self).setUp()
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn,
+            self.server.root_pw,
+            filterstr=u'(objectClass=*)',
+            bytes_mode=False
+        )
+        self.suffix = self.server.suffix
+
+
+@unittest.skipUnless(PY2, "no bytes_mode under Py3")
+class TestSyncreplBytesMode(BaseSyncreplTests, SlapdTestCase):
+    def setUp(self):
+        super(TestSyncreplBytesMode, self).setUp()
+        self.tester = SyncreplClient(
+            self.server.ldap_uri,
+            self.server.root_dn.encode('utf-8'),
+            self.server.root_pw.encode('utf-8'),
+            filterstr=b'(objectClass=*)',
+            bytes_mode=True
+        )
+        self.suffix = self.server.suffix.encode('utf-8')
+
+
 if __name__ == '__main__':
     unittest.main()

From 51229fd1277f513fab7b7b2f1f1094c1b427e67e Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Fri, 5 Jan 2018 16:58:11 +0100
Subject: [PATCH 711/868] Doc: Add updating the GitHub release page to the
 release process

https://github.com/python-ldap/python-ldap/pull/146
---
 Doc/contributing.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index c45e9c9..9061332 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -214,3 +214,6 @@ If you are tasked with releasing python-ldap, remember to:
 * Release the ``sdist`` on PyPI.
 * Announce the release on the mailing list.
   Mention the Git hash.
+* Add the release's log from ``CHANGES`` on the `GitHub release page`_.
+
+.. _GitHub release page: https://github.com/python-ldap/python-ldap/releases

From 98c535b9fc3e89bef5deb479590a9509440b494a Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Fri, 5 Jan 2018 07:59:53 -0800
Subject: [PATCH 712/868] Remove unused local variable, norm_func

https://github.com/python-ldap/python-ldap/pull/140
---
 Lib/ldap/modlist.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index e1dfe44..ecd7a42 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -73,7 +73,6 @@ def modifyModlist(
       replace_attr_value = len(old_value)!=len(new_value)
       if not replace_attr_value:
         if attrtype_lower in case_ignore_attr_types:
-          norm_func = str.lower
           old_value_set = set(map(str.lower,old_value))
           new_value_set = set(map(str.lower,new_value))
         else:

From 3ae51ed14c1139ee026d411577d5b349a215a075 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Fri, 5 Jan 2018 08:39:20 -0800
Subject: [PATCH 713/868] Update uses of map() to use list/set comprehensions
 instead

Updates style to modern Python idioms.
---
 Lib/ldap/controls/deref.py |  2 +-
 Lib/ldap/filter.py         |  2 +-
 Lib/ldap/functions.py      |  3 +--
 Lib/ldap/modlist.py        | 10 +++++-----
 Lib/ldapurl.py             |  2 +-
 5 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index b927f1a..0d43ab1 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -108,7 +108,7 @@ def decodeControlValue(self,encodedControlValue):
     for deref_res in decodedValue:
       deref_attr,deref_val,deref_vals = deref_res[0],deref_res[1],deref_res[2]
       partial_attrs_dict = {
-        str(tv[0]): map(str,tv[1])
+        str(tv[0]): [str(v) for v in tv[1]]
         for tv in deref_vals or []
       }
       try:
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index 56665dc..3dba7f7 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -54,7 +54,7 @@ def filter_format(filter_template,assertion_values):
         List or tuple of assertion values. Length must match
         count of %s in filter_template.
   """
-  return filter_template % (tuple(map(escape_filter_chars,assertion_values)))
+  return filter_template % tuple(escape_filter_chars(v) for v in assertion_values)
 
 
 def time_span_filter(
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 8c7580e..6c351ef 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -138,8 +138,7 @@ def escape_str(escape_func,s,*args):
   Applies escape_func() to all items of `args' and returns a string based
   on format string `s'.
   """
-  escape_args = map(escape_func,args)
-  return s % tuple(escape_args)
+  return s % tuple(escape_func(v) for v in args)
 
 
 def strf_secs(secs):
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index ecd7a42..6f51312 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -11,7 +11,7 @@
 
 def addModlist(entry,ignore_attr_types=None):
   """Build modify list for call of method LDAPObject.add()"""
-  ignore_attr_types = set(map(str.lower,ignore_attr_types or []))
+  ignore_attr_types = {v.lower() for v in ignore_attr_types or []}
   modlist = []
   for attrtype in entry.keys():
     if attrtype.lower() in ignore_attr_types:
@@ -46,8 +46,8 @@ def modifyModlist(
       List of attribute type names for which comparison will be made
       case-insensitive
   """
-  ignore_attr_types = set(map(str.lower,ignore_attr_types or []))
-  case_ignore_attr_types = set(map(str.lower,case_ignore_attr_types or []))
+  ignore_attr_types = {v.lower() for v in ignore_attr_types or []}
+  case_ignore_attr_types = {v.lower() for v in case_ignore_attr_types or []}
   modlist = []
   attrtype_lower_map = {}
   for a in old_entry.keys():
@@ -73,8 +73,8 @@ def modifyModlist(
       replace_attr_value = len(old_value)!=len(new_value)
       if not replace_attr_value:
         if attrtype_lower in case_ignore_attr_types:
-          old_value_set = set(map(str.lower,old_value))
-          new_value_set = set(map(str.lower,new_value))
+          old_value_set = {v.lower() for v in old_value}
+          new_value_set = {v.lower() for v in new_value}
         else:
           old_value_set = set(old_value)
           new_value_set = set(new_value)
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 374336d..698889a 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -158,7 +158,7 @@ def values(self):
     ]
 
   def __str__(self):
-    return ','.join(map(str,self.values()))
+    return ','.join(str(v) for v in self.values())
 
   def __repr__(self):
     return '<%s.%s instance at %s: %s>' % (

From 98999bd617aa837f3f57a3add9802b499f3dbba8 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jan 2018 17:30:54 +0100
Subject: [PATCH 714/868] Make schema attribute names text

Schema attribute names must be text in Python 2, too. Otherwise
read_subschemasubentry_s() fails with bytes error.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/schema/models.py | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index c1362a9..9a8cb5b 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -127,7 +127,7 @@ class ObjectClass(SchemaElement):
     This list of strings contains NAMEs or OIDs of object classes
     this object class is derived from
   """
-  schema_attribute = 'objectClasses'
+  schema_attribute = u'objectClasses'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -225,7 +225,7 @@ class AttributeType(SchemaElement):
     This list of strings contains NAMEs or OIDs of attribute types
     this attribute type is derived from
   """
-  schema_attribute = 'attributeTypes'
+  schema_attribute = u'attributeTypes'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -319,7 +319,7 @@ class LDAPSyntax(SchemaElement):
     Integer flag (0 or 1) indicating whether the attribute type is marked
     as not human-readable (X-NOT-HUMAN-READABLE)
   """
-  schema_attribute = 'ldapSyntaxes'
+  schema_attribute = u'ldapSyntaxes'
   token_defaults = {
     'DESC':(None,),
     'X-NOT-HUMAN-READABLE':(None,),
@@ -367,7 +367,7 @@ class MatchingRule(SchemaElement):
   syntax
     String contains OID of the LDAP syntax this matching rule is usable with
   """
-  schema_attribute = 'matchingRules'
+  schema_attribute = u'matchingRules'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -413,7 +413,7 @@ class MatchingRuleUse(SchemaElement):
     This list of strings contains NAMEs or OIDs of attribute types
     for which this matching rule is used
   """
-  schema_attribute = 'matchingRuleUse'
+  schema_attribute = u'matchingRuleUse'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -470,7 +470,7 @@ class DITContentRule(SchemaElement):
     This list of strings contains NAMEs or OIDs of attributes which
     may not be present in an entry of the object class
   """
-  schema_attribute = 'dITContentRules'
+  schema_attribute = u'dITContentRules'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -527,7 +527,7 @@ class DITStructureRule(SchemaElement):
     List of strings with NAMEs or OIDs of allowed structural object classes
     of superior entries in the DIT
   """
-  schema_attribute = 'dITStructureRules'
+  schema_attribute = u'dITStructureRules'
 
   token_defaults = {
     'NAME':(()),
@@ -591,7 +591,7 @@ class NameForm(SchemaElement):
     This list of strings contains NAMEs or OIDs of additional attributes
     an RDN may contain
   """
-  schema_attribute = 'nameForms'
+  schema_attribute = u'nameForms'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),

From 2f2f64c546898cec8cdd076b3114ecd290e2a87e Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jan 2018 17:32:42 +0100
Subject: [PATCH 715/868] Add more tests for bytes mode affected functions

Tests marked with expected failure are currently affected by bug #147.

See: https://github.com/python-ldap/python-ldap/issues/147

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldapobject.py | 104 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 2e1d338..fb48011 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -161,6 +161,30 @@ def test_bytesmode_search_results_have_bytes(self):
             for value in values:
                 self.assertEqual(type(value), bytes)
 
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    @unittest.expectedFailure
+    def test_bytesmode_search_defaults(self):
+        l = self._get_bytes_ldapobject()
+        base = 'cn=Foo1,' + self.server.suffix
+        kwargs = dict(
+            base=base.encode('utf-8'),
+            scope=ldap.SCOPE_SUBTREE,
+            # filterstr=b'(objectClass=*)'
+        )
+        expected = [
+            (
+                base,
+                {'cn': [b'Foo1'], 'objectClass': [b'organizationalRole']}
+            ),
+        ]
+
+        result = l.search_s(**kwargs)
+        self.assertEqual(result, expected)
+        result = l.search_st(**kwargs)
+        self.assertEqual(result, expected)
+        result = l.search_ext_s(**kwargs)
+        self.assertEqual(result, expected)
+
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
     def test_unset_bytesmode_search_warns_bytes(self):
         l = self._get_bytes_ldapobject(explicit=False)
@@ -263,11 +287,51 @@ def test003_search_oneattr(self):
             [('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': [b'Foo4']})]
         )
 
+    def test_find_unique_entry(self):
+        result = self._ldap_conn.find_unique_entry(
+            self.server.suffix,
+            ldap.SCOPE_SUBTREE,
+            '(cn=Foo4)',
+            ['cn'],
+        )
+        self.assertEqual(
+            result,
+            ('cn=Foo4,ou=Container,'+self.server.suffix, {'cn': [b'Foo4']})
+        )
+        with self.assertRaises(ldap.SIZELIMIT_EXCEEDED):
+            # > 2 entries returned
+            self._ldap_conn.find_unique_entry(
+                self.server.suffix,
+                ldap.SCOPE_ONELEVEL,
+                '(cn=Foo*)',
+                ['*'],
+            )
+        with self.assertRaises(ldap.NO_UNIQUE_ENTRY):
+            # 0 entries returned
+            self._ldap_conn.find_unique_entry(
+                self.server.suffix,
+                ldap.SCOPE_ONELEVEL,
+                '(cn=Bar*)',
+                ['*'],
+            )
+
     def test_search_subschema(self):
         l = self._ldap_conn
         dn = l.search_subschemasubentry_s()
         self.assertIsInstance(dn, text_type)
         self.assertEqual(dn, "cn=Subschema")
+        subschema = l.read_subschemasubentry_s(dn)
+        self.assertIsInstance(subschema, dict)
+        self.assertEqual(
+            sorted(subschema),
+            [
+                u'attributeTypes',
+                u'ldapSyntaxes',
+                u'matchingRuleUse',
+                u'matchingRules',
+                u'objectClasses'
+            ]
+        )
 
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
     def test_search_subschema_have_bytes(self):
@@ -275,6 +339,18 @@ def test_search_subschema_have_bytes(self):
         dn = l.search_subschemasubentry_s()
         self.assertIsInstance(dn, bytes)
         self.assertEqual(dn, b"cn=Subschema")
+        subschema = l.read_subschemasubentry_s(dn)
+        self.assertIsInstance(subschema, dict)
+        self.assertEqual(
+            sorted(subschema),
+            [
+                b'attributeTypes',
+                b'ldapSyntaxes',
+                b'matchingRuleUse',
+                b'matchingRules',
+                b'objectClasses'
+            ]
+        )
 
     def test004_errno107(self):
         l = self.ldap_object_class('ldap://127.0.0.1:42')
@@ -433,6 +509,34 @@ def test_multiple_starttls(self):
             l.simple_bind_s(self.server.root_dn, self.server.root_pw)
             self.assertEqual(l.whoami_s(), 'dn:' + self.server.root_dn)
 
+    def test_dse(self):
+        dse = self._ldap_conn.read_rootdse_s()
+        self.assertIsInstance(dse, dict)
+        self.assertEqual(dse[u'supportedLDAPVersion'], [b'3'])
+        self.assertEqual(
+            sorted(dse),
+            [u'configContext', u'entryDN', u'namingContexts', u'objectClass',
+             u'structuralObjectClass', u'subschemaSubentry',
+             u'supportedControl', u'supportedExtension', u'supportedFeatures',
+             u'supportedLDAPVersion', u'supportedSASLMechanisms']
+        )
+        self.assertEqual(
+            self._ldap_conn.get_naming_contexts(),
+            [self.server.suffix.encode('utf-8')]
+        )
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    @unittest.expectedFailure
+    def test_dse_bytes(self):
+        l = self._get_bytes_ldapobject()
+        dse = l.read_rootdse_s()
+        self.assertIsInstance(dse, dict)
+        self.assertEqual(dse[u'supportedLDAPVersion'], [b'3'])
+        self.assertEqual(
+            l.get_naming_contexts(),
+            [self.server.suffix.encode('utf-8')]
+        )
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From e56f61753e6b58b32f571ba9510f4e14ea666786 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jan 2018 17:57:13 +0100
Subject: [PATCH 716/868] Add workarounds for default argument types

Several default arguments are not compatible with bytes mode. Default to
bytes in bytes mode.

See: https://github.com/python-ldap/python-ldap/issues/147

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/ldapobject.py | 55 +++++++++++++++++++++++++++++++++---------
 Tests/t_ldapobject.py  |  4 +--
 2 files changed, 44 insertions(+), 15 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index f65e09a..71d298a 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -795,7 +795,12 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
     """
     if PY2:
         base = self._bytesify_input('base', base)
-        filterstr = self._bytesify_input('filterstr', filterstr)
+        # workaround for default argument,
+        # see https://github.com/python-ldap/python-ldap/issues/147
+        if self.bytes_mode and filterstr == '(objectClass=*)':
+          filterstr = b'(objectClass=*)'
+        else:
+          filterstr = self._bytesify_input('filterstr', filterstr)
         if attrlist is not None:
             attrlist = tuple(self._bytesify_input('attrlist', a)
                              for a in attrlist)
@@ -885,7 +890,7 @@ def set_option(self,option,invalue):
       invalue = RequestControlTuples(invalue)
     return self._ldap_call(self._l.set_option,option,invalue)
 
-  def search_subschemasubentry_s(self,dn=''):
+  def search_subschemasubentry_s(self,dn=None):
     """
     Returns the distinguished name of the sub schema sub entry
     for a part of a DIT specified by dn.
@@ -895,9 +900,17 @@ def search_subschemasubentry_s(self,dn=''):
 
     Returns: None or text/bytes depending on bytes_mode.
     """
+    if self.bytes_mode:
+      empty_dn = b''
+      attrname = b'subschemaSubentry'
+    else:
+      empty_dn = u''
+      attrname = u'subschemaSubentry'
+    if dn is None:
+      dn = empty_dn
     try:
       r = self.search_s(
-        dn,ldap.SCOPE_BASE,'(objectClass=*)',['subschemaSubentry']
+        dn,ldap.SCOPE_BASE,'(objectClass=*)',[attrname]
       )
     except (ldap.NO_SUCH_OBJECT,ldap.NO_SUCH_ATTRIBUTE,ldap.INSUFFICIENT_ACCESS):
       r = []
@@ -906,11 +919,11 @@ def search_subschemasubentry_s(self,dn=''):
     try:
       if r:
         e = ldap.cidict.cidict(r[0][1])
-        search_subschemasubentry_dn = e.get('subschemaSubentry',[None])[0]
+        search_subschemasubentry_dn = e.get(attrname,[None])[0]
         if search_subschemasubentry_dn is None:
           if dn:
             # Try to find sub schema sub entry in root DSE
-            return self.search_subschemasubentry_s(dn='')
+            return self.search_subschemasubentry_s(dn=empty_dn)
           else:
             # If dn was already root DSE we can return here
             return None
@@ -945,11 +958,19 @@ def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     """
     Returns the sub schema sub entry's data
     """
+    if self.bytes_mode:
+      filterstr = b'(objectClass=subschema)'
+      if attrs is None:
+        attrs = [attr.encode('utf-8') for attr in SCHEMA_ATTRS]
+    else:
+      filterstr = u'(objectClass=subschema)'
+      if attrs is None:
+        attrs = SCHEMA_ATTRS
     try:
       subschemasubentry = self.read_s(
         subschemasubentry_dn,
-        filterstr='(objectClass=subschema)',
-        attrlist=attrs or SCHEMA_ATTRS
+        filterstr=filterstr,
+        attrlist=attrs
       )
     except ldap.NO_SUCH_OBJECT:
       return None
@@ -964,7 +985,7 @@ def find_unique_entry(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass
       base,
       scope,
       filterstr,
-      attrlist=attrlist or ['*'],
+      attrlist=attrlist,
       attrsonly=attrsonly,
       serverctrls=serverctrls,
       clientctrls=clientctrls,
@@ -979,10 +1000,16 @@ def read_rootdse_s(self, filterstr='(objectClass=*)', attrlist=None):
     """
     convenience wrapper around read_s() for reading rootDSE
     """
+    if self.bytes_mode:
+      base = b''
+      attrlist = attrlist or [b'*', b'+']
+    else:
+      base = u''
+      attrlist = attrlist or [u'*', u'+']
     ldap_rootdse = self.read_s(
-      '',
+      base,
       filterstr=filterstr,
-      attrlist=attrlist or ['*', '+'],
+      attrlist=attrlist,
     )
     return ldap_rootdse  # read_rootdse_s()
 
@@ -991,9 +1018,13 @@ def get_naming_contexts(self):
     returns all attribute values of namingContexts in rootDSE
     if namingContexts is not present (not readable) then empty list is returned
     """
+    if self.bytes_mode:
+      name = b'namingContexts'
+    else:
+      name = u'namingContexts'
     return self.read_rootdse_s(
-      attrlist=['namingContexts']
-    ).get('namingContexts', [])
+      attrlist=[name]
+    ).get(name, [])
 
 
 class ReconnectLDAPObject(SimpleLDAPObject):
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index fb48011..243cd86 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -162,7 +162,6 @@ def test_bytesmode_search_results_have_bytes(self):
                 self.assertEqual(type(value), bytes)
 
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    @unittest.expectedFailure
     def test_bytesmode_search_defaults(self):
         l = self._get_bytes_ldapobject()
         base = 'cn=Foo1,' + self.server.suffix
@@ -335,7 +334,7 @@ def test_search_subschema(self):
 
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
     def test_search_subschema_have_bytes(self):
-        l = self._get_bytes_ldapobject(explicit=False)
+        l = self._get_bytes_ldapobject()
         dn = l.search_subschemasubentry_s()
         self.assertIsInstance(dn, bytes)
         self.assertEqual(dn, b"cn=Subschema")
@@ -526,7 +525,6 @@ def test_dse(self):
         )
 
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    @unittest.expectedFailure
     def test_dse_bytes(self):
         l = self._get_bytes_ldapobject()
         dse = l.read_rootdse_s()

From 274d826f660ef7cd49c0662126d3c41758800cf1 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jan 2018 18:07:23 +0100
Subject: [PATCH 717/868] Better hack: filterstr=None

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap.rst |  3 +++
 Lib/ldap/ldapobject.py | 33 ++++++++++++++++++++-------------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 2099414..467f1d7 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -1068,7 +1068,10 @@ and wait for and return with the server's result, or with
    or :py:meth:`search_ext_s()` (client-side search limit). If non-zero
    not more than *sizelimit* results are returned by the server.
 
+   .. versionchanged:: 3.0
 
+      ``filterstr=None`` is equal to ``filterstr='(objectClass=*)'``.
+   
 
 .. py:method:: LDAPObject.start_tls_s() -> None
 
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 71d298a..69431ef 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -748,7 +748,7 @@ def result4(self,msgid=ldap.RES_ANY,all=1,timeout=None,add_ctrls=0,add_intermedi
         resp_data = self._bytesify_results(resp_data, with_ctrls=add_ctrls)
     return resp_type, resp_data, resp_msgid, decoded_resp_ctrls, resp_name, resp_value
 
-  def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
+  def search_ext(self,base,scope,filterstr=None,attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
     """
     search(base, scope [,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0]]]) -> int
     search_s(base, scope [,filterstr='(objectClass=*)' [,attrlist=None [,attrsonly=0]]])
@@ -793,17 +793,24 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
         The amount of search results retrieved can be limited with the
         sizelimit parameter if non-zero.
     """
+
     if PY2:
         base = self._bytesify_input('base', base)
-        # workaround for default argument,
-        # see https://github.com/python-ldap/python-ldap/issues/147
-        if self.bytes_mode and filterstr == '(objectClass=*)':
-          filterstr = b'(objectClass=*)'
+        if filterstr is None:
+          # workaround for default argument,
+          # see https://github.com/python-ldap/python-ldap/issues/147
+          if self.bytes_mode:
+            filterstr = b'(objectClass=*)'
+          else:
+            filterstr = u'(objectClass=*)'
         else:
           filterstr = self._bytesify_input('filterstr', filterstr)
         if attrlist is not None:
             attrlist = tuple(self._bytesify_input('attrlist', a)
                              for a in attrlist)
+    else:
+      if filterstr is None:
+        filterstr = '(objectClass=*)'
     return self._ldap_call(
       self._l.search_ext,
       base,scope,filterstr,
@@ -813,17 +820,17 @@ def search_ext(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrson
       timeout,sizelimit,
     )
 
-  def search_ext_s(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
+  def search_ext_s(self,base,scope,filterstr=None,attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
     msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
     return self.result(msgid,all=1,timeout=timeout)[1]
 
-  def search(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0):
+  def search(self,base,scope,filterstr=None,attrlist=None,attrsonly=0):
     return self.search_ext(base,scope,filterstr,attrlist,attrsonly,None,None)
 
-  def search_s(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0):
+  def search_s(self,base,scope,filterstr=None,attrlist=None,attrsonly=0):
     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
 
-  def search_st(self,base,scope,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,timeout=-1):
+  def search_st(self,base,scope,filterstr=None,attrlist=None,attrsonly=0,timeout=-1):
     return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout)
 
   def start_tls_s(self):
@@ -910,7 +917,7 @@ def search_subschemasubentry_s(self,dn=None):
       dn = empty_dn
     try:
       r = self.search_s(
-        dn,ldap.SCOPE_BASE,'(objectClass=*)',[attrname]
+        dn,ldap.SCOPE_BASE,None,[attrname]
       )
     except (ldap.NO_SUCH_OBJECT,ldap.NO_SUCH_ATTRIBUTE,ldap.INSUFFICIENT_ACCESS):
       r = []
@@ -943,7 +950,7 @@ def read_s(self,dn,filterstr=None,attrlist=None,serverctrls=None,clientctrls=Non
     r = self.search_ext_s(
       dn,
       ldap.SCOPE_BASE,
-      filterstr or '(objectClass=*)',
+      filterstr,
       attrlist=attrlist,
       serverctrls=serverctrls,
       clientctrls=clientctrls,
@@ -977,7 +984,7 @@ def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     else:
       return subschemasubentry
 
-  def find_unique_entry(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass=*)',attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1):
+  def find_unique_entry(self,base,scope=ldap.SCOPE_SUBTREE,filterstr=None,attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1):
     """
     Returns a unique entry, raises exception if not unique
     """
@@ -996,7 +1003,7 @@ def find_unique_entry(self,base,scope=ldap.SCOPE_SUBTREE,filterstr='(objectClass
       raise NO_UNIQUE_ENTRY('No or non-unique search result for %s' % (repr(filterstr)))
     return r[0]
 
-  def read_rootdse_s(self, filterstr='(objectClass=*)', attrlist=None):
+  def read_rootdse_s(self, filterstr=None, attrlist=None):
     """
     convenience wrapper around read_s() for reading rootDSE
     """

From f8f8c9c024fe1b9809c173a1f51e9f055cb6fec3 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 10 Jan 2018 10:59:28 +0100
Subject: [PATCH 718/868] Wording change in search* docs

---
 Doc/reference/ldap.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 467f1d7..fdd5d35 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -1070,7 +1070,7 @@ and wait for and return with the server's result, or with
 
    .. versionchanged:: 3.0
 
-      ``filterstr=None`` is equal to ``filterstr='(objectClass=*)'``.
+      ``filterstr=None`` is equivalent to ``filterstr='(objectClass=*)'``.
    
 
 .. py:method:: LDAPObject.start_tls_s() -> None

From 6e75fc4b0f1d7becf0b6958c9da14552a6d6a5e6 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 10 Jan 2018 02:47:25 -0800
Subject: [PATCH 719/868] Remove support for EOL Python 3.3

Python 3.3 is end of life. It is no longer receiving bug fixes including
for security issues. It has been EOL since 2017-09-29. For a library
focused on authentication, supporting environments that are not
receiving security updates sends the wrong message. For additional
details, see:

https://devguide.python.org/#status-of-python-branches

Reduces testing and maintenance resources.

https://github.com/python-ldap/python-ldap/pull/154
---
 .travis.yml        | 4 ----
 Doc/installing.rst | 2 +-
 setup.py           | 7 +++----
 tox.ini            | 7 ++++---
 4 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 22559b7..5479573 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,10 +18,6 @@ matrix:
       env:
         - TOXENV=py27
         - WITH_GCOV=1
-    - python: 3.3
-      env:
-        - TOXENV=py33
-        - WITH_GCOV=1
     - python: 3.4
       env:
         - TOXENV=py34
diff --git a/Doc/installing.rst b/Doc/installing.rst
index efbab70..bb06c21 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -120,7 +120,7 @@ Build prerequisites
 The following software packages are required to be installed
 on the local system when building python-ldap:
 
-- `Python`_ version 2.7, or 3.3 or later including its development files
+- `Python`_ version 2.7, or 3.4 or later including its development files
 - C compiler corresponding to your Python version (on Linux, it is usually ``gcc``)
 - `OpenLDAP`_ client libs version 2.4.11 or later;
   it is not possible and not supported to build with prior versions.
diff --git a/setup.py b/setup.py
index 2f6bd89..034c4dd 100644
--- a/setup.py
+++ b/setup.py
@@ -9,8 +9,8 @@
 
 if sys.version_info[0] == 2 and sys.version_info[1] < 7:
     raise RuntimeError('This software requires Python 2.7 or 3.x.')
-if sys.version_info[0] >= 3 and sys.version_info < (3, 3):
-    raise RuntimeError('The C API from Python 3.3+ is required.')
+if sys.version_info[0] >= 3 and sys.version_info < (3, 4):
+    raise RuntimeError('The C API from Python 3.4+ is required.')
 
 if sys.version_info[0] >= 3:
     from configparser import ConfigParser
@@ -91,7 +91,6 @@ class OpenLDAP2:
     'Programming Language :: Python :: 2',
     'Programming Language :: Python :: 2.7',
     'Programming Language :: Python :: 3',
-    'Programming Language :: Python :: 3.3',
     'Programming Language :: Python :: 3.4',
     'Programming Language :: Python :: 3.5',
     'Programming Language :: Python :: 3.6',
@@ -168,6 +167,6 @@ class OpenLDAP2:
     'pyasn1_modules >= 0.1.5',
   ],
   zip_safe=False,
-  python_requires='>=2.7,!=3.0.*,!=3.1.*,!=3.2.*',
+  python_requires='>=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*',
   test_suite = 'Tests',
 )
diff --git a/tox.ini b/tox.ini
index 58e3cf6..abba0b0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py33,py34,py35,py36,{py2,py3}-nosasltls,doc,coverage-report
+envlist = py27,py34,py35,py36,{py2,py3}-nosasltls,doc,coverage-report
 minver = 1.8
 
 [testenv]
@@ -13,8 +13,9 @@ deps = coverage
 passenv = WITH_GCOV
 # - Enable BytesWarning 
 # - Turn all warnings into exceptions.
-# - 'ignore:the imp module is deprecated' is required to ignore import of
-#   'imp' in distutils. Python 3.3 and 3.4 use PendingDeprecationWarning.
+# - 'ignore:the imp module is deprecated' is required to ignore import of 'imp'
+#   in distutils. Python < 3.6 use PendingDeprecationWarning; Python >= 3.6 use
+#   DeprecationWarning.
 commands = {envpython} -bb -Werror \
     "-Wignore:the imp module is deprecated:DeprecationWarning" \
     "-Wignore:the imp module is deprecated:PendingDeprecationWarning" \

From 9369294db7a8d39f6416b74de61e1596cd309b88 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 10 Jan 2018 12:09:05 +0100
Subject: [PATCH 720/868] simple_bind() accept None for who and cred

sasl_bind_s() has accepted None for who and cred for a long time. Now
simple_bind() and simple_bind_s() default to and accept None, too.

See: https://github.com/python-ldap/python-ldap/issues/147

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap.rst | 9 +++++++--
 Lib/ldap/ldapobject.py | 6 +++---
 Modules/LDAPObject.c   | 2 +-
 Tests/t_ldapobject.py  | 8 ++++++++
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index fdd5d35..66434b5 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -1000,9 +1000,9 @@ and wait for and return with the server's result, or with
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
 
-.. py:method:: LDAPObject.simple_bind([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> int
+.. py:method:: LDAPObject.simple_bind([who=None [, cred=None [, serverctrls=None [, clientctrls=None]]]]) -> int
 
-.. py:method:: LDAPObject.simple_bind_s([who='' [, cred='' [, serverctrls=None [, clientctrls=None]]]]) -> None
+.. py:method:: LDAPObject.simple_bind_s([who=None [, cred=None [, serverctrls=None [, clientctrls=None]]]]) -> None
 
    After an LDAP object is created, and before any other operations can be
    attempted over the connection, a bind operation must be performed.
@@ -1015,6 +1015,11 @@ and wait for and return with the server's result, or with
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
+   .. versionchanged:: 3.0
+
+      :meth:`~LDAPObject.simple_bind` and :meth:`~LDAPObject.simple_bind_s`
+      now accept `None` for who and cred, too.
+
 
 .. py:method:: LDAPObject.search(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->int
 
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 69431ef..5a80bff 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -406,7 +406,7 @@ def add(self,dn,modlist):
   def add_s(self,dn,modlist):
     return self.add_ext_s(dn,modlist,None,None)
 
-  def simple_bind(self,who='',cred='',serverctrls=None,clientctrls=None):
+  def simple_bind(self,who=None,cred=None,serverctrls=None,clientctrls=None):
     """
     simple_bind([who='' [,cred='']]) -> int
     """
@@ -415,7 +415,7 @@ def simple_bind(self,who='',cred='',serverctrls=None,clientctrls=None):
         cred = self._bytesify_input('cred', cred)
     return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
-  def simple_bind_s(self,who='',cred='',serverctrls=None,clientctrls=None):
+  def simple_bind_s(self,who=None,cred=None,serverctrls=None,clientctrls=None):
     """
     simple_bind_s([who='' [,cred='']]) -> 4-tuple
     """
@@ -1107,7 +1107,7 @@ def _apply_last_bind(self):
       func(self,*args,**kwargs)
     else:
       # Send explicit anon simple bind request to provoke ldap.SERVER_DOWN in method reconnect()
-      SimpleLDAPObject.simple_bind_s(self,'','')
+      SimpleLDAPObject.simple_bind_s(self, None, None)
 
   def _restore_options(self):
     """Restore all recorded options"""
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index addbe96..f8720fa 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -499,7 +499,7 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
     LDAPControl** client_ldcs = NULL;
     struct berval cred;
 
-    if (!PyArg_ParseTuple( args, "ss#|OO", &who, &cred.bv_val, &cred_len, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple( args, "zz#|OO", &who, &cred.bv_val, &cred_len, &serverctrls, &clientctrls )) return NULL;
     cred.bv_len = (ber_len_t) cred_len;
 
     if (not_valid(self)) return NULL;
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 243cd86..27deadc 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -401,6 +401,14 @@ def assertIsSubclass(self, cls, other):
             cls.__mro__
         )
 
+    def test_simple_bind_noarg(self):
+        l = self.ldap_object_class(self.server.ldap_uri)
+        l.simple_bind_s()
+        self.assertEqual(l.whoami_s(), u'')
+        l = self.ldap_object_class(self.server.ldap_uri)
+        l.simple_bind_s(None, None)
+        self.assertEqual(l.whoami_s(), u'')
+
     @unittest.skipUnless(PY2, "no bytes_mode under Py3")
     def test_ldapbyteswarning(self):
         self.assertIsSubclass(ldap.LDAPBytesWarning, BytesWarning)

From a144e3d0b51a5622a228b682d9b9109005c9ecfc Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 10 Jan 2018 12:21:59 +0100
Subject: [PATCH 721/868] ReST syntax fix

---
 Doc/reference/ldap.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 66434b5..9cb1d52 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -1018,7 +1018,7 @@ and wait for and return with the server's result, or with
    .. versionchanged:: 3.0
 
       :meth:`~LDAPObject.simple_bind` and :meth:`~LDAPObject.simple_bind_s`
-      now accept `None` for who and cred, too.
+      now accept ``None`` for *who* and *cred*, too.
 
 
 .. py:method:: LDAPObject.search(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->int

From abcd2e9937336b82f08dc52557f2319a998cdca1 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 10 Jan 2018 12:31:37 +0100
Subject: [PATCH 722/868] Improve valgrind rule for PR_strdup

libldap's NSS engine has one known memory leak. One block of memory is
leaked one time only. The existing rule only matches when all debug
symbols are installed. The new rule should work without debug symbols.

https://github.com/python-ldap/python-ldap/pull/157
Closes: https://github.com/python-ldap/python-ldap/issues/156
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Misc/python-ldap.supp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Misc/python-ldap.supp b/Misc/python-ldap.supp
index 3267fd0..b9954a9 100644
--- a/Misc/python-ldap.supp
+++ b/Misc/python-ldap.supp
@@ -33,7 +33,8 @@
    match-leak-kinds: definite
    fun:malloc
    fun:PL_strdup
-   fun:tlsm_init
+   ...
+   fun:ldap_set_option
    ...
 }
 

From ad46c1104ea40117f8fb0fd08653517743f94723 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Wed, 10 Jan 2018 12:35:58 +0100
Subject: [PATCH 723/868] Bump version to 3.0.0b4 and update CHANGES

https://github.com/python-ldap/python-ldap/pull/158
---
 CHANGES                   | 18 ++++++++++++++++++
 Lib/ldap/pkginfo.py       |  2 +-
 Lib/ldapurl.py            |  2 +-
 Lib/ldif.py               |  2 +-
 Lib/slapdtest/__init__.py |  2 +-
 5 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9384819..03d892f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,21 @@
+----------------------------------------------------------------
+Released 3.0.0b4 2018-01-10
+
+Changes since 3.0.0b3:
+
+Removed support for Python 3.3, which reached its end-of-life 2017-09-29.
+
+Lib/
+* Make default argument values work under bytes_mode
+* Update use of map() to use list/set comprehensions instead
+
+Test/
+* Refactor syncrepl tests to run with bytes_mode
+
+Doc/
+* Document all_records attribute of LDIFRecordList
+
+
 ----------------------------------------------------------------
 Released 3.0.0b3 2017-12-20
 
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index dec5a9c..24e2017 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.0.0b3'
+__version__ = '3.0.0b4'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 698889a..ca28de3 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b3'
+__version__ = '3.0.0b4'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 96b1651..29c118c 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.0.0b3'
+__version__ = '3.0.0b4'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index d268874..727aa52 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b3'
+__version__ = '3.0.0b4'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls

From 2387fe6df83bd438536b175938d8b6323070f387 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 15 Jan 2018 23:17:58 +0100
Subject: [PATCH 724/868] Use correct types for BER en/decode

ber_scanf() and ber_printf() "i" format uses ber_int_t. lber_types.h
defines the type as int but Python code assumes the type to be unsigned
long:

    #define LBER_INT_T int
    typedef LBER_INT_T ber_int_t;

The code was working fine on little endian machines but broke on big
endian machines. ber_int_t is now correctly parsed as signed int.

https://github.com/python-ldap/python-ldap/pull/162
Fixes: https://github.com/python-ldap/python-ldap/issues/161
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/ldapcontrol.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 9522d57..ec50625 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -242,7 +242,7 @@ encode_rfc2696(PyObject *self, PyObject *args)
     BerElement *ber = 0;
     struct berval cookie, *ctrl_val;
     Py_ssize_t cookie_len;
-    unsigned long size;
+    int size = 0; /* ber_int_t is int */
     ber_tag_t tag;
 
     if (!PyArg_ParseTuple(args, "is#:encode_page_control", &size,
@@ -300,7 +300,7 @@ decode_rfc2696(PyObject *self, PyObject *args)
     struct berval ldctl_value;
     ber_tag_t tag;
     struct berval *cookiep;
-    unsigned long count = 0;
+    int count = 0;  /* ber_int_t is int */
     Py_ssize_t ldctl_value_len;
 
     if (!PyArg_ParseTuple(args, "s#:decode_page_control",
@@ -320,7 +320,7 @@ decode_rfc2696(PyObject *self, PyObject *args)
         goto endlbl;
     }
 
-    res = Py_BuildValue("(kO&)", count, LDAPberval_to_object, cookiep);
+    res = Py_BuildValue("(iO&)", count, LDAPberval_to_object, cookiep);
     ber_bvfree(cookiep);
 
  endlbl:

From 1266c65b75bfe8a74892874163d268ef5541487d Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 15 Jan 2018 23:20:50 +0100
Subject: [PATCH 725/868] Ignore SASL methods in DSE test

OpenLDAP may not offer SASL in restricted environments.

https://github.com/python-ldap/python-ldap/pull/163
Closes: https://github.com/python-ldap/python-ldap/issues/160
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldapobject.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 27deadc..2c8ce75 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -520,12 +520,15 @@ def test_dse(self):
         dse = self._ldap_conn.read_rootdse_s()
         self.assertIsInstance(dse, dict)
         self.assertEqual(dse[u'supportedLDAPVersion'], [b'3'])
+        keys = set(dse)
+        # SASL info may be missing in restricted build environments
+        keys.discard(u'supportedSASLMechanisms')
         self.assertEqual(
-            sorted(dse),
-            [u'configContext', u'entryDN', u'namingContexts', u'objectClass',
+            keys,
+            {u'configContext', u'entryDN', u'namingContexts', u'objectClass',
              u'structuralObjectClass', u'subschemaSubentry',
              u'supportedControl', u'supportedExtension', u'supportedFeatures',
-             u'supportedLDAPVersion', u'supportedSASLMechanisms']
+             u'supportedLDAPVersion'}
         )
         self.assertEqual(
             self._ldap_conn.get_naming_contexts(),

From 7d69bbdeb9b9777b9048d3fb40aa9d7c1fd83127 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 16 Jan 2018 13:21:56 +0100
Subject: [PATCH 726/868] Remove filterstr workaround from syncrpl test

https://github.com/python-ldap/python-ldap/pull/159
Closes: https://github.com/python-ldap/python-ldap/issues/147
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_ldap_syncrepl.py | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 8c4eb34..71f240c 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -132,8 +132,7 @@ class SyncreplClient(SimpleLDAPObject, SyncreplConsumer):
     search, it can't be used for anything else.
     """
 
-    def __init__(self, uri, dn, password, storage=None, filterstr=None,
-                 **kwargs):
+    def __init__(self, uri, dn, password, storage=None, **kwargs):
         """
         Set up our object by creating a search client, connecting, and binding.
         """
@@ -152,7 +151,6 @@ def __init__(self, uri, dn, password, storage=None, filterstr=None,
         self.data['cookie'] = None
         self.present = []
         self.refresh_done = False
-        self.filterstr = filterstr
 
         SimpleLDAPObject.__init__(self, uri, **kwargs)
         self.simple_bind_s(dn, password)
@@ -175,7 +173,6 @@ def search(self, search_base, search_mode):
             search_base,
             ldap.SCOPE_SUBTREE,
             mode=search_mode,
-            filterstr=self.filterstr
         )
 
     def cancel(self):
@@ -431,7 +428,6 @@ def setUp(self):
             self.server.ldap_uri,
             self.server.root_dn,
             self.server.root_pw,
-            filterstr=u'(objectClass=*)',
             bytes_mode=False
         )
         self.suffix = self.server.suffix
@@ -445,7 +441,6 @@ def setUp(self):
             self.server.ldap_uri,
             self.server.root_dn.encode('utf-8'),
             self.server.root_pw.encode('utf-8'),
-            filterstr=b'(objectClass=*)',
             bytes_mode=True
         )
         self.suffix = self.server.suffix.encode('utf-8')

From 22c3ccf7eab3fc0d05acd0b18d9e1c6f08ec3f0f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 18 Jan 2018 11:35:50 +0100
Subject: [PATCH 727/868] Set LDAPNOINIT env in all tests

All test suites are now setting LDAPNOINIT to prevent processing of
/etc/openldap/ldap.conf. This fixes TLS tests when ldap.conf contains a
relaxed TLS_REQCERT option.

See: https://github.com/python-ldap/python-ldap/issues/169
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_bind.py                  | 10 ++++++++--
 Tests/t_cext.py                  |  3 +--
 Tests/t_cidict.py                |  8 +++++---
 Tests/t_edit.py                  |  9 +++++++--
 Tests/t_ldap_controls_libldap.py |  1 -
 Tests/t_ldap_dn.py               |  4 +++-
 Tests/t_ldap_filter.py           |  6 ++++--
 Tests/t_ldap_functions.py        |  6 ++++--
 Tests/t_ldap_modlist.py          |  6 +++++-
 Tests/t_ldap_options.py          |  4 +++-
 Tests/t_ldap_sasl.py             |  1 -
 Tests/t_ldap_schema_tokenizer.py |  4 ++++
 Tests/t_ldap_syncrepl.py         |  4 ++--
 Tests/t_ldapobject.py            |  6 ++++--
 Tests/t_ldapurl.py               |  5 +++++
 Tests/t_ldif.py                  |  8 +++++---
 Tests/t_untested_mods.py         |  5 +++++
 17 files changed, 65 insertions(+), 25 deletions(-)

diff --git a/Tests/t_bind.py b/Tests/t_bind.py
index 6e9a61c..3e2b67f 100644
--- a/Tests/t_bind.py
+++ b/Tests/t_bind.py
@@ -9,9 +9,15 @@
     PY2 = False
     text_type = str
 
-import ldap, unittest
-from slapdtest import SlapdTestCase
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+import ldap
 from ldap.ldapobject import LDAPObject
+from slapdtest import SlapdTestCase
 
 
 class TestBinds(SlapdTestCase):
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index d8233dc..af26706 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -10,13 +10,12 @@
 import os
 import unittest
 
-from slapdtest import SlapdTestCase, requires_tls
-
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
 # import the plain C wrapper module
 import _ldap
+from slapdtest import SlapdTestCase, requires_tls
 
 
 class TestLdapCExtension(SlapdTestCase):
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index 00d0726..8e5d8d6 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -5,11 +5,13 @@
 See https://www.python-ldap.org/ for details.
 """
 
-# from Python's standard lib
+import os
 import unittest
 
-# from python-ldap
-import ldap, ldap.cidict
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+import ldap
+import ldap.cidict
 
 
 class TestCidict(unittest.TestCase):
diff --git a/Tests/t_edit.py b/Tests/t_edit.py
index 0012c9c..a5b3f65 100644
--- a/Tests/t_edit.py
+++ b/Tests/t_edit.py
@@ -9,10 +9,15 @@
     PY2 = False
     text_type = str
 
-import ldap, unittest
-from slapdtest import SlapdTestCase
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
 
+import ldap
 from ldap.ldapobject import LDAPObject
+from slapdtest import SlapdTestCase
 
 
 class EditionTests(SlapdTestCase):
diff --git a/Tests/t_ldap_controls_libldap.py b/Tests/t_ldap_controls_libldap.py
index 229935e..d397861 100644
--- a/Tests/t_ldap_controls_libldap.py
+++ b/Tests/t_ldap_controls_libldap.py
@@ -4,7 +4,6 @@
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
-import ldap
 from ldap.controls import pagedresults
 from ldap.controls import libldap
 
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 459c1dc..4b4dd31 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -8,9 +8,11 @@
 from __future__ import unicode_literals
 
 # from Python's standard lib
+import os
 import unittest
 
-# from python-ldap
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
 import ldap.dn
 
 
diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index 5eda05d..da96446 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -5,10 +5,12 @@
 See https://www.python-ldap.org/ for details.
 """
 
-# from Python's standard lib
+import os
 import unittest
 
-# from python-ldap
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
 from ldap.filter import escape_filter_chars
 
 
diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
index cdd2ffb..45931da 100644
--- a/Tests/t_ldap_functions.py
+++ b/Tests/t_ldap_functions.py
@@ -5,10 +5,12 @@
 See https://www.python-ldap.org/ for details.
 """
 
-# from Python's standard lib
+import os
 import unittest
 
-# from python-ldap
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
 import ldap
 from ldap.dn import escape_dn_chars
 from ldap.filter import escape_filter_chars
diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
index a206cde..db248b7 100644
--- a/Tests/t_ldap_modlist.py
+++ b/Tests/t_ldap_modlist.py
@@ -5,12 +5,16 @@
 See https://www.python-ldap.org/ for details.
 """
 
+import os
 import unittest
 
-import ldap
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
 
+import ldap
 from ldap.modlist import addModlist,modifyModlist
 
+
 class TestModlist(unittest.TestCase):
 
     addModlist_tests = [
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
index a681a9b..ffc2451 100644
--- a/Tests/t_ldap_options.py
+++ b/Tests/t_ldap_options.py
@@ -4,12 +4,14 @@
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
+from slapdtest import SlapdTestCase, requires_tls
+
 import ldap
 from ldap.controls import RequestControlTuples
 from ldap.controls.pagedresults import SimplePagedResultsControl
 from ldap.controls.openldap import SearchNoOpControl
 from ldap.ldapobject import SimpleLDAPObject
-from slapdtest import SlapdTestCase, requires_tls
+
 
 SENTINEL = object()
 
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index d104468..e60ac12 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -5,7 +5,6 @@
 See https://www.python-ldap.org/ for details.
 """
 import os
-import socket
 import unittest
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index d676e8a..c858177 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -5,8 +5,12 @@
 See https://www.python-ldap.org/ for details.
 """
 
+import os
 import unittest
 
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
 import ldap.schema
 
 # basic test cases
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 71f240c..73ba1fb 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -16,8 +16,6 @@
 else:
     PY2 = False
 
-from slapdtest import SlapdObject, SlapdTestCase
-
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
@@ -25,6 +23,8 @@
 from ldap.ldapobject import SimpleLDAPObject
 from ldap.syncrepl import SyncreplConsumer
 
+from slapdtest import SlapdObject, SlapdTestCase
+
 # a template string for generating simple slapd.conf file
 SLAPD_CONF_PROVIDER_TEMPLATE = r"""
 serverID %(serverid)s
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 2c8ce75..b57ecf1 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -22,8 +22,6 @@
 import unittest
 import warnings
 import pickle
-from slapdtest import SlapdTestCase
-from slapdtest import requires_ldapi, requires_sasl, requires_tls
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -31,6 +29,10 @@
 import ldap
 from ldap.ldapobject import SimpleLDAPObject, ReconnectLDAPObject
 
+from slapdtest import SlapdTestCase
+from slapdtest import requires_ldapi, requires_sasl, requires_tls
+
+
 LDIF_TEMPLATE = """dn: %(suffix)s
 objectClass: dcObject
 objectClass: organization
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 2be03f6..c4a813d 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -7,7 +7,12 @@
 
 from __future__ import unicode_literals
 
+import os
 import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
 from ldap.compat import quote
 
 import ldapurl
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index adf0d26..4f181df 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -7,16 +7,18 @@
 
 from __future__ import unicode_literals
 
-# from Python's standard lib
-import unittest
+import os
 import textwrap
+import unittest
 
 try:
     from StringIO import StringIO
 except ImportError:
     from io import StringIO
 
-# from python-ldap
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
 import ldif
 
 
diff --git a/Tests/t_untested_mods.py b/Tests/t_untested_mods.py
index 7f0f30d..5e726a6 100644
--- a/Tests/t_untested_mods.py
+++ b/Tests/t_untested_mods.py
@@ -1,5 +1,10 @@
 # modules without any tests
 
+import os
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
 import ldap.controls.deref
 import ldap.controls.openldap
 import ldap.controls.ppolicy

From dfbe5234aa6008cb164c3e9107685cc53d2b0144 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 18 Jan 2018 11:37:35 +0100
Subject: [PATCH 728/868] Add test for secure TLS default

Now test that the default value for cert validation is DEMAND.

See: https://github.com/python-ldap/python-ldap/issues/169
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Tests/t_cext.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index af26706..350651c 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -826,10 +826,28 @@ def test_tls_ext(self):
         l.set_option(_ldap.OPT_X_TLS_NEWCTX, 0)
         l.start_tls_s()
 
+    @requires_tls()
+    def test_tls_require_cert(self):
+        # libldap defaults to secure cert validation
+        # see libraries/libldap/init.c
+        #     gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND;
+
+        self.assertEqual(
+            _ldap.get_option(_ldap.OPT_X_TLS_REQUIRE_CERT),
+            _ldap.OPT_X_TLS_DEMAND
+        )
+        l = self._open_conn(bind=False)
+        self.assertEqual(
+            l.get_option(_ldap.OPT_X_TLS_REQUIRE_CERT),
+            _ldap.OPT_X_TLS_DEMAND
+        )
+
     @requires_tls()
     def test_tls_ext_noca(self):
         l = self._open_conn(bind=False)
         l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        # fails because libldap defaults to secure cert validation but
+        # the test CA is not installed as trust anchor.
         with self.assertRaises(_ldap.CONNECT_ERROR) as e:
             l.start_tls_s()
         # known resaons:

From e148184281c5d5e3bc98d4da95c913c495065374 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Mon, 22 Jan 2018 12:50:07 +0100
Subject: [PATCH 729/868] Make bytes mode TypeError more useful

Make bytes mode TypeError more useful

It's a bit hard to understand where the TypeError excactly comes from.
The exception now contains the argument name.

https://github.com/python-ldap/python-ldap/pull/165
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/ldapobject.py | 10 ++++++--
 Modules/LDAPObject.c   | 54 +++++++++++++++++++++---------------------
 Modules/functions.c    |  2 +-
 Modules/ldapcontrol.c  |  8 +++----
 Tests/t_cext.py        | 10 ++++++--
 Tests/t_ldapobject.py  | 48 ++++++++++++++++++++++++++++++++-----
 6 files changed, 90 insertions(+), 42 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 5a80bff..a0712a3 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -144,7 +144,10 @@ def _bytesify_input(self, arg_name, value):
         return value
       else:
         if self.bytes_mode_hardfail:
-          raise TypeError("All provided fields *must* be bytes when bytes mode is on; got %r" % (value,))
+          raise TypeError(
+            "All provided fields *must* be bytes when bytes mode is on; "
+            "got type '{}' for '{}'.".format(type(value).__name__, arg_name)
+          )
         else:
           _raise_byteswarning(
             "Received non-bytes value for '{}' with default (disabled) bytes mode; "
@@ -153,7 +156,10 @@ def _bytesify_input(self, arg_name, value):
           return value.encode('utf-8')
     else:
       if not isinstance(value, text_type):
-        raise TypeError("All provided fields *must* be text when bytes mode is off; got %r" % (value,))
+        raise TypeError(
+          "All provided fields *must* be text when bytes mode is off; "
+          "got type '{}' for '{}'.".format(type(value).__name__, arg_name)
+        )
       assert not isinstance(value, bytes)
       return value.encode('utf-8')
 
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index f8720fa..d7265a4 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -108,16 +108,16 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
     Py_ssize_t i, len, nstrs;
 
     if (!PyTuple_Check(tup)) {
-        LDAPerror_TypeError("expected a tuple", tup);
+        LDAPerror_TypeError("Tuple_to_LDAPMod(): expected a tuple", tup);
         return NULL;
     }
 
     if (no_op) {
-        if (!PyArg_ParseTuple( tup, "sO", &type, &list ))
+        if (!PyArg_ParseTuple( tup, "sO:Tuple_to_LDAPMod", &type, &list ))
                 return NULL;
         op = 0;
     } else {
-        if (!PyArg_ParseTuple( tup, "isO", &op, &type, &list ))
+        if (!PyArg_ParseTuple( tup, "isO:Tuple_to_LDAPMod", &op, &type, &list ))
                 return NULL;
     }
 
@@ -161,7 +161,7 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
           if (item == NULL)
               goto error;
           if (!PyBytes_Check(item)) {
-              LDAPerror_TypeError("expected a byte string in the list", item);
+              LDAPerror_TypeError("Tuple_to_LDAPMod(): expected a byte string in the list", item);
               goto error;
           }
           lm->mod_bvalues[i]->bv_len = PyBytes_Size(item);
@@ -206,14 +206,14 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
     PyObject *item;
 
     if (!PySequence_Check(list)) {
-        LDAPerror_TypeError("expected list of tuples", list);
+        LDAPerror_TypeError("List_to_LDAPMods(): expected list of tuples", list);
         return NULL;
     }
 
     len = PySequence_Length(list);
 
     if (len < 0) {
-        LDAPerror_TypeError("expected list of tuples", list);
+        LDAPerror_TypeError("List_to_LDAPMods(): expected list of tuples", list);
         return NULL;
     }
 
@@ -262,7 +262,7 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
 #endif
         /* caught by John Benninghoff <johnb@netscape.com> */
         LDAPerror_TypeError(
-            "expected *list* of strings, not a string", attrlist);
+            "attrs_from_List(): expected *list* of strings, not a string", attrlist);
         goto error;
     } else {
         PyObject *item = NULL;
@@ -291,7 +291,7 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
 #if PY_MAJOR_VERSION == 2
             /* Encoded in Python to UTF-8 */
             if (!PyBytes_Check(item)) {
-                LDAPerror_TypeError("expected bytes in list", item);
+                LDAPerror_TypeError("attrs_from_List(): expected bytes in list", item);
                 goto error;
             }
             if (PyBytes_AsStringAndSize(item, &str, &strlen) == -1) {
@@ -299,7 +299,7 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
             }
 #else
             if (!PyUnicode_Check(item)) {
-                LDAPerror_TypeError("expected string in list", item);
+                LDAPerror_TypeError("attrs_from_List(): expected string in list", item);
                 goto error;
             }
             str = PyUnicode_AsUTF8AndSize(item, &strlen);
@@ -361,7 +361,7 @@ l_ldap_unbind_ext( LDAPObject* self, PyObject* args )
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "|OO", &serverctrls, &clientctrls)) return NULL;
+    if (!PyArg_ParseTuple( args, "|OO:unbind_ext", &serverctrls, &clientctrls)) return NULL;
     if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
@@ -404,7 +404,7 @@ l_ldap_abandon_ext( LDAPObject* self, PyObject* args )
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "i|OO", &msgid, &serverctrls, &clientctrls)) return NULL;
+    if (!PyArg_ParseTuple( args, "i|OO:abandon_ext", &msgid, &serverctrls, &clientctrls)) return NULL;
     if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
@@ -449,7 +449,7 @@ l_ldap_add_ext( LDAPObject* self, PyObject *args )
     int ldaperror;
     LDAPMod **mods;
 
-    if (!PyArg_ParseTuple( args, "sO|OO", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple( args, "sO|OO:add_ext", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
     if (not_valid(self)) return NULL;
 
     mods = List_to_LDAPMods( modlist, 1 );
@@ -499,7 +499,7 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
     LDAPControl** client_ldcs = NULL;
     struct berval cred;
 
-    if (!PyArg_ParseTuple( args, "zz#|OO", &who, &cred.bv_val, &cred_len, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple( args, "zz#|OO:simple_bind", &who, &cred.bv_val, &cred_len, &serverctrls, &clientctrls )) return NULL;
     cred.bv_len = (ber_len_t) cred_len;
 
     if (not_valid(self)) return NULL;
@@ -649,7 +649,7 @@ l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
     struct berval *servercred;
     int ldaperror;
 
-    if (!PyArg_ParseTuple(args, "zzz#OO", &dn, &mechanism, &cred.bv_val, &cred_len, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple(args, "zzz#OO:sasl_bind_s", &dn, &mechanism, &cred.bv_val, &cred_len, &serverctrls, &clientctrls ))
         return NULL;
 
     if (not_valid(self)) return NULL;
@@ -713,9 +713,9 @@ l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
      * "i" otherwise. 
      */
 #if (PY_MAJOR_VERSION == 2) && (PY_MINOR_VERSION < 3)
-    if (!PyArg_ParseTuple(args, "sOOOi", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
+    if (!PyArg_ParseTuple(args, "sOOOi:sasl_interactive_bind_s", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
 #else
-    if (!PyArg_ParseTuple(args, "sOOOI", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
+    if (!PyArg_ParseTuple(args, "sOOOI:sasl_interactive_bind_s", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
 #endif
       return NULL;
 
@@ -780,7 +780,7 @@ l_ldap_cancel( LDAPObject* self, PyObject* args )
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "i|OO", &cancelid, &serverctrls, &clientctrls)) return NULL;
+    if (!PyArg_ParseTuple( args, "i|OO:cancel", &cancelid, &serverctrls, &clientctrls)) return NULL;
     if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
@@ -826,7 +826,7 @@ l_ldap_compare_ext( LDAPObject* self, PyObject *args )
     Py_ssize_t value_len;
     struct berval value;
 
-    if (!PyArg_ParseTuple( args, "sss#|OO", &dn, &attr, &value.bv_val, &value_len, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple( args, "sss#|OO:compare_ext", &dn, &attr, &value.bv_val, &value_len, &serverctrls, &clientctrls )) return NULL;
     value.bv_len = (ber_len_t) value_len;
 
     if (not_valid(self)) return NULL;
@@ -871,7 +871,7 @@ l_ldap_delete_ext( LDAPObject* self, PyObject *args )
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "s|OO", &dn, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple( args, "s|OO:delete_ext", &dn, &serverctrls, &clientctrls )) return NULL;
     if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
@@ -916,7 +916,7 @@ l_ldap_modify_ext( LDAPObject* self, PyObject *args )
     int ldaperror;
     LDAPMod **mods;
 
-    if (!PyArg_ParseTuple( args, "sO|OO", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple( args, "sO|OO:modify_ext", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
     if (not_valid(self)) return NULL;
 
     mods = List_to_LDAPMods( modlist, 0 );
@@ -969,7 +969,7 @@ l_ldap_rename( LDAPObject* self, PyObject *args )
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "ss|ziOO", &dn, &newrdn, &newSuperior, &delold, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple( args, "ss|ziOO:rename", &dn, &newrdn, &newSuperior, &delold, &serverctrls, &clientctrls ))
         return NULL;
     if (not_valid(self)) return NULL;
 
@@ -1022,7 +1022,7 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     char **refs = NULL;
     LDAPControl **serverctrls = 0;
 
-    if (!PyArg_ParseTuple( args, "|iidiii", &msgid, &all, &timeout, &add_ctrls, &add_intermediates, &add_extop ))
+    if (!PyArg_ParseTuple( args, "|iidiii:result4", &msgid, &all, &timeout, &add_ctrls, &add_intermediates, &add_extop ))
         return NULL;
     if (not_valid(self)) return NULL;
     
@@ -1162,7 +1162,7 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "sis|OiOOdi",
+    if (!PyArg_ParseTuple( args, "sis|OiOOdi:search_ext",
                            &base, &scope, &filter, &attrlist, &attrsonly,
                            &serverctrls, &clientctrls, &timeout, &sizelimit )) return NULL;
     if (not_valid(self)) return NULL;
@@ -1224,7 +1224,7 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "|OO", &serverctrls, &clientctrls)) return NULL;
+    if (!PyArg_ParseTuple( args, "|OO:whoami_s", &serverctrls, &clientctrls)) return NULL;
     if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
@@ -1265,7 +1265,7 @@ l_ldap_start_tls_s( LDAPObject* self, PyObject* args )
 {
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "" )) return NULL;
+    if (!PyArg_ParseTuple( args, ":start_tls_s" )) return NULL;
     if (not_valid(self)) return NULL;
 
     LDAP_BEGIN_ALLOW_THREADS( self );
@@ -1331,7 +1331,7 @@ l_ldap_passwd( LDAPObject* self, PyObject *args )
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "z#z#z#|OO", &user.bv_val, &user_len, &oldpw.bv_val, &oldpw_len, &newpw.bv_val, &newpw_len, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple( args, "z#z#z#|OO:passwd", &user.bv_val, &user_len, &oldpw.bv_val, &oldpw_len, &newpw.bv_val, &newpw_len, &serverctrls, &clientctrls ))
         return NULL;
 
     user.bv_len = (ber_len_t) user_len;
@@ -1387,7 +1387,7 @@ l_ldap_extended_operation( LDAPObject* self, PyObject *args )
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "sz#|OO", &reqoid, &reqvalue.bv_val, &reqvalue.bv_len, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple( args, "sz#|OO:extended_operation", &reqoid, &reqvalue.bv_val, &reqvalue.bv_len, &serverctrls, &clientctrls ))
         return NULL;
 
     if (not_valid(self)) return NULL;
diff --git a/Modules/functions.c b/Modules/functions.c
index a31be05..6bbf487 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -16,7 +16,7 @@ l_ldap_initialize(PyObject* unused, PyObject *args)
     LDAP *ld = NULL;
     int ret;
 
-    if (!PyArg_ParseTuple(args, "s", &uri))
+    if (!PyArg_ParseTuple(args, "s:initialize", &uri))
     	return NULL;
 
     Py_BEGIN_ALLOW_THREADS
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index ec50625..c8f9dfc 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -72,11 +72,11 @@ Tuple_to_LDAPControl( PyObject* tup )
     Py_ssize_t len;
 
     if (!PyTuple_Check(tup)) {
-      LDAPerror_TypeError("expected a tuple", tup);
+      LDAPerror_TypeError("Tuple_to_LDAPControl(): expected a tuple", tup);
       return NULL;
     }
 
-    if (!PyArg_ParseTuple( tup, "sbO", &oid, &iscritical, &bytes ))
+    if (!PyArg_ParseTuple( tup, "sbO:Tuple_to_LDAPControl", &oid, &iscritical, &bytes ))
         return NULL;
   
     lc = PyMem_NEW(LDAPControl, 1);
@@ -106,7 +106,7 @@ Tuple_to_LDAPControl( PyObject* tup )
         berbytes.bv_val = PyBytes_AsString(bytes);
     }
     else {
-        LDAPerror_TypeError("expected bytes", bytes);
+        LDAPerror_TypeError("Tuple_to_LDAPControl(): expected bytes", bytes);
         LDAPControl_DEL(lc);
         return NULL;
     }
@@ -128,7 +128,7 @@ LDAPControls_from_object(PyObject* list, LDAPControl ***controls_ret)
     PyObject* item;
   
     if (!PySequence_Check(list)) {
-        LDAPerror_TypeError("expected a list", list);
+        LDAPerror_TypeError("LDAPControls_from_object(): expected a list", list);
         return 0;
     }
 
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 350651c..ff5fb6c 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -784,10 +784,16 @@ def assertInvalidControls(self, func, *args, **kwargs):
         # last two args are serverctrls, clientctrls
         with self.assertRaises(TypeError) as e:
             func(*(args + (object, None) + post))
-        self.assertEqual(e.exception.args, ('expected a list', object))
+        self.assertEqual(
+            e.exception.args,
+            ('LDAPControls_from_object(): expected a list', object)
+        )
         with self.assertRaises(TypeError) as e:
             func(*(args + (None, object) + post))
-        self.assertEqual(e.exception.args, ('expected a list', object))
+        self.assertEqual(
+            e.exception.args,
+            ('LDAPControls_from_object(): expected a list', object)
+        )
 
     def test_invalid_controls(self):
         l = self._open_conn()
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index b57ecf1..1c84742 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -106,12 +106,48 @@ def test_reject_bytes_base(self):
         base = self.server.suffix
         l = self._ldap_conn
 
-        with self.assertRaises(TypeError):
-            l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*'])
-        with self.assertRaises(TypeError):
-            l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
-        with self.assertRaises(TypeError):
-            l.search_s(base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*'])
+        with self.assertRaises(TypeError) as e:
+            l.search_s(
+                base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*']
+            )
+        if PY2:
+            self.assertIn(
+                u"got type 'str' for 'base'", text_type(e.exception)
+            )
+        elif sys.version_info >= (3, 5, 0):
+            # Python 3.4.x does not include 'search_ext()' in message
+            self.assertEqual(
+                "search_ext() argument 1 must be str, not bytes",
+                text_type(e.exception)
+            )
+
+        with self.assertRaises(TypeError) as e:
+            l.search_s(
+                base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*']
+            )
+        if PY2:
+            self.assertIn(
+                u"got type 'str' for 'filterstr'", text_type(e.exception)
+            )
+        elif sys.version_info >= (3, 5, 0):
+            self.assertEqual(
+                "search_ext() argument 3 must be str, not bytes",
+                text_type(e.exception)
+            )
+
+        with self.assertRaises(TypeError) as e:
+            l.search_s(
+                base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*']
+            )
+        if PY2:
+            self.assertIn(
+                u"got type 'str' for 'attrlist'", text_type(e.exception)
+            )
+        elif sys.version_info >= (3, 5, 0):
+            self.assertEqual(
+                ('attrs_from_List(): expected string in list', b'*'),
+                e.exception.args
+            )
 
     def test_search_keys_are_text(self):
         base = self.server.suffix

From 1b17e853c48e48a033ceb2eec257ca0a481397f0 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 15 Jan 2018 17:55:18 +0100
Subject: [PATCH 730/868] Add bytes_strictness to allow configuring behavior on
 bytes/text mismatch

Fixes: https://github.com/python-ldap/python-ldap/issues/166
---
 Doc/bytes_mode.rst     | 52 ++++++++++++++++-----------
 Doc/reference/ldap.rst |  5 +--
 Lib/ldap/ldapobject.py | 82 ++++++++++++++++++++++++++----------------
 Tests/t_ldapobject.py  | 70 +++++++++++++++++++++++++++++++++---
 4 files changed, 152 insertions(+), 57 deletions(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index bbd83db..135125f 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -43,37 +43,47 @@ Encoding/decoding to other formats – text, images, etc. – is left to the cal
 The bytes mode
 --------------
 
-The behavior of python-ldap 3.0 in Python 2 is influenced by a ``bytes_mode``
-argument to :func:`ldap.initialize`.
-The argument can take these values:
+In Python 3, text values are represented as ``str``, the Unicode text type.
 
-``bytes_mode=True``: backwards-compatible
+In Python 2, the behavior of python-ldap 3.0 is influenced by a ``bytes_mode``
+argument to :func:`ldap.initialize`:
 
-    Text values returned from python-ldap are always bytes (``str``).
-    Text values supplied to python-ldap may be either bytes or Unicode.
-    The encoding for bytes is always assumed to be UTF-8.
+``bytes_mode=True`` (backwards compatible):
+    Text values are represented as bytes (``str``) encoded using UTF-8.
 
-    Not available in Python 3.
+``bytes_mode=False`` (future compatible):
+    Text values are represented as ``unicode``.
 
-``bytes_mode=False``: strictly future-compatible
+If not given explicitly, python-ldap will default to ``bytes_mode=True``,
+but if an ``unicode`` value supplied to it, if will warn and use that value.
 
-    Text values must be represented as ``unicode``.
-    An error is raised if python-ldap receives a text value as bytes (``str``).
+Backwards-compatible behavior is not scheduled for removal until Python 2
+itself reaches end of life.
 
-Unspecified: relaxed mode with warnings
 
-    Causes a warning on Python 2.
+Errors, warnings, and automatic encoding
+----------------------------------------
 
-    Text values returned from python-ldap are always ``unicode``.
-    Text values supplied to python-ldap should be ``unicode``;
-    warnings are emitted when they are not.
+While the type of values *returned* from python-ldap is always given by
+``bytes_mode``, the behavior for “wrong-type” values *passed in* can be
+controlled by the ``bytes_strictness`` argument to :func:`ldap.initialize`:
 
-    The warnings are of type :class:`~ldap.LDAPBytesWarning`, which
-    is a subclass of :class:`BytesWarning` designed to be easily
-    :ref:`filtered out <filter-bytes-warning>` if needed.
+``bytes_strictness='error'`` (default if ``bytes_mode`` is specified):
+  A ``TypeError`` is raised.
 
-Backwards-compatible behavior is not scheduled for removal until Python 2
-itself reaches end of life.
+``bytes_strictness='warn'`` (default when ``bytes_mode`` is not given explicitly):
+  A warning is raised, and the value is encoded/decoded
+  using the UTF-8 encoding.
+
+  The warnings are of type :class:`~ldap.LDAPBytesWarning`, which
+  is a subclass of :class:`BytesWarning` designed to be easily
+  :ref:`filtered out <filter-bytes-warning>` if needed.
+
+``bytes_strictness='silent'``:
+  The value is automatically encoded/decoded using the UTF-8 encoding.
+
+When setting ``bytes_strictness``, an explicit value for ``bytes_mode`` needs
+to be given as well.
 
 
 Porting recommendations
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 9cb1d52..585c34c 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -29,7 +29,7 @@ Functions
 
 This module defines the following functions:
 
-.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None]]]]) -> LDAPObject object
+.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None, [bytes_strictness=None]]]]]) -> LDAPObject object
 
    Initializes a new connection object for accessing the given LDAP server,
    and return an LDAP object (see :ref:`ldap-objects`) used to perform operations
@@ -53,7 +53,8 @@ This module defines the following functions:
    *trace_file* specifies a file-like object as target of the debug log and
    *trace_stack_limit* specifies the stack limit of tracebacks in debug log.
 
-   The *bytes_mode* argument specifies text/bytes behavior under Python 2.
+   The *bytes_mode* and *bytes_strictness* arguments specify text/bytes
+   behavior under Python 2.
    See :ref:`text-bytes` for a complete documentation.
 
    Possible values for *trace_level* are
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index a0712a3..9e92ce6 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -93,7 +93,8 @@ class SimpleLDAPObject:
 
   def __init__(
     self,uri,
-    trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None
+    trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None,
+    bytes_strictness=None,
   ):
     self._trace_level = trace_level
     self._trace_file = trace_file or sys.stdout
@@ -107,20 +108,26 @@ def __init__(
     # Bytes mode
     # ----------
 
-    # By default, raise a TypeError when receiving invalid args
-    self.bytes_mode_hardfail = True
-    if bytes_mode is None and PY2:
-      _raise_byteswarning(
-        "Under Python 2, python-ldap uses bytes by default. "
-        "This will be removed in Python 3 (no bytes for DN/RDN/field names). "
-        "Please call initialize(..., bytes_mode=False) explicitly.")
-      bytes_mode = True
-      # Disable hard failure when running in backwards compatibility mode.
-      self.bytes_mode_hardfail = False
-    elif bytes_mode and not PY2:
-      raise ValueError("bytes_mode is *not* supported under Python 3.")
-    # On by default on Py2, off on Py3.
+    if PY2:
+        if bytes_mode is None:
+            bytes_mode = True
+            if bytes_strictness is None:
+                _raise_byteswarning(
+                  "Under Python 2, python-ldap uses bytes by default. "
+                  "This will be removed in Python 3 (no bytes for "
+                  "DN/RDN/field names). "
+                  "Please call initialize(..., bytes_mode=False) explicitly.")
+                bytes_strictness = 'warn'
+        else:
+            if bytes_strictness is None:
+                bytes_strictness = 'error'
+    else:
+        if bytes_mode:
+            raise ValueError("bytes_mode is *not* supported under Python 3.")
+        bytes_mode = False
+        bytes_strictness = 'error'
     self.bytes_mode = bytes_mode
+    self.bytes_strictness = bytes_strictness
 
   def _bytesify_input(self, arg_name, value):
     """Adapt a value following bytes_mode in Python 2.
@@ -130,38 +137,46 @@ def _bytesify_input(self, arg_name, value):
     With bytes_mode ON, takes bytes or None and returns bytes or None.
     With bytes_mode OFF, takes unicode or None and returns bytes or None.
 
-    This function should be applied on all text inputs (distinguished names
-    and attribute names in modlists) to convert them to the bytes expected
-    by the C bindings.
+    For the wrong argument type (unicode or bytes, respectively),
+    behavior depends on the bytes_strictness setting.
+    In all cases, bytes or None are returned (or an exception is raised).
     """
     if not PY2:
       return value
-
     if value is None:
       return value
+
     elif self.bytes_mode:
       if isinstance(value, bytes):
         return value
+      elif self.bytes_strictness == 'silent':
+        pass
+      elif self.bytes_strictness == 'warn':
+        _raise_byteswarning(
+            "Received non-bytes value for '{}' in bytes mode; "
+            "please choose an explicit "
+            "option for bytes_mode on your LDAP connection".format(arg_name))
       else:
-        if self.bytes_mode_hardfail:
           raise TypeError(
             "All provided fields *must* be bytes when bytes mode is on; "
             "got type '{}' for '{}'.".format(type(value).__name__, arg_name)
           )
-        else:
-          _raise_byteswarning(
-            "Received non-bytes value for '{}' with default (disabled) bytes mode; "
-            "please choose an explicit "
-            "option for bytes_mode on your LDAP connection".format(arg_name))
-          return value.encode('utf-8')
+      return value.encode('utf-8')
     else:
-      if not isinstance(value, text_type):
+      if isinstance(value, unicode):
+        return value.encode('utf-8')
+      elif self.bytes_strictness == 'silent':
+        pass
+      elif self.bytes_strictness == 'warn':
+        _raise_byteswarning(
+            "Received non-text value for '{}' with bytes_mode off and "
+            "bytes_strictness='warn'".format(arg_name))
+      else:
         raise TypeError(
           "All provided fields *must* be text when bytes mode is off; "
           "got type '{}' for '{}'.".format(type(value).__name__, arg_name)
         )
-      assert not isinstance(value, bytes)
-      return value.encode('utf-8')
+      return value
 
   def _bytesify_modlist(self, arg_name, modlist, with_opcode):
     """Adapt a modlist according to bytes_mode.
@@ -1064,7 +1079,7 @@ class ReconnectLDAPObject(SimpleLDAPObject):
   def __init__(
     self,uri,
     trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None,
-    retry_max=1,retry_delay=60.0
+    bytes_strictness=None, retry_max=1, retry_delay=60.0
   ):
     """
     Parameters like SimpleLDAPObject.__init__() with these
@@ -1078,7 +1093,9 @@ def __init__(
     self._uri = uri
     self._options = []
     self._last_bind = None
-    SimpleLDAPObject.__init__(self,uri,trace_level,trace_file,trace_stack_limit,bytes_mode)
+    SimpleLDAPObject.__init__(self, uri, trace_level, trace_file,
+                              trace_stack_limit, bytes_mode,
+                              bytes_strictness=bytes_strictness)
     self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
     self._retry_max = retry_max
     self._retry_delay = retry_delay
@@ -1097,6 +1114,11 @@ def __getstate__(self):
 
   def __setstate__(self,d):
     """set up the object from pickled data"""
+    hardfail = d.get('bytes_mode_hardfail')
+    if hardfail:
+        d.setdefault('bytes_strictness', 'error')
+    else:
+        d.setdefault('bytes_strictness', 'warn')
     self.__dict__.update(d)
     self._last_bind = getattr(SimpleLDAPObject, self._last_bind[0]), self._last_bind[1], self._last_bind[2]
     self._ldap_object_lock = self._ldap_lock()
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 1c84742..0a8e78e 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -162,9 +162,9 @@ def test_search_keys_are_text(self):
             for value in values:
                 self.assertEqual(type(value), bytes)
 
-    def _get_bytes_ldapobject(self, explicit=True):
+    def _get_bytes_ldapobject(self, explicit=True, **kwargs):
         if explicit:
-            kwargs = {'bytes_mode': True}
+            kwargs.setdefault('bytes_mode', True)
         else:
             kwargs = {}
         return self._open_ldap_conn(
@@ -231,6 +231,68 @@ def test_unset_bytesmode_search_warns_bytes(self):
         l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
         l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
 
+    def _search_wrong_type(self, bytes_mode, strictness):
+        if bytes_mode:
+            l = self._get_bytes_ldapobject(bytes_strictness=strictness)
+        else:
+            l = self._open_ldap_conn(bytes_mode=False,
+                                     bytes_strictness=strictness)
+        base = 'cn=Foo1,' + self.server.suffix
+        if not bytes_mode:
+            base = base.encode('utf-8')
+        result = l.search_s(base, scope=ldap.SCOPE_SUBTREE)
+        return result[0][-1]['cn']
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_bytesmode_silent(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            self._search_wrong_type(bytes_mode=True, strictness='silent')
+        self.assertEqual(w, [])
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_bytesmode_warn(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            self._search_wrong_type(bytes_mode=True, strictness='warn')
+        self.assertEqual(len(w), 1)
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_bytesmode_error(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            with self.assertRaises(TypeError):
+                self._search_wrong_type(bytes_mode=True, strictness='error')
+        self.assertEqual(w, [])
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_textmode_silent(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            self._search_wrong_type(bytes_mode=True, strictness='silent')
+        self.assertEqual(w, [])
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_textmode_warn(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            self._search_wrong_type(bytes_mode=True, strictness='warn')
+        self.assertEqual(len(w), 1)
+
+    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
+    def test_textmode_error(self):
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', ldap.LDAPBytesWarning)
+            with self.assertRaises(TypeError):
+                self._search_wrong_type(bytes_mode=True, strictness='error')
+        self.assertEqual(w, [])
+
     def test_search_accepts_unicode_dn(self):
         base = self.server.suffix
         l = self._ldap_conn
@@ -470,7 +532,7 @@ def test_ldapbyteswarning(self):
         self.assertIs(msg.category, ldap.LDAPBytesWarning)
         self.assertEqual(
             text_type(msg.message),
-            "Received non-bytes value for 'base' with default (disabled) bytes "
+            "Received non-bytes value for 'base' in bytes "
             "mode; please choose an explicit option for bytes_mode on your "
             "LDAP connection"
         )
@@ -632,7 +694,7 @@ def test103_reconnect_get_state(self):
                 str('_trace_stack_limit'): 5,
                 str('_uri'): self.server.ldap_uri,
                 str('bytes_mode'): l1.bytes_mode,
-                str('bytes_mode_hardfail'): l1.bytes_mode_hardfail,
+                str('bytes_strictness'): l1.bytes_strictness,
                 str('timeout'): -1,
             },
         )

From 671d9f1722a2c8f6c8a15e8c240a8a1f6b3a898f Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 30 Jan 2018 12:11:26 +0100
Subject: [PATCH 731/868] Link with lber

setup.cfg overrides settings in setup.py. Include lber in list of
libraries in setup.cfg, too.

https://github.com/python-ldap/python-ldap/pull/173
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 setup.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.cfg b/setup.cfg
index 374dd42..87cdfd7 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -19,7 +19,7 @@ extra_objects =
 
 # Example for full-featured build:
 # Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
-libs = ldap_r
+libs = ldap_r lber
 
 # Installation options
 [install]

From ef0c5140c7599a4ac02af11dd81c719d8f7b4828 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 12 Feb 2018 11:00:36 +0100
Subject: [PATCH 732/868] Document that bytes_strictness is ignored on Python
 3.

Thi is done to better support programs compatible with both py2 and py3.
---
 Doc/bytes_mode.rst | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index 135125f..d7c2aa4 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -65,8 +65,9 @@ Errors, warnings, and automatic encoding
 ----------------------------------------
 
 While the type of values *returned* from python-ldap is always given by
-``bytes_mode``, the behavior for “wrong-type” values *passed in* can be
-controlled by the ``bytes_strictness`` argument to :func:`ldap.initialize`:
+``bytes_mode``, for Python 2 the behavior for “wrong-type” values *passed in*
+can be controlled by the ``bytes_strictness`` argument to
+:func:`ldap.initialize`:
 
 ``bytes_strictness='error'`` (default if ``bytes_mode`` is specified):
   A ``TypeError`` is raised.
@@ -82,6 +83,9 @@ controlled by the ``bytes_strictness`` argument to :func:`ldap.initialize`:
 ``bytes_strictness='silent'``:
   The value is automatically encoded/decoded using the UTF-8 encoding.
 
+On Python 3, ``bytes_strictness`` is ignored and a ``TypeError`` is always
+raised.
+
 When setting ``bytes_strictness``, an explicit value for ``bytes_mode`` needs
 to be given as well.
 

From 2920ac2e3748ea8c96419bb7f88036d2e4507398 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 12 Feb 2018 11:26:40 +0100
Subject: [PATCH 733/868] Doc: Link to bytes mode from text-string arguments in
 the ldap module

---
 Doc/reference/ldap.rst | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 585c34c..5d15158 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -697,6 +697,9 @@ and wait for and return with the server's result, or with
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
+   The *dn* argument, and mod_type (second item) of *modlist* are text strings;
+   see :ref:`bytes_mode`.
+
 
 .. py:method:: LDAPObject.bind(who, cred, method) -> int
 
@@ -738,6 +741,8 @@ and wait for and return with the server's result, or with
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
+   The *dn* and *attr* arguments are text strings; see :ref:`bytes_mode`.
+
    .. note::
 
       A design fault in the LDAP API prevents *value*
@@ -758,6 +763,8 @@ and wait for and return with the server's result, or with
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
+   The *dn* argument is text string; see :ref:`bytes_mode`.
+
 
 .. py:method:: LDAPObject.extop(extreq[,serverctrls=None[,clientctrls=None]]]) -> int
 
@@ -811,6 +818,9 @@ and wait for and return with the server's result, or with
    You might want to look into sub-module :py:mod:`ldap.modlist` for
    generating *modlist*.
 
+   The *dn* argument, and mod_type (second item) of *modlist* are text strings;
+   see :ref:`bytes_mode`.
+
 
 .. py:method:: LDAPObject.modrdn(dn, newrdn [, delold=1]) -> int
 
@@ -827,6 +837,8 @@ and wait for and return with the server's result, or with
    This operation is emulated by :py:meth:`rename()` and :py:meth:`rename_s()` methods
    since the modrdn2* routines in the C library are deprecated.
 
+   The *dn* and *newrdn* arguments are text strings; see :ref:`bytes_mode`.
+
 
 .. py:method:: LDAPObject.passwd(user, oldpw, newpw [, serverctrls=None [, clientctrls=None]]) -> int
 
@@ -845,6 +857,8 @@ and wait for and return with the server's result, or with
 
    The asynchronous version returns the initiated message id.
 
+   The *user*, *oldpw* and *newpw* arguments are text strings; see :ref:`bytes_mode`.
+
    .. seealso::
 
       :rfc:`3062` - LDAP Password Modify Extended Operation
@@ -866,6 +880,8 @@ and wait for and return with the server's result, or with
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
+   The *dn* and *newdn* arguments are text strings; see :ref:`bytes_mode`.
+
 
 .. py:method:: LDAPObject.result([msgid=RES_ANY [, all=1 [, timeout=None]]]) -> 2-tuple
 
@@ -1016,12 +1032,13 @@ and wait for and return with the server's result, or with
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
+   The *who* and *cred* arguments are text strings; see :ref:`bytes_mode`.
+
    .. versionchanged:: 3.0
 
       :meth:`~LDAPObject.simple_bind` and :meth:`~LDAPObject.simple_bind_s`
       now accept ``None`` for *who* and *cred*, too.
 
-
 .. py:method:: LDAPObject.search(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->int
 
 .. py:method:: LDAPObject.search_s(base, scope [,filterstr='(objectClass=*)' [, attrlist=None [, attrsonly=0]]]) ->list|None
@@ -1074,6 +1091,9 @@ and wait for and return with the server's result, or with
    or :py:meth:`search_ext_s()` (client-side search limit). If non-zero
    not more than *sizelimit* results are returned by the server.
 
+   The *base* and *filterstr* arguments, and *attrlist* contents,
+   are text strings; see :ref:`bytes_mode`.
+
    .. versionchanged:: 3.0
 
       ``filterstr=None`` is equivalent to ``filterstr='(objectClass=*)'``.

From 6e0dca67594dd90270864fcf24780472458ae642 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 12 Mar 2018 15:53:36 +0100
Subject: [PATCH 734/868] Add changelog and bump version to 3.0.0

---
 CHANGES                   | 33 +++++++++++++++++++++++++++++++++
 Lib/ldap/pkginfo.py       |  2 +-
 Lib/ldapurl.py            |  2 +-
 Lib/ldif.py               |  2 +-
 Lib/slapdtest/__init__.py |  2 +-
 5 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 03d892f..7a5e102 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,36 @@
+----------------------------------------------------------------
+Released 3.0.0 2018-03-12
+
+Notable changes since 2.4.45 (please see detailed logs below):
+* Python 3 support and bytes_mode
+  see: https://python-ldap.readthedocs.io/en/latest/bytes_mode.html
+* The module `ldap.async` is renamed to `ldap.asyncsearch`
+* New dependencies: pyasn1, pyasn1_modules
+* Dropped support for Python 2.6 and 3.3
+
+
+Changes since 3.0.0b4:
+
+Lib/
+* Add bytes_strictness to allow configuring behavior on bytes/text mismatch
+
+Modules/
+* Add argument name to bytes mode TypeError
+* Use correct integer types for BER encode/decode (fix for big endian machines)
+
+Test/
+* Set $LDAPNOINIT in all tests
+* Add test for secure TLS default
+* Ignore SASL methods in DSE test (fix for restricted environments)
+* Remove filterstr workaround from syncrepl test
+* Explicitly set TLS_REQUIRE_CERT option to TLS_HARD in test_tls_ext_noca
+
+Doc/
+* Link to bytes mode from text-string arguments in the ldap module
+
+Infrastructure:
+* Include lber in list of libraries in setup.cfg
+
 ----------------------------------------------------------------
 Released 3.0.0b4 2018-01-10
 
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index 24e2017..47199e9 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.0.0b4'
+__version__ = '3.0.0'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index ca28de3..b3e1171 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b4'
+__version__ = '3.0.0'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 29c118c..cdcccc0 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.0.0b4'
+__version__ = '3.0.0'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 727aa52..8297024 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0b4'
+__version__ = '3.0.0'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls

From 361b1fb48c3ced4ff44b77570df9ed1b946f9b61 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 12 Mar 2018 15:57:55 +0100
Subject: [PATCH 735/868] slapdtest: Fix error message for missing commands

---
 Lib/slapdtest/_slapdtest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 484eb54..adcccb8 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -254,7 +254,7 @@ def _find_command(self, cmd, in_sbin=False):
         if command is None:
             raise ValueError(
                 "Command '{}' not found. Set the {} environment variable to "
-                "override slapdtest's search path.".format(value, var_name)
+                "override slapdtest's search path.".format(cmd, var_name)
             )
         return command
 

From f3868eaabc1c35c487934856257916ee968b7616 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 13 Mar 2018 17:06:41 +0100
Subject: [PATCH 736/868] Doc: Remove warning about unreleased version

---
 Doc/installing.rst | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index bb06c21..6df062f 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -5,13 +5,6 @@
 Installing python-ldap
 ######################
 
-.. warning::
-
-    You are reading documentation for an unreleased version.
-
-    Following these instructions will currently get you version 2.5.2,
-    which does not support Python 3.
-
 
 Installing from PyPI
 ====================

From e33ad515aa29cc3fbaa1d81fe9d3092f67ff0f34 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 22 Nov 2017 13:43:56 +0100
Subject: [PATCH 737/868] Add indent.pro from cpython

---
 .indent.pro | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .indent.pro

diff --git a/.indent.pro b/.indent.pro
new file mode 100644
index 0000000..02cceb6
--- /dev/null
+++ b/.indent.pro
@@ -0,0 +1,24 @@
+--blank-lines-after-declarations
+--blank-lines-after-procedures
+--braces-after-func-def-line
+--braces-on-if-line
+--braces-on-struct-decl-line
+--break-after-boolean-operator
+--comment-indentation25
+--comment-line-length79
+--continue-at-parentheses
+--dont-cuddle-do-while
+--dont-cuddle-else
+--indent-level4
+--line-length79
+--no-space-after-casts
+--no-space-after-function-call-names
+--no-space-after-parentheses
+--no-tabs
+--procnames-start-lines
+--space-after-for
+--space-after-if
+--space-after-while
+--swallow-optional-blank-lines
+-T PyCFunction
+-T PyObject

From b0f364247cb2a42841d175b8949330f4eb360335 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 22 Nov 2017 13:57:22 +0100
Subject: [PATCH 738/868] Add Makefile and LDAP related types to indent.pro

Makefile contains targets to run indent and autopep8.
---
 .indent.pro |  7 +++++++
 Makefile    | 14 +++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.indent.pro b/.indent.pro
index 02cceb6..4e8adc1 100644
--- a/.indent.pro
+++ b/.indent.pro
@@ -22,3 +22,10 @@
 --swallow-optional-blank-lines
 -T PyCFunction
 -T PyObject
+-T PyMethodDef
+-T LDAP
+-T LDAPMod
+-T LDAPMessage
+-T LDAPControl
+-T LDAPObject
+-T sasl_interact_t
diff --git a/Makefile b/Makefile
index e4ff75a..c4c2ca1 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,7 @@ LCOV_REPORT_OPTIONS=--show-details -no-branch-coverage \
 	--title "python-ldap LCOV report"
 SCAN_REPORT=build/scan_report
 PYTHON_SUPP=/usr/share/doc/python3-devel/valgrind-python.supp
+AUTOPEP8_OPTS=--aggressive
 
 .NOTPARALLEL:
 
@@ -13,7 +14,7 @@ all:
 
 .PHONY: clean
 clean:
-	rm -rf build dist *.egg-info $(VENV) .tox MANIFEST
+	rm -rf build dist *.egg-info .tox MANIFEST
 	rm -f .coverage .coverage.*
 	find . \( -name '*.py[co]' -or -name '*.so*' -or -name '*.dylib' \) \
 	    -delete
@@ -77,3 +78,14 @@ valgrind: build $(PYTHON_SUPP)
 	    echo "Found definitive leak, see build/valgrind.log"; \
 	    exit 1; \
 	fi
+
+# Code autoformatter
+.PHONY: indent
+indent:
+	indent Modules/*.c Modules/*.h
+	rm -f Modules/*.c~ Modules/*.h~
+
+.PHONY: autopep8
+autopep8:
+	$(PYTHON) -m autopep8 -r -i -j0 $(AUTOPEP8_OPTS) \
+	    Demo Lib Tests setup.py

From db242769139785e59cec1c5f8de95a2c2bae0a64 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 12:49:26 +0100
Subject: [PATCH 739/868] Makefile: Add "autoformat" rule to format all the
 code

---
 Makefile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c4c2ca1..2d3293e 100644
--- a/Makefile
+++ b/Makefile
@@ -80,12 +80,13 @@ valgrind: build $(PYTHON_SUPP)
 	fi
 
 # Code autoformatter
-.PHONY: indent
+.PHONY: autoformat indent autopep8
+autoformat: indent autopep8
+
 indent:
 	indent Modules/*.c Modules/*.h
 	rm -f Modules/*.c~ Modules/*.h~
 
-.PHONY: autopep8
 autopep8:
 	$(PYTHON) -m autopep8 -r -i -j0 $(AUTOPEP8_OPTS) \
 	    Demo Lib Tests setup.py

From 61c21a089972c533517897e5f7028981d7f3abb4 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 13 Dec 2017 18:11:59 +0100
Subject: [PATCH 740/868] Add tests and coverage for tracing

python-ldap can trace LDAP calls, but it was not possible to use the
feature without changing code manually. Tracing can now be enabled with
the env var PYTHON_LDAP_TRACE_LEVEL and redirected to a file with
PYTHON_LDAP_TRACE_FILE.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/__init__.py   | 11 +++++++++--
 Lib/ldap/ldapobject.py |  7 ++++---
 Tests/t_ldapobject.py  |  2 +-
 tox.ini                | 11 ++++++++++-
 4 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 3a86095..72e1e4b 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -8,13 +8,20 @@
 
 from ldap.pkginfo import __version__, __author__, __license__
 
+import os
 import sys
 
 if __debug__:
   # Tracing is only supported in debugging mode
+  import atexit
   import traceback
-  _trace_level = 0
-  _trace_file = sys.stderr
+  _trace_level = int(os.environ.get("PYTHON_LDAP_TRACE_LEVEL", 0))
+  _trace_file = os.environ.get("PYTHON_LDAP_TRACE_FILE")
+  if _trace_file is None:
+    _trace_file = sys.stderr
+  else:
+    _trace_file = open(_trace_file, 'a')
+    atexit.register(_trace_file.close)
   _trace_stack_limit = None
 
 import _ldap
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 9e92ce6..36bf034 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -96,8 +96,8 @@ def __init__(
     trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None,
     bytes_strictness=None,
   ):
-    self._trace_level = trace_level
-    self._trace_file = trace_file or sys.stdout
+    self._trace_level = trace_level or ldap._trace_level
+    self._trace_file = trace_file or ldap._trace_file
     self._trace_stack_limit = trace_stack_limit
     self._uri = uri
     self._ldap_object_lock = self._ldap_lock('opcall')
@@ -1123,7 +1123,8 @@ def __setstate__(self,d):
     self._last_bind = getattr(SimpleLDAPObject, self._last_bind[0]), self._last_bind[1], self._last_bind[2]
     self._ldap_object_lock = self._ldap_lock()
     self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
-    self._trace_file = sys.stdout
+    # XXX cannot pickle file, use default trace file
+    self._trace_file = ldap._trace_file
     self.reconnect(self._uri)
 
   def _store_last_bind(self,method,*args,**kwargs):
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 0a8e78e..33c2c5a 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -690,7 +690,7 @@ def test103_reconnect_get_state(self):
                 str('_retry_delay'): 60.0,
                 str('_retry_max'): 1,
                 str('_start_tls'): 0,
-                str('_trace_level'): 0,
+                str('_trace_level'): ldap._trace_level,
                 str('_trace_stack_limit'): 5,
                 str('_uri'): self.server.ldap_uri,
                 str('bytes_mode'): l1.bytes_mode,
diff --git a/tox.ini b/tox.ini
index abba0b0..bb9adac 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py34,py35,py36,{py2,py3}-nosasltls,doc,coverage-report
+envlist = py27,py34,py35,py36,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
 minver = 1.8
 
 [testenv]
@@ -49,6 +49,15 @@ passenv = {[testenv]passenv}
 setenv = {[testenv:py2-nosasltls]setenv}
 commands = {[testenv:py2-nosasltls]commands}
 
+[testenv:py3-trace]
+basepython = python3
+deps = {[testenv]deps}
+passenv = {[testenv]passenv}
+setenv =
+    PYTHON_LDAP_TRACE_LEVEL=9
+    PYTHON_LDAP_TRACE_FILE={envtmpdir}/trace.log
+commands = {[testenv]commands}
+
 [testenv:pypy]
 # PyPy doesn't have working setup.py test
 deps = pytest

From 06800b3307bb08d99252b4dbd4d6566497485c61 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 13:42:30 +0100
Subject: [PATCH 741/868] Add py3-trace tox environment to Travis CI config

---
 .travis.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 5479573..3c7e989 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -45,6 +45,9 @@ matrix:
       env:
         - TOXENV=py3-nosasltls
         - WITH_GCOV=1
+    - python: 3.6
+      env:
+        - TOXENV=py3-trace
     - python: 3.6
       env: TOXENV=doc
   allow_failures:

From 0473e8764215a6586aef36d470f4eaa7f81e3fdc Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 12:54:24 +0100
Subject: [PATCH 742/868] Doc: Add `make autoformat` to the contributing guide

---
 Doc/contributing.rst | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index 9061332..badb931 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -102,6 +102,17 @@ Specify a different one using, for example::
 
 Notable targets are:
 
+``make autoformat``
+    Automatically re-formats C and Python code to conform to Python style
+    guides (`PEP 7`_ and `PEP 8`_).
+    Note that no backups are made – please commit any other changes before
+    using this target.
+
+    Requires the ``indent`` program and the ``autopep8`` Python module.
+
+.. _PEP 7: https://www.python.org/dev/peps/pep-0007/
+.. _PEP 8: https://www.python.org/dev/peps/pep-0008/
+
 ``make lcov lcov-open``
     Generate and view test coverage for C code.
     Requires LCOV_.

From 9a74c29012f9173197b717b559214c4c21cf57ce Mon Sep 17 00:00:00 2001
From: automatic <python-ldap@python.org>
Date: Wed, 14 Mar 2018 14:44:03 +0100
Subject: [PATCH 743/868] Reformat and indent all C files

Generated with:

    make indent
    make indent
---
 Modules/LDAPObject.c          | 1076 ++++++++++++++++++---------------
 Modules/LDAPObject.h          |   19 +-
 Modules/berval.h              |    4 +-
 Modules/common.c              |   15 +-
 Modules/common.h              |   10 +-
 Modules/constants.c           |  189 +++---
 Modules/constants.h           |   12 +-
 Modules/constants_generated.h |   35 +-
 Modules/functions.c           |  130 ++--
 Modules/functions.h           |    2 +-
 Modules/ldapcontrol.c         |  210 ++++---
 Modules/ldapcontrol.h         |    6 +-
 Modules/ldapmodule.c          |   81 +--
 Modules/message.c             |  473 ++++++++-------
 Modules/message.h             |    7 +-
 Modules/options.c             |  258 ++++----
 Modules/options.h             |    2 +-
 17 files changed, 1320 insertions(+), 1209 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index d7265a4..2bd6209 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -16,15 +16,16 @@
 #include <sasl/sasl.h>
 #endif
 
-static void free_attrs(char***);
+static void free_attrs(char ***);
 
 /* constructor */
 
-LDAPObject*
-newLDAPObject( LDAP* l ) 
+LDAPObject *
+newLDAPObject(LDAP *l)
 {
-    LDAPObject* self = (LDAPObject*) PyObject_NEW(LDAPObject, &LDAP_Type);
-    if (self == NULL) 
+    LDAPObject *self = (LDAPObject *)PyObject_NEW(LDAPObject, &LDAP_Type);
+
+    if (self == NULL)
         return NULL;
     self->ldap = l;
     self->_save = NULL;
@@ -35,13 +36,13 @@ newLDAPObject( LDAP* l )
 /* destructor */
 
 static void
-dealloc( LDAPObject* self )
+dealloc(LDAPObject *self)
 {
     if (self->ldap) {
         if (self->valid) {
-            LDAP_BEGIN_ALLOW_THREADS( self );
-            ldap_unbind_ext( self->ldap, NULL, NULL );
-            LDAP_END_ALLOW_THREADS( self );
+            LDAP_BEGIN_ALLOW_THREADS(self);
+            ldap_unbind_ext(self->ldap, NULL, NULL);
+            LDAP_END_ALLOW_THREADS(self);
             self->valid = 0;
         }
         self->ldap = NULL;
@@ -59,11 +60,13 @@ dealloc( LDAPObject* self )
  */
 
 static int
-not_valid( LDAPObject* l ) {
+not_valid(LDAPObject *l)
+{
     if (l->valid) {
         return 0;
-    } else {
-        PyErr_SetString( LDAPexception_class, "LDAP connection invalid" );
+    }
+    else {
+        PyErr_SetString(LDAPexception_class, "LDAP connection invalid");
         return 1;
     }
 }
@@ -71,7 +74,7 @@ not_valid( LDAPObject* l ) {
 /* free a LDAPMod (complete or partially) allocated in Tuple_to_LDAPMod() */
 
 static void
-LDAPMod_DEL( LDAPMod* lm )
+LDAPMod_DEL(LDAPMod *lm)
 {
     Py_ssize_t i;
 
@@ -98,8 +101,8 @@ LDAPMod_DEL( LDAPMod* lm )
 
 /* XXX - there is no way to pass complex-structured BER objects in here! */
 
-static LDAPMod*
-Tuple_to_LDAPMod( PyObject* tup, int no_op ) 
+static LDAPMod *
+Tuple_to_LDAPMod(PyObject *tup, int no_op)
 {
     int op;
     char *type;
@@ -113,12 +116,13 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
     }
 
     if (no_op) {
-        if (!PyArg_ParseTuple( tup, "sO:Tuple_to_LDAPMod", &type, &list ))
-                return NULL;
+        if (!PyArg_ParseTuple(tup, "sO:Tuple_to_LDAPMod", &type, &list))
+            return NULL;
         op = 0;
-    } else {
-        if (!PyArg_ParseTuple( tup, "isO:Tuple_to_LDAPMod", &op, &type, &list ))
-                return NULL;
+    }
+    else {
+        if (!PyArg_ParseTuple(tup, "isO:Tuple_to_LDAPMod", &op, &type, &list))
+            return NULL;
     }
 
     lm = PyMem_NEW(LDAPMod, 1);
@@ -130,43 +134,52 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
 
     len = strlen(type);
     lm->mod_type = PyMem_NEW(char, len + 1);
+
     if (lm->mod_type == NULL)
         goto nomem;
     memcpy(lm->mod_type, type, len + 1);
 
     if (list == Py_None) {
         /* None indicates a NULL mod_bvals */
-    } else if (PyBytes_Check(list)) {
+    }
+    else if (PyBytes_Check(list)) {
         /* Single string is a singleton list */
         lm->mod_bvalues = PyMem_NEW(struct berval *, 2);
+
         if (lm->mod_bvalues == NULL)
             goto nomem;
         lm->mod_bvalues[0] = PyMem_NEW(struct berval, 1);
+
         if (lm->mod_bvalues[0] == NULL)
             goto nomem;
         lm->mod_bvalues[1] = NULL;
         lm->mod_bvalues[0]->bv_len = PyBytes_Size(list);
         lm->mod_bvalues[0]->bv_val = PyBytes_AsString(list);
-    } else if (PySequence_Check(list)) {
+    }
+    else if (PySequence_Check(list)) {
         nstrs = PySequence_Length(list);
         lm->mod_bvalues = PyMem_NEW(struct berval *, nstrs + 1);
+
         if (lm->mod_bvalues == NULL)
             goto nomem;
         for (i = 0; i < nstrs; i++) {
-          lm->mod_bvalues[i] = PyMem_NEW(struct berval, 1);
-          if (lm->mod_bvalues[i] == NULL)
-              goto nomem;
-          lm->mod_bvalues[i+1] = NULL;
-          item = PySequence_GetItem(list, i);
-          if (item == NULL)
-              goto error;
-          if (!PyBytes_Check(item)) {
-              LDAPerror_TypeError("Tuple_to_LDAPMod(): expected a byte string in the list", item);
-              goto error;
-          }
-          lm->mod_bvalues[i]->bv_len = PyBytes_Size(item);
-          lm->mod_bvalues[i]->bv_val = PyBytes_AsString(item);
-          Py_DECREF(item);
+            lm->mod_bvalues[i] = PyMem_NEW(struct berval, 1);
+
+            if (lm->mod_bvalues[i] == NULL)
+                goto nomem;
+            lm->mod_bvalues[i + 1] = NULL;
+            item = PySequence_GetItem(list, i);
+            if (item == NULL)
+                goto error;
+            if (!PyBytes_Check(item)) {
+                LDAPerror_TypeError
+                    ("Tuple_to_LDAPMod(): expected a byte string in the list",
+                     item);
+                goto error;
+            }
+            lm->mod_bvalues[i]->bv_len = PyBytes_Size(item);
+            lm->mod_bvalues[i]->bv_val = PyBytes_AsString(item);
+            Py_DECREF(item);
         }
         if (nstrs == 0)
             lm->mod_bvalues[0] = NULL;
@@ -174,10 +187,10 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
 
     return lm;
 
-nomem:
+  nomem:
     PyErr_NoMemory();
-error:
-    if (lm) 
+  error:
+    if (lm)
         LDAPMod_DEL(lm);
 
     return NULL;
@@ -186,10 +199,12 @@ Tuple_to_LDAPMod( PyObject* tup, int no_op )
 /* free the structure allocated in List_to_LDAPMods() */
 
 static void
-LDAPMods_DEL( LDAPMod** lms ) {
-    LDAPMod** lmp;
-    for ( lmp = lms; *lmp; lmp++ )
-        LDAPMod_DEL( *lmp );
+LDAPMods_DEL(LDAPMod **lms)
+{
+    LDAPMod **lmp;
+
+    for (lmp = lms; *lmp; lmp++)
+        LDAPMod_DEL(*lmp);
     PyMem_DEL(lms);
 }
 
@@ -198,33 +213,36 @@ LDAPMods_DEL( LDAPMod** lms ) {
  * NOTE: list of tuples must live longer than the LDAPMods
  */
 
-static LDAPMod**
-List_to_LDAPMods( PyObject *list, int no_op ) {
+static LDAPMod **
+List_to_LDAPMods(PyObject *list, int no_op)
+{
 
     Py_ssize_t i, len;
-    LDAPMod** lms;
+    LDAPMod **lms;
     PyObject *item;
 
     if (!PySequence_Check(list)) {
-        LDAPerror_TypeError("List_to_LDAPMods(): expected list of tuples", list);
+        LDAPerror_TypeError("List_to_LDAPMods(): expected list of tuples",
+                            list);
         return NULL;
     }
 
     len = PySequence_Length(list);
 
     if (len < 0) {
-        LDAPerror_TypeError("List_to_LDAPMods(): expected list of tuples", list);
+        LDAPerror_TypeError("List_to_LDAPMods(): expected list of tuples",
+                            list);
         return NULL;
     }
 
     lms = PyMem_NEW(LDAPMod *, len + 1);
-    if (lms == NULL) 
+    if (lms == NULL)
         goto nomem;
 
     for (i = 0; i < len; i++) {
         lms[i] = NULL;
         item = PySequence_GetItem(list, i);
-        if (item == NULL) 
+        if (item == NULL)
             goto error;
         lms[i] = Tuple_to_LDAPMod(item, no_op);
         Py_DECREF(item);
@@ -234,9 +252,9 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
     lms[len] = NULL;
     return lms;
 
-nomem:
+  nomem:
     PyErr_NoMemory();
-error:
+  error:
     if (lms)
         LDAPMods_DEL(lms);
     return NULL;
@@ -248,7 +266,8 @@ List_to_LDAPMods( PyObject *list, int no_op ) {
  */
 
 int
-attrs_from_List( PyObject *attrlist, char***attrsp) {
+attrs_from_List(PyObject *attrlist, char ***attrsp)
+{
 
     char **attrs = NULL;
     PyObject *seq = NULL;
@@ -256,17 +275,22 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
     if (attrlist == Py_None) {
         /* None means a NULL attrlist */
 #if PY_MAJOR_VERSION == 2
-    } else if (PyBytes_Check(attrlist)) {
+    }
+    else if (PyBytes_Check(attrlist)) {
 #else
-    } else if (PyUnicode_Check(attrlist)) {
+    }
+    else if (PyUnicode_Check(attrlist)) {
 #endif
         /* caught by John Benninghoff <johnb@netscape.com> */
-        LDAPerror_TypeError(
-            "attrs_from_List(): expected *list* of strings, not a string", attrlist);
+        LDAPerror_TypeError
+            ("attrs_from_List(): expected *list* of strings, not a string",
+             attrlist);
         goto error;
-    } else {
+    }
+    else {
         PyObject *item = NULL;
         Py_ssize_t i, len, strlen;
+
 #if PY_MAJOR_VERSION >= 3
         const char *str;
 #else
@@ -280,8 +304,9 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
         len = PySequence_Length(attrlist);
 
         attrs = PyMem_NEW(char *, len + 1);
+
         if (attrs == NULL)
-                goto nomem;
+            goto nomem;
 
         for (i = 0; i < len; i++) {
             attrs[i] = NULL;
@@ -291,7 +316,8 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
 #if PY_MAJOR_VERSION == 2
             /* Encoded in Python to UTF-8 */
             if (!PyBytes_Check(item)) {
-                LDAPerror_TypeError("attrs_from_List(): expected bytes in list", item);
+                LDAPerror_TypeError
+                    ("attrs_from_List(): expected bytes in list", item);
                 goto error;
             }
             if (PyBytes_AsStringAndSize(item, &str, &strlen) == -1) {
@@ -299,7 +325,8 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
             }
 #else
             if (!PyUnicode_Check(item)) {
-                LDAPerror_TypeError("attrs_from_List(): expected string in list", item);
+                LDAPerror_TypeError
+                    ("attrs_from_List(): expected string in list", item);
                 goto error;
             }
             str = PyUnicode_AsUTF8AndSize(item, &strlen);
@@ -309,6 +336,7 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
              * 3.7 actually returns a const char.
              */
             attrs[i] = (char *)PyMem_NEW(char *, strlen + 1);
+
             if (attrs[i] == NULL)
                 goto nomem;
             memcpy(attrs[i], str, strlen + 1);
@@ -320,9 +348,9 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
     *attrsp = attrs;
     return 1;
 
-nomem:
+  nomem:
     PyErr_NoMemory();
-error:
+  error:
     Py_XDECREF(seq);
     free_attrs(&attrs);
     return 0;
@@ -331,7 +359,8 @@ attrs_from_List( PyObject *attrlist, char***attrsp) {
 /* free memory allocated from above routine */
 
 static void
-free_attrs( char*** attrsp) {
+free_attrs(char ***attrsp)
+{
     char **attrs = *attrsp;
     char **p;
 
@@ -351,18 +380,20 @@ free_attrs( char*** attrsp) {
 
 /* ldap_unbind_ext */
 
-static PyObject*
-l_ldap_unbind_ext( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_unbind_ext(LDAPObject *self, PyObject *args)
 {
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "|OO:unbind_ext", &serverctrls, &clientctrls)) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple(args, "|OO:unbind_ext", &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -371,20 +402,20 @@ l_ldap_unbind_ext( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_unbind_ext( self->ldap, server_ldcs, client_ldcs );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror = ldap_unbind_ext(self->ldap, server_ldcs, client_ldcs);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_unbind_ext" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_unbind_ext");
 
     self->valid = 0;
     Py_INCREF(Py_None);
@@ -393,19 +424,22 @@ l_ldap_unbind_ext( LDAPObject* self, PyObject* args )
 
 /* ldap_abandon_ext */
 
-static PyObject*
-l_ldap_abandon_ext( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_abandon_ext(LDAPObject *self, PyObject *args)
 {
     int msgid;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "i|OO:abandon_ext", &msgid, &serverctrls, &clientctrls)) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "i|OO:abandon_ext", &msgid, &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -414,20 +448,20 @@ l_ldap_abandon_ext( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_abandon_ext( self->ldap, msgid, server_ldcs, client_ldcs );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror = ldap_abandon_ext(self->ldap, msgid, server_ldcs, client_ldcs);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_abandon_ext" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_abandon_ext");
 
     Py_INCREF(Py_None);
     return Py_None;
@@ -436,58 +470,62 @@ l_ldap_abandon_ext( LDAPObject* self, PyObject* args )
 /* ldap_add_ext */
 
 static PyObject *
-l_ldap_add_ext( LDAPObject* self, PyObject *args )
+l_ldap_add_ext(LDAPObject *self, PyObject *args)
 {
     char *dn;
     PyObject *modlist;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
     LDAPMod **mods;
 
-    if (!PyArg_ParseTuple( args, "sO|OO:add_ext", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "sO|OO:add_ext", &dn, &modlist, &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
-    mods = List_to_LDAPMods( modlist, 1 );
+    mods = List_to_LDAPMods(modlist, 1);
     if (mods == NULL)
         return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
-            LDAPMods_DEL( mods );
+            LDAPMods_DEL(mods);
             return NULL;
         }
     }
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPMods_DEL( mods );
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPMods_DEL(mods);
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_add_ext( self->ldap, dn, mods, server_ldcs, client_ldcs, &msgid);
-    LDAP_END_ALLOW_THREADS( self );
-    LDAPMods_DEL( mods );
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_add_ext(self->ldap, dn, mods, server_ldcs, client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
+    LDAPMods_DEL(mods);
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_add_ext" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_add_ext");
 
     return PyInt_FromLong(msgid);
 }
 
 /* ldap_simple_bind */
 
-static PyObject*
-l_ldap_simple_bind( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_simple_bind(LDAPObject *self, PyObject *args)
 {
     char *who;
     int msgid;
@@ -495,14 +533,18 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
     Py_ssize_t cred_len;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
     struct berval cred;
 
-    if (!PyArg_ParseTuple( args, "zz#|OO:simple_bind", &who, &cred.bv_val, &cred_len, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "zz#|OO:simple_bind", &who, &cred.bv_val, &cred_len,
+         &serverctrls, &clientctrls))
+        return NULL;
     cred.bv_len = (ber_len_t) cred_len;
 
-    if (not_valid(self)) return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -511,25 +553,26 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_sasl_bind( self->ldap, who, LDAP_SASL_SIMPLE, &cred, server_ldcs, client_ldcs, &msgid);
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_sasl_bind(self->ldap, who, LDAP_SASL_SIMPLE, &cred, server_ldcs,
+                       client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_simple_bind" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_simple_bind");
 
-    return PyInt_FromLong( msgid );
+    return PyInt_FromLong(msgid);
 }
 
-
 #ifdef HAVE_SASL
 /* The following functions implement SASL binds. A new method
    sasl_interactive_bind_s(bind_dn, sasl_mechanism) has been introduced.
@@ -566,46 +609,41 @@ l_ldap_simple_bind( LDAPObject* self, PyObject* args )
      argument specifies, which information should be passed back to
      the SASL lib (see SASL_CB_xxx in sasl.h)
 */
-static int interaction ( unsigned flags, 
-                         sasl_interact_t *interact,
-                         PyObject* SASLObject )
+static int
+interaction(unsigned flags, sasl_interact_t *interact, PyObject *SASLObject)
 {
 /*  const char *dflt = interact->defresult; */
-  PyObject *result;
-  char *c_result;
-  result = PyObject_CallMethod(SASLObject,
-                               "callback",
-                               "isss",
-                               interact->id,  /* see sasl.h */
-                               interact->challenge,
-                               interact->prompt,   
-                               interact->defresult);
-
-  if (result == NULL) 
-    /*searching for a better error code */
-    return LDAP_OPERATIONS_ERROR; 
-  c_result = PyBytes_AsString(result); /*xxx Error checking?? */
-  
-  /* according to the sasl docs, we should malloc() the returned
-     string only for calls where interact->id == SASL_CB_PASS, so we
-     probably leak a few bytes per ldap bind. However, if I restrict
-     the strdup() to this case, I get segfaults. Should probably be
-     fixed sometimes.
-  */
-  interact->result = strdup( c_result );
-  if (interact->result == NULL)
-    return LDAP_OPERATIONS_ERROR;
-  interact->len = strlen(c_result);
-  /* We _should_ overwrite the python string buffer for security
-     reasons, however we may not (api/stringObjects.html). Any ideas?
-  */
-  
-  Py_DECREF(result); /*not needed any longer */
-  result = NULL;
-  
-  return LDAP_SUCCESS;
-}
+    PyObject *result;
+    char *c_result;
+
+    result = PyObject_CallMethod(SASLObject, "callback", "isss", interact->id,  /* see sasl.h */
+                                 interact->challenge,
+                                 interact->prompt, interact->defresult);
+
+    if (result == NULL)
+        /*searching for a better error code */
+        return LDAP_OPERATIONS_ERROR;
+    c_result = PyBytes_AsString(result);        /*xxx Error checking?? */
+
+    /* according to the sasl docs, we should malloc() the returned
+       string only for calls where interact->id == SASL_CB_PASS, so we
+       probably leak a few bytes per ldap bind. However, if I restrict
+       the strdup() to this case, I get segfaults. Should probably be
+       fixed sometimes.
+     */
+    interact->result = strdup(c_result);
+    if (interact->result == NULL)
+        return LDAP_OPERATIONS_ERROR;
+    interact->len = strlen(c_result);
+    /* We _should_ overwrite the python string buffer for security
+       reasons, however we may not (api/stringObjects.html). Any ideas?
+     */
 
+    Py_DECREF(result);  /*not needed any longer */
+    result = NULL;
+
+    return LDAP_SUCCESS;
+}
 
 /* 
   This function will be called by ldap_sasl_interactive_bind(). The
@@ -615,26 +653,27 @@ static int interaction ( unsigned flags,
 
 */
 
-int py_ldap_sasl_interaction(   LDAP *ld, 
-                                unsigned flags, 
-                                void *defaults,
-                                void *in )
+int
+py_ldap_sasl_interaction(LDAP *ld, unsigned flags, void *defaults, void *in)
 {
-  /* These are just typecasts */
-  sasl_interact_t *interact = (sasl_interact_t *) in;
-  PyObject *SASLObject = (PyObject *) defaults;
-  /* Loop over the array of sasl_interact_t structs */
-  while( interact->id != SASL_CB_LIST_END ) {
-    int rc = 0;
-    rc = interaction( flags, interact, SASLObject );
-    if( rc )  return rc;
-    interact++;
-  }
-  return LDAP_SUCCESS;
+    /* These are just typecasts */
+    sasl_interact_t *interact = (sasl_interact_t *)in;
+    PyObject *SASLObject = (PyObject *)defaults;
+
+    /* Loop over the array of sasl_interact_t structs */
+    while (interact->id != SASL_CB_LIST_END) {
+        int rc = 0;
+
+        rc = interaction(flags, interact, SASLObject);
+        if (rc)
+            return rc;
+        interact++;
+    }
+    return LDAP_SUCCESS;
 }
 
-static PyObject*
-l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_sasl_bind_s(LDAPObject *self, PyObject *args)
 {
     const char *dn;
     const char *mechanism;
@@ -643,16 +682,19 @@ l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
 
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     struct berval *servercred;
     int ldaperror;
 
-    if (!PyArg_ParseTuple(args, "zzz#OO:sasl_bind_s", &dn, &mechanism, &cred.bv_val, &cred_len, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple
+        (args, "zzz#OO:sasl_bind_s", &dn, &mechanism, &cred.bv_val, &cred_len,
+         &serverctrls, &clientctrls))
         return NULL;
 
-    if (not_valid(self)) return NULL;
+    if (not_valid(self))
+        return NULL;
 
     cred.bv_len = cred_len;
 
@@ -662,44 +704,45 @@ l_ldap_sasl_bind_s( LDAPObject* self, PyObject* args )
     }
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
     ldaperror = ldap_sasl_bind_s(self->ldap,
                                  dn,
                                  mechanism,
                                  cred.bv_val ? &cred : NULL,
-                                 (LDAPControl**) server_ldcs, 
-                                 (LDAPControl**) client_ldcs,
-                                 &servercred);
-    LDAP_END_ALLOW_THREADS( self );
+                                 (LDAPControl **)server_ldcs,
+                                 (LDAPControl **)client_ldcs, &servercred);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror == LDAP_SASL_BIND_IN_PROGRESS) {
         if (servercred && servercred->bv_val && *servercred->bv_val)
-            return PyBytes_FromStringAndSize( servercred->bv_val, servercred->bv_len );
-    } else if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror( self->ldap, "l_ldap_sasl_bind_s" );
-    return PyInt_FromLong( ldaperror );
+            return PyBytes_FromStringAndSize(servercred->bv_val,
+                                             servercred->bv_len);
+    }
+    else if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "l_ldap_sasl_bind_s");
+    return PyInt_FromLong(ldaperror);
 }
 
-static PyObject* 
-l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_sasl_interactive_bind_s(LDAPObject *self, PyObject *args)
 {
     char *c_mechanism;
     char *who;
 
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
-    PyObject       *SASLObject = NULL;
+    PyObject *SASLObject = NULL;
     PyObject *mechanism = NULL;
     int msgid;
 
@@ -713,13 +756,18 @@ l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
      * "i" otherwise. 
      */
 #if (PY_MAJOR_VERSION == 2) && (PY_MINOR_VERSION < 3)
-    if (!PyArg_ParseTuple(args, "sOOOi:sasl_interactive_bind_s", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
+    if (!PyArg_ParseTuple
+        (args, "sOOOi:sasl_interactive_bind_s", &who, &SASLObject,
+         &serverctrls, &clientctrls, &sasl_flags))
 #else
-    if (!PyArg_ParseTuple(args, "sOOOI:sasl_interactive_bind_s", &who, &SASLObject, &serverctrls, &clientctrls, &sasl_flags ))
+    if (!PyArg_ParseTuple
+        (args, "sOOOI:sasl_interactive_bind_s", &who, &SASLObject,
+         &serverctrls, &clientctrls, &sasl_flags))
 #endif
-      return NULL;
+        return NULL;
 
-    if (not_valid(self)) return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -728,14 +776,15 @@ l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
     /* now we extract the sasl mechanism from the SASL Object */
     mechanism = PyObject_GetAttrString(SASLObject, "mech");
-    if (mechanism == NULL) return NULL;
+    if (mechanism == NULL)
+        return NULL;
     c_mechanism = PyBytes_AsString(mechanism);
     Py_DECREF(mechanism);
     mechanism = NULL;
@@ -745,43 +794,44 @@ l_ldap_sasl_interactive_bind_s( LDAPObject* self, PyObject* args )
        Python object SASLObject, but passing it through some
        static variable would destroy thread safety, IMHO.
      */
-    msgid = ldap_sasl_interactive_bind_s(self->ldap, 
-                                         who, 
-                                         c_mechanism, 
-                                         (LDAPControl**) server_ldcs, 
-                                         (LDAPControl**) client_ldcs,
-                                         sasl_flags, 
-                                         py_ldap_sasl_interaction, 
-                                         SASLObject);
-
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    msgid = ldap_sasl_interactive_bind_s(self->ldap,
+                                         who,
+                                         c_mechanism,
+                                         (LDAPControl **)server_ldcs,
+                                         (LDAPControl **)client_ldcs,
+                                         sasl_flags,
+                                         py_ldap_sasl_interaction, SASLObject);
+
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
     if (msgid != LDAP_SUCCESS)
-        return LDAPerror( self->ldap, "ldap_sasl_interactive_bind_s" );
-    return PyInt_FromLong( msgid );
+        return LDAPerror(self->ldap, "ldap_sasl_interactive_bind_s");
+    return PyInt_FromLong(msgid);
 }
 #endif
 
-
 #ifdef LDAP_API_FEATURE_CANCEL
 
 /* ldap_cancel */
 
-static PyObject*
-l_ldap_cancel( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_cancel(LDAPObject *self, PyObject *args)
 {
     int msgid;
     int cancelid;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "i|OO:cancel", &cancelid, &serverctrls, &clientctrls)) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "i|OO:cancel", &cancelid, &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -790,22 +840,23 @@ l_ldap_cancel( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_cancel( self->ldap, cancelid, server_ldcs, client_ldcs, &msgid );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_cancel(self->ldap, cancelid, server_ldcs, client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_cancel" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_cancel");
 
-    return PyInt_FromLong( msgid );
+    return PyInt_FromLong(msgid);
 }
 
 #endif
@@ -813,23 +864,27 @@ l_ldap_cancel( LDAPObject* self, PyObject* args )
 /* ldap_compare_ext */
 
 static PyObject *
-l_ldap_compare_ext( LDAPObject* self, PyObject *args )
+l_ldap_compare_ext(LDAPObject *self, PyObject *args)
 {
     char *dn, *attr;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
     Py_ssize_t value_len;
     struct berval value;
 
-    if (!PyArg_ParseTuple( args, "sss#|OO:compare_ext", &dn, &attr, &value.bv_val, &value_len, &serverctrls, &clientctrls )) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "sss#|OO:compare_ext", &dn, &attr, &value.bv_val, &value_len,
+         &serverctrls, &clientctrls))
+        return NULL;
     value.bv_len = (ber_len_t) value_len;
 
-    if (not_valid(self)) return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -838,41 +893,45 @@ l_ldap_compare_ext( LDAPObject* self, PyObject *args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_compare_ext( self->ldap, dn, attr, &value, server_ldcs, client_ldcs, &msgid );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_compare_ext(self->ldap, dn, attr, &value, server_ldcs,
+                         client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_compare_ext" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_compare_ext");
 
-    return PyInt_FromLong( msgid );
+    return PyInt_FromLong(msgid);
 }
 
-
 /* ldap_delete_ext */
 
 static PyObject *
-l_ldap_delete_ext( LDAPObject* self, PyObject *args )
+l_ldap_delete_ext(LDAPObject *self, PyObject *args)
 {
     char *dn;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "s|OO:delete_ext", &dn, &serverctrls, &clientctrls )) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "s|OO:delete_ext", &dn, &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -881,97 +940,104 @@ l_ldap_delete_ext( LDAPObject* self, PyObject *args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_delete_ext( self->ldap, dn, server_ldcs, client_ldcs, &msgid );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_delete_ext(self->ldap, dn, server_ldcs, client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_delete_ext" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_delete_ext");
 
     return PyInt_FromLong(msgid);
 }
 
-
 /* ldap_modify_ext */
 
 static PyObject *
-l_ldap_modify_ext( LDAPObject* self, PyObject *args )
+l_ldap_modify_ext(LDAPObject *self, PyObject *args)
 {
     char *dn;
     PyObject *modlist;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
     LDAPMod **mods;
 
-    if (!PyArg_ParseTuple( args, "sO|OO:modify_ext", &dn, &modlist, &serverctrls, &clientctrls )) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple
+        (args, "sO|OO:modify_ext", &dn, &modlist, &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
-    mods = List_to_LDAPMods( modlist, 0 );
+    mods = List_to_LDAPMods(modlist, 0);
     if (mods == NULL)
         return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
-            LDAPMods_DEL( mods );
+            LDAPMods_DEL(mods);
             return NULL;
         }
     }
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPMods_DEL( mods );
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPMods_DEL(mods);
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_modify_ext( self->ldap, dn, mods, server_ldcs, client_ldcs, &msgid );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_modify_ext(self->ldap, dn, mods, server_ldcs, client_ldcs,
+                        &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPMods_DEL( mods );
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPMods_DEL(mods);
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_modify_ext" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_modify_ext");
 
-    return PyInt_FromLong( msgid );
+    return PyInt_FromLong(msgid);
 }
 
-
 /* ldap_rename */
 
 static PyObject *
-l_ldap_rename( LDAPObject* self, PyObject *args )
+l_ldap_rename(LDAPObject *self, PyObject *args)
 {
     char *dn, *newrdn;
     char *newSuperior = NULL;
     int delold = 1;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "ss|ziOO:rename", &dn, &newrdn, &newSuperior, &delold, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple
+        (args, "ss|ziOO:rename", &dn, &newrdn, &newSuperior, &delold,
+         &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
         return NULL;
-    if (not_valid(self)) return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -980,29 +1046,30 @@ l_ldap_rename( LDAPObject* self, PyObject *args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_rename( self->ldap, dn, newrdn, newSuperior, delold, server_ldcs, client_ldcs, &msgid );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_rename(self->ldap, dn, newrdn, newSuperior, delold, server_ldcs,
+                    client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_rename" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_rename");
 
-    return PyInt_FromLong( msgid );
+    return PyInt_FromLong(msgid);
 }
 
-
 /* ldap_result4 */
 
 static PyObject *
-l_ldap_result4( LDAPObject* self, PyObject *args )
+l_ldap_result4(LDAPObject *self, PyObject *args)
 {
     int msgid = LDAP_RES_ANY;
     int all = 1;
@@ -1011,7 +1078,7 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     int add_intermediates = 0;
     int add_extop = 0;
     struct timeval tv;
-    struct timeval* tvp;
+    struct timeval *tvp;
     int res_type;
     LDAPMessage *msg = NULL;
     PyObject *result_str, *retval, *pmsg, *pyctrls = 0;
@@ -1022,31 +1089,38 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     char **refs = NULL;
     LDAPControl **serverctrls = 0;
 
-    if (!PyArg_ParseTuple( args, "|iidiii:result4", &msgid, &all, &timeout, &add_ctrls, &add_intermediates, &add_extop ))
+    if (!PyArg_ParseTuple
+        (args, "|iidiii:result4", &msgid, &all, &timeout, &add_ctrls,
+         &add_intermediates, &add_extop))
         return NULL;
-    if (not_valid(self)) return NULL;
-    
+    if (not_valid(self))
+        return NULL;
+
     if (timeout >= 0) {
         tvp = &tv;
-        set_timeval_from_double( tvp, timeout );
-    } else {
+        set_timeval_from_double(tvp, timeout);
+    }
+    else {
         tvp = NULL;
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    res_type = ldap_result( self->ldap, msgid, all, tvp, &msg );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    res_type = ldap_result(self->ldap, msgid, all, tvp, &msg);
+    LDAP_END_ALLOW_THREADS(self);
 
     if (res_type < 0)   /* LDAP or system error */
-        return LDAPerror( self->ldap, "ldap_result4" );
+        return LDAPerror(self->ldap, "ldap_result4");
 
     if (res_type == 0) {
         /* Polls return (None, None, None, None); timeouts raise an exception */
         if (timeout == 0) {
             if (add_extop) {
-                return Py_BuildValue("(OOOOOO)", Py_None, Py_None, Py_None, Py_None, Py_None, Py_None);
-            } else {
-                return Py_BuildValue("(OOOO)", Py_None, Py_None, Py_None, Py_None);
+                return Py_BuildValue("(OOOOOO)", Py_None, Py_None, Py_None,
+                                     Py_None, Py_None, Py_None);
+            }
+            else {
+                return Py_BuildValue("(OOOO)", Py_None, Py_None, Py_None,
+                                     Py_None);
             }
         }
         else
@@ -1058,75 +1132,90 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
 
     if (res_type == LDAP_RES_SEARCH_ENTRY) {
         /* LDAPmessage_to_python will parse entries and read the controls for each entry */
-    } else if (res_type == LDAP_RES_SEARCH_REFERENCE) {
+    }
+    else if (res_type == LDAP_RES_SEARCH_REFERENCE) {
         /* LDAPmessage_to_python will parse refs and read the controls for each res */
-    } else if (res_type == LDAP_RES_INTERMEDIATE) {
+    }
+    else if (res_type == LDAP_RES_INTERMEDIATE) {
         /* LDAPmessage_to_python will parse intermediates and controls */
-    } else {
+    }
+    else {
         int rc;
+
         if (res_type == LDAP_RES_EXTENDED) {
             struct berval *retdata = 0;
-            LDAP_BEGIN_ALLOW_THREADS( self );
-            rc = ldap_parse_extended_result( self->ldap, msg, &retoid, &retdata, 0 );
-            LDAP_END_ALLOW_THREADS( self );
+
+            LDAP_BEGIN_ALLOW_THREADS(self);
+            rc = ldap_parse_extended_result(self->ldap, msg, &retoid, &retdata,
+                                            0);
+            LDAP_END_ALLOW_THREADS(self);
             /* handle error rc!=0 here? */
             if (rc == LDAP_SUCCESS) {
                 valuestr = LDAPberval_to_object(retdata);
             }
-            ber_bvfree( retdata );
+            ber_bvfree(retdata);
         }
-            
-        LDAP_BEGIN_ALLOW_THREADS( self );
-        rc = ldap_parse_result( self->ldap, msg, &result, NULL, NULL, &refs,
-                                &serverctrls, 0 );
-        LDAP_END_ALLOW_THREADS( self );
+
+        LDAP_BEGIN_ALLOW_THREADS(self);
+        rc = ldap_parse_result(self->ldap, msg, &result, NULL, NULL, &refs,
+                               &serverctrls, 0);
+        LDAP_END_ALLOW_THREADS(self);
     }
 
-    if (result != LDAP_SUCCESS) {               /* result error */
+    if (result != LDAP_SUCCESS) {       /* result error */
         char *e, err[1024];
+
         if (result == LDAP_REFERRAL && refs && refs[0]) {
             snprintf(err, sizeof(err), "Referral:\n%s", refs[0]);
             e = err;
-        } else
+        }
+        else
             e = "ldap_parse_result";
         ldap_msgfree(msg);
         Py_XDECREF(valuestr);
-        return LDAPerror( self->ldap, e );
+        return LDAPerror(self->ldap, e);
     }
 
     if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
         int err = LDAP_NO_MEMORY;
-        LDAP_BEGIN_ALLOW_THREADS( self );
+
+        LDAP_BEGIN_ALLOW_THREADS(self);
         ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &err);
-        LDAP_END_ALLOW_THREADS( self );
+        LDAP_END_ALLOW_THREADS(self);
         ldap_msgfree(msg);
         Py_XDECREF(valuestr);
         return LDAPerror(self->ldap, "LDAPControls_to_List");
     }
     ldap_controls_free(serverctrls);
 
-    pmsg = LDAPmessage_to_python( self->ldap, msg, add_ctrls, add_intermediates );
+    pmsg =
+        LDAPmessage_to_python(self->ldap, msg, add_ctrls, add_intermediates);
 
     if (res_type == 0) {
         result_str = Py_None;
         Py_INCREF(Py_None);
-    } else {
-        result_str = PyInt_FromLong( res_type );
+    }
+    else {
+        result_str = PyInt_FromLong(res_type);
     }
 
     if (pmsg == NULL) {
-            retval = NULL;
-    } else {
+        retval = NULL;
+    }
+    else {
         /* s handles NULL, but O does not */
         if (add_extop) {
             retval = Py_BuildValue("(OOiOsO)", result_str, pmsg, res_msgid,
-                                   pyctrls, retoid, valuestr ? valuestr : Py_None);
-        } else {
-            retval = Py_BuildValue("(OOiO)", result_str, pmsg, res_msgid, pyctrls);
+                                   pyctrls, retoid,
+                                   valuestr ? valuestr : Py_None);
+        }
+        else {
+            retval =
+                Py_BuildValue("(OOiO)", result_str, pmsg, res_msgid, pyctrls);
         }
 
         if (pmsg != Py_None) {
-        Py_DECREF(pmsg);
+            Py_DECREF(pmsg);
         }
     }
     Py_XDECREF(valuestr);
@@ -1135,11 +1224,10 @@ l_ldap_result4( LDAPObject* self, PyObject *args )
     return retval;
 }
 
-
 /* ldap_search_ext */
 
-static PyObject*
-l_ldap_search_ext( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_search_ext(LDAPObject *self, PyObject *args)
 {
     char *base;
     int scope;
@@ -1150,73 +1238,76 @@ l_ldap_search_ext( LDAPObject* self, PyObject* args )
 
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     double timeout = -1.0;
     struct timeval tv;
-    struct timeval* tvp;
+    struct timeval *tvp;
 
     int sizelimit = 0;
 
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "sis|OiOOdi:search_ext",
-                           &base, &scope, &filter, &attrlist, &attrsonly,
-                           &serverctrls, &clientctrls, &timeout, &sizelimit )) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple(args, "sis|OiOOdi:search_ext",
+                          &base, &scope, &filter, &attrlist, &attrsonly,
+                          &serverctrls, &clientctrls, &timeout, &sizelimit))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
-    if (!attrs_from_List( attrlist, &attrs ))
-         return NULL;
+    if (!attrs_from_List(attrlist, &attrs))
+        return NULL;
 
     if (timeout >= 0) {
         tvp = &tv;
-        set_timeval_from_double( tvp, timeout );
-    } else {
+        set_timeval_from_double(tvp, timeout);
+    }
+    else {
         tvp = NULL;
     }
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs)) {
-            free_attrs( &attrs );
+            free_attrs(&attrs);
             return NULL;
         }
     }
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            free_attrs( &attrs );
-            LDAPControl_List_DEL( server_ldcs );
+            free_attrs(&attrs);
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_search_ext( self->ldap, base, scope, filter, attrs, attrsonly,
-                             server_ldcs, client_ldcs, tvp, sizelimit, &msgid );
-    LDAP_END_ALLOW_THREADS( self );
-
-    free_attrs( &attrs );
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror =
+        ldap_search_ext(self->ldap, base, scope, filter, attrs, attrsonly,
+                        server_ldcs, client_ldcs, tvp, sizelimit, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_search_ext" );
+    free_attrs(&attrs);
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    return PyInt_FromLong( msgid );
-}       
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_search_ext");
 
+    return PyInt_FromLong(msgid);
+}
 
 /* ldap_whoami_s (available since OpenLDAP 2.1.13) */
 
-static PyObject*
-l_ldap_whoami_s( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_whoami_s(LDAPObject *self, PyObject *args)
 {
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     struct berval *bvalue = NULL;
 
@@ -1224,8 +1315,10 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
 
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "|OO:whoami_s", &serverctrls, &clientctrls)) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple(args, "|OO:whoami_s", &serverctrls, &clientctrls))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -1234,21 +1327,21 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_whoami_s( self->ldap, &bvalue, server_ldcs, client_ldcs );
-    LDAP_END_ALLOW_THREADS( self );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror = ldap_whoami_s(self->ldap, &bvalue, server_ldcs, client_ldcs);
+    LDAP_END_ALLOW_THREADS(self);
 
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS ) {
+    if (ldaperror != LDAP_SUCCESS) {
         ber_bvfree(bvalue);
-        return LDAPerror( self->ldap, "ldap_whoami_s" );
+        return LDAPerror(self->ldap, "ldap_whoami_s");
     }
 
     result = LDAPberval_to_unicode_object(bvalue);
@@ -1260,20 +1353,22 @@ l_ldap_whoami_s( LDAPObject* self, PyObject* args )
 #ifdef HAVE_TLS
 /* ldap_start_tls_s */
 
-static PyObject*
-l_ldap_start_tls_s( LDAPObject* self, PyObject* args )
+static PyObject *
+l_ldap_start_tls_s(LDAPObject *self, PyObject *args)
 {
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, ":start_tls_s" )) return NULL;
-    if (not_valid(self)) return NULL;
+    if (!PyArg_ParseTuple(args, ":start_tls_s"))
+        return NULL;
+    if (not_valid(self))
+        return NULL;
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_start_tls_s( self->ldap, NULL, NULL );
-    LDAP_END_ALLOW_THREADS( self );
-    if ( ldaperror != LDAP_SUCCESS ){
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror = ldap_start_tls_s(self->ldap, NULL, NULL);
+    LDAP_END_ALLOW_THREADS(self);
+    if (ldaperror != LDAP_SUCCESS) {
         ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &ldaperror);
-        return LDAPerror( self->ldap, "ldap_start_tls_s" );
+        return LDAPerror(self->ldap, "ldap_start_tls_s");
     }
 
     Py_INCREF(Py_None);
@@ -1284,8 +1379,8 @@ l_ldap_start_tls_s( LDAPObject* self, PyObject* args )
 
 /* ldap_set_option */
 
-static PyObject*
-l_ldap_set_option(PyObject* self, PyObject *args)
+static PyObject *
+l_ldap_set_option(PyObject *self, PyObject *args)
 {
     PyObject *value;
     int option;
@@ -1298,11 +1393,10 @@ l_ldap_set_option(PyObject* self, PyObject *args)
     return Py_None;
 }
 
-
 /* ldap_get_option */
 
-static PyObject*
-l_ldap_get_option(PyObject* self, PyObject *args)
+static PyObject *
+l_ldap_get_option(PyObject *self, PyObject *args)
 {
     int option;
 
@@ -1311,11 +1405,10 @@ l_ldap_get_option(PyObject* self, PyObject *args)
     return LDAP_get_option((LDAPObject *)self, option);
 }
 
-
 /* ldap_passwd */
 
 static PyObject *
-l_ldap_passwd( LDAPObject* self, PyObject *args )
+l_ldap_passwd(LDAPObject *self, PyObject *args)
 {
     struct berval user;
     Py_ssize_t user_len;
@@ -1325,20 +1418,23 @@ l_ldap_passwd( LDAPObject* self, PyObject *args )
     Py_ssize_t newpw_len;
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "z#z#z#|OO:passwd", &user.bv_val, &user_len, &oldpw.bv_val, &oldpw_len, &newpw.bv_val, &newpw_len, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple
+        (args, "z#z#z#|OO:passwd", &user.bv_val, &user_len, &oldpw.bv_val,
+         &oldpw_len, &newpw.bv_val, &newpw_len, &serverctrls, &clientctrls))
         return NULL;
 
     user.bv_len = (ber_len_t) user_len;
     oldpw.bv_len = (ber_len_t) oldpw_len;
     newpw.bv_len = (ber_len_t) newpw_len;
-    
-    if (not_valid(self)) return NULL;
+
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -1347,50 +1443,50 @@ l_ldap_passwd( LDAPObject* self, PyObject *args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_passwd( self->ldap,
-            user.bv_val != NULL ? &user : NULL,
-            oldpw.bv_val != NULL ? &oldpw : NULL,
-            newpw.bv_val != NULL ? &newpw : NULL,
-            server_ldcs,
-            client_ldcs,
-            &msgid );
-    LDAP_END_ALLOW_THREADS( self );
-    
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror = ldap_passwd(self->ldap,
+                            user.bv_val != NULL ? &user : NULL,
+                            oldpw.bv_val != NULL ? &oldpw : NULL,
+                            newpw.bv_val != NULL ? &newpw : NULL,
+                            server_ldcs, client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_passwd" );
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    return PyInt_FromLong( msgid );
-}
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_passwd");
 
+    return PyInt_FromLong(msgid);
+}
 
 /* ldap_extended_operation */
 
 static PyObject *
-l_ldap_extended_operation( LDAPObject* self, PyObject *args )
+l_ldap_extended_operation(LDAPObject *self, PyObject *args)
 {
     char *reqoid = NULL;
-    struct berval reqvalue = {0, NULL};
+    struct berval reqvalue = { 0, NULL };
     PyObject *serverctrls = Py_None;
     PyObject *clientctrls = Py_None;
-    LDAPControl** server_ldcs = NULL;
-    LDAPControl** client_ldcs = NULL;
+    LDAPControl **server_ldcs = NULL;
+    LDAPControl **client_ldcs = NULL;
 
     int msgid;
     int ldaperror;
 
-    if (!PyArg_ParseTuple( args, "sz#|OO:extended_operation", &reqoid, &reqvalue.bv_val, &reqvalue.bv_len, &serverctrls, &clientctrls ))
+    if (!PyArg_ParseTuple
+        (args, "sz#|OO:extended_operation", &reqoid, &reqvalue.bv_val,
+         &reqvalue.bv_len, &serverctrls, &clientctrls))
         return NULL;
 
-    if (not_valid(self)) return NULL;
+    if (not_valid(self))
+        return NULL;
 
     if (!PyNone_Check(serverctrls)) {
         if (!LDAPControls_from_object(serverctrls, &server_ldcs))
@@ -1399,91 +1495,91 @@ l_ldap_extended_operation( LDAPObject* self, PyObject *args )
 
     if (!PyNone_Check(clientctrls)) {
         if (!LDAPControls_from_object(clientctrls, &client_ldcs)) {
-            LDAPControl_List_DEL( server_ldcs );
+            LDAPControl_List_DEL(server_ldcs);
             return NULL;
         }
     }
 
-    LDAP_BEGIN_ALLOW_THREADS( self );
-    ldaperror = ldap_extended_operation( self->ldap, reqoid,
-            reqvalue.bv_val != NULL ? &reqvalue : NULL,
-            server_ldcs,
-            client_ldcs,
-            &msgid );
-    LDAP_END_ALLOW_THREADS( self );
-    
-    LDAPControl_List_DEL( server_ldcs );
-    LDAPControl_List_DEL( client_ldcs );
+    LDAP_BEGIN_ALLOW_THREADS(self);
+    ldaperror = ldap_extended_operation(self->ldap, reqoid,
+                                        reqvalue.bv_val !=
+                                        NULL ? &reqvalue : NULL, server_ldcs,
+                                        client_ldcs, &msgid);
+    LDAP_END_ALLOW_THREADS(self);
+
+    LDAPControl_List_DEL(server_ldcs);
+    LDAPControl_List_DEL(client_ldcs);
 
-    if ( ldaperror!=LDAP_SUCCESS )
-        return LDAPerror( self->ldap, "ldap_extended_operation" );
+    if (ldaperror != LDAP_SUCCESS)
+        return LDAPerror(self->ldap, "ldap_extended_operation");
 
-    return PyInt_FromLong( msgid );
+    return PyInt_FromLong(msgid);
 }
 
 /* methods */
 
 static PyMethodDef methods[] = {
-    {"unbind_ext",      (PyCFunction)l_ldap_unbind_ext,         METH_VARARGS },
-    {"abandon_ext",     (PyCFunction)l_ldap_abandon_ext,        METH_VARARGS },
-    {"add_ext",         (PyCFunction)l_ldap_add_ext,            METH_VARARGS },
-    {"simple_bind",     (PyCFunction)l_ldap_simple_bind,        METH_VARARGS },
+    {"unbind_ext", (PyCFunction)l_ldap_unbind_ext, METH_VARARGS},
+    {"abandon_ext", (PyCFunction)l_ldap_abandon_ext, METH_VARARGS},
+    {"add_ext", (PyCFunction)l_ldap_add_ext, METH_VARARGS},
+    {"simple_bind", (PyCFunction)l_ldap_simple_bind, METH_VARARGS},
 #ifdef HAVE_SASL
-    {"sasl_interactive_bind_s", (PyCFunction)l_ldap_sasl_interactive_bind_s,    METH_VARARGS },
-    {"sasl_bind_s", (PyCFunction)l_ldap_sasl_bind_s,    METH_VARARGS },
+    {"sasl_interactive_bind_s", (PyCFunction)l_ldap_sasl_interactive_bind_s,
+     METH_VARARGS},
+    {"sasl_bind_s", (PyCFunction)l_ldap_sasl_bind_s, METH_VARARGS},
 #endif
-    {"compare_ext",     (PyCFunction)l_ldap_compare_ext,        METH_VARARGS },
-    {"delete_ext",      (PyCFunction)l_ldap_delete_ext,         METH_VARARGS },
-    {"modify_ext",      (PyCFunction)l_ldap_modify_ext,         METH_VARARGS },
-    {"rename",          (PyCFunction)l_ldap_rename,             METH_VARARGS },
-    {"result4",         (PyCFunction)l_ldap_result4,            METH_VARARGS },
-    {"search_ext",      (PyCFunction)l_ldap_search_ext,         METH_VARARGS },
+    {"compare_ext", (PyCFunction)l_ldap_compare_ext, METH_VARARGS},
+    {"delete_ext", (PyCFunction)l_ldap_delete_ext, METH_VARARGS},
+    {"modify_ext", (PyCFunction)l_ldap_modify_ext, METH_VARARGS},
+    {"rename", (PyCFunction)l_ldap_rename, METH_VARARGS},
+    {"result4", (PyCFunction)l_ldap_result4, METH_VARARGS},
+    {"search_ext", (PyCFunction)l_ldap_search_ext, METH_VARARGS},
 #ifdef HAVE_TLS
-    {"start_tls_s",     (PyCFunction)l_ldap_start_tls_s,        METH_VARARGS },
+    {"start_tls_s", (PyCFunction)l_ldap_start_tls_s, METH_VARARGS},
 #endif
-    {"whoami_s",        (PyCFunction)l_ldap_whoami_s,           METH_VARARGS },
-    {"passwd",          (PyCFunction)l_ldap_passwd,             METH_VARARGS },
-    {"set_option",      (PyCFunction)l_ldap_set_option,         METH_VARARGS },
-    {"get_option",      (PyCFunction)l_ldap_get_option,         METH_VARARGS },
+    {"whoami_s", (PyCFunction)l_ldap_whoami_s, METH_VARARGS},
+    {"passwd", (PyCFunction)l_ldap_passwd, METH_VARARGS},
+    {"set_option", (PyCFunction)l_ldap_set_option, METH_VARARGS},
+    {"get_option", (PyCFunction)l_ldap_get_option, METH_VARARGS},
 #ifdef LDAP_API_FEATURE_CANCEL
-    {"cancel",          (PyCFunction)l_ldap_cancel,             METH_VARARGS },
+    {"cancel", (PyCFunction)l_ldap_cancel, METH_VARARGS},
 #endif
-    {"extop",           (PyCFunction)l_ldap_extended_operation,         METH_VARARGS },
-    { NULL, NULL }
+    {"extop", (PyCFunction)l_ldap_extended_operation, METH_VARARGS},
+    {NULL, NULL}
 };
 
 /* type entry */
 
 PyTypeObject LDAP_Type = {
-        PyVarObject_HEAD_INIT(NULL, 0)
-        "LDAP",                 /*tp_name*/
-        sizeof(LDAPObject),     /*tp_basicsize*/
-        0,                      /*tp_itemsize*/
-        /* methods */
-        (destructor)dealloc,    /*tp_dealloc*/
-        0,                      /*tp_print*/
-        0,                      /*tp_getattr*/
-        0,                      /*tp_setattr*/
-        0,                      /*tp_compare*/
-        0,                      /*tp_repr*/
-        0,                      /*tp_as_number*/
-        0,                      /*tp_as_sequence*/
-        0,                      /*tp_as_mapping*/
-        0,                      /*tp_hash*/
-        0,                      /*tp_call*/
-        0,                      /*tp_str*/
-        0,                      /*tp_getattro*/
-        0,                      /*tp_setattro*/
-        0,                      /*tp_as_buffer*/
-        0,                      /*tp_flags*/
-        0,                      /*tp_doc*/
-        0,                      /*tp_traverse*/
-        0,                      /*tp_clear*/
-        0,                      /*tp_richcompare*/
-        0,                      /*tp_weaklistoffset*/
-        0,                      /*tp_iter*/
-        0,                      /*tp_iternext*/
-        methods,                /*tp_methods*/
-        0,                      /*tp_members*/
-        0,                      /*tp_getset*/
+    PyVarObject_HEAD_INIT(NULL, 0)
+        "LDAP",         /*tp_name */
+    sizeof(LDAPObject), /*tp_basicsize */
+    0,                  /*tp_itemsize */
+    /* methods */
+    (destructor) dealloc,       /*tp_dealloc */
+    0,                  /*tp_print */
+    0,                  /*tp_getattr */
+    0,                  /*tp_setattr */
+    0,                  /*tp_compare */
+    0,                  /*tp_repr */
+    0,                  /*tp_as_number */
+    0,                  /*tp_as_sequence */
+    0,                  /*tp_as_mapping */
+    0,                  /*tp_hash */
+    0,                  /*tp_call */
+    0,                  /*tp_str */
+    0,                  /*tp_getattro */
+    0,                  /*tp_setattro */
+    0,                  /*tp_as_buffer */
+    0,                  /*tp_flags */
+    0,                  /*tp_doc */
+    0,                  /*tp_traverse */
+    0,                  /*tp_clear */
+    0,                  /*tp_richcompare */
+    0,                  /*tp_weaklistoffset */
+    0,                  /*tp_iter */
+    0,                  /*tp_iternext */
+    methods,            /*tp_methods */
+    0,                  /*tp_members */
+    0,                  /*tp_getset */
 };
diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index 8cd6fc3..a456bce 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -1,7 +1,7 @@
 /* See https://www.python-ldap.org/ for details. */
 
-#ifndef __h_LDAPObject 
-#define __h_LDAPObject 
+#ifndef __h_LDAPObject
+#define __h_LDAPObject
 
 #include "common.h"
 
@@ -12,22 +12,22 @@
 #endif
 
 #if PYTHON_API_VERSION < 1007
-typedef PyObject*	_threadstate;
+typedef PyObject *_threadstate;
 #else
-typedef PyThreadState*	_threadstate;
+typedef PyThreadState *_threadstate;
 #endif
 
 typedef struct {
-        PyObject_HEAD
-	LDAP* ldap;
-	_threadstate	_save; /* for thread saving on referrals */
-	int valid;
+    PyObject_HEAD LDAP *ldap;
+    _threadstate _save;         /* for thread saving on referrals */
+    int valid;
 } LDAPObject;
 
 extern PyTypeObject LDAP_Type;
+
 #define LDAPObject_Check(v)     (Py_TYPE(v) == &LDAP_Type)
 
-extern LDAPObject *newLDAPObject( LDAP* );
+extern LDAPObject *newLDAPObject(LDAP *);
 
 /* macros to allow thread saving in the context of an LDAP connection */
 
@@ -48,4 +48,3 @@ extern LDAPObject *newLDAPObject( LDAP* );
 	}
 
 #endif /* __h_LDAPObject */
-
diff --git a/Modules/berval.h b/Modules/berval.h
index 9702b8c..2aa9c97 100644
--- a/Modules/berval.h
+++ b/Modules/berval.h
@@ -1,7 +1,7 @@
 /* See https://www.python-ldap.org/ for details. */
 
-#ifndef __h_berval 
-#define __h_berval 
+#ifndef __h_berval
+#define __h_berval
 
 #include "common.h"
 #include "lber.h"
diff --git a/Modules/common.c b/Modules/common.c
index 0f0cd36..9d7001c 100644
--- a/Modules/common.c
+++ b/Modules/common.c
@@ -6,21 +6,24 @@
 /* dynamically add the methods into the module dictionary d */
 
 void
-LDAPadd_methods( PyObject* d, PyMethodDef* methods ) 
+LDAPadd_methods(PyObject *d, PyMethodDef *methods)
 {
     PyMethodDef *meth;
 
-    for( meth = methods; meth->ml_meth; meth++ ) {
-        PyObject *f = PyCFunction_New( meth, NULL );
-        PyDict_SetItemString( d, meth->ml_name, f );
+    for (meth = methods; meth->ml_meth; meth++) {
+        PyObject *f = PyCFunction_New(meth, NULL);
+
+        PyDict_SetItemString(d, meth->ml_name, f);
         Py_DECREF(f);
     }
 }
 
 /* Raise TypeError with custom message and object */
-PyObject*
-LDAPerror_TypeError(const char *msg, PyObject *obj) {
+PyObject *
+LDAPerror_TypeError(const char *msg, PyObject *obj)
+{
     PyObject *args = Py_BuildValue("sO", msg, obj);
+
     if (args == NULL) {
         return NULL;
     }
diff --git a/Modules/common.h b/Modules/common.h
index 029f234..affa5f9 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -1,8 +1,8 @@
 /* common utility macros
  * See https://www.python-ldap.org/ for details. */
 
-#ifndef __h_common 
-#define __h_common 
+#ifndef __h_common
+#define __h_common
 
 #define PY_SSIZE_T_CLEAN
 
@@ -24,9 +24,10 @@
 #define streq( a, b ) \
 	( (*(a)==*(b)) && 0==strcmp(a,b) )
 
-extern PyObject* LDAPerror_TypeError(const char *, PyObject *);
+extern PyObject *LDAPerror_TypeError(const char *, PyObject *);
+
+void LDAPadd_methods(PyObject *d, PyMethodDef *methods);
 
-void LDAPadd_methods( PyObject*d, PyMethodDef*methods );
 #define PyNone_Check(o) ((o) == Py_None)
 
 /* Py2/3 compatibility */
@@ -36,4 +37,3 @@ void LDAPadd_methods( PyObject*d, PyMethodDef*methods );
 #endif
 
 #endif /* __h_common_ */
-
diff --git a/Modules/constants.c b/Modules/constants.c
index c2b595c..f8da373 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -8,133 +8,136 @@
 
 /* the base exception class */
 
-PyObject*
-LDAPexception_class;
+PyObject *LDAPexception_class;
 
 /* list of exception classes */
 
 #define LDAP_ERROR_MIN          LDAP_REFERRAL_LIMIT_EXCEEDED
 
 #ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
-  #define LDAP_ERROR_MAX          LDAP_PROXIED_AUTHORIZATION_DENIED
+#define LDAP_ERROR_MAX          LDAP_PROXIED_AUTHORIZATION_DENIED
 #else
-  #ifdef LDAP_ASSERTION_FAILED
-    #define LDAP_ERROR_MAX          LDAP_ASSERTION_FAILED
-  #else
-    #define LDAP_ERROR_MAX          LDAP_OTHER
-  #endif
+#ifdef LDAP_ASSERTION_FAILED
+#define LDAP_ERROR_MAX          LDAP_ASSERTION_FAILED
+#else
+#define LDAP_ERROR_MAX          LDAP_OTHER
+#endif
 #endif
 
 #define LDAP_ERROR_OFFSET       -LDAP_ERROR_MIN
 
-static PyObject* errobjects[ LDAP_ERROR_MAX-LDAP_ERROR_MIN+1 ];
-
+static PyObject *errobjects[LDAP_ERROR_MAX - LDAP_ERROR_MIN + 1];
 
 /* Convert a bare LDAP error number into an exception */
-PyObject*
+PyObject *
 LDAPerr(int errnum)
 {
-  if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX) {
-    PyErr_SetNone(errobjects[errnum+LDAP_ERROR_OFFSET]);
-  } else {
-    PyObject *args = Py_BuildValue("{s:i}", "errnum", errnum);
-    if (args == NULL)
-      return NULL;
-    PyErr_SetObject(LDAPexception_class, args);
-    Py_DECREF(args);
-  }
-  return NULL;
+    if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX) {
+        PyErr_SetNone(errobjects[errnum + LDAP_ERROR_OFFSET]);
+    }
+    else {
+        PyObject *args = Py_BuildValue("{s:i}", "errnum", errnum);
+
+        if (args == NULL)
+            return NULL;
+        PyErr_SetObject(LDAPexception_class, args);
+        Py_DECREF(args);
+    }
+    return NULL;
 }
 
 /* Convert an LDAP error into an informative python exception */
-PyObject*
-LDAPerror( LDAP *l, char *msg )
+PyObject *
+LDAPerror(LDAP *l, char *msg)
 {
-  if (l == NULL) {
-    PyErr_SetFromErrno( LDAPexception_class );
-    return NULL;
-  }
-  else {
-    int myerrno, errnum, opt_errnum;
-    PyObject *errobj;
-    PyObject *info;
-    PyObject *str;
-    PyObject *pyerrno;
-    char *matched, *error;
-
-    /* at first save errno for later use before it gets overwritten by another call */
-    myerrno = errno;
-
-    opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
-    if (opt_errnum != LDAP_OPT_SUCCESS)
-      errnum = opt_errnum;
-
-    if (errnum == LDAP_NO_MEMORY)
-      return PyErr_NoMemory();
-
-    if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
-      errobj = errobjects[errnum+LDAP_ERROR_OFFSET];
-    else
-      errobj = LDAPexception_class;
-
-    info = PyDict_New();
-    if (info == NULL)
-      return NULL;
-
-    str = PyUnicode_FromString(ldap_err2string(errnum));
-    if (str)
-      PyDict_SetItemString( info, "desc", str );
-    Py_XDECREF(str);
-
-    if (myerrno != 0) {
-        pyerrno = PyInt_FromLong(myerrno);
-        if (pyerrno)
-            PyDict_SetItemString( info, "errno", pyerrno );
-        Py_XDECREF(pyerrno);
+    if (l == NULL) {
+        PyErr_SetFromErrno(LDAPexception_class);
+        return NULL;
     }
+    else {
+        int myerrno, errnum, opt_errnum;
+        PyObject *errobj;
+        PyObject *info;
+        PyObject *str;
+        PyObject *pyerrno;
+        char *matched, *error;
+
+        /* at first save errno for later use before it gets overwritten by another call */
+        myerrno = errno;
+
+        opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
+        if (opt_errnum != LDAP_OPT_SUCCESS)
+            errnum = opt_errnum;
+
+        if (errnum == LDAP_NO_MEMORY)
+            return PyErr_NoMemory();
+
+        if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
+            errobj = errobjects[errnum + LDAP_ERROR_OFFSET];
+        else
+            errobj = LDAPexception_class;
+
+        info = PyDict_New();
+        if (info == NULL)
+            return NULL;
+
+        str = PyUnicode_FromString(ldap_err2string(errnum));
+        if (str)
+            PyDict_SetItemString(info, "desc", str);
+        Py_XDECREF(str);
 
-    if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
-      && matched != NULL) {
-        if (*matched != '\0') {
-      str = PyUnicode_FromString(matched);
-      if (str)
-          PyDict_SetItemString( info, "matched", str );
-      Py_XDECREF(str);
+        if (myerrno != 0) {
+            pyerrno = PyInt_FromLong(myerrno);
+            if (pyerrno)
+                PyDict_SetItemString(info, "errno", pyerrno);
+            Py_XDECREF(pyerrno);
         }
-        ldap_memfree(matched);
-    }
 
-    if (errnum == LDAP_REFERRAL) {
-        str = PyUnicode_FromString(msg);
-        if (str)
-      PyDict_SetItemString( info, "info", str );
-        Py_XDECREF(str);
-    } else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
-        if (error != NULL && *error != '\0') {
-            str = PyUnicode_FromString(error);
+        if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
+            && matched != NULL) {
+            if (*matched != '\0') {
+                str = PyUnicode_FromString(matched);
+                if (str)
+                    PyDict_SetItemString(info, "matched", str);
+                Py_XDECREF(str);
+            }
+            ldap_memfree(matched);
+        }
+
+        if (errnum == LDAP_REFERRAL) {
+            str = PyUnicode_FromString(msg);
             if (str)
-                PyDict_SetItemString( info, "info", str );
+                PyDict_SetItemString(info, "info", str);
             Py_XDECREF(str);
         }
-        ldap_memfree(error);
+        else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
+            if (error != NULL && *error != '\0') {
+                str = PyUnicode_FromString(error);
+                if (str)
+                    PyDict_SetItemString(info, "info", str);
+                Py_XDECREF(str);
+            }
+            ldap_memfree(error);
+        }
+        PyErr_SetObject(errobj, info);
+        Py_DECREF(info);
+        return NULL;
     }
-    PyErr_SetObject( errobj, info );
-    Py_DECREF(info);
-    return NULL;
-  }
 }
 
 /* initialise the module constants */
 
 int
-LDAPinit_constants( PyObject* m )
+LDAPinit_constants(PyObject *m)
 {
     PyObject *exc;
 
     /* simple constants */
 
-    if (PyModule_AddIntConstant(m, "OPT_ON", 1) != 0) return -1;
-    if (PyModule_AddIntConstant(m, "OPT_OFF", 0) != 0) return -1;
+    if (PyModule_AddIntConstant(m, "OPT_ON", 1) != 0)
+        return -1;
+    if (PyModule_AddIntConstant(m, "OPT_OFF", 0) != 0)
+        return -1;
 
     /* exceptions */
 
@@ -143,11 +146,13 @@ LDAPinit_constants( PyObject* m )
         return -1;
     }
 
-    if (PyModule_AddObject(m, "LDAPError", LDAPexception_class) != 0) return -1;
+    if (PyModule_AddObject(m, "LDAPError", LDAPexception_class) != 0)
+        return -1;
     Py_INCREF(LDAPexception_class);
 
     /* XXX - backward compatibility with pre-1.8 */
-    if (PyModule_AddObject(m, "error", LDAPexception_class) != 0) return -1;
+    if (PyModule_AddObject(m, "error", LDAPexception_class) != 0)
+        return -1;
     Py_INCREF(LDAPexception_class);
 
     /* Generated constants -- see Lib/ldap/constants.py */
diff --git a/Modules/constants.h b/Modules/constants.h
index 4056f90..8a390b5 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -7,19 +7,19 @@
 #include "lber.h"
 #include "ldap.h"
 
-extern int LDAPinit_constants( PyObject* m );
-extern PyObject* LDAPconstant( int );
+extern int LDAPinit_constants(PyObject *m);
+extern PyObject *LDAPconstant(int);
 
-extern PyObject* LDAPexception_class;
-extern PyObject* LDAPerror( LDAP*, char*msg );
-PyObject* LDAPerr(int errnum);
+extern PyObject *LDAPexception_class;
+extern PyObject *LDAPerror(LDAP *, char *msg);
+PyObject *LDAPerr(int errnum);
 
 #ifndef LDAP_CONTROL_PAGE_OID
 #define LDAP_CONTROL_PAGE_OID "1.2.840.113556.1.4.319"
 #endif /* !LDAP_CONTROL_PAGE_OID */
 
 #ifndef LDAP_CONTROL_VALUESRETURNFILTER
-#define LDAP_CONTROL_VALUESRETURNFILTER "1.2.826.0.1.3344810.2.3" /* RFC 3876 */
+#define LDAP_CONTROL_VALUESRETURNFILTER "1.2.826.0.1.3344810.2.3"       /* RFC 3876 */
 #endif /* !LDAP_CONTROL_VALUESRETURNFILTER */
 
 #endif /* __h_constants_ */
diff --git a/Modules/constants_generated.h b/Modules/constants_generated.h
index 083ba16..455852e 100644
--- a/Modules/constants_generated.h
+++ b/Modules/constants_generated.h
@@ -76,12 +76,10 @@ add_err(TOO_LATE);
 add_err(CANNOT_CANCEL);
 #endif
 
-
 #if defined(LDAP_ASSERTION_FAILED)
 add_err(ASSERTION_FAILED);
 #endif
 
-
 #if defined(LDAP_PROXIED_AUTHORIZATION_DENIED)
 add_err(PROXIED_AUTHORIZATION_DENIED);
 #endif
@@ -194,7 +192,6 @@ add_int(OPT_URI);
 add_int(OPT_DEFBASE);
 #endif
 
-
 #if HAVE_TLS
 
 #if defined(LDAP_OPT_X_TLS)
@@ -220,27 +217,22 @@ add_int(OPT_X_TLS_TRY);
 add_int(OPT_X_TLS_PEERCERT);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_VERSION)
 add_int(OPT_X_TLS_VERSION);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_CIPHER)
 add_int(OPT_X_TLS_CIPHER);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_PEERCERT)
 add_int(OPT_X_TLS_PEERCERT);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_CRLCHECK)
 add_int(OPT_X_TLS_CRLCHECK);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_CRLFILE)
 add_int(OPT_X_TLS_CRLFILE);
 #endif
@@ -253,12 +245,10 @@ add_int(OPT_X_TLS_CRL_ALL);
 add_int(OPT_X_TLS_NEWCTX);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_PROTOCOL_MIN)
 add_int(OPT_X_TLS_PROTOCOL_MIN);
 #endif
 
-
 #if defined(LDAP_OPT_X_TLS_PACKAGE)
 add_int(OPT_X_TLS_PACKAGE);
 #endif
@@ -279,27 +269,22 @@ add_int(OPT_X_SASL_SSF_MAX);
 add_int(OPT_X_SASL_NOCANON);
 #endif
 
-
 #if defined(LDAP_OPT_X_SASL_USERNAME)
 add_int(OPT_X_SASL_USERNAME);
 #endif
 
-
 #if defined(LDAP_OPT_CONNECT_ASYNC)
 add_int(OPT_CONNECT_ASYNC);
 #endif
 
-
 #if defined(LDAP_OPT_X_KEEPALIVE_IDLE)
 add_int(OPT_X_KEEPALIVE_IDLE);
 #endif
 
-
 #if defined(LDAP_OPT_X_KEEPALIVE_PROBES)
 add_int(OPT_X_KEEPALIVE_PROBES);
 #endif
 
-
 #if defined(LDAP_OPT_X_KEEPALIVE_INTERVAL)
 add_int(OPT_X_KEEPALIVE_INTERVAL);
 #endif
@@ -325,23 +310,27 @@ add_int(URL_ERR_BADSCOPE);
 add_int(URL_ERR_MEM);
 
 #ifdef HAVE_LIBLDAP_R
-if (PyModule_AddIntConstant(m, "LIBLDAP_R", 1) != 0) return -1;
+if (PyModule_AddIntConstant(m, "LIBLDAP_R", 1) != 0)
+    return -1;
 #else
-if (PyModule_AddIntConstant(m, "LIBLDAP_R", 0) != 0) return -1;
+if (PyModule_AddIntConstant(m, "LIBLDAP_R", 0) != 0)
+    return -1;
 #endif
 
-
 #ifdef HAVE_SASL
-if (PyModule_AddIntConstant(m, "SASL_AVAIL", 1) != 0) return -1;
+if (PyModule_AddIntConstant(m, "SASL_AVAIL", 1) != 0)
+    return -1;
 #else
-if (PyModule_AddIntConstant(m, "SASL_AVAIL", 0) != 0) return -1;
+if (PyModule_AddIntConstant(m, "SASL_AVAIL", 0) != 0)
+    return -1;
 #endif
 
-
 #ifdef HAVE_TLS
-if (PyModule_AddIntConstant(m, "TLS_AVAIL", 1) != 0) return -1;
+if (PyModule_AddIntConstant(m, "TLS_AVAIL", 1) != 0)
+    return -1;
 #else
-if (PyModule_AddIntConstant(m, "TLS_AVAIL", 0) != 0) return -1;
+if (PyModule_AddIntConstant(m, "TLS_AVAIL", 0) != 0)
+    return -1;
 #endif
 
 add_string(CONTROL_MANAGEDSAIT);
diff --git a/Modules/functions.c b/Modules/functions.c
index 6bbf487..4731efb 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -9,29 +9,26 @@
 
 /* ldap_initialize */
 
-static PyObject*
-l_ldap_initialize(PyObject* unused, PyObject *args)
+static PyObject *
+l_ldap_initialize(PyObject *unused, PyObject *args)
 {
     char *uri;
     LDAP *ld = NULL;
     int ret;
 
     if (!PyArg_ParseTuple(args, "s:initialize", &uri))
-    	return NULL;
-
-    Py_BEGIN_ALLOW_THREADS
-    ret = ldap_initialize(&ld, uri);
-    Py_END_ALLOW_THREADS
-    if (ret != LDAP_SUCCESS)
-    	return LDAPerror(ld, "ldap_initialize");
-    return (PyObject*)newLDAPObject(ld);
-}
+        return NULL;
 
+    Py_BEGIN_ALLOW_THREADS ret = ldap_initialize(&ld, uri);
+    Py_END_ALLOW_THREADS if (ret != LDAP_SUCCESS)
+        return LDAPerror(ld, "ldap_initialize");
+    return (PyObject *)newLDAPObject(ld);
+}
 
 /* ldap_str2dn */
 
-static PyObject*
-l_ldap_str2dn( PyObject* unused, PyObject *args )
+static PyObject *
+l_ldap_str2dn(PyObject *unused, PyObject *args)
 {
     struct berval str;
     LDAPDN dn;
@@ -46,58 +43,59 @@ l_ldap_str2dn( PyObject* unused, PyObject *args )
      * ((('a','b',1),('c','d',1)),(('e','f',1),))
      * The integers are a bit combination of the AVA_* flags
      */
-    if (!PyArg_ParseTuple( args, "z#|i:str2dn", 
-	    &str.bv_val, &str_len, &flags )) 
-	return NULL;
+    if (!PyArg_ParseTuple(args, "z#|i:str2dn", &str.bv_val, &str_len, &flags))
+        return NULL;
     str.bv_len = (ber_len_t) str_len;
 
     res = ldap_bv2dn(&str, &dn, flags);
     if (res != LDAP_SUCCESS)
-	return LDAPerr(res);
+        return LDAPerr(res);
 
     tmp = PyList_New(0);
     if (!tmp)
-	goto failed;
+        goto failed;
 
     for (i = 0; dn[i]; i++) {
-	LDAPRDN rdn;
-	PyObject *rdnlist;
-
-	rdn = dn[i];
-	rdnlist = PyList_New(0);
-	if (!rdnlist)
-	    goto failed;
-	if (PyList_Append(tmp, rdnlist) == -1) {
-	    Py_DECREF(rdnlist);
-	    goto failed;
-	}
-
-	for (j = 0; rdn[j]; j++) {
-	    LDAPAVA *ava = rdn[j];
-	    PyObject *tuple;
-
-	    tuple = Py_BuildValue("(O&O&i)",
-		LDAPberval_to_unicode_object, &ava->la_attr,
-		LDAPberval_to_unicode_object, &ava->la_value,
-		ava->la_flags & ~(LDAP_AVA_FREE_ATTR|LDAP_AVA_FREE_VALUE));
-	    if (!tuple) {
-		Py_DECREF(rdnlist);
-		goto failed;
-	    }
-
-	    if (PyList_Append(rdnlist, tuple) == -1) {
-		Py_DECREF(tuple);
-		goto failed;
-	    }
-	    Py_DECREF(tuple);
-	}
-	Py_DECREF(rdnlist);
+        LDAPRDN rdn;
+        PyObject *rdnlist;
+
+        rdn = dn[i];
+        rdnlist = PyList_New(0);
+        if (!rdnlist)
+            goto failed;
+        if (PyList_Append(tmp, rdnlist) == -1) {
+            Py_DECREF(rdnlist);
+            goto failed;
+        }
+
+        for (j = 0; rdn[j]; j++) {
+            LDAPAVA *ava = rdn[j];
+            PyObject *tuple;
+
+            tuple = Py_BuildValue("(O&O&i)",
+                                  LDAPberval_to_unicode_object, &ava->la_attr,
+                                  LDAPberval_to_unicode_object, &ava->la_value,
+                                  ava->
+                                  la_flags & ~(LDAP_AVA_FREE_ATTR |
+                                               LDAP_AVA_FREE_VALUE));
+            if (!tuple) {
+                Py_DECREF(rdnlist);
+                goto failed;
+            }
+
+            if (PyList_Append(rdnlist, tuple) == -1) {
+                Py_DECREF(tuple);
+                goto failed;
+            }
+            Py_DECREF(tuple);
+        }
+        Py_DECREF(rdnlist);
     }
 
     result = tmp;
     tmp = NULL;
 
-failed:
+  failed:
     Py_XDECREF(tmp);
     ldap_dnfree(dn);
     return result;
@@ -105,46 +103,46 @@ l_ldap_str2dn( PyObject* unused, PyObject *args )
 
 /* ldap_set_option (global options) */
 
-static PyObject*
-l_ldap_set_option(PyObject* self, PyObject *args)
+static PyObject *
+l_ldap_set_option(PyObject *self, PyObject *args)
 {
     PyObject *value;
     int option;
 
     if (!PyArg_ParseTuple(args, "iO:set_option", &option, &value))
-	return NULL;
+        return NULL;
     if (!LDAP_set_option(NULL, option, value))
-	return NULL;
+        return NULL;
     Py_INCREF(Py_None);
     return Py_None;
 }
 
 /* ldap_get_option (global options) */
 
-static PyObject*
-l_ldap_get_option(PyObject* self, PyObject *args)
+static PyObject *
+l_ldap_get_option(PyObject *self, PyObject *args)
 {
     int option;
 
     if (!PyArg_ParseTuple(args, "i:get_option", &option))
-	return NULL;
+        return NULL;
     return LDAP_get_option(NULL, option);
 }
 
-
 /* methods */
 
 static PyMethodDef methods[] = {
-    { "initialize",	(PyCFunction)l_ldap_initialize,		METH_VARARGS },
-    { "str2dn",	    (PyCFunction)l_ldap_str2dn,			METH_VARARGS },
-    { "set_option", (PyCFunction)l_ldap_set_option,		METH_VARARGS },
-    { "get_option", (PyCFunction)l_ldap_get_option,		METH_VARARGS },
-    { NULL, NULL }
+    {"initialize", (PyCFunction)l_ldap_initialize, METH_VARARGS},
+    {"str2dn", (PyCFunction)l_ldap_str2dn, METH_VARARGS},
+    {"set_option", (PyCFunction)l_ldap_set_option, METH_VARARGS},
+    {"get_option", (PyCFunction)l_ldap_get_option, METH_VARARGS},
+    {NULL, NULL}
 };
 
 /* initialisation */
 
 void
-LDAPinit_functions( PyObject* d ) {
-    LDAPadd_methods( d, methods );
+LDAPinit_functions(PyObject *d)
+{
+    LDAPadd_methods(d, methods);
 }
diff --git a/Modules/functions.h b/Modules/functions.h
index 854a940..2aef974 100644
--- a/Modules/functions.h
+++ b/Modules/functions.h
@@ -4,6 +4,6 @@
 #define __h_functions_
 
 #include "common.h"
-extern void LDAPinit_functions( PyObject* );
+extern void LDAPinit_functions(PyObject *);
 
 #endif /* __h_functions_ */
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index c8f9dfc..f53e681 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -27,13 +27,13 @@ LDAPControl_DumpList( LDAPControl** lcs ) {
 } */
 
 /* Free a single LDAPControl object created by Tuple_to_LDAPControl */
-  
+
 static void
-LDAPControl_DEL( LDAPControl* lc )
+LDAPControl_DEL(LDAPControl *lc)
 {
     if (lc == NULL)
         return;
-  
+
     if (lc->ldctl_oid)
         PyMem_DEL(lc->ldctl_oid);
     PyMem_DEL(lc);
@@ -42,16 +42,17 @@ LDAPControl_DEL( LDAPControl* lc )
 /* Free an array of LDAPControl objects created by LDAPControls_from_object */
 
 void
-LDAPControl_List_DEL( LDAPControl** lcs )
+LDAPControl_List_DEL(LDAPControl **lcs)
 {
-    LDAPControl** lcp;
+    LDAPControl **lcp;
+
     if (lcs == NULL)
         return;
 
-    for ( lcp = lcs; *lcp; lcp++ )
-        LDAPControl_DEL( *lcp );
+    for (lcp = lcs; *lcp; lcp++)
+        LDAPControl_DEL(*lcp);
 
-    PyMem_DEL( lcs );
+    PyMem_DEL(lcs);
 }
 
 /* Takes a tuple of the form:
@@ -61,8 +62,8 @@ LDAPControl_List_DEL( LDAPControl** lcs )
  * The Value string should represent an ASN.1 encoded structure.
  */
 
-static LDAPControl*
-Tuple_to_LDAPControl( PyObject* tup )
+static LDAPControl *
+Tuple_to_LDAPControl(PyObject *tup)
 {
     char *oid;
     char iscritical;
@@ -72,13 +73,14 @@ Tuple_to_LDAPControl( PyObject* tup )
     Py_ssize_t len;
 
     if (!PyTuple_Check(tup)) {
-      LDAPerror_TypeError("Tuple_to_LDAPControl(): expected a tuple", tup);
-      return NULL;
+        LDAPerror_TypeError("Tuple_to_LDAPControl(): expected a tuple", tup);
+        return NULL;
     }
 
-    if (!PyArg_ParseTuple( tup, "sbO:Tuple_to_LDAPControl", &oid, &iscritical, &bytes ))
+    if (!PyArg_ParseTuple
+        (tup, "sbO:Tuple_to_LDAPControl", &oid, &iscritical, &bytes))
         return NULL;
-  
+
     lc = PyMem_NEW(LDAPControl, 1);
     if (lc == NULL) {
         PyErr_NoMemory();
@@ -110,7 +112,7 @@ Tuple_to_LDAPControl( PyObject* tup )
         LDAPControl_DEL(lc);
         return NULL;
     }
-    
+
     lc->ldctl_value = berbytes;
 
     return lc;
@@ -120,41 +122,42 @@ Tuple_to_LDAPControl( PyObject* tup )
  * function) into an array of LDAPControl objects. */
 
 int
-LDAPControls_from_object(PyObject* list, LDAPControl ***controls_ret)
+LDAPControls_from_object(PyObject *list, LDAPControl ***controls_ret)
 {
     Py_ssize_t len, i;
-    LDAPControl** ldcs;
-    LDAPControl* ldc;
-    PyObject* item;
-  
+    LDAPControl **ldcs;
+    LDAPControl *ldc;
+    PyObject *item;
+
     if (!PySequence_Check(list)) {
-        LDAPerror_TypeError("LDAPControls_from_object(): expected a list", list);
+        LDAPerror_TypeError("LDAPControls_from_object(): expected a list",
+                            list);
         return 0;
     }
 
     len = PySequence_Length(list);
-    ldcs = PyMem_NEW(LDAPControl*, len + 1);
+    ldcs = PyMem_NEW(LDAPControl *, len + 1);
     if (ldcs == NULL) {
         PyErr_NoMemory();
         return 0;
     }
 
     for (i = 0; i < len; i++) {
-      item = PySequence_GetItem(list, i);
-      if (item == NULL) {
-          PyMem_DEL(ldcs);
-          return 0;
-      }
-
-      ldc = Tuple_to_LDAPControl(item);
-      if (ldc == NULL) {
-          Py_DECREF(item);
-          PyMem_DEL(ldcs);
-          return 0;
-      }
-
-      ldcs[i] = ldc;
-      Py_DECREF(item);
+        item = PySequence_GetItem(list, i);
+        if (item == NULL) {
+            PyMem_DEL(ldcs);
+            return 0;
+        }
+
+        ldc = Tuple_to_LDAPControl(item);
+        if (ldc == NULL) {
+            Py_DECREF(item);
+            PyMem_DEL(ldcs);
+            return 0;
+        }
+
+        ldcs[i] = ldc;
+        Py_DECREF(item);
     }
 
     ldcs[len] = NULL;
@@ -162,7 +165,7 @@ LDAPControls_from_object(PyObject* list, LDAPControl ***controls_ret)
     return 1;
 }
 
-PyObject*
+PyObject *
 LDAPControls_to_List(LDAPControl **ldcs)
 {
     PyObject *res = 0, *pyctrl;
@@ -170,7 +173,8 @@ LDAPControls_to_List(LDAPControl **ldcs)
     Py_ssize_t num_ctrls = 0, i;
 
     if (tmp)
-        while (*tmp++) num_ctrls++;
+        while (*tmp++)
+            num_ctrls++;
 
     if ((res = PyList_New(num_ctrls)) == NULL) {
         return NULL;
@@ -190,59 +194,58 @@ LDAPControls_to_List(LDAPControl **ldcs)
     return res;
 }
 
-
-
 /* --------------- en-/decoders ------------- */
 
 /* Matched Values, aka, Values Return Filter */
-static PyObject*
+static PyObject *
 encode_rfc3876(PyObject *self, PyObject *args)
 {
-	PyObject *res = 0;
-	int err;
-	BerElement *vrber = 0;
-	char *vrFilter;
-	struct berval *ctrl_val;
-
-	if (!PyArg_ParseTuple(args, "s:encode_valuesreturnfilter_control", &vrFilter)) {
-		goto endlbl;
-	}
-
-	if (!(vrber = ber_alloc_t(LBER_USE_DER))) {
-		LDAPerr(LDAP_NO_MEMORY);
-		goto endlbl;
-	}
-
-	err = ldap_put_vrFilter(vrber, vrFilter);
-	if (err == -1) {
-		LDAPerr(LDAP_FILTER_ERROR);
-		goto endlbl;
-	}
-
-	err = ber_flatten(vrber, &ctrl_val);
-	if (err == -1) {
-		LDAPerr(LDAP_NO_MEMORY);
-		goto endlbl;
-	}
-
-	res = LDAPberval_to_object(ctrl_val);
-	ber_bvfree(ctrl_val);
-
-endlbl:
-	if (vrber)
-		ber_free(vrber, 1);
-
-	return res;
+    PyObject *res = 0;
+    int err;
+    BerElement *vrber = 0;
+    char *vrFilter;
+    struct berval *ctrl_val;
+
+    if (!PyArg_ParseTuple
+        (args, "s:encode_valuesreturnfilter_control", &vrFilter)) {
+        goto endlbl;
+    }
+
+    if (!(vrber = ber_alloc_t(LBER_USE_DER))) {
+        LDAPerr(LDAP_NO_MEMORY);
+        goto endlbl;
+    }
+
+    err = ldap_put_vrFilter(vrber, vrFilter);
+    if (err == -1) {
+        LDAPerr(LDAP_FILTER_ERROR);
+        goto endlbl;
+    }
+
+    err = ber_flatten(vrber, &ctrl_val);
+    if (err == -1) {
+        LDAPerr(LDAP_NO_MEMORY);
+        goto endlbl;
+    }
+
+    res = LDAPberval_to_object(ctrl_val);
+    ber_bvfree(ctrl_val);
+
+  endlbl:
+    if (vrber)
+        ber_free(vrber, 1);
+
+    return res;
 }
 
-static PyObject*
+static PyObject *
 encode_rfc2696(PyObject *self, PyObject *args)
 {
     PyObject *res = 0;
     BerElement *ber = 0;
     struct berval cookie, *ctrl_val;
     Py_ssize_t cookie_len;
-    int size = 0; /* ber_int_t is int */
+    int size = 0;               /* ber_int_t is int */
     ber_tag_t tag;
 
     if (!PyArg_ParseTuple(args, "is#:encode_page_control", &size,
@@ -285,14 +288,13 @@ encode_rfc2696(PyObject *self, PyObject *args)
     res = LDAPberval_to_object(ctrl_val);
     ber_bvfree(ctrl_val);
 
- endlbl:
+  endlbl:
     if (ber)
         ber_free(ber, 1);
     return res;
 }
 
-
-static PyObject*
+static PyObject *
 decode_rfc2696(PyObject *self, PyObject *args)
 {
     PyObject *res = 0;
@@ -300,7 +302,7 @@ decode_rfc2696(PyObject *self, PyObject *args)
     struct berval ldctl_value;
     ber_tag_t tag;
     struct berval *cookiep;
-    int count = 0;  /* ber_int_t is int */
+    int count = 0;              /* ber_int_t is int */
     Py_ssize_t ldctl_value_len;
 
     if (!PyArg_ParseTuple(args, "s#:decode_page_control",
@@ -323,13 +325,13 @@ decode_rfc2696(PyObject *self, PyObject *args)
     res = Py_BuildValue("(iO&)", count, LDAPberval_to_object, cookiep);
     ber_bvfree(cookiep);
 
- endlbl:
+  endlbl:
     if (ber)
         ber_free(ber, 1);
     return res;
 }
 
-static PyObject*
+static PyObject *
 encode_assertion_control(PyObject *self, PyObject *args)
 {
     int err;
@@ -346,41 +348,35 @@ encode_assertion_control(PyObject *self, PyObject *args)
     /* XXX: ldap_create() is a nasty and slow hack. It's creating a full blown
      * LDAP object just to encode assertion controls.
      */
-    Py_BEGIN_ALLOW_THREADS
-    err = ldap_create(&ld);
-    Py_END_ALLOW_THREADS
-
-    if (err != LDAP_SUCCESS)
-    	return LDAPerror(ld, "ldap_create");
+    Py_BEGIN_ALLOW_THREADS err = ldap_create(&ld);
+    Py_END_ALLOW_THREADS if (err != LDAP_SUCCESS)
+        return LDAPerror(ld, "ldap_create");
 
-    err = ldap_create_assertion_control_value(ld,assertion_filterstr,&ctrl_val);
+    err =
+        ldap_create_assertion_control_value(ld, assertion_filterstr,
+                                            &ctrl_val);
 
     if (err != LDAP_SUCCESS) {
         LDAPerror(ld, "ldap_create_assertion_control_value");
-        Py_BEGIN_ALLOW_THREADS
-        ldap_unbind_ext(ld, NULL, NULL);
-        Py_END_ALLOW_THREADS
-        return NULL;
+        Py_BEGIN_ALLOW_THREADS ldap_unbind_ext(ld, NULL, NULL);
+        Py_END_ALLOW_THREADS return NULL;
     }
-    Py_BEGIN_ALLOW_THREADS
-    ldap_unbind_ext(ld, NULL, NULL);
-    Py_END_ALLOW_THREADS
-
-    res = LDAPberval_to_object(&ctrl_val);
+    Py_BEGIN_ALLOW_THREADS ldap_unbind_ext(ld, NULL, NULL);
+    Py_END_ALLOW_THREADS res = LDAPberval_to_object(&ctrl_val);
     if (ctrl_val.bv_val != NULL) {
         ber_memfree(ctrl_val.bv_val);
     }
-    endlbl:
+  endlbl:
 
     return res;
 }
 
 static PyMethodDef methods[] = {
-    {"encode_page_control", encode_rfc2696, METH_VARARGS },
-    {"decode_page_control", decode_rfc2696, METH_VARARGS },
-    {"encode_valuesreturnfilter_control", encode_rfc3876, METH_VARARGS },
-    {"encode_assertion_control", encode_assertion_control, METH_VARARGS },
-    { NULL, NULL }
+    {"encode_page_control", encode_rfc2696, METH_VARARGS},
+    {"decode_page_control", decode_rfc2696, METH_VARARGS},
+    {"encode_valuesreturnfilter_control", encode_rfc3876, METH_VARARGS},
+    {"encode_assertion_control", encode_assertion_control, METH_VARARGS},
+    {NULL, NULL}
 };
 
 void
diff --git a/Modules/ldapcontrol.h b/Modules/ldapcontrol.h
index 1c09d95..de694c0 100644
--- a/Modules/ldapcontrol.h
+++ b/Modules/ldapcontrol.h
@@ -7,8 +7,8 @@
 #include "ldap.h"
 
 void LDAPinit_control(PyObject *d);
-void LDAPControl_List_DEL( LDAPControl** );
-int  LDAPControls_from_object(PyObject *, LDAPControl ***);
-PyObject* LDAPControls_to_List(LDAPControl **ldcs);
+void LDAPControl_List_DEL(LDAPControl **);
+int LDAPControls_from_object(PyObject *, LDAPControl ***);
+PyObject *LDAPControls_to_List(LDAPControl **ldcs);
 
 #endif /* __h_ldapcontrol */
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index f37c1b8..8bd55ab 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -21,56 +21,56 @@ static char author_str[] = STR(LDAPMODULE_AUTHOR);
 static char license_str[] = STR(LDAPMODULE_LICENSE);
 
 static void
-init_pkginfo( PyObject* m )
+init_pkginfo(PyObject *m)
 {
-	PyModule_AddStringConstant(m, "__version__", version_str);
-	PyModule_AddStringConstant(m, "__author__", author_str);
-	PyModule_AddStringConstant(m, "__license__", license_str);
+    PyModule_AddStringConstant(m, "__version__", version_str);
+    PyModule_AddStringConstant(m, "__author__", author_str);
+    PyModule_AddStringConstant(m, "__license__", license_str);
 }
 
 /* dummy module methods */
-static PyMethodDef methods[]  = {
-	{ NULL, NULL }
+static PyMethodDef methods[] = {
+    {NULL, NULL}
 };
 
 /* module initialisation */
 
-
 /* Common initialization code */
-PyObject* init_ldap_module(void)
+PyObject *
+init_ldap_module(void)
 {
-	PyObject *m, *d;
+    PyObject *m, *d;
 
-	/* Create the module and add the functions */
+    /* Create the module and add the functions */
 #if PY_MAJOR_VERSION >= 3
-        static struct PyModuleDef ldap_moduledef = {
-                PyModuleDef_HEAD_INIT,
-                "_ldap",              /* m_name */
-                "",                   /* m_doc */
-                -1,                   /* m_size */
-                methods,              /* m_methods */
-        };
-        m = PyModule_Create(&ldap_moduledef);
+    static struct PyModuleDef ldap_moduledef = {
+        PyModuleDef_HEAD_INIT,
+        "_ldap",        /* m_name */
+        "",             /* m_doc */
+        -1,             /* m_size */
+        methods,        /* m_methods */
+    };
+    m = PyModule_Create(&ldap_moduledef);
 #else
-	m = Py_InitModule("_ldap", methods);
+    m = Py_InitModule("_ldap", methods);
 #endif
-        /* Initialize LDAP class */
-        if (PyType_Ready(&LDAP_Type) < 0) {
-		Py_DECREF(m);
-		return NULL;
-	}
+    /* Initialize LDAP class */
+    if (PyType_Ready(&LDAP_Type) < 0) {
+        Py_DECREF(m);
+        return NULL;
+    }
 
-	/* Add some symbolic constants to the module */
-	d = PyModule_GetDict(m);
+    /* Add some symbolic constants to the module */
+    d = PyModule_GetDict(m);
 
-	init_pkginfo(m);
+    init_pkginfo(m);
 
-	if (LDAPinit_constants(m) == -1) {
-		return NULL;
-	}
+    if (LDAPinit_constants(m) == -1) {
+        return NULL;
+    }
 
-	LDAPinit_functions(d);
-	LDAPinit_control(d);
+    LDAPinit_functions(d);
+    LDAPinit_control(d);
 
     /* Marker for LDAPBytesWarning stack walking
      * See _raise_byteswarning in ldapobject.py
@@ -79,20 +79,23 @@ PyObject* init_ldap_module(void)
         return NULL;
     }
 
-	/* Check for errors */
-	if (PyErr_Occurred())
-		Py_FatalError("can't initialize module _ldap");
+    /* Check for errors */
+    if (PyErr_Occurred())
+        Py_FatalError("can't initialize module _ldap");
 
-        return m;
+    return m;
 }
 
-
 #if PY_MAJOR_VERSION < 3
-PyMODINIT_FUNC init_ldap() {
+PyMODINIT_FUNC
+init_ldap()
+{
     init_ldap_module();
 }
 #else
-PyMODINIT_FUNC PyInit__ldap() {
+PyMODINIT_FUNC
+PyInit__ldap()
+{
     return init_ldap_module();
 }
 #endif
diff --git a/Modules/message.c b/Modules/message.c
index b7f3ae7..cf3ea3b 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -21,261 +21,268 @@
  * be returned
  */
 PyObject *
-LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls, int add_intermediates)
+LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
+                      int add_intermediates)
 {
     /* we convert an LDAP message into a python structure.
      * It is always a list of dictionaries.
      * We always free m.
      */
 
-     PyObject *result, *pyctrls = 0;
-     LDAPMessage* entry;
-     LDAPControl **serverctrls = 0;
-     int rc;
+    PyObject *result, *pyctrls = 0;
+    LDAPMessage *entry;
+    LDAPControl **serverctrls = 0;
+    int rc;
 
-     result = PyList_New(0);
-     if (result == NULL) {
-        ldap_msgfree( m );
-	return NULL;
-     }
+    result = PyList_New(0);
+    if (result == NULL) {
+        ldap_msgfree(m);
+        return NULL;
+    }
 
-     for(entry = ldap_first_entry(ld,m);
-         entry != NULL;
-	 entry = ldap_next_entry(ld,entry))
-     {
-	 char *dn;
-	 char *attr;
-	 BerElement *ber = NULL;
-	 PyObject* entrytuple; 
-	 PyObject* attrdict; 
-	 PyObject* pydn;
+    for (entry = ldap_first_entry(ld, m);
+         entry != NULL; entry = ldap_next_entry(ld, entry)) {
+        char *dn;
+        char *attr;
+        BerElement *ber = NULL;
+        PyObject *entrytuple;
+        PyObject *attrdict;
+        PyObject *pydn;
 
-	 dn = ldap_get_dn( ld, entry );
-	 if (dn == NULL)  {
-	     Py_DECREF(result);
-             ldap_msgfree( m );
-	     return LDAPerror( ld, "ldap_get_dn" );
-	 }
+        dn = ldap_get_dn(ld, entry);
+        if (dn == NULL) {
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            return LDAPerror(ld, "ldap_get_dn");
+        }
 
-	 attrdict = PyDict_New();
-	 if (attrdict == NULL) {
-		Py_DECREF(result);
-		ldap_msgfree( m );
-		ldap_memfree(dn);
-		return NULL;
-	 }
+        attrdict = PyDict_New();
+        if (attrdict == NULL) {
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            ldap_memfree(dn);
+            return NULL;
+        }
 
-	 rc = ldap_get_entry_controls( ld, entry, &serverctrls );
-	 if (rc) {
-	    Py_DECREF(result);
-	    ldap_msgfree( m );
-	    ldap_memfree(dn);
-	    return LDAPerror( ld, "ldap_get_entry_controls" );
-	 }
+        rc = ldap_get_entry_controls(ld, entry, &serverctrls);
+        if (rc) {
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            ldap_memfree(dn);
+            return LDAPerror(ld, "ldap_get_entry_controls");
+        }
 
-	 /* convert serverctrls to list of tuples */
-	 if ( ! ( pyctrls = LDAPControls_to_List( serverctrls ) ) ) {
-	    int err = LDAP_NO_MEMORY;
-	    ldap_set_option( ld, LDAP_OPT_ERROR_NUMBER, &err );
-	    Py_DECREF(result);
-	    ldap_msgfree( m );
-	    ldap_memfree(dn);
-	    ldap_controls_free(serverctrls);
-	    return LDAPerror( ld, "LDAPControls_to_List" );
-	 }
-	 ldap_controls_free(serverctrls);
+        /* convert serverctrls to list of tuples */
+        if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
+            int err = LDAP_NO_MEMORY;
 
-  	 /* Fill attrdict with lists */
-	 for( attr = ldap_first_attribute( ld, entry, &ber );
-	      attr != NULL;
-	      attr = ldap_next_attribute( ld, entry, ber )
-	 ) {
-	     PyObject* valuelist;
-	     PyObject* pyattr;
-	     struct berval **bvals;
+            ldap_set_option(ld, LDAP_OPT_ERROR_NUMBER, &err);
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            ldap_memfree(dn);
+            ldap_controls_free(serverctrls);
+            return LDAPerror(ld, "LDAPControls_to_List");
+        }
+        ldap_controls_free(serverctrls);
 
-	     pyattr = PyUnicode_FromString(attr);
+        /* Fill attrdict with lists */
+        for (attr = ldap_first_attribute(ld, entry, &ber);
+             attr != NULL; attr = ldap_next_attribute(ld, entry, ber)
+            ) {
+            PyObject *valuelist;
+            PyObject *pyattr;
+            struct berval **bvals;
 
-	     bvals = ldap_get_values_len( ld, entry, attr );
+            pyattr = PyUnicode_FromString(attr);
 
-	     /* Find which list to append to */
-	     if ( PyDict_Contains( attrdict, pyattr ) ) {
-		 valuelist = PyDict_GetItem( attrdict, pyattr );
-	     } else {
-		 valuelist = PyList_New(0);
-		 if (valuelist != NULL && PyDict_SetItem(attrdict,
-		     pyattr, valuelist) == -1) {
-			Py_DECREF(valuelist);
-			valuelist = NULL;	/* catch error later */
-		 }
-	     }
+            bvals = ldap_get_values_len(ld, entry, attr);
 
-	     if (valuelist == NULL) {
-		Py_DECREF(pyattr);
-		Py_DECREF(attrdict);
-		Py_DECREF(result);
-		if (ber != NULL)
-		    ber_free(ber, 0);
-		ldap_msgfree( m );
-		ldap_memfree(attr);
-		ldap_memfree(dn);
-		Py_XDECREF(pyctrls);
-		return NULL;
-	     }
+            /* Find which list to append to */
+            if (PyDict_Contains(attrdict, pyattr)) {
+                valuelist = PyDict_GetItem(attrdict, pyattr);
+            }
+            else {
+                valuelist = PyList_New(0);
+                if (valuelist != NULL && PyDict_SetItem(attrdict,
+                                                        pyattr,
+                                                        valuelist) == -1) {
+                    Py_DECREF(valuelist);
+                    valuelist = NULL;   /* catch error later */
+                }
+            }
 
-	     if (bvals != NULL) {
-	        Py_ssize_t i;
-		for (i=0; bvals[i]; i++) {
-		    PyObject *valuestr;
+            if (valuelist == NULL) {
+                Py_DECREF(pyattr);
+                Py_DECREF(attrdict);
+                Py_DECREF(result);
+                if (ber != NULL)
+                    ber_free(ber, 0);
+                ldap_msgfree(m);
+                ldap_memfree(attr);
+                ldap_memfree(dn);
+                Py_XDECREF(pyctrls);
+                return NULL;
+            }
 
-		    valuestr = LDAPberval_to_object(bvals[i]);
-		    if (PyList_Append( valuelist, valuestr ) == -1) {
-		        Py_DECREF(pyattr);
-			Py_DECREF(attrdict);
-			Py_DECREF(result);
-			Py_DECREF(valuestr);
-			Py_DECREF(valuelist);
-			if (ber != NULL)
-			    ber_free(ber, 0);
-			ldap_msgfree( m );
-			ldap_memfree(attr);
-			ldap_memfree(dn);
-			Py_XDECREF(pyctrls);
-			return NULL;
-		    }
-		    Py_DECREF(valuestr);
-	    	}
-		ldap_value_free_len(bvals);
-	     }
-	     Py_DECREF(pyattr);
-	     Py_DECREF( valuelist );
-	     ldap_memfree(attr);
-	 }
+            if (bvals != NULL) {
+                Py_ssize_t i;
 
-	 pydn = PyUnicode_FromString(dn);
-	 if (pydn == NULL) {
-	     Py_DECREF(result);
-	     ldap_msgfree( m );
-	     ldap_memfree(dn);
-	     return NULL;
-	 }
+                for (i = 0; bvals[i]; i++) {
+                    PyObject *valuestr;
 
-	 if (add_ctrls) {
-	    entrytuple = Py_BuildValue("(OOO)", pydn, attrdict, pyctrls);
-	 } else {
-	    entrytuple = Py_BuildValue("(OO)", pydn, attrdict);
-	 }
-	 Py_DECREF(pydn);
-	 ldap_memfree(dn);
-	 Py_DECREF(attrdict);
-	 Py_XDECREF(pyctrls);
-	 PyList_Append(result, entrytuple);
-	 Py_DECREF(entrytuple);
-	 if (ber != NULL)
-		 ber_free(ber, 0);
-     }
-     for(entry = ldap_first_reference(ld,m);
-	 entry != NULL;
-	 entry = ldap_next_reference(ld,entry))
-     {
-	 char **refs = NULL;
-	 PyObject* entrytuple;
-	 PyObject* reflist = PyList_New(0);
+                    valuestr = LDAPberval_to_object(bvals[i]);
+                    if (PyList_Append(valuelist, valuestr) == -1) {
+                        Py_DECREF(pyattr);
+                        Py_DECREF(attrdict);
+                        Py_DECREF(result);
+                        Py_DECREF(valuestr);
+                        Py_DECREF(valuelist);
+                        if (ber != NULL)
+                            ber_free(ber, 0);
+                        ldap_msgfree(m);
+                        ldap_memfree(attr);
+                        ldap_memfree(dn);
+                        Py_XDECREF(pyctrls);
+                        return NULL;
+                    }
+                    Py_DECREF(valuestr);
+                }
+                ldap_value_free_len(bvals);
+            }
+            Py_DECREF(pyattr);
+            Py_DECREF(valuelist);
+            ldap_memfree(attr);
+        }
 
-	 if (reflist == NULL)  {
-	     Py_DECREF(result);
-	     ldap_msgfree( m );
-	     return NULL;
-	 }
-	 if (ldap_parse_reference(ld, entry, &refs, &serverctrls, 0) != LDAP_SUCCESS) {
-             Py_DECREF(reflist);
-	     Py_DECREF(result);
-	     ldap_msgfree( m );
-	     return LDAPerror( ld, "ldap_parse_reference" );
-	 }
-	 /* convert serverctrls to list of tuples */
-	 if ( ! ( pyctrls = LDAPControls_to_List( serverctrls ) ) ) {
-	     int err = LDAP_NO_MEMORY;
-	     ldap_set_option( ld, LDAP_OPT_ERROR_NUMBER, &err );
-             Py_DECREF(reflist);
-	     Py_DECREF(result);
-	     ldap_msgfree( m );
-	     ldap_controls_free(serverctrls);
-	     return LDAPerror( ld, "LDAPControls_to_List" );
-	 }
-	 ldap_controls_free(serverctrls);
-	 if (refs) {
-	     Py_ssize_t i;
-	     for (i=0; refs[i] != NULL; i++) {
-                 /* A referal is a distinguishedName => unicode */
-		 PyObject *refstr = PyUnicode_FromString(refs[i]);
-		 PyList_Append(reflist, refstr);
-		 Py_DECREF(refstr);
-	     }
-	     ber_memvfree( (void **) refs );
-	 }
-	 if (add_ctrls) {
-	    entrytuple = Py_BuildValue("(sOO)", NULL, reflist, pyctrls);
-	 } else {
-	    entrytuple = Py_BuildValue("(sO)", NULL, reflist);
-	 }
-	 Py_DECREF(reflist);
-	 Py_XDECREF(pyctrls);
-	 PyList_Append(result, entrytuple);
-	 Py_DECREF(entrytuple);
-     }
-     if (add_intermediates) {
-	for(entry = ldap_first_message(ld,m);
-	    entry != NULL;
-	    entry = ldap_next_message(ld,entry))
-	   {
-	      /* list of tuples */
-	      /* each tuple is OID, Berval, controllist */
-	      if ( LDAP_RES_INTERMEDIATE == ldap_msgtype( entry ) ) {
-		 PyObject* valtuple;
-		 PyObject *valuestr;
-		 char *retoid = 0;
-		 PyObject *pyoid;
-		 struct berval *retdata = 0;
+        pydn = PyUnicode_FromString(dn);
+        if (pydn == NULL) {
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            ldap_memfree(dn);
+            return NULL;
+        }
 
-		 if (ldap_parse_intermediate( ld, entry, &retoid, &retdata, &serverctrls, 0 ) != LDAP_SUCCESS) {
-		    Py_DECREF(result);
-		    ldap_msgfree( m );
-		    return LDAPerror( ld, "ldap_parse_intermediate" );
-		 }
-		 /* convert serverctrls to list of tuples */
-		 if ( ! ( pyctrls = LDAPControls_to_List( serverctrls ) ) ) {
-		    int err = LDAP_NO_MEMORY;
-		    ldap_set_option( ld, LDAP_OPT_ERROR_NUMBER, &err );
-		    Py_DECREF(result);
-		    ldap_msgfree( m );
-		    ldap_controls_free(serverctrls);
-		    ldap_memfree( retoid );
-		    ber_bvfree( retdata );
-		    return LDAPerror( ld, "LDAPControls_to_List" );
-		 }
-		 ldap_controls_free(serverctrls);
+        if (add_ctrls) {
+            entrytuple = Py_BuildValue("(OOO)", pydn, attrdict, pyctrls);
+        }
+        else {
+            entrytuple = Py_BuildValue("(OO)", pydn, attrdict);
+        }
+        Py_DECREF(pydn);
+        ldap_memfree(dn);
+        Py_DECREF(attrdict);
+        Py_XDECREF(pyctrls);
+        PyList_Append(result, entrytuple);
+        Py_DECREF(entrytuple);
+        if (ber != NULL)
+            ber_free(ber, 0);
+    }
+    for (entry = ldap_first_reference(ld, m);
+         entry != NULL; entry = ldap_next_reference(ld, entry)) {
+        char **refs = NULL;
+        PyObject *entrytuple;
+        PyObject *reflist = PyList_New(0);
 
-		 valuestr = LDAPberval_to_object(retdata);
-		 ber_bvfree( retdata );
-		 pyoid = PyUnicode_FromString(retoid);
-		 ldap_memfree( retoid );
-		 if (pyoid == NULL)  {
-			Py_DECREF(result);
-			ldap_msgfree( m );
-			return NULL;
-		 }
-		 valtuple = Py_BuildValue("(OOO)", pyoid,
-					  valuestr ? valuestr : Py_None,
-					  pyctrls);
-		 Py_DECREF(pyoid);
-		 Py_DECREF(valuestr);
-		 Py_XDECREF(pyctrls);
-		 PyList_Append(result, valtuple);
-		 Py_DECREF(valtuple);
-	      }
-	   }
-     }
-     ldap_msgfree( m );
-     return result;
+        if (reflist == NULL) {
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            return NULL;
+        }
+        if (ldap_parse_reference(ld, entry, &refs, &serverctrls, 0) !=
+            LDAP_SUCCESS) {
+            Py_DECREF(reflist);
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            return LDAPerror(ld, "ldap_parse_reference");
+        }
+        /* convert serverctrls to list of tuples */
+        if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
+            int err = LDAP_NO_MEMORY;
+
+            ldap_set_option(ld, LDAP_OPT_ERROR_NUMBER, &err);
+            Py_DECREF(reflist);
+            Py_DECREF(result);
+            ldap_msgfree(m);
+            ldap_controls_free(serverctrls);
+            return LDAPerror(ld, "LDAPControls_to_List");
+        }
+        ldap_controls_free(serverctrls);
+        if (refs) {
+            Py_ssize_t i;
+
+            for (i = 0; refs[i] != NULL; i++) {
+                /* A referal is a distinguishedName => unicode */
+                PyObject *refstr = PyUnicode_FromString(refs[i]);
+
+                PyList_Append(reflist, refstr);
+                Py_DECREF(refstr);
+            }
+            ber_memvfree((void **)refs);
+        }
+        if (add_ctrls) {
+            entrytuple = Py_BuildValue("(sOO)", NULL, reflist, pyctrls);
+        }
+        else {
+            entrytuple = Py_BuildValue("(sO)", NULL, reflist);
+        }
+        Py_DECREF(reflist);
+        Py_XDECREF(pyctrls);
+        PyList_Append(result, entrytuple);
+        Py_DECREF(entrytuple);
+    }
+    if (add_intermediates) {
+        for (entry = ldap_first_message(ld, m);
+             entry != NULL; entry = ldap_next_message(ld, entry)) {
+            /* list of tuples */
+            /* each tuple is OID, Berval, controllist */
+            if (LDAP_RES_INTERMEDIATE == ldap_msgtype(entry)) {
+                PyObject *valtuple;
+                PyObject *valuestr;
+                char *retoid = 0;
+                PyObject *pyoid;
+                struct berval *retdata = 0;
+
+                if (ldap_parse_intermediate
+                    (ld, entry, &retoid, &retdata, &serverctrls,
+                     0) != LDAP_SUCCESS) {
+                    Py_DECREF(result);
+                    ldap_msgfree(m);
+                    return LDAPerror(ld, "ldap_parse_intermediate");
+                }
+                /* convert serverctrls to list of tuples */
+                if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
+                    int err = LDAP_NO_MEMORY;
+
+                    ldap_set_option(ld, LDAP_OPT_ERROR_NUMBER, &err);
+                    Py_DECREF(result);
+                    ldap_msgfree(m);
+                    ldap_controls_free(serverctrls);
+                    ldap_memfree(retoid);
+                    ber_bvfree(retdata);
+                    return LDAPerror(ld, "LDAPControls_to_List");
+                }
+                ldap_controls_free(serverctrls);
+
+                valuestr = LDAPberval_to_object(retdata);
+                ber_bvfree(retdata);
+                pyoid = PyUnicode_FromString(retoid);
+                ldap_memfree(retoid);
+                if (pyoid == NULL) {
+                    Py_DECREF(result);
+                    ldap_msgfree(m);
+                    return NULL;
+                }
+                valtuple = Py_BuildValue("(OOO)", pyoid,
+                                         valuestr ? valuestr : Py_None,
+                                         pyctrls);
+                Py_DECREF(pyoid);
+                Py_DECREF(valuestr);
+                Py_XDECREF(pyctrls);
+                PyList_Append(result, valtuple);
+                Py_DECREF(valtuple);
+            }
+        }
+    }
+    ldap_msgfree(m);
+    return result;
 }
diff --git a/Modules/message.h b/Modules/message.h
index c3522ac..2978ea5 100644
--- a/Modules/message.h
+++ b/Modules/message.h
@@ -1,12 +1,13 @@
 /* See https://www.python-ldap.org/ for details. */
 
-#ifndef __h_message 
-#define __h_message 
+#ifndef __h_message
+#define __h_message
 
 #include "common.h"
 #include "lber.h"
 #include "ldap.h"
 
-extern PyObject* LDAPmessage_to_python( LDAP*ld, LDAPMessage*m, int add_ctrls, int add_intermediates );
+extern PyObject *LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
+                                       int add_intermediates);
 
 #endif /* __h_message_ */
diff --git a/Modules/options.c b/Modules/options.c
index ee606d4..85560e6 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -7,9 +7,10 @@
 #include "options.h"
 
 void
-set_timeval_from_double( struct timeval *tv, double d ) {
-	tv->tv_usec = (long) ( fmod(d, 1.0) * 1000000.0 );
-	tv->tv_sec = (long) floor(d);
+set_timeval_from_double(struct timeval *tv, double d)
+{
+    tv->tv_usec = (long)(fmod(d, 1.0) * 1000000.0);
+    tv->tv_sec = (long)floor(d);
 }
 
 /**
@@ -23,7 +24,7 @@ option_error(int res, const char *fn)
         PyErr_SetString(PyExc_ValueError, "option error");
     else if (res == LDAP_PARAM_ERROR)
         PyErr_SetString(PyExc_ValueError, "parameter error");
-    else if (res == LDAP_NO_MEMORY) 
+    else if (res == LDAP_NO_MEMORY)
         PyErr_NoMemory();
     else
         PyErr_Format(PyExc_SystemError, "error %d from %s", res, fn);
@@ -48,15 +49,15 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 
     ld = self ? self->ldap : NULL;
 
-    switch(option) {
+    switch (option) {
     case LDAP_OPT_API_INFO:
     case LDAP_OPT_API_FEATURE_INFO:
 #ifdef HAVE_SASL
     case LDAP_OPT_X_SASL_SSF:
 #endif
-	    /* Read-only options */
-	    PyErr_SetString(PyExc_ValueError, "read-only option");
-	    return 0;
+        /* Read-only options */
+        PyErr_SetString(PyExc_ValueError, "read-only option");
+        return 0;
     case LDAP_OPT_REFERRALS:
     case LDAP_OPT_RESTART:
 #ifdef LDAP_OPT_X_SASL_NOCANON
@@ -65,9 +66,9 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 #ifdef LDAP_OPT_CONNECT_ASYNC
     case LDAP_OPT_CONNECT_ASYNC:
 #endif
-	    /* Truth-value options */
-	    ptr = PyObject_IsTrue(value) ? LDAP_OPT_ON : LDAP_OPT_OFF;
-	    break;
+        /* Truth-value options */
+        ptr = PyObject_IsTrue(value) ? LDAP_OPT_ON : LDAP_OPT_OFF;
+        break;
 
     case LDAP_OPT_DEREF:
     case LDAP_OPT_SIZELIMIT:
@@ -102,11 +103,11 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
     case LDAP_OPT_X_KEEPALIVE_INTERVAL:
 #endif
 
-	    /* integer value options */
-	    if (!PyArg_Parse(value, "i:set_option", &intval))
-		return 0;
-	    ptr = &intval;
-	    break;
+        /* integer value options */
+        if (!PyArg_Parse(value, "i:set_option", &intval))
+            return 0;
+        ptr = &intval;
+        break;
     case LDAP_OPT_HOST_NAME:
     case LDAP_OPT_URI:
 #ifdef LDAP_OPT_DEFBASE
@@ -129,69 +130,71 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
 #ifdef HAVE_SASL
     case LDAP_OPT_X_SASL_SECPROPS:
 #endif
-	    /* String valued options */
-	    if (!PyArg_Parse(value, "s:set_option", &strval))
-		return 0;
-	    ptr = strval;
-	    break;
+        /* String valued options */
+        if (!PyArg_Parse(value, "s:set_option", &strval))
+            return 0;
+        ptr = strval;
+        break;
     case LDAP_OPT_TIMEOUT:
     case LDAP_OPT_NETWORK_TIMEOUT:
         /* Float valued timeval options */
         if (value == Py_None) {
             /* None is mapped to infinity timeout */
             doubleval = -1;
-        } else {
+        }
+        else {
             /* 'd' handles int/long */
             if (!PyArg_Parse(value, "d:set_option", &doubleval)) {
                 if (PyErr_ExceptionMatches(PyExc_TypeError)) {
                     /* TypeError: mention either float or None is expected */
                     PyErr_Clear();
-                    PyErr_Format(
-                        PyExc_TypeError,
-                        "A float or None is expected for timeout, got %.100s",
-                        Py_TYPE(value)->tp_name
-                    );
+                    PyErr_Format(PyExc_TypeError,
+                                 "A float or None is expected for timeout, got %.100s",
+                                 Py_TYPE(value)->tp_name);
                 }
                 return 0;
             }
         }
 
         if (doubleval >= 0) {
-            set_timeval_from_double( &tv, doubleval );
+            set_timeval_from_double(&tv, doubleval);
             ptr = &tv;
-        } else if (doubleval == -1) {
+        }
+        else if (doubleval == -1) {
             /* -1 is infinity timeout */
             tv.tv_sec = -1;
             tv.tv_usec = 0;
             ptr = &tv;
-        } else {
-            PyErr_Format(
-                PyExc_ValueError,
-                "timeout must be >= 0 or -1/None for infinity, got %d",
-                option
-            );
+        }
+        else {
+            PyErr_Format(PyExc_ValueError,
+                         "timeout must be >= 0 or -1/None for infinity, got %d",
+                         option);
             return 0;
         }
         break;
 
     case LDAP_OPT_SERVER_CONTROLS:
     case LDAP_OPT_CLIENT_CONTROLS:
-            if (!LDAPControls_from_object(value, &controls))
-                return 0;
-            ptr = controls;
-            break;
+        if (!LDAPControls_from_object(value, &controls))
+            return 0;
+        ptr = controls;
+        break;
     default:
-	    PyErr_Format(PyExc_ValueError, "unknown option %d", option);
-	    return 0;
+        PyErr_Format(PyExc_ValueError, "unknown option %d", option);
+        return 0;
     }
-	
-    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
+
+    if (self)
+        LDAP_BEGIN_ALLOW_THREADS(self);
     res = ldap_set_option(ld, option, ptr);
-    if (self) LDAP_END_ALLOW_THREADS(self);
+    if (self)
+        LDAP_END_ALLOW_THREADS(self);
 
-    if ((option == LDAP_OPT_SERVER_CONTROLS) || (option == LDAP_OPT_CLIENT_CONTROLS))
+    if ((option == LDAP_OPT_SERVER_CONTROLS) ||
+        (option == LDAP_OPT_CLIENT_CONTROLS))
         LDAPControl_List_DEL(controls);
-    
+
     if (res != LDAP_OPT_SUCCESS) {
         option_error(res, "ldap_set_option");
         return 0;
@@ -215,41 +218,44 @@ LDAP_get_option(LDAPObject *self, int option)
 
     ld = self ? self->ldap : NULL;
 
-    switch(option) {
+    switch (option) {
     case LDAP_OPT_API_INFO:
-	    apiinfo.ldapai_info_version = LDAP_API_INFO_VERSION;
-	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
-	    res = ldap_get_option( ld, option, &apiinfo );
-	    if (self) LDAP_END_ALLOW_THREADS(self);
-	    if (res != LDAP_OPT_SUCCESS)
-		return option_error(res, "ldap_get_option");
-    
-	    /* put the extensions into tuple form */
-	    num_extensions = 0;
-	    while (apiinfo.ldapai_extensions[num_extensions])
-		num_extensions++;
-	    extensions = PyTuple_New(num_extensions);
-	    for (i = 0; i < num_extensions; i++)
-		PyTuple_SET_ITEM(extensions, i,
-		    PyUnicode_FromString(apiinfo.ldapai_extensions[i]));
+        apiinfo.ldapai_info_version = LDAP_API_INFO_VERSION;
+        if (self)
+            LDAP_BEGIN_ALLOW_THREADS(self);
+        res = ldap_get_option(ld, option, &apiinfo);
+        if (self)
+            LDAP_END_ALLOW_THREADS(self);
+        if (res != LDAP_OPT_SUCCESS)
+            return option_error(res, "ldap_get_option");
+
+        /* put the extensions into tuple form */
+        num_extensions = 0;
+        while (apiinfo.ldapai_extensions[num_extensions])
+            num_extensions++;
+        extensions = PyTuple_New(num_extensions);
+        for (i = 0; i < num_extensions; i++)
+            PyTuple_SET_ITEM(extensions, i,
+                             PyUnicode_FromString(apiinfo.
+                                                  ldapai_extensions[i]));
 
-	    /* return api info as a dictionary */
-	    v = Py_BuildValue("{s:i, s:i, s:i, s:s, s:i, s:O}",
-		    "info_version",     apiinfo.ldapai_info_version,
-		    "api_version",      apiinfo.ldapai_api_version,
-		    "protocol_version", apiinfo.ldapai_protocol_version,
-		    "vendor_name",      apiinfo.ldapai_vendor_name,
-		    "vendor_version",   apiinfo.ldapai_vendor_version,
-		    "extensions",       extensions);
+        /* return api info as a dictionary */
+        v = Py_BuildValue("{s:i, s:i, s:i, s:s, s:i, s:O}",
+                          "info_version", apiinfo.ldapai_info_version,
+                          "api_version", apiinfo.ldapai_api_version,
+                          "protocol_version", apiinfo.ldapai_protocol_version,
+                          "vendor_name", apiinfo.ldapai_vendor_name,
+                          "vendor_version", apiinfo.ldapai_vendor_version,
+                          "extensions", extensions);
 
-	    if (apiinfo.ldapai_vendor_name)
-		ldap_memfree(apiinfo.ldapai_vendor_name);
-	    for (i = 0; i < num_extensions; i++)
-		ldap_memfree(apiinfo.ldapai_extensions[i]);
-	    ldap_memfree(apiinfo.ldapai_extensions);
-	    Py_DECREF(extensions);
+        if (apiinfo.ldapai_vendor_name)
+            ldap_memfree(apiinfo.ldapai_vendor_name);
+        for (i = 0; i < num_extensions; i++)
+            ldap_memfree(apiinfo.ldapai_extensions[i]);
+        ldap_memfree(apiinfo.ldapai_extensions);
+        Py_DECREF(extensions);
 
-	    return v;
+        return v;
 
 #ifdef HAVE_SASL
     case LDAP_OPT_X_SASL_SSF:
@@ -292,13 +298,15 @@ LDAP_get_option(LDAPObject *self, int option)
 #ifdef LDAP_OPT_X_KEEPALIVE_INTERVAL
     case LDAP_OPT_X_KEEPALIVE_INTERVAL:
 #endif
-	    /* Integer-valued options */
-	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
-	    res = ldap_get_option(ld, option, &intval);
-	    if (self) LDAP_END_ALLOW_THREADS(self);
-	    if (res != LDAP_OPT_SUCCESS)
-		return option_error(res, "ldap_get_option");
-	    return PyInt_FromLong(intval);
+        /* Integer-valued options */
+        if (self)
+            LDAP_BEGIN_ALLOW_THREADS(self);
+        res = ldap_get_option(ld, option, &intval);
+        if (self)
+            LDAP_END_ALLOW_THREADS(self);
+        if (res != LDAP_OPT_SUCCESS)
+            return option_error(res, "ldap_get_option");
+        return PyInt_FromLong(intval);
 
     case LDAP_OPT_HOST_NAME:
     case LDAP_OPT_URI:
@@ -338,53 +346,59 @@ LDAP_get_option(LDAPObject *self, int option)
     case LDAP_OPT_X_SASL_USERNAME:
 #endif
 #endif
-	    /* String-valued options */
-	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
-	    res = ldap_get_option(ld, option, &strval);
-	    if (self) LDAP_END_ALLOW_THREADS(self);
-	    if (res != LDAP_OPT_SUCCESS)
-		return option_error(res, "ldap_get_option");
-	    if (strval == NULL) {
-		Py_INCREF(Py_None);
-		return Py_None;
-	    }
-	    v = PyUnicode_FromString(strval);
-	    ldap_memfree(strval);
-	    return v;
+        /* String-valued options */
+        if (self)
+            LDAP_BEGIN_ALLOW_THREADS(self);
+        res = ldap_get_option(ld, option, &strval);
+        if (self)
+            LDAP_END_ALLOW_THREADS(self);
+        if (res != LDAP_OPT_SUCCESS)
+            return option_error(res, "ldap_get_option");
+        if (strval == NULL) {
+            Py_INCREF(Py_None);
+            return Py_None;
+        }
+        v = PyUnicode_FromString(strval);
+        ldap_memfree(strval);
+        return v;
 
     case LDAP_OPT_TIMEOUT:
     case LDAP_OPT_NETWORK_TIMEOUT:
-	    /* Double-valued timeval options */
-	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
-	    res = ldap_get_option(ld, option, &tv);
-	    if (self) LDAP_END_ALLOW_THREADS(self);
-	    if (res != LDAP_OPT_SUCCESS)
-		return option_error(res, "ldap_get_option");
-	    if (tv == NULL) {
-		Py_INCREF(Py_None);
-		return Py_None;
-	    }
-	    v = PyFloat_FromDouble(
-              (double) tv->tv_sec + ( (double) tv->tv_usec / 1000000.0 )
+        /* Double-valued timeval options */
+        if (self)
+            LDAP_BEGIN_ALLOW_THREADS(self);
+        res = ldap_get_option(ld, option, &tv);
+        if (self)
+            LDAP_END_ALLOW_THREADS(self);
+        if (res != LDAP_OPT_SUCCESS)
+            return option_error(res, "ldap_get_option");
+        if (tv == NULL) {
+            Py_INCREF(Py_None);
+            return Py_None;
+        }
+        v = PyFloat_FromDouble((double)tv->tv_sec +
+                               ((double)tv->tv_usec / 1000000.0)
             );
-	    ldap_memfree(tv);
-	    return v;
+        ldap_memfree(tv);
+        return v;
 
     case LDAP_OPT_SERVER_CONTROLS:
     case LDAP_OPT_CLIENT_CONTROLS:
-	    if (self) LDAP_BEGIN_ALLOW_THREADS(self);
-	    res = ldap_get_option(ld, option, &lcs);
-	    if (self) LDAP_END_ALLOW_THREADS(self);
+        if (self)
+            LDAP_BEGIN_ALLOW_THREADS(self);
+        res = ldap_get_option(ld, option, &lcs);
+        if (self)
+            LDAP_END_ALLOW_THREADS(self);
+
+        if (res != LDAP_OPT_SUCCESS)
+            return option_error(res, "ldap_get_option");
 
-	    if (res != LDAP_OPT_SUCCESS)
-		return option_error(res, "ldap_get_option");
+        v = LDAPControls_to_List(lcs);
+        ldap_controls_free(lcs);
+        return v;
 
-            v = LDAPControls_to_List(lcs);
-            ldap_controls_free(lcs);
-            return v;
-            
     default:
-	    PyErr_Format(PyExc_ValueError, "unknown option %d", option);
-	    return NULL;
+        PyErr_Format(PyExc_ValueError, "unknown option %d", option);
+        return NULL;
     }
 }
diff --git a/Modules/options.h b/Modules/options.h
index 570fdc1..fd6a5ce 100644
--- a/Modules/options.h
+++ b/Modules/options.h
@@ -4,4 +4,4 @@ int LDAP_optionval_by_name(const char *name);
 int LDAP_set_option(LDAPObject *self, int option, PyObject *value);
 PyObject *LDAP_get_option(LDAPObject *self, int option);
 
-void set_timeval_from_double( struct timeval *tv, double d );
+void set_timeval_from_double(struct timeval *tv, double d);

From 60b761b5b2ac4da380f89a3357a1628acb3b8471 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 14 Mar 2018 07:12:42 -0700
Subject: [PATCH 744/868] Remove long deprecated functions ldap.open() and
 ldap.init()

The functions have been deprecated since at least 2011. That has been
lots of time for library users to see the warning and update calling code.

https://github.com/python-ldap/python-ldap/pull/124
---
 Doc/reference/ldap.rst | 26 ++++----------------------
 Lib/ldap/__init__.py   |  2 +-
 Lib/ldap/functions.py  | 30 ------------------------------
 3 files changed, 5 insertions(+), 53 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 5d15158..6203a2d 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -67,28 +67,6 @@ This module defines the following functions:
 
       :rfc:`4516` - Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator
 
-.. py:function:: open(host [, port=PORT]) -> LDAPObject object
-
-   Opens a new connection with an LDAP server, and return an LDAP object  (see
-   :ref:`ldap-objects`) used to perform operations on that server.  *host* is a
-   string containing solely the host name. *port* is an integer specifying the
-   port where the LDAP server is  listening (default is 389).
-
-   .. deprecated:: 3.0
-
-      ``ldap.open()`` is deprecated. It will be removed in version 3.1. Use
-      :func:`ldap.initialize()` with a URI like ``'ldap://<hostname>:<port>'``
-      instead.
-
-.. py:function:: init(host [, port=PORT]) -> LDAPObject object
-
-   Alias of :func:`ldap.open()`.
-
-   .. deprecated:: 3.0
-
-      ``ldap.init()`` is deprecated. It will be removed in version 3.1. Use
-      :func:`ldap.initialize()` with a URI like ``'ldap://<hostname>:<port>'``
-      instead.
 
 .. py:function:: get_option(option) -> int|string
 
@@ -100,6 +78,10 @@ This module defines the following functions:
    This function sets the value of the global option specified by *option* to
    *invalue*.
 
+.. versionchanged:: 3.1
+
+   The deprecated functions ``ldap.init()`` and ``ldap.open()`` were removed.
+
 
 .. _ldap-constants:
 
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 72e1e4b..068f9e6 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -91,7 +91,7 @@ def release(self):
 # Create module-wide lock for serializing all calls into underlying LDAP lib
 _ldap_module_lock = LDAPLock(desc='Module wide')
 
-from ldap.functions import open,initialize,init,get_option,set_option,escape_str,strf_secs,strp_secs
+from ldap.functions import initialize,get_option,set_option,escape_str,strf_secs,strp_secs
 
 from ldap.ldapobject import NO_UNIQUE_ENTRY, LDAPBytesWarning
 
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 6c351ef..ae83d08 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -85,36 +85,6 @@ def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None, b
   return LDAPObject(uri,trace_level,trace_file,trace_stack_limit,bytes_mode)
 
 
-def open(host,port=389,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None,bytes_mode=None):
-  """
-  Return LDAPObject instance by opening LDAP connection to
-  specified LDAP host
-
-  Parameters:
-  host
-        LDAP host and port, e.g. localhost
-  port
-        integer specifying the port number to use, e.g. 389
-  trace_level
-        If non-zero a trace output of LDAP calls is generated.
-  trace_file
-        File object where to write the trace output to.
-        Default is to use stdout.
-  bytes_mode
-        Whether to enable "bytes_mode" for backwards compatibility under Py2.
-  """
-  import warnings
-  warnings.warn(
-    'ldap.open() is deprecated. Use ldap.initialize() instead. It will be '
-    'removed in python-ldap 3.1.',
-    category=DeprecationWarning,
-    stacklevel=2,
-  )
-  return initialize('ldap://%s:%d' % (host,port),trace_level,trace_file,trace_stack_limit,bytes_mode)
-
-init = open
-
-
 def get_option(option):
   """
   get_option(name) -> value

From 28528ea20114b44b1bab6f01041d985c0873ee78 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 14 Mar 2018 12:32:24 +0100
Subject: [PATCH 745/868] cidict: Make iteration over cidict yield same values
 as keys()

---
 Lib/ldap/cidict.py | 3 +++
 Tests/t_cidict.py  | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index f7e8d39..3ba2feb 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -44,6 +44,9 @@ def has_key(self,key):
   def __contains__(self,key):
     return IterableUserDict.__contains__(self, key.lower())
 
+  def __iter__(self):
+    return iter(self.keys())
+
   def keys(self):
     return self._keys.values()
 
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index 8e5d8d6..f8b993f 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -36,6 +36,8 @@ def test_cidict(self):
         self.assertEqual(cix.get("xyz", None), 987)
         cix_keys = sorted(cix.keys())
         self.assertEqual(cix_keys, ['AbCDeF','xYZ'])
+        cix_keys = sorted(cix)
+        self.assertEqual(cix_keys, ['AbCDeF','xYZ'])
         cix_items = sorted(cix.items())
         self.assertEqual(cix_items, [('AbCDeF',123), ('xYZ',987)])
         del cix["abcdEF"]

From 4ea6e31b361eacf5afc7c831211e5d908c340e1b Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 11:18:23 +0100
Subject: [PATCH 746/868] Lib: Use items() when appropriate in dict iteration

When both key and value are needed,

    for key, value in dictionary.items():
        ...

is used instead of:

    for key in dictionary.keys():
        value = dictionary[key]
        ...

Thanks to Jon Dufresne for finding keys() usages.
---
 Lib/ldap/cidict.py          |  4 ++--
 Lib/ldap/modlist.py         | 14 +++++++-------
 Lib/ldap/schema/models.py   |  4 ++--
 Lib/ldap/schema/subentry.py |  7 +++----
 Lib/ldapurl.py              |  4 ++--
 Lib/ldif.py                 |  4 ++--
 6 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 3ba2feb..4f7e091 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -35,8 +35,8 @@ def __delitem__(self,key):
     del self.data[lower_key]
 
   def update(self,dict):
-    for key in dict.keys():
-      self[key] = dict[key]
+    for key, value in dict.items():
+      self[key] = value
 
   def has_key(self,key):
     return key in self
diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 6f51312..4acf4e9 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -13,14 +13,14 @@ def addModlist(entry,ignore_attr_types=None):
   """Build modify list for call of method LDAPObject.add()"""
   ignore_attr_types = {v.lower() for v in ignore_attr_types or []}
   modlist = []
-  for attrtype in entry.keys():
+  for attrtype, value in entry.items():
     if attrtype.lower() in ignore_attr_types:
       # This attribute type is ignored
       continue
     # Eliminate empty attr value strings in list
-    attrvaluelist = [item for item in entry[attrtype] if item is not None]
+    attrvaluelist = [item for item in value if item is not None]
     if attrvaluelist:
-      modlist.append((attrtype,entry[attrtype]))
+      modlist.append((attrtype, value))
   return modlist # addModlist()
 
 
@@ -52,13 +52,13 @@ def modifyModlist(
   attrtype_lower_map = {}
   for a in old_entry.keys():
     attrtype_lower_map[a.lower()]=a
-  for attrtype in new_entry.keys():
+  for attrtype, value in new_entry.items():
     attrtype_lower = attrtype.lower()
     if attrtype_lower in ignore_attr_types:
       # This attribute type is ignored
       continue
     # Filter away null-strings
-    new_value = [item for item in new_entry[attrtype] if item is not None]
+    new_value = [item for item in value if item is not None]
     if attrtype_lower in attrtype_lower_map:
       old_value = old_entry.get(attrtype_lower_map[attrtype_lower],[])
       old_value = [item for item in old_value if item is not None]
@@ -88,10 +88,10 @@ def modifyModlist(
   if not ignore_oldexistent:
     # Remove all attributes of old_entry which are not present
     # in new_entry at all
-    for a in attrtype_lower_map.keys():
+    for a, val in attrtype_lower_map.items():
       if a in ignore_attr_types:
         # This attribute type is ignored
         continue
-      attrtype = attrtype_lower_map[a]
+      attrtype = val
       modlist.append((ldap.MOD_DELETE,attrtype,None))
   return modlist # modifyModlist()
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 9a8cb5b..feb7bff 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -655,8 +655,8 @@ def _at2key(self,nameoroid):
       return t
 
   def update(self,dict):
-    for key in dict.keys():
-      self[key] = dict[key]
+    for key, value in dict.values():
+      self[key] = value
 
   def __contains__(self,nameoroid):
     return self._at2key(nameoroid) in self.data
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 6091a75..aa094cb 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -136,8 +136,8 @@ def ldap_entry(self):
     entry = {}
     # Collect the schema elements and store them in
     # entry's attributes
-    for se_class in self.sed.keys():
-      for se in self.sed[se_class].values():
+    for se_class, elements in self.sed.items():
+      for se in elements.values():
         se_str = str(se)
         try:
           entry[SCHEMA_ATTR_MAPPING[se_class]].append(se_str)
@@ -153,8 +153,7 @@ def listall(self,schema_element_class,schema_element_filters=None):
     avail_se = self.sed[schema_element_class]
     if schema_element_filters:
       result = []
-      for se_key in avail_se.keys():
-        se = avail_se[se_key]
+      for se_key, se in avail_se.items():
         for fk,fv in schema_element_filters:
           try:
             if getattr(se,fk) in fv:
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index b3e1171..5159d89 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -313,9 +313,9 @@ def applyDefaults(self,defaults):
         Dictionary containing a mapping from class attributes
         to default values
     """
-    for k in defaults.keys():
+    for k, value in defaults.items():
       if getattr(self,k) is None:
-        setattr(self,k,defaults[k])
+        setattr(self, k, value)
 
   def initializeUrl(self):
     """
diff --git a/Lib/ldif.py b/Lib/ldif.py
index cdcccc0..3fbb2b1 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -150,8 +150,8 @@ def _unparseEntryRecord(self,entry):
     entry
         dictionary holding an entry
     """
-    for attr_type in sorted(entry.keys()):
-      for attr_value in entry[attr_type]:
+    for attr_type, values in sorted(entry.items()):
+      for attr_value in values:
         self._unparseAttrTypeandValue(attr_type,attr_value)
 
   def _unparseChangeRecord(self,modlist):

From 6ae0e0afc41a14ecbd79c34dabf5beb5e57822a0 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 14 Mar 2018 16:58:14 -0700
Subject: [PATCH 747/868] Trim white space throughout the project

Many editors clean up trailing white space on save. By removing it all
in one go, it helps keep future diffs cleaner by avoiding spurious white
space changes on unrelated lines.
---
 .gitignore                      |  1 -
 Build/build-openbsd/Makefile    |  2 +-
 Build/build-openbsd/pkg/DESCR   |  2 +-
 Build/setup.cfg.mingw           |  4 ++--
 Build/setup.cfg.suse-linux      |  2 +-
 Demo/Lib/ldap/async/deltree.py  |  2 +-
 Demo/Lib/ldif/ldifcopy.py       |  1 -
 Demo/matchedvalues.py           |  1 -
 Demo/options.py                 |  4 ----
 Demo/pyasn1/sessiontrack.py     |  1 -
 Demo/pyasn1/syncrepl.py         |  4 ++--
 Demo/schema.py                  |  2 +-
 Demo/schema_tree.py             |  1 -
 Demo/simple.py                  |  5 ++---
 Demo/simplebrowse.py            |  5 ++---
 Doc/installing.rst              |  1 -
 Doc/reference/ldap-async.rst    |  1 -
 Doc/reference/ldap-dn.rst       |  1 -
 Doc/reference/ldap-extop.rst    |  1 -
 Doc/reference/ldap-filter.rst   |  1 -
 Doc/reference/ldap-sasl.rst     |  3 +--
 Doc/reference/ldap-syncrepl.rst |  1 -
 Doc/reference/ldap.rst          |  5 ++---
 Doc/reference/ldapurl.rst       |  1 -
 Doc/reference/ldif.rst          |  1 -
 Doc/sample_workflow.rst         |  1 -
 Lib/ldap/constants.py           |  2 +-
 Lib/ldap/controls/deref.py      |  2 +-
 Lib/ldapurl.py                  |  1 -
 Modules/LDAPObject.c            | 20 ++++++++++----------
 Tests/t_ldap_asyncsearch.py     |  1 -
 Tests/t_ldap_sasl.py            |  1 -
 Tests/t_ldif.py                 |  4 ++--
 setup.cfg                       |  4 ++--
 setup.py                        |  2 +-
 tox.ini                         |  2 +-
 36 files changed, 34 insertions(+), 59 deletions(-)

diff --git a/.gitignore b/.gitignore
index 962248f..0034b3a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-
 # Auto-generated
 .*.swp
 *.pyc
diff --git a/Build/build-openbsd/Makefile b/Build/build-openbsd/Makefile
index ce91faf..40ad81c 100644
--- a/Build/build-openbsd/Makefile
+++ b/Build/build-openbsd/Makefile
@@ -10,7 +10,7 @@ HOMEPAGE=		https://www.python-ldap.org/
 FAKE=			Yes
 CONFIGURE_STYLE=	gnu
 SEPARATE_BUILD=		Yes
-EXTRACT_ONLY=	
+EXTRACT_ONLY=
 
 CONFIGURE_ARGS+=	--with-ldap=${LOCALBASE}
 
diff --git a/Build/build-openbsd/pkg/DESCR b/Build/build-openbsd/pkg/DESCR
index d3cf0cc..9e58e62 100644
--- a/Build/build-openbsd/pkg/DESCR
+++ b/Build/build-openbsd/pkg/DESCR
@@ -1,2 +1,2 @@
-This Python library provides access to the LDAP (Lightweight Directory Access 
+This Python library provides access to the LDAP (Lightweight Directory Access
 Protocol) RFC1823 C interface.
diff --git a/Build/setup.cfg.mingw b/Build/setup.cfg.mingw
index 16ab57f..ffbd0d8 100644
--- a/Build/setup.cfg.mingw
+++ b/Build/setup.cfg.mingw
@@ -15,8 +15,8 @@ defines = WIN32
 library_dirs = C:/msys/1.0/home/mcicogni/openldap-mingw-build-4/openldap-2.2.18/libraries/libldap_r/.libs C:/msys/1.0/home/mcicogni/openldap-mingw-build-4/openldap-2.2.18/libraries/liblber/.libs C:\msys\1.0\home\mcicogni\openldap-mingw-build-4\openssl-0.9.7e
 include_dirs = C:/msys/1.0/home/mcicogni/openldap-mingw-build-4/openldap-2.2.18/include
 
-extra_compile_args = 
-extra_objects = 
+extra_compile_args =
+extra_objects =
 
 libs = ldap_r lber ssl crypto ws2_32 gdi32
 
diff --git a/Build/setup.cfg.suse-linux b/Build/setup.cfg.suse-linux
index 3ea064d..0a48ef2 100644
--- a/Build/setup.cfg.suse-linux
+++ b/Build/setup.cfg.suse-linux
@@ -8,7 +8,7 @@
 library_dirs = /usr/lib/sasl2
 include_dirs = /usr/include/sasl
 
-extra_compile_args = 
+extra_compile_args =
 extra_objects =
 
 # Example for full-featured SuSE build:
diff --git a/Demo/Lib/ldap/async/deltree.py b/Demo/Lib/ldap/async/deltree.py
index 68d3643..d3fc620 100644
--- a/Demo/Lib/ldap/async/deltree.py
+++ b/Demo/Lib/ldap/async/deltree.py
@@ -5,7 +5,7 @@
 class DeleteLeafs(ldap.async.AsyncSearchHandler):
   """
   Class for deleting entries which are results of a search.
-  
+
   DNs of Non-leaf entries are collected in DeleteLeafs.nonLeafEntries.
   """
   _entryResultTypes = ldap.async._entryResultTypes
diff --git a/Demo/Lib/ldif/ldifcopy.py b/Demo/Lib/ldif/ldifcopy.py
index 62cb391..3bbe3f3 100644
--- a/Demo/Lib/ldif/ldifcopy.py
+++ b/Demo/Lib/ldif/ldifcopy.py
@@ -20,4 +20,3 @@
   process_url_schemes=['file','ftp','http']
 )
 ldif_collector.parse()
-
diff --git a/Demo/matchedvalues.py b/Demo/matchedvalues.py
index 59c594f..7a6e7b6 100644
--- a/Demo/matchedvalues.py
+++ b/Demo/matchedvalues.py
@@ -61,4 +61,3 @@ def print_result(search_result):
 res = ld.search_ext_s(base, scope, filter, attrlist = ['mail'], serverctrls = [mv])
 print("Matched values control: %s" % control_filter)
 print_result(res)
-
diff --git a/Demo/options.py b/Demo/options.py
index 8b4e215..28a0437 100644
--- a/Demo/options.py
+++ b/Demo/options.py
@@ -24,7 +24,3 @@
 #print("time limit:",l.get_option(ldap.OPT_TIMELIMIT))
 print("Binding...")
 l.simple_bind_s("","")
-
-
-
-
diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
index 33dddda..58a34e8 100644
--- a/Demo/pyasn1/sessiontrack.py
+++ b/Demo/pyasn1/sessiontrack.py
@@ -58,4 +58,3 @@
   ldap_url.attrs or ['*'],
   serverctrls=[st_ctrl]
 )
-
diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 61d63ad..7103bc6 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -93,8 +93,8 @@ def syncrepl_present(self,uuids,refreshDeletes=False):
         # If we have not been given any UUID values,
         # then we have recieved all the present controls...
         if uuids is None:
-            # We only do things if refreshDeletes is false as the syncrepl 
-            # extension will call syncrepl_delete instead when it detects a 
+            # We only do things if refreshDeletes is false as the syncrepl
+            # extension will call syncrepl_delete instead when it detects a
             # delete notice
             if refreshDeletes is False:
                 deletedEntries = [
diff --git a/Demo/schema.py b/Demo/schema.py
index 4d350f0..03f90a8 100644
--- a/Demo/schema.py
+++ b/Demo/schema.py
@@ -47,7 +47,7 @@
     attr_type_filter = [
       ('no_user_mod',[0]),
       ('usage',range(2)),
-    ]  
+    ]
   )
 except KeyError as e:
   print('***KeyError',str(e))
diff --git a/Demo/schema_tree.py b/Demo/schema_tree.py
index 79c8a83..648bb86 100644
--- a/Demo/schema_tree.py
+++ b/Demo/schema_tree.py
@@ -98,4 +98,3 @@ def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
 
   print('\n*** Attribute types tree ***\n')
   PrintSchemaTree(schema,ldap.schema.AttributeType,at_tree,'_',0)
-
diff --git a/Demo/simple.py b/Demo/simple.py
index 6004c9e..5fa0425 100644
--- a/Demo/simple.py
+++ b/Demo/simple.py
@@ -97,11 +97,10 @@
 #
 
 res = l.search_s(
-	"ou=CSEE, o=UQ, c=AU", 
-	_ldap.SCOPE_SUBTREE, 
+	"ou=CSEE, o=UQ, c=AU",
+	_ldap.SCOPE_SUBTREE,
 	"objectclass=*",
       )
 print(res)
 
 l.unbind()
-
diff --git a/Demo/simplebrowse.py b/Demo/simplebrowse.py
index d13c368..9d13800 100644
--- a/Demo/simplebrowse.py
+++ b/Demo/simplebrowse.py
@@ -50,7 +50,7 @@
 		# We're not interested in attributes at this stage, so
 		# we specify [] as the list of attribute names to retreive.
 		#
-		for name,attrs in l.search_s(dn, ldap.SCOPE_ONELEVEL, 
+		for name,attrs in l.search_s(dn, ldap.SCOPE_ONELEVEL,
 		    "objectclass=*", []):
 			#-- shorten resulting dns for output brevity
 			if name.startswith(dn+", "):
@@ -100,7 +100,7 @@
 			print("  %-24s" % name)
 			for k,vals in attrs.items():
 			    for v in vals:
-				if len(v) > 200: 
+				if len(v) > 200:
 					v = `v[:200]` + \
 						("... (%d bytes)" % len(v))
 				else:
@@ -125,4 +125,3 @@
 
     except:
 	print_exc()
-
diff --git a/Doc/installing.rst b/Doc/installing.rst
index 6df062f..dc4f5b9 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -246,4 +246,3 @@ Debugging symbols are preserved with compile option ``-g``.
   extra_objects =
 
   libs = ldap_r lber sasl2 ssl crypto
-
diff --git a/Doc/reference/ldap-async.rst b/Doc/reference/ldap-async.rst
index 76245f6..d7a1840 100644
--- a/Doc/reference/ldap-async.rst
+++ b/Doc/reference/ldap-async.rst
@@ -112,4 +112,3 @@ for writing search results as LDIF to stdout. ::
        s.endResultBreak-s.beginResultsDropped
      )
    )
-
diff --git a/Doc/reference/ldap-dn.rst b/Doc/reference/ldap-dn.rst
index c22a64c..3e0bbb5 100644
--- a/Doc/reference/ldap-dn.rst
+++ b/Doc/reference/ldap-dn.rst
@@ -107,4 +107,3 @@ Splitting a LDAPv3 DN with a multi-valued RDN into its AVA parts:
 
 >>> ldap.dn.str2dn('cn=John Doe+mail=john.doe@example.com,dc=example,dc=com')
 [[('cn', 'John Doe', 1), ('mail', 'john.doe@example.com', 1)], [('dc', 'example', 1)], [('dc', 'com', 1)]]
-
diff --git a/Doc/reference/ldap-extop.rst b/Doc/reference/ldap-extop.rst
index 607f3f0..8fe49f4 100644
--- a/Doc/reference/ldap-extop.rst
+++ b/Doc/reference/ldap-extop.rst
@@ -38,4 +38,3 @@ This requires :py:mod:`pyasn1` and :py:mod:`pyasn1_modules` to be installed.
 
 .. autoclass:: ldap.extop.dds.RefreshResponse
    :members:
-
diff --git a/Doc/reference/ldap-filter.rst b/Doc/reference/ldap-filter.rst
index 577befb..b08d5e9 100644
--- a/Doc/reference/ldap-filter.rst
+++ b/Doc/reference/ldap-filter.rst
@@ -35,4 +35,3 @@ The :mod:`ldap.filter` module defines the following functions:
    whole filter string.
 
    .. % -> string
-
diff --git a/Doc/reference/ldap-sasl.rst b/Doc/reference/ldap-sasl.rst
index 96f13aa..9a8c96a 100644
--- a/Doc/reference/ldap-sasl.rst
+++ b/Doc/reference/ldap-sasl.rst
@@ -35,7 +35,7 @@ Classes
 
 .. autoclass:: ldap.sasl.sasl
    :members:
-   
+
    This class is used with :py:meth:`ldap.LDAPObject.sasl_interactive_bind_s()`.
 
 
@@ -82,4 +82,3 @@ and sends a SASL external bind request.
    ldap_conn.sasl_non_interactive_bind_s('EXTERNAL')
    # Find out the SASL Authorization Identity
    print ldap_conn.whoami_s()
-
diff --git a/Doc/reference/ldap-syncrepl.rst b/Doc/reference/ldap-syncrepl.rst
index d3717df..b3b2cf9 100644
--- a/Doc/reference/ldap-syncrepl.rst
+++ b/Doc/reference/ldap-syncrepl.rst
@@ -20,4 +20,3 @@ This module defines the following classes:
 
 .. autoclass:: ldap.syncrepl.SyncreplConsumer
    :members:
-
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 6203a2d..a3ee63c 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -968,7 +968,7 @@ and wait for and return with the server's result, or with
 .. py:method:: LDAPObject.sasl_interactive_bind_s(who, auth[, serverctrls=None [, clientctrls=None [, sasl_flags=ldap.SASL_QUIET]]]) -> None
 
    This call is used to bind to the directory with a SASL bind request.
-   
+
    *auth* is an :py:class:`ldap.sasl.sasl()` instance.
 
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
@@ -1079,7 +1079,7 @@ and wait for and return with the server's result, or with
    .. versionchanged:: 3.0
 
       ``filterstr=None`` is equivalent to ``filterstr='(objectClass=*)'``.
-   
+
 
 .. py:method:: LDAPObject.start_tls_s() -> None
 
@@ -1220,4 +1220,3 @@ subtree search.
 >>> for dn,entry in r:
 >>>   print('Processing',repr(dn))
 >>>   handle_ldap_entry(entry)
-
diff --git a/Doc/reference/ldapurl.rst b/Doc/reference/ldapurl.rst
index 86d0817..96b5ed2 100644
--- a/Doc/reference/ldapurl.rst
+++ b/Doc/reference/ldapurl.rst
@@ -124,4 +124,3 @@ with \module{ldapurl} module.
 >>> ldap_url = ldapurl.LDAPUrl(hostport='localhost:1389',dn='dc=stroeder,dc=com',attrs=['cn','mail'],who='cn=Michael,dc=stroeder,dc=com',cred='secret')
 >>> ldap_url.unparse()
 'ldap://localhost:1389/dc=stroeder,dc=com?cn,mail?base?(objectclass=*)?bindname=cn=Michael%2Cdc=stroeder%2Cdc=com,X-BINDPW=secret'
-
diff --git a/Doc/reference/ldif.rst b/Doc/reference/ldif.rst
index 64afbb0..c508f7d 100644
--- a/Doc/reference/ldif.rst
+++ b/Doc/reference/ldif.rst
@@ -94,4 +94,3 @@ with :mod:`ldif` module, skip some entries and write the result to stdout. ::
 
    parser = MyLDIF(open("input.ldif", 'rb'), sys.stdout)
    parser.parse()
-
diff --git a/Doc/sample_workflow.rst b/Doc/sample_workflow.rst
index 97e51c6..c2010c1 100644
--- a/Doc/sample_workflow.rst
+++ b/Doc/sample_workflow.rst
@@ -1,4 +1,3 @@
-
 .. _sample workflow:
 
 Sample workflow for python-ldap development
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index 9eb5ceb..7a7982b 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -16,7 +16,7 @@
 from __future__ import print_function
 
 class Constant(object):
-    """Base class for a definition of an OpenLDAP constant 
+    """Base class for a definition of an OpenLDAP constant
     """
 
     def __init__(self, name, optional=False, requirements=(), doc=None):
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index 0d43ab1..b9994eb 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 """
-ldap.controls.deref - classes for 
+ldap.controls.deref - classes for
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
 
 See https://www.python-ldap.org/ for project details.
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 5159d89..12eafdc 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -429,4 +429,3 @@ def __delattr__(self,name):
           pass
     else:
       del self.__dict__[name]
-
diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 2bd6209..bc26727 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -54,8 +54,8 @@ dealloc(LDAPObject *self)
  * utility functions
  */
 
-/* 
- * check to see if the LDAPObject is valid, 
+/*
+ * check to see if the LDAPObject is valid,
  * ie has been opened, and not closed. An exception is set if not valid.
  */
 
@@ -89,8 +89,8 @@ LDAPMod_DEL(LDAPMod *lm)
     PyMem_DEL(lm);
 }
 
-/* 
- * convert a tuple of the form (int,str,[str,...]) 
+/*
+ * convert a tuple of the form (int,str,[str,...])
  * or (str, [str,...]) if no_op is true, into an LDAPMod structure.
  * See ldap_modify(3) for details.
  *
@@ -208,8 +208,8 @@ LDAPMods_DEL(LDAPMod **lms)
     PyMem_DEL(lms);
 }
 
-/* 
- * convert a list of tuples into a LDAPMod*[] array structure 
+/*
+ * convert a list of tuples into a LDAPMod*[] array structure
  * NOTE: list of tuples must live longer than the LDAPMods
  */
 
@@ -589,7 +589,7 @@ l_ldap_simple_bind(LDAPObject *self, PyObject *args)
      auth modules ("mechanisms"), or try
 
        ldapsearch   -b "" -s base -LLL -x  supportedSASLMechanisms
-     
+
      (perhaps with an additional -h and -p argument for ldap host and
      port). The latter will show you which SASL mechanisms are known
      to the LDAP server. If you do not want to set up Kerberos, you
@@ -645,7 +645,7 @@ interaction(unsigned flags, sasl_interact_t *interact, PyObject *SASLObject)
     return LDAP_SUCCESS;
 }
 
-/* 
+/*
   This function will be called by ldap_sasl_interactive_bind(). The
   "*in" is an array of sasl_interact_t's (see sasl.h for a
   reference). The last interact in the array has an interact->id of
@@ -748,12 +748,12 @@ l_ldap_sasl_interactive_bind_s(LDAPObject *self, PyObject *args)
 
     static unsigned sasl_flags = LDAP_SASL_QUIET;
 
-    /* 
+    /*
      * In Python 2.3+, a "I" format argument indicates that we're either converting
      * the Python object into a long or an unsigned int. In versions prior to that,
      * it will always convert to a long. Since the sasl_flags variable is an
      * unsigned int, we need to use the "I" flag if we're running Python 2.3+ and a
-     * "i" otherwise. 
+     * "i" otherwise.
      */
 #if (PY_MAJOR_VERSION == 2) && (PY_MINOR_VERSION < 3)
     if (!PyArg_ParseTuple
diff --git a/Tests/t_ldap_asyncsearch.py b/Tests/t_ldap_asyncsearch.py
index 8b46966..1b89050 100644
--- a/Tests/t_ldap_asyncsearch.py
+++ b/Tests/t_ldap_asyncsearch.py
@@ -22,4 +22,3 @@ def test_deprecated(self):
 
 if __name__ == '__main__':
     unittest.main()
-
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index e60ac12..9cf675a 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -94,4 +94,3 @@ def test_external_tlscert(self):
 
 if __name__ == '__main__':
     unittest.main()
-
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 4f181df..048b3f4 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -467,7 +467,7 @@ def test_weird_empty_lines(self):
             """
 
             # comment before version
-               
+
             version: 1
 
 
@@ -586,7 +586,7 @@ def test_weird_empty_lines(self):
             """
 
             # comment before version
-               
+
             version: 1
 
 
diff --git a/setup.cfg b/setup.cfg
index 87cdfd7..c654606 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -14,8 +14,8 @@
 # ./configure --with-cyrus-sasl --with-tls
 defines = HAVE_SASL HAVE_TLS HAVE_LIBLDAP_R
 
-extra_compile_args = 
-extra_objects = 
+extra_compile_args =
+extra_objects =
 
 # Example for full-featured build:
 # Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
diff --git a/setup.py b/setup.py
index 034c4dd..1b3dcde 100644
--- a/setup.py
+++ b/setup.py
@@ -71,7 +71,7 @@ class OpenLDAP2:
   from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose.
   Additionally the package contains modules for other LDAP-related stuff
   (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3 extended operations
-  and controls, etc.). 
+  and controls, etc.).
   """,
   author = 'python-ldap project',
   author_email = 'python-ldap@python.org',
diff --git a/tox.ini b/tox.ini
index bb9adac..992a699 100644
--- a/tox.ini
+++ b/tox.ini
@@ -11,7 +11,7 @@ minver = 1.8
 [testenv]
 deps = coverage
 passenv = WITH_GCOV
-# - Enable BytesWarning 
+# - Enable BytesWarning
 # - Turn all warnings into exceptions.
 # - 'ignore:the imp module is deprecated' is required to ignore import of 'imp'
 #   in distutils. Python < 3.6 use PendingDeprecationWarning; Python >= 3.6 use

From 97aa653cd8577580b65d6a5faa2ce711c5f57d77 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 14 Mar 2018 17:52:16 -0700
Subject: [PATCH 748/868] Remove assignment of variable to itself

Looks like a simple mistake. Introduced in
2ce408cf8b7d5b084556de0d36bf5666c1fda515.
---
 Lib/slapdtest/_slapdtest.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index adcccb8..2856a84 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -566,7 +566,6 @@ def _open_ldap_conn(self, who=None, cred=None, **kwargs):
     def setUpClass(cls):
         cls.server = cls.server_class()
         cls.server.start()
-        cls.server = cls.server
 
     @classmethod
     def tearDownClass(cls):

From fd0ec9057e6aaab67b2514c7802d4a4ad0712cb8 Mon Sep 17 00:00:00 2001
From: Gabriel Briones <gabriel.briones.sayeg@intel.com>
Date: Thu, 15 Mar 2018 12:10:49 -0600
Subject: [PATCH 749/868] Disable SASL external when missing SASL support

https://github.com/python-ldap/python-ldap/pull/190
Closes: https://github.com/python-ldap/python-ldap/issues/189
---
 Lib/slapdtest/_slapdtest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 2856a84..7e230c8 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -213,7 +213,7 @@ def __init__(self):
             self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
             self.default_ldap_uri = self.ldapi_uri
             # use SASL/EXTERNAL via LDAPI when invoking OpenLDAP CLI tools
-            self.cli_sasl_external = True
+            self.cli_sasl_external = ldap.SASL_AVAIL
         else:
             self.ldapi_uri = None
             self.default_ldap_uri = self.ldap_uri

From f477486b9185b92ff774096ed41effd3a90ca6b0 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 27 Mar 2018 10:52:27 +0200
Subject: [PATCH 750/868] Tests: Disable warnings-as-errors for Python 3.4

Python 3.4 is in its security fix only phase. We should make sure
the tests pass, but warnings should no longer break CI.
---
 tox.ini | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tox.ini b/tox.ini
index 992a699..f7751d0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -29,6 +29,12 @@ passenv = {[testenv]passenv}
 commands = {envpython} \
     -m coverage run --parallel setup.py test
 
+[testenv:py34]
+# No warnings with Python 3.4
+passenv = {[testenv]passenv}
+commands = {envpython} \
+    -m coverage run --parallel setup.py test
+
 [testenv:py2-nosasltls]
 basepython = python2
 deps = {[testenv]deps}

From 4a6a719f0da66a3764c979ff423ca2c6c320d57a Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Tue, 27 Mar 2018 11:24:57 +0200
Subject: [PATCH 751/868] Fix parsing of PPolicyControl ASN.1 structure

Password policy control decoder failed to handle graceAuthNsRemaining
correctly. The warning.getComponentByName('timeBeforeExpiration') call
materialized the time before expiration CHOICE element. The fixed
implementation uses pyasn1's dict interface to check which CHOICE
element is set.

https://github.com/python-ldap/python-ldap/pull/194
Closes: https://github.com/python-ldap/python-ldap/issues/192
See: https://github.com/python-ldap/python-ldap/issues/193
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/controls/ppolicy.py     | 35 +++++++++++++++-----------------
 Tests/t_ldap_controls_ppolicy.py | 33 ++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 19 deletions(-)
 create mode 100644 Tests/t_ldap_controls_ppolicy.py

diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index aa761f3..67efe3a 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -11,13 +11,13 @@
 ]
 
 # Imports from python-ldap 2.4+
-import ldap.controls
-from ldap.controls import RequestControl,ResponseControl,ValueLessRequestControl,KNOWN_RESPONSE_CONTROLS
+from ldap.controls import (
+  ResponseControl, ValueLessRequestControl, KNOWN_RESPONSE_CONTROLS
+)
 
 # Imports from pyasn1
 from pyasn1.type import tag,namedtype,namedval,univ,constraint
-from pyasn1.codec.ber import encoder,decoder
-from pyasn1_modules.rfc2251 import LDAPDN
+from pyasn1.codec.der import decoder
 
 
 class PasswordPolicyWarning(univ.Choice):
@@ -70,25 +70,22 @@ def __init__(self,criticality=False):
 
   def decodeControlValue(self,encodedControlValue):
     ppolicyValue,_ = decoder.decode(encodedControlValue,asn1Spec=PasswordPolicyResponseValue())
+    self.timeBeforeExpiration = None
+    self.graceAuthNsRemaining = None
+    self.error = None
+
     warning = ppolicyValue.getComponentByName('warning')
-    if not warning.hasValue():
-      self.timeBeforeExpiration,self.graceAuthNsRemaining = None,None
-    else:
-      timeBeforeExpiration = warning.getComponentByName('timeBeforeExpiration')
-      if timeBeforeExpiration.hasValue():
-        self.timeBeforeExpiration = int(timeBeforeExpiration)
-      else:
-        self.timeBeforeExpiration = None
-      graceAuthNsRemaining = warning.getComponentByName('graceAuthNsRemaining')
-      if graceAuthNsRemaining.hasValue():
-        self.graceAuthNsRemaining = int(graceAuthNsRemaining)
-      else:
-        self.graceAuthNsRemaining = None
+    if warning.hasValue():
+      if 'timeBeforeExpiration' in warning:
+        self.timeBeforeExpiration = int(
+          warning.getComponentByName('timeBeforeExpiration'))
+      if 'graceAuthNsRemaining' in warning:
+        self.graceAuthNsRemaining = int(
+          warning.getComponentByName('graceAuthNsRemaining'))
+
     error = ppolicyValue.getComponentByName('error')
     if error.hasValue():
       self.error = int(error)
-    else:
-      self.error = None
 
 
 KNOWN_RESPONSE_CONTROLS[PasswordPolicyControl.controlType] = PasswordPolicyControl
diff --git a/Tests/t_ldap_controls_ppolicy.py b/Tests/t_ldap_controls_ppolicy.py
new file mode 100644
index 0000000..8644e56
--- /dev/null
+++ b/Tests/t_ldap_controls_ppolicy.py
@@ -0,0 +1,33 @@
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+from ldap.controls import ppolicy
+
+
+PP_GRACEAUTH = b'0\x84\x00\x00\x00\t\xa0\x84\x00\x00\x00\x03\x81\x01\x02'
+PP_TIMEBEFORE = b'0\x84\x00\x00\x00\t\xa0\x84\x00\x00\x00\x03\x80\x012'
+
+
+class TestControlsPPolicy(unittest.TestCase):
+    def assertPPolicy(self, pp, timeBeforeExpiration=None,
+                      graceAuthNsRemaining=None, error=None):
+        self.assertEqual(pp.timeBeforeExpiration, timeBeforeExpiration)
+        self.assertEqual(pp.graceAuthNsRemaining, graceAuthNsRemaining)
+        self.assertEqual(pp.error, error)
+
+    def test_ppolicy_graceauth(self):
+        pp = ppolicy.PasswordPolicyControl()
+        pp.decodeControlValue(PP_GRACEAUTH)
+        self.assertPPolicy(pp, graceAuthNsRemaining=2)
+
+    def test_ppolicy_timebefore(self):
+        pp = ppolicy.PasswordPolicyControl()
+        pp.decodeControlValue(PP_TIMEBEFORE)
+        self.assertPPolicy(pp, timeBeforeExpiration=50)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 06be5eb9acd0f27554011819be7a938d250ef125 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Tue, 27 Mar 2018 02:28:09 -0700
Subject: [PATCH 752/868] Make SlapdObject.root_dn a property

Allows overriding SlapdObject.suffix or SlapdObject.root_cn without also
requiring root_dn be defined. It is now computed from the existing
values at runtime. The result is an easier to use SlapdObject class.

https://github.com/python-ldap/python-ldap/pull/195
---
 Lib/slapdtest/_slapdtest.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 7e230c8..2bbd141 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -169,7 +169,6 @@ class SlapdObject(object):
     database = 'mdb'
     suffix = 'dc=slapd-test,dc=python-ldap,dc=org'
     root_cn = 'Manager'
-    root_dn = 'cn=%s,%s' % (root_cn, suffix)
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
     local_host = '127.0.0.1'
@@ -232,6 +231,10 @@ def __init__(self):
         self.clientcert = os.path.join(HERE, 'certs/client.pem')
         self.clientkey = os.path.join(HERE, 'certs/client.key')
 
+    @property
+    def root_dn(self):
+        return 'cn={self.root_cn},{self.suffix}'.format(self=self)
+
     def _find_commands(self):
         self.PATH_LDAPADD = self._find_command('ldapadd')
         self.PATH_LDAPDELETE = self._find_command('ldapdelete')

From adc40d00f4fa7a5ba47f6b988778e985b3702fc2 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Tue, 27 Mar 2018 02:37:10 -0700
Subject: [PATCH 753/868] In SlapdObject,  build include directives dynamically

Allows overriding openldap_schema_files without requiring rewriting the
conf file.

https://github.com/python-ldap/python-ldap/pull/196
---
 Lib/slapdtest/_slapdtest.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 2bbd141..f248ff6 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -29,7 +29,7 @@
 SLAPD_CONF_TEMPLATE = r"""
 serverID %(serverid)s
 moduleload back_%(database)s
-include "%(schema_prefix)s/core.schema"
+%(include_directives)s
 loglevel %(loglevel)s
 allow bind_v2
 
@@ -316,9 +316,17 @@ def gen_config(self):
         for generating specific static configuration files you have to
         override this method
         """
+        include_directives = '\n'.join(
+            'include "{schema_prefix}/{schema_file}"'.format(
+                schema_prefix=self._schema_prefix,
+                schema_file=schema_file,
+            )
+            for schema_file in self.openldap_schema_files
+        )
         config_dict = {
             'serverid': hex(self.server_id),
             'schema_prefix':self._schema_prefix,
+            'include_directives': include_directives,
             'loglevel': self.slapd_loglevel,
             'database': self.database,
             'directory': self._db_directory,

From e5492c7490a5bfdfee8944f04628d2d8e7ce854a Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Fri, 30 Mar 2018 06:15:03 -0700
Subject: [PATCH 754/868] Stop catching ImportError for pyasn1

pyasn1 and pyasn1_modules are hard dependencies of python-ldap. They
have been listed in install_requires since commit
5d158578ce5a01f159378294ae7a88af66d4a05b. As they are not optional, can
expect imports to succeed.
---
 Lib/ldap/controls/__init__.py | 5 +----
 Lib/ldap/extop/__init__.py    | 9 ++-------
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index 43b938d..811b3be 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -17,10 +17,7 @@
 
 import ldap
 
-try:
-  from pyasn1.error import PyAsn1Error
-except ImportError:
-  PyAsn1Error = None
+from pyasn1.error import PyAsn1Error
 
 
 __all__ = [
diff --git a/Lib/ldap/extop/__init__.py b/Lib/ldap/extop/__init__.py
index d18c682..874166d 100644
--- a/Lib/ldap/extop/__init__.py
+++ b/Lib/ldap/extop/__init__.py
@@ -63,10 +63,5 @@ def decodeResponseValue(self,value):
     return value
 
 
-# Optionally import sub-modules which need pyasn1 et al
-try:
-  import pyasn1,pyasn1_modules.rfc2251
-except ImportError:
-  pass
-else:
-  from ldap.extop.dds import *
+# Import sub-modules
+from ldap.extop.dds import *

From 55c96b9953650e0e19a4d99ac5ef6a64f5a5db75 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Fri, 30 Mar 2018 05:56:06 -0700
Subject: [PATCH 755/868] Make SlapdObject a context manager

Allows for automatic cleanup of resources using the with statement. For
example:

   with slapdtest.SlapdObject() as server:
       server.ldapadd(...)
       ...

When using SlapdObject in a function, it is more convenient and concise
than using try/finally pattern.
---
 Lib/slapdtest/_slapdtest.py | 11 +++++++++++
 Tests/t_slapdobject.py      | 18 ++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 Tests/t_slapdobject.py

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index f248ff6..03ad8d8 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -164,6 +164,10 @@ class SlapdObject(object):
 
     When a reference to an instance of this class is lost, the slapd
     server is shut down.
+
+    An instance can be used as a context manager. When exiting the context
+    manager, the slapd server is shut down and the temporary data store is
+    removed.
     """
     slapd_conf_template = SLAPD_CONF_TEMPLATE
     database = 'mdb'
@@ -553,6 +557,13 @@ def ldapdelete(self, dn, recursive=False, extra_args=None):
         extra_args.append(dn)
         self._cli_popen(self.PATH_LDAPDELETE, extra_args=extra_args)
 
+    def __enter__(self):
+        self.start()
+        return self
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        self.stop()
+
 
 class SlapdTestCase(unittest.TestCase):
     """
diff --git a/Tests/t_slapdobject.py b/Tests/t_slapdobject.py
new file mode 100644
index 0000000..e1cc971
--- /dev/null
+++ b/Tests/t_slapdobject.py
@@ -0,0 +1,18 @@
+import unittest
+
+import slapdtest
+
+
+class TestSlapdObject(unittest.TestCase):
+    def test_context_manager(self):
+        with slapdtest.SlapdObject() as server:
+            self.assertIsNotNone(server._proc)
+        self.assertIsNone(server._proc)
+
+    def test_context_manager_after_start(self):
+        server = slapdtest.SlapdObject()
+        server.start()
+        self.assertIsNotNone(server._proc)
+        with server:
+            self.assertIsNotNone(server._proc)
+        self.assertIsNone(server._proc)

From ca705aaa5e66c6eeec8b2dc152646b7f7e1636a2 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 3 Apr 2018 13:23:35 +0200
Subject: [PATCH 756/868] Add versionchanged entry in slapdtest docs about
 context manager

---
 Lib/slapdtest/_slapdtest.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 03ad8d8..f1885ca 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -168,6 +168,10 @@ class SlapdObject(object):
     An instance can be used as a context manager. When exiting the context
     manager, the slapd server is shut down and the temporary data store is
     removed.
+
+    .. versionchanged:: 3.1
+
+        Added context manager functionality
     """
     slapd_conf_template = SLAPD_CONF_TEMPLATE
     database = 'mdb'

From e7ee841412d873c62707843a822bc4a8639c6c23 Mon Sep 17 00:00:00 2001
From: Marti Raudsepp <marti@juffo.org>
Date: Tue, 3 Apr 2018 14:40:27 +0300
Subject: [PATCH 757/868] Doc: Replace Mac OS X -> macOS, this is now the
 official name

https://github.com/python-ldap/python-ldap/pull/202
---
 Doc/faq.rst               | 2 +-
 Doc/installing.rst        | 4 ++--
 Doc/spelling_wordlist.txt | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Doc/faq.rst b/Doc/faq.rst
index ef479a8..4475414 100644
--- a/Doc/faq.rst
+++ b/Doc/faq.rst
@@ -114,7 +114,7 @@ telling Lib/ldap.py and Lib/ldap/schema.py are not found::
 
 .. _install-macosx:
 
-**Q**: What's the correct way to install on Mac OS X?
+**Q**: What's the correct way to install on macOS?
 
   **A**::
 
diff --git a/Doc/installing.rst b/Doc/installing.rst
index dc4f5b9..f698663 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -73,8 +73,8 @@ Unofficial packages for Windows are available on
 The CVS repository of FreeBSD contains the package
 `py-ldap <https://svnweb.freebsd.org/ports/head/net/py-ldap/>`_
 
-Mac OS X
---------
+macOS
+-----
 
 You can install directly with pip::
 
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index 925ddc3..3ee0e85 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -83,6 +83,7 @@ LDIFWriter
 libldap
 libs
 Libs
+macOS
 modlist
 modrdn
 msgid

From c10cd5c347b75ebf80d8a31fffb057aaf39db44d Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sun, 1 Apr 2018 13:20:10 -0700
Subject: [PATCH 758/868] Add new Pytest cache directory to gitignore

Starting with Pytest 3.4.0 (2018-01-30), Pytest's cache directory was
renamed to .pytest_cache.

https://docs.pytest.org/en/latest/changelog.html#pytest-3-4-0-2018-01-30

> The default cache directory has been renamed from .cache to
> .pytest_cache after community feedback that the name .cache did not
> make it clear that it was used by pytest.
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 0034b3a..5f6d042 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ __pycache__/
 .coverage*
 !.coveragerc
 /.cache
+/.pytest_cache
 
 # shared libs installed by 'setup.py test'
 /Lib/*.so*

From 28f5251fd534fd50d333b522c857a2b0aaa56787 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Fri, 30 Mar 2018 06:07:27 -0700
Subject: [PATCH 759/868] Move import statements to top level

For import statements that can safely exist at the top level of the
file, move them there.

In Lib/slapdtest/_slapdtest.py, Adding imports local to functions
unnecessarily resulted in duplicates.

This style is also more in line with PEP8:

https://www.python.org/dev/peps/pep-0008/#imports

> Imports are always put at the top of the file, just after any module
> comments and docstrings, and before module globals and constants.
---
 Lib/ldap/asyncsearch.py     |  3 ++-
 Lib/ldap/schema/subentry.py | 11 +++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/Lib/ldap/asyncsearch.py b/Lib/ldap/asyncsearch.py
index 80b5b2a..6514dd0 100644
--- a/Lib/ldap/asyncsearch.py
+++ b/Lib/ldap/asyncsearch.py
@@ -8,6 +8,8 @@
 
 from ldap import __version__
 
+import ldif
+
 SEARCH_RESULT_TYPES = {
   ldap.RES_SEARCH_ENTRY,
   ldap.RES_SEARCH_RESULT,
@@ -269,7 +271,6 @@ class LDIFWriter(FileWriter):
   """
 
   def __init__(self,l,writer_obj,headerStr='',footerStr=''):
-    import ldif
     if isinstance(writer_obj,ldif.LDIFWriter):
       self._ldif_writer = writer_obj
     else:
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index aa094cb..5ccbce0 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -4,10 +4,17 @@
 See https://www.python-ldap.org/ for details.
 """
 
+import copy
+
 import ldap.cidict,ldap.schema
 
+from ldap.compat import urlopen
 from ldap.schema.models import *
 
+import ldapurl
+import ldif
+
+
 SCHEMA_CLASS_MAPPING = ldap.cidict.cidict()
 SCHEMA_ATTR_MAPPING = {}
 
@@ -256,7 +263,6 @@ def get_inheritedobj(self,se_class,nameoroid,inherited=None):
     Get a schema element by name or OID with all class attributes
     set including inherited class attributes
     """
-    import copy
     inherited = inherited or []
     se = copy.copy(self.sed[se_class].get(self.getoid(se_class,nameoroid)))
     if se and hasattr(se,'sup'):
@@ -452,7 +458,6 @@ def urlfetch(uri,trace_level=0):
   """
   uri = uri.strip()
   if uri.startswith(('ldap:', 'ldaps:', 'ldapi:')):
-    import ldapurl
     ldap_url = ldapurl.LDAPUrl(uri)
 
     l=ldap.initialize(ldap_url.initializeUrl(),trace_level)
@@ -472,8 +477,6 @@ def urlfetch(uri,trace_level=0):
     l.unbind_s()
     del l
   else:
-    import ldif
-    from ldap.compat import urlopen
     ldif_file = urlopen(uri)
     ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
     ldif_parser.parse()

From f23f7901f5343581fcfbc3a5db8a745d8adb4e3f Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Thu, 19 Apr 2018 06:32:39 -0700
Subject: [PATCH 760/868] Update all pypi.python.org URLs to pypi.org

For details on the new PyPI, see the blog post:

https://pythoninsider.blogspot.ca/2018/04/new-pypi-launched-legacy-pypi-shutting.html
---
 Demo/pyasn1/README   | 4 ++--
 Doc/contributing.rst | 2 +-
 Doc/faq.rst          | 2 +-
 Doc/installing.rst   | 6 +++---
 setup.py             | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Demo/pyasn1/README b/Demo/pyasn1/README
index b5fc28f..2ca95a6 100644
--- a/Demo/pyasn1/README
+++ b/Demo/pyasn1/README
@@ -2,5 +2,5 @@ The sample modules/scripts herein require modules pyasn1 and pyasn1-modules.
 
 https://github.com/etingof/pyasn1
 
-https://pypi.python.org/pypi/pyasn1
-https://pypi.python.org/pypi/pyasn1-modules
+https://pypi.org/project/pyasn1/
+https://pypi.org/project/pyasn1-modules/
diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index badb931..e6481fe 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -143,7 +143,7 @@ keeps track of all reference increments and decrements. The leak plugin runs
 each test multiple times and checks if the reference count increases.
 
 .. _pytest: https://docs.pytest.org/en/latest/
-.. _pytest-leaks: https://pypi.python.org/pypi/pytest-leaks
+.. _pytest-leaks: https://pypi.org/project/pytest-leaks/
 
 Download and compile the *pydebug* build::
 
diff --git a/Doc/faq.rst b/Doc/faq.rst
index 4475414..c2e7e15 100644
--- a/Doc/faq.rst
+++ b/Doc/faq.rst
@@ -26,7 +26,7 @@ Usage
   **A1**. For earlier versions, there's `pyldap`_, an independent fork
   now merged into python-ldap.
 
-.. _pyldap: https://pypi.python.org/pypi/pyldap
+.. _pyldap: https://pypi.org/project/pyldap/
 
 
 **Q**: Does it work with Python 2.6? (1.5|2.0|2.1|2.2|2.3|2.4|2.5)?
diff --git a/Doc/installing.rst b/Doc/installing.rst
index f698663..babbaf6 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -15,7 +15,7 @@ For example::
 
     $ python -m pip install python-ldap
 
-.. _PyPI repository: https://pypi.python.org/pypi/python-ldap/
+.. _PyPI repository: https://pypi.org/project/python-ldap/
 .. _pip: https://pip.pypa.io/en/stable/
 
 For installing from PyPI, you will need the same :ref:`build prerequisites`
@@ -27,8 +27,8 @@ We do not currently provide pre-built packages (wheels).
 Furthermore, python-ldap requires the modules `pyasn1`_ and `pyasn1-modules`_.
 ``pip`` will install these automatically.
 
-.. _pyasn1: https://pypi.python.org/pypi/pyasn1
-.. _pyasn1-modules: https://pypi.python.org/pypi/pyasn1-modules
+.. _pyasn1: https://pypi.org/project/pyasn1/
+.. _pyasn1-modules: https://pypi.org/project/pyasn1-modules/
 
 
 Pre-built Binaries
diff --git a/setup.py b/setup.py
index 1b3dcde..e1914aa 100644
--- a/setup.py
+++ b/setup.py
@@ -76,7 +76,7 @@ class OpenLDAP2:
   author = 'python-ldap project',
   author_email = 'python-ldap@python.org',
   url = 'https://www.python-ldap.org/',
-  download_url = 'https://pypi.python.org/pypi/python-ldap/',
+  download_url = 'https://pypi.org/project/python-ldap/',
   classifiers = [
     'Development Status :: 5 - Production/Stable',
     'Intended Audience :: Developers',

From 5faff53839906ac65bdc4cb87e0a009395a3ac0e Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sat, 28 Apr 2018 09:47:57 -0700
Subject: [PATCH 761/868] Fix assertTrue(result, _ldap.RES_BIND) to
 assertEqual()

Fix a pattern where assertTrue(result, _ldap.RES_BIND) was mistakenly
used in place of self.assertEqual(result, _ldap.RES_BIND).

Mistakes introduced in commit 162cedf71ba62b3944d18a27ed206d55e679f966.
---
 Tests/t_cext.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index ff5fb6c..49ef269 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -234,7 +234,7 @@ def test_simple_anonymous_bind(self):
         m = l.simple_bind("", "")
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertTrue(result, _ldap.RES_BIND)
+        self.assertEqual(result, _ldap.RES_BIND)
         self.assertEqual(msgid, m)
         self.assertEqual(pmsg, [])
         self.assertEqual(ctrls, [])
@@ -629,7 +629,7 @@ def test_whoami_anonymous(self):
         # Anonymous bind
         m = l.simple_bind("", "")
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        self.assertTrue(result, _ldap.RES_BIND)
+        self.assertEqual(result, _ldap.RES_BIND)
         # check with Who Am I? extended operation
         r = l.whoami_s()
         self.assertEqual("", r)

From 68a6db69f76b8f7be6e26aa0c85f7b8a297c22bc Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sat, 28 Apr 2018 09:06:29 -0700
Subject: [PATCH 762/868] Use builtin unittest methods assertIsNone &
 assertIsNotNone

These methods were introduced in Python 2.7 and 3.1. Available in all
supported environments. Can remove the local reimplementation.

https://docs.python.org/3/library/unittest.html#unittest.TestCase.assertIsNone
https://docs.python.org/2/library/unittest.html#unittest.TestCase.assertIsNone
---
 Tests/t_cext.py         | 132 +++++++++++++++++++---------------------
 Tests/t_cidict.py       |   2 +-
 Tests/t_ldap_options.py |  12 ++--
 Tests/t_ldapurl.py      |  24 +++-----
 4 files changed, 80 insertions(+), 90 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 49ef269..4de2b99 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -99,12 +99,6 @@ def _open_conn(self, bind=True):
             self.assertEqual(type(msgid), type(0))
         return l
 
-    def assertNotNone(self, expr, msg=None):
-        self.assertFalse(expr is None, msg or repr(expr))
-
-    def assertNone(self, expr, msg=None):
-        self.assertFalse(expr is not None, msg or repr(expr))
-
     # Test for the existence of a whole bunch of constants
     # that the C module is supposed to export
     def test_constants(self):
@@ -128,88 +122,88 @@ def test_constants(self):
         self.assertEqual(_ldap.RES_SEARCH_REFERENCE, 0x73) # v3
         self.assertEqual(_ldap.RES_EXTENDED, 0x78)         # v3
         #self.assertEqual(_ldap.RES_INTERMEDIATE, 0x79)     # v3
-        self.assertNotNone(_ldap.RES_ANY)
-        self.assertNotNone(_ldap.RES_UNSOLICITED)
+        self.assertIsNotNone(_ldap.RES_ANY)
+        self.assertIsNotNone(_ldap.RES_UNSOLICITED)
 
-        self.assertNotNone(_ldap.AUTH_NONE)
-        self.assertNotNone(_ldap.AUTH_SIMPLE)
+        self.assertIsNotNone(_ldap.AUTH_NONE)
+        self.assertIsNotNone(_ldap.AUTH_SIMPLE)
 
-        self.assertNotNone(_ldap.SCOPE_BASE)
-        self.assertNotNone(_ldap.SCOPE_ONELEVEL)
-        self.assertNotNone(_ldap.SCOPE_SUBTREE)
+        self.assertIsNotNone(_ldap.SCOPE_BASE)
+        self.assertIsNotNone(_ldap.SCOPE_ONELEVEL)
+        self.assertIsNotNone(_ldap.SCOPE_SUBTREE)
 
-        self.assertNotNone(_ldap.MOD_ADD)
-        self.assertNotNone(_ldap.MOD_DELETE)
-        self.assertNotNone(_ldap.MOD_REPLACE)
-        self.assertNotNone(_ldap.MOD_INCREMENT)
-        self.assertNotNone(_ldap.MOD_BVALUES)
+        self.assertIsNotNone(_ldap.MOD_ADD)
+        self.assertIsNotNone(_ldap.MOD_DELETE)
+        self.assertIsNotNone(_ldap.MOD_REPLACE)
+        self.assertIsNotNone(_ldap.MOD_INCREMENT)
+        self.assertIsNotNone(_ldap.MOD_BVALUES)
 
         # for result4()
-        self.assertNotNone(_ldap.MSG_ONE)
-        self.assertNotNone(_ldap.MSG_ALL)
-        self.assertNotNone(_ldap.MSG_RECEIVED)
+        self.assertIsNotNone(_ldap.MSG_ONE)
+        self.assertIsNotNone(_ldap.MSG_ALL)
+        self.assertIsNotNone(_ldap.MSG_RECEIVED)
 
         # for OPT_DEFEF
-        self.assertNotNone(_ldap.DEREF_NEVER)
-        self.assertNotNone(_ldap.DEREF_SEARCHING)
-        self.assertNotNone(_ldap.DEREF_FINDING)
-        self.assertNotNone(_ldap.DEREF_ALWAYS)
+        self.assertIsNotNone(_ldap.DEREF_NEVER)
+        self.assertIsNotNone(_ldap.DEREF_SEARCHING)
+        self.assertIsNotNone(_ldap.DEREF_FINDING)
+        self.assertIsNotNone(_ldap.DEREF_ALWAYS)
 
         # for OPT_SIZELIMIT, OPT_TIMELIMIT
-        self.assertNotNone(_ldap.NO_LIMIT)
+        self.assertIsNotNone(_ldap.NO_LIMIT)
 
         # standard options
-        self.assertNotNone(_ldap.OPT_API_INFO)
-        self.assertNotNone(_ldap.OPT_DEREF)
-        self.assertNotNone(_ldap.OPT_SIZELIMIT)
-        self.assertNotNone(_ldap.OPT_TIMELIMIT)
-        self.assertNotNone(_ldap.OPT_REFERRALS)
-        self.assertNotNone(_ldap.OPT_RESTART)
-        self.assertNotNone(_ldap.OPT_PROTOCOL_VERSION)
-        self.assertNotNone(_ldap.OPT_SERVER_CONTROLS)
-        self.assertNotNone(_ldap.OPT_CLIENT_CONTROLS)
-        self.assertNotNone(_ldap.OPT_API_FEATURE_INFO)
-        self.assertNotNone(_ldap.OPT_HOST_NAME)
-        self.assertNotNone(_ldap.OPT_ERROR_NUMBER)   # = OPT_RESULT_CODE
-        self.assertNotNone(_ldap.OPT_ERROR_STRING)   # = OPT_DIAGNOSITIC_MESSAGE
-        self.assertNotNone(_ldap.OPT_MATCHED_DN)
+        self.assertIsNotNone(_ldap.OPT_API_INFO)
+        self.assertIsNotNone(_ldap.OPT_DEREF)
+        self.assertIsNotNone(_ldap.OPT_SIZELIMIT)
+        self.assertIsNotNone(_ldap.OPT_TIMELIMIT)
+        self.assertIsNotNone(_ldap.OPT_REFERRALS)
+        self.assertIsNotNone(_ldap.OPT_RESTART)
+        self.assertIsNotNone(_ldap.OPT_PROTOCOL_VERSION)
+        self.assertIsNotNone(_ldap.OPT_SERVER_CONTROLS)
+        self.assertIsNotNone(_ldap.OPT_CLIENT_CONTROLS)
+        self.assertIsNotNone(_ldap.OPT_API_FEATURE_INFO)
+        self.assertIsNotNone(_ldap.OPT_HOST_NAME)
+        self.assertIsNotNone(_ldap.OPT_ERROR_NUMBER)   # = OPT_RESULT_CODE
+        self.assertIsNotNone(_ldap.OPT_ERROR_STRING)   # = OPT_DIAGNOSITIC_MESSAGE
+        self.assertIsNotNone(_ldap.OPT_MATCHED_DN)
 
         # OpenLDAP specific
-        self.assertNotNone(_ldap.OPT_DEBUG_LEVEL)
-        self.assertNotNone(_ldap.OPT_TIMEOUT)
-        self.assertNotNone(_ldap.OPT_REFHOPLIMIT)
-        self.assertNotNone(_ldap.OPT_NETWORK_TIMEOUT)
-        self.assertNotNone(_ldap.OPT_URI)
-        #self.assertNotNone(_ldap.OPT_REFERRAL_URLS)
-        #self.assertNotNone(_ldap.OPT_SOCKBUF)
-        #self.assertNotNone(_ldap.OPT_DEFBASE)
-        #self.assertNotNone(_ldap.OPT_CONNECT_ASYNC)
+        self.assertIsNotNone(_ldap.OPT_DEBUG_LEVEL)
+        self.assertIsNotNone(_ldap.OPT_TIMEOUT)
+        self.assertIsNotNone(_ldap.OPT_REFHOPLIMIT)
+        self.assertIsNotNone(_ldap.OPT_NETWORK_TIMEOUT)
+        self.assertIsNotNone(_ldap.OPT_URI)
+        #self.assertIsNotNone(_ldap.OPT_REFERRAL_URLS)
+        #self.assertIsNotNone(_ldap.OPT_SOCKBUF)
+        #self.assertIsNotNone(_ldap.OPT_DEFBASE)
+        #self.assertIsNotNone(_ldap.OPT_CONNECT_ASYNC)
 
         # str2dn()
-        self.assertNotNone(_ldap.DN_FORMAT_LDAP)
-        self.assertNotNone(_ldap.DN_FORMAT_LDAPV3)
-        self.assertNotNone(_ldap.DN_FORMAT_LDAPV2)
-        self.assertNotNone(_ldap.DN_FORMAT_DCE)
-        self.assertNotNone(_ldap.DN_FORMAT_UFN)
-        self.assertNotNone(_ldap.DN_FORMAT_AD_CANONICAL)
-        self.assertNotNone(_ldap.DN_FORMAT_MASK)
-        self.assertNotNone(_ldap.DN_PRETTY)
-        self.assertNotNone(_ldap.DN_SKIP)
-        self.assertNotNone(_ldap.DN_P_NOLEADTRAILSPACES)
-        self.assertNotNone(_ldap.DN_P_NOSPACEAFTERRDN)
-        self.assertNotNone(_ldap.DN_PEDANTIC)
-        self.assertNotNone(_ldap.AVA_NULL)
-        self.assertNotNone(_ldap.AVA_STRING)
-        self.assertNotNone(_ldap.AVA_BINARY)
-        self.assertNotNone(_ldap.AVA_NONPRINTABLE)
+        self.assertIsNotNone(_ldap.DN_FORMAT_LDAP)
+        self.assertIsNotNone(_ldap.DN_FORMAT_LDAPV3)
+        self.assertIsNotNone(_ldap.DN_FORMAT_LDAPV2)
+        self.assertIsNotNone(_ldap.DN_FORMAT_DCE)
+        self.assertIsNotNone(_ldap.DN_FORMAT_UFN)
+        self.assertIsNotNone(_ldap.DN_FORMAT_AD_CANONICAL)
+        self.assertIsNotNone(_ldap.DN_FORMAT_MASK)
+        self.assertIsNotNone(_ldap.DN_PRETTY)
+        self.assertIsNotNone(_ldap.DN_SKIP)
+        self.assertIsNotNone(_ldap.DN_P_NOLEADTRAILSPACES)
+        self.assertIsNotNone(_ldap.DN_P_NOSPACEAFTERRDN)
+        self.assertIsNotNone(_ldap.DN_PEDANTIC)
+        self.assertIsNotNone(_ldap.AVA_NULL)
+        self.assertIsNotNone(_ldap.AVA_STRING)
+        self.assertIsNotNone(_ldap.AVA_BINARY)
+        self.assertIsNotNone(_ldap.AVA_NONPRINTABLE)
 
         # these two constants are pointless? XXX
         self.assertEqual(_ldap.OPT_ON, 1)
         self.assertEqual(_ldap.OPT_OFF, 0)
 
         # these constants useless after ldap_url_parse() was dropped XXX
-        self.assertNotNone(_ldap.URL_ERR_BADSCOPE)
-        self.assertNotNone(_ldap.URL_ERR_MEM)
+        self.assertIsNotNone(_ldap.URL_ERR_BADSCOPE)
+        self.assertIsNotNone(_ldap.URL_ERR_MEM)
 
     def test_test_flags(self):
         # test flag, see slapdtest and tox.ini
@@ -263,7 +257,7 @@ def test_anon_rootdse_search(self):
     def test_unbind(self):
         l = self._open_conn()
         m = l.unbind_ext()
-        self.assertNone(m)
+        self.assertIsNone(m)
         # Second attempt to unbind should yield an exception
         try:
             l.unbind_ext()
@@ -301,7 +295,7 @@ def test_abandon(self):
         l = self._open_conn()
         m = l.search_ext(self.server.suffix, _ldap.SCOPE_SUBTREE, '(objectClass=*)')
         ret = l.abandon_ext(m)
-        self.assertNone(ret)
+        self.assertIsNone(ret)
         try:
             r = l.result4(m, _ldap.MSG_ALL, 0.3)  # (timeout /could/ be longer)
         except _ldap.TIMEOUT as e:
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index f8b993f..fa5a39b 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -30,7 +30,7 @@ def test_cidict(self):
         cix = ldap.cidict.cidict(data)
         self.assertEqual(cix["ABCDEF"], 123)
         self.assertEqual(cix.get("ABCDEF", None), 123)
-        self.assertEqual(cix.get("not existent", None), None)
+        self.assertIsNone(cix.get("not existent", None))
         cix["xYZ"] = 987
         self.assertEqual(cix["XyZ"], 987)
         self.assertEqual(cix.get("xyz", None), 987)
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
index ffc2451..684fdf7 100644
--- a/Tests/t_ldap_options.py
+++ b/Tests/t_ldap_options.py
@@ -71,9 +71,9 @@ def _test_timeout(self, option):
         old = self.get_option(option)
         try:
             self.set_option(option, None)
-            self.assertEqual(self.get_option(option), None)
+            self.assertIsNone(self.get_option(option))
             self.set_option(option, -1)
-            self.assertEqual(self.get_option(option), None)
+            self.assertIsNone(self.get_option(option))
         finally:
             self.set_option(option, old)
 
@@ -168,16 +168,16 @@ def test_network_timeout_attribute(self):
             self.assertEqual(self.get_option(option), 5)
 
             self.conn.network_timeout = -1
-            self.assertEqual(self.conn.network_timeout, None)
-            self.assertEqual(self.get_option(option), None)
+            self.assertIsNone(self.conn.network_timeout)
+            self.assertIsNone(self.get_option(option))
 
             self.conn.network_timeout = 10.5
             self.assertEqual(self.conn.network_timeout, 10.5)
             self.assertEqual(self.get_option(option), 10.5)
 
             self.conn.network_timeout = None
-            self.assertEqual(self.conn.network_timeout, None)
-            self.assertEqual(self.get_option(option), None)
+            self.assertIsNone(self.conn.network_timeout)
+            self.assertIsNone(self.get_option(option))
         finally:
             self.set_option(option, old)
 
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index c4a813d..1408efc 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -183,10 +183,6 @@ def test_ldapurl(self):
 
 
 class TestLDAPUrl(unittest.TestCase):
-
-    def assertNone(self, expr, msg=None):
-        self.assertFalse(expr is not None, msg or ("%r" % expr))
-
     def test_combo(self):
         u = MyLDAPUrl(
             "ldap://127.0.0.1:1234/dc=example,dc=com"
@@ -223,15 +219,15 @@ def test_parse_empty_dn(self):
 
     def test_parse_default_attrs(self):
         u = LDAPUrl("ldap://")
-        self.assertNone(u.attrs)
+        self.assertIsNone(u.attrs)
 
     def test_parse_default_scope(self):
         u = LDAPUrl("ldap://")
-        self.assertNone(u.scope)     # RFC4516 s3
+        self.assertIsNone(u.scope)     # RFC4516 s3
 
     def test_parse_default_filter(self):
         u = LDAPUrl("ldap://")
-        self.assertNone(u.filterstr) # RFC4516 s3
+        self.assertIsNone(u.filterstr) # RFC4516 s3
 
     def test_parse_default_extensions(self):
         u = LDAPUrl("ldap://")
@@ -285,9 +281,9 @@ def test_parse_dn(self):
 
     def test_parse_attrs(self):
         u = LDAPUrl("ldap:///?")
-        self.assertEqual(u.attrs, None)
+        self.assertIsNone(u.attrs)
         u = LDAPUrl("ldap:///??")
-        self.assertEqual(u.attrs, None)
+        self.assertIsNone(u.attrs)
         u = LDAPUrl("ldap:///?*?")
         self.assertEqual(u.attrs, ['*'])
         u = LDAPUrl("ldap:///?*,*?")
@@ -303,9 +299,9 @@ def test_parse_attrs(self):
 
     def test_parse_scope_default(self):
         u = LDAPUrl("ldap:///??")
-        self.assertNone(u.scope) # on opposite to RFC4516 s3 for referral chasing
+        self.assertIsNone(u.scope) # on opposite to RFC4516 s3 for referral chasing
         u = LDAPUrl("ldap:///???")
-        self.assertNone(u.scope) # on opposite to RFC4516 s3 for referral chasing
+        self.assertIsNone(u.scope) # on opposite to RFC4516 s3 for referral chasing
 
     def test_parse_scope(self):
         u = LDAPUrl("ldap:///??sub")
@@ -355,8 +351,8 @@ def test_parse_filter(self):
 
     def test_parse_extensions(self):
         u = LDAPUrl("ldap:///????")
-        self.assertNone(u.extensions)
-        self.assertNone(u.who)
+        self.assertIsNone(u.extensions)
+        self.assertIsNone(u.who)
         u = LDAPUrl("ldap:///????bindname=cn=root")
         self.assertEqual(len(u.extensions), 1)
         self.assertEqual(u.who, "cn=root")
@@ -380,7 +376,7 @@ def test_parse_extensions_5questions(self):
     def test_parse_extensions_novalue(self):
         u = LDAPUrl("ldap:///????bindname")
         self.assertEqual(len(u.extensions), 1)
-        self.assertNone(u.who)
+        self.assertIsNone(u.who)
 
     @unittest.expectedFailure
     def test_bad_urls(self):

From 77e934e88766002e77462d541b6e9c9599c7d410 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 24 May 2018 23:36:57 +0200
Subject: [PATCH 763/868] Fix ref counting bug in LDAPmessage_to_python

PyDict_GetItem() returns a borrowed reference. The code later
Py_DECREF() the reference, which causes a segfault at a later point in
time.

Fixes: https://github.com/python-ldap/python-ldap/issues/218
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/message.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Modules/message.c b/Modules/message.c
index cf3ea3b..2c05488 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -99,7 +99,15 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
 
             /* Find which list to append to */
             if (PyDict_Contains(attrdict, pyattr)) {
+                /* Multiple attribute entries with same name. This code path
+                 * is rarely used and cannot be exhausted with OpenLDAP
+                 * tests. 389-DS sometimes triggeres it, see
+                 * https://github.com/python-ldap/python-ldap/issues/218
+                 */
                 valuelist = PyDict_GetItem(attrdict, pyattr);
+                /* Turn borrowed reference into owned reference */
+                if (valuelist != NULL)
+                    Py_INCREF(valuelist);
             }
             else {
                 valuelist = PyList_New(0);

From 1eb07ff43bb072ffb04dd0b07bb46e38b2642422 Mon Sep 17 00:00:00 2001
From: SOMA Yuki <pj.moc.liamg@gmail.com>
Date: Fri, 27 Apr 2018 11:55:55 +0900
Subject: [PATCH 764/868] Tests: modlist test cases were obsolete in Python 3

---
 Tests/t_ldap_modlist.py | 72 ++++++++++++++++++++---------------------
 1 file changed, 36 insertions(+), 36 deletions(-)

diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
index db248b7..53c80cc 100644
--- a/Tests/t_ldap_modlist.py
+++ b/Tests/t_ldap_modlist.py
@@ -20,19 +20,19 @@ class TestModlist(unittest.TestCase):
     addModlist_tests = [
         (
             {
-                'objectClass':['person','pilotPerson'],
-                'cn':['Michael Str\303\266der','Michael Stroeder'],
-                'sn':['Str\303\266der'],
+                'objectClass': [b'person',b'pilotPerson'],
+                'cn':[b'Michael Str\303\266der',b'Michael Stroeder'],
+                'sn':[b'Str\303\266der'],
                 'dummy1':[],
-                'dummy2':['2'],
-                'dummy3':[''],
+                'dummy2':[b'2'],
+                'dummy3':[b''],
             },
             [
-                ('objectClass',['person','pilotPerson']),
-                ('cn',['Michael Str\303\266der','Michael Stroeder']),
-                ('sn',['Str\303\266der']),
-                ('dummy2',['2']),
-                ('dummy3',['']),
+                ('objectClass',[b'person',b'pilotPerson']),
+                ('cn',[b'Michael Str\303\266der',b'Michael Stroeder']),
+                ('sn',[b'Str\303\266der']),
+                ('dummy2',[b'2']),
+                ('dummy3',[b'']),
             ]
         ),
     ]
@@ -52,42 +52,42 @@ def test_addModlist(self):
     modifyModlist_tests = [
         (
             {
-                'objectClass':['person','pilotPerson'],
-                'cn':['Michael Str\303\266der','Michael Stroeder'],
-                'sn':['Str\303\266der'],
-                'enum':['a','b','c'],
-                'c':['DE'],
+                'objectClass':[b'person',b'pilotPerson'],
+                'cn':[b'Michael Str\303\266der',b'Michael Stroeder'],
+                'sn':[b'Str\303\266der'],
+                'enum':[b'a',b'b',b'c'],
+                'c':[b'DE'],
             },
             {
-                'objectClass':['person','inetOrgPerson'],
-                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'objectClass':[b'person',b'inetOrgPerson'],
+                'cn':[b'Michael Str\303\266der',b'Michael Stroeder'],
                 'sn':[],
-                'enum':['a','b','d'],
-                'mail':['michael@stroeder.com'],
+                'enum':[b'a',b'b',b'd'],
+                'mail':[b'michael@stroeder.com'],
             },
             [],
             [
                 (ldap.MOD_DELETE,'objectClass',None),
-                (ldap.MOD_ADD,'objectClass',['person','inetOrgPerson']),
+                (ldap.MOD_ADD,'objectClass',[b'person',b'inetOrgPerson']),
                 (ldap.MOD_DELETE,'c',None),
                 (ldap.MOD_DELETE,'sn',None),
-                (ldap.MOD_ADD,'mail',['michael@stroeder.com']),
+                (ldap.MOD_ADD,'mail',[b'michael@stroeder.com']),
                 (ldap.MOD_DELETE,'enum',None),
-                (ldap.MOD_ADD,'enum',['a','b','d']),
+                (ldap.MOD_ADD,'enum',[b'a',b'b',b'd']),
             ]
         ),
 
         (
             {
-                'c':['DE'],
+                'c':[b'DE'],
             },
             {
-                'c':['FR'],
+                'c':[b'FR'],
             },
             [],
             [
                 (ldap.MOD_DELETE,'c',None),
-                (ldap.MOD_ADD,'c',['FR']),
+                (ldap.MOD_ADD,'c',[b'FR']),
             ]
         ),
 
@@ -95,10 +95,10 @@ def test_addModlist(self):
         # of removing an attribute with MOD_DELETE,attr_type,None
         (
             {
-                'objectClass':['person'],
+                'objectClass':[b'person'],
                 'cn':[None],
-                'sn':[''],
-                'c':['DE'],
+                'sn':[b''],
+                'c':[b'DE'],
             },
             {
                 'objectClass':[],
@@ -115,22 +115,22 @@ def test_addModlist(self):
 
         (
             {
-                'objectClass':['person'],
-                'cn':['Michael Str\303\266der','Michael Stroeder'],
-                'sn':['Str\303\266der'],
-                'enum':['a','b','C'],
+                'objectClass':[b'person'],
+                'cn':[b'Michael Str\303\266der',b'Michael Stroeder'],
+                'sn':[b'Str\303\266der'],
+                'enum':[b'a',b'b',b'C'],
             },
             {
-                'objectClass':['Person'],
-                'cn':['Michael Str\303\266der','Michael Stroeder'],
+                'objectClass':[b'Person'],
+                'cn':[b'Michael Str\303\266der',b'Michael Stroeder'],
                 'sn':[],
-                'enum':['a','b','c'],
+                'enum':[b'a',b'b',b'c'],
             },
             ['objectClass'],
             [
                 (ldap.MOD_DELETE,'sn',None),
                 (ldap.MOD_DELETE,'enum',None),
-                (ldap.MOD_ADD,'enum',['a','b','c']),
+                (ldap.MOD_ADD,'enum',[b'a',b'b',b'c']),
             ]
         ),
 

From f3ff4a320a21a3ac42bc7587eaed09c4f9b2f9f5 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sat, 28 Apr 2018 14:27:54 -0700
Subject: [PATCH 765/868] Return a bool in .compare_s() and .compare_ext_s()

Previously, LDAPObject.compare_s() and LDAPObject.compare_ext_s()
returned 1 for true and 0 for false. As the return value is intended for
a bool context, return a bool instead.
---
 CHANGES                |  7 +++++++
 Doc/reference/ldap.rst | 13 ++++++-------
 Lib/ldap/ldapobject.py | 18 +++++++++---------
 Tests/t_ldapobject.py  | 12 ++++++++++++
 4 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7a5e102..8f17c2a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+----------------------------------------------------------------
+UNRELEASED
+
+Lib/
+* LDAPObject.compare_s() and LDAPObject.compare_ext_s() now return a bool
+  instead of 1 or 0.
+
 ----------------------------------------------------------------
 Released 3.0.0 2018-03-12
 
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index a3ee63c..601824b 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -704,17 +704,16 @@ and wait for and return with the server's result, or with
 
 .. py:method:: LDAPObject.compare(dn, attr, value) -> int
 
-.. py:method:: LDAPObject.compare_s(dn, attr, value) -> tuple
+.. py:method:: LDAPObject.compare_s(dn, attr, value) -> bool
 
 .. py:method:: LDAPObject.compare_ext(dn, attr, value [, serverctrls=None [, clientctrls=None]]) -> int
 
-.. py:method:: LDAPObject.compare_ext_s(dn, attr, value [, serverctrls=None [, clientctrls=None]]) -> tuple
+.. py:method:: LDAPObject.compare_ext_s(dn, attr, value [, serverctrls=None [, clientctrls=None]]) -> bool
 
-   Perform an LDAP comparison between the attribute named *attr* of
-   entry *dn*, and the value *value*. The synchronous forms
-   returns :py:const:`0` for false, or :py:const:`1` for true.
-   The asynchronous forms returns the message ID of the initiated request,
-   and the result of the asynchronous compare can be obtained using
+   Perform an LDAP comparison between the attribute named *attr* of entry *dn*,
+   and the value *value*. The synchronous forms returns ``True`` or ``False``.
+   The asynchronous forms returns the message ID of the initiated request, and
+   the result of the asynchronous compare can be obtained using
    :py:meth:`result()`.
 
    Note that the asynchronous technique yields the answer
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 36bf034..8fa71c3 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -495,14 +495,14 @@ def sasl_bind_s(self,dn,mechanism,cred,serverctrls=None,clientctrls=None):
   def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
     """
     compare_ext(dn, attr, value [,serverctrls=None[,clientctrls=None]]) -> int
-    compare_ext_s(dn, attr, value [,serverctrls=None[,clientctrls=None]]) -> int
+    compare_ext_s(dn, attr, value [,serverctrls=None[,clientctrls=None]]) -> bool
     compare(dn, attr, value) -> int
-    compare_s(dn, attr, value) -> int
-        Perform an LDAP comparison between the attribute named attr of
-        entry dn, and the value value. The synchronous form returns 0
-        for false, or 1 for true.  The asynchronous form returns the
-        message id of the initiates request, and the result of the
-        asynchronous compare can be obtained using result().
+    compare_s(dn, attr, value) -> bool
+        Perform an LDAP comparison between the attribute named attr of entry
+        dn, and the value value. The synchronous form returns True or False.
+        The asynchronous form returns the message id of the initiates request,
+        and the result of the asynchronous compare can be obtained using
+        result().
 
         Note that this latter technique yields the answer by raising
         the exception objects COMPARE_TRUE or COMPARE_FALSE.
@@ -520,9 +520,9 @@ def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
     try:
         ldap_res = self.result3(msgid,all=1,timeout=self.timeout)
     except ldap.COMPARE_TRUE:
-      return 1
+      return True
     except ldap.COMPARE_FALSE:
-      return 0
+      return False
     raise ldap.PROTOCOL_ERROR(
         'Compare operation returned wrong result: %r' % (ldap_res)
     )
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 33c2c5a..7686826 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -646,6 +646,18 @@ def test_dse_bytes(self):
             [self.server.suffix.encode('utf-8')]
         )
 
+    def test_compare_s_true(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+        result = l.compare_s('cn=Foo1,%s' % base, 'cn', 'Foo1')
+        self.assertIs(result, True)
+
+    def test_compare_s_false(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+        result = l.compare_s('cn=Foo1,%s' % base, 'cn', 'Foo2')
+        self.assertIs(result, False)
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From 8d6da14a94066e3b1e2f8d4940ba7cbb34c6fde6 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 25 May 2018 13:50:38 +0200
Subject: [PATCH 766/868] Update CHANGES for 3.1.0

---
 CHANGES | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 8f17c2a..2c04f80 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,9 +1,59 @@
 ----------------------------------------------------------------
-UNRELEASED
+Released 3.1.0 2018-05-25
+
+This release brings two minor API changes:
+- Long-deprecated functions `ldap.open()` and `ldap.init()` are removed
+- `LDAPObject.compare_s()` and `compare_ext_s` return bool instead of 0 or 1
+
+All changes since 3.0.0:
 
 Lib/
+* Remove long deprecated functions ldap.open() and ldap.init()
 * LDAPObject.compare_s() and LDAPObject.compare_ext_s() now return a bool
   instead of 1 or 0.
+* Make iteration over cidict yield same values as keys()
+* Fail if pyasn1 is not installed
+* Fix parsing of PPolicyControl ASN.1 structure
+* Use items() when appropriate in dict iteration
+* Add support for tracing LDAP calls. Tracing can now be enabled with
+  the env var PYTHON_LDAP_TRACE_LEVEL and redirected to a file with
+  PYTHON_LDAP_TRACE_FILE.
+  (This is mainly intended for debugging and internal testing; the
+  configuration or output may change in future versions.)
+
+Modules/
+* Fix ref counting bug in LDAPmessage_to_python
+
+Doc/
+* Remove warning about unreleased version
+* Doc: Replace Mac OS X -> macOS
+
+Tests/
+* Add tests and coverage for tracing
+* Disable warnings-as-errors for Python 3.4
+* Fix assertTrue to assertEqual
+* Mark several test values as bytes
+
+Lib/slapdtest/
+* Fix error message for missing commands
+* Make SlapdObject a context manager
+* Disable SASL external when missing SASL support
+* Make SlapdObject.root_dn a property
+* In SlapdObject, build include directives dynamically
+* Move import statements to top level
+
+Code style:
+* Add Makefile rules for automatic formatting of C and Python code
+* Reformat and indent all C files
+* Trim white space throughout the project
+
+Infrastructure:
+* Add py3-trace tox environment to Travis CI config
+* Add new Pytest cache directory to gitignore
+
+General:
+* Update all pypi.python.org URLs to pypi.org
+
 
 ----------------------------------------------------------------
 Released 3.0.0 2018-03-12

From a06254e6b75fb0430fc0eaa475c30bc370d18030 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 25 May 2018 13:54:20 +0200
Subject: [PATCH 767/868] Bump version to 3.1.0

---
 Lib/ldap/pkginfo.py       | 2 +-
 Lib/ldapurl.py            | 2 +-
 Lib/ldif.py               | 2 +-
 Lib/slapdtest/__init__.py | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index 47199e9..d004c5d 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.0.0'
+__version__ = '3.1.0'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 12eafdc..7a25eca 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0'
+__version__ = '3.1.0'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 3fbb2b1..3f13ec6 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.0.0'
+__version__ = '3.1.0'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 8297024..56ba2c9 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.0.0'
+__version__ = '3.1.0'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls

From f228e7c4c164e4c0aa86fa3e23a4a21e72521b0d Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Thu, 31 May 2018 20:22:21 -0700
Subject: [PATCH 768/868] Correct attr value's type to bytes in tests

Refs #212
---
 Tests/t_ldapobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 7686826..4ab63f5 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -649,13 +649,13 @@ def test_dse_bytes(self):
     def test_compare_s_true(self):
         base = self.server.suffix
         l = self._ldap_conn
-        result = l.compare_s('cn=Foo1,%s' % base, 'cn', 'Foo1')
+        result = l.compare_s('cn=Foo1,%s' % base, 'cn', b'Foo1')
         self.assertIs(result, True)
 
     def test_compare_s_false(self):
         base = self.server.suffix
         l = self._ldap_conn
-        result = l.compare_s('cn=Foo1,%s' % base, 'cn', 'Foo2')
+        result = l.compare_s('cn=Foo1,%s' % base, 'cn', b'Foo2')
         self.assertIs(result, False)
 
 

From e8cc39db0990bfb56e95c6ae1bd2f8be10e88683 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 4 Jul 2018 19:15:54 -0700
Subject: [PATCH 769/868] Docs: Fix internal set|get_option func|meth
 references

Previous syntax did not create links and appeared as raw rst syntax.

https://www.python-ldap.org/en/python-ldap-3.0.0/reference/ldap.html#options
---
 Doc/reference/ldap.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 601824b..0ce2e41 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -121,9 +121,9 @@ Options
    :manpage:`ldap.conf(5)` and :manpage:`ldap_get_option(3)`
 
 
-For use with functions :py:func:set_option() and :py:func:get_option()
-and methods :py:method:LDAPObject.set_option() and :py:method:LDAPObject.get_option() the
-following option identifiers are defined as constants:
+For use with functions :py:func:`set_option` and :py:func:`get_option` and
+methods :py:meth:`LDAPObject.set_option` and :py:meth:`LDAPObject.get_option`
+the following option identifiers are defined as constants:
 
 .. py:data:: OPT_API_FEATURE_INFO
 

From 97379aa8a8f8b5eaab472b03b3a94de5c3a91cfe Mon Sep 17 00:00:00 2001
From: "Ivan A. Melnikov" <iv@altlinux.org>
Date: Mon, 9 Jul 2018 16:15:07 +0400
Subject: [PATCH 770/868] tests: Use system-specific ENOTCONN value

The integer values for `errno` are  not standard and can vary from
platform to platform, so the tests should rely on the constants
provided in `errno` module.

Closes: #228
---
 Tests/t_cext.py       | 10 ++++++----
 Tests/t_ldapobject.py | 15 +++++++++------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 4de2b99..96c3b2c 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -7,6 +7,7 @@
 
 from __future__ import unicode_literals
 
+import errno
 import os
 import unittest
 
@@ -731,15 +732,16 @@ def test_cancel(self):
         if not self._require_attr(l, 'cancel'):         # FEATURE_CANCEL
             return
 
-    def test_errno107(self):
+    def test_enotconn(self):
         l = _ldap.initialize('ldap://127.0.0.1:42')
         try:
             m = l.simple_bind("", "")
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
         except _ldap.SERVER_DOWN as ldap_err:
-            errno = ldap_err.args[0]['errno']
-            if errno != 107:
-                self.fail("expected errno=107, got %d" % errno)
+            errno_val = ldap_err.args[0]['errno']
+            if errno_val != errno.ENOTCONN:
+                self.fail("expected errno=%d, got %d"
+                          % (errno.ENOTCONN, errno_val))
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 4ab63f5..0619d51 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -16,6 +16,7 @@
     PY2 = False
     text_type = str
 
+import errno
 import contextlib
 import linecache
 import os
@@ -451,18 +452,20 @@ def test_search_subschema_have_bytes(self):
             ]
         )
 
-    def test004_errno107(self):
+    def test004_enotconn(self):
         l = self.ldap_object_class('ldap://127.0.0.1:42')
         try:
             m = l.simple_bind_s("", "")
             r = l.result4(m, ldap.MSG_ALL, self.timeout)
         except ldap.SERVER_DOWN as ldap_err:
-            errno = ldap_err.args[0]['errno']
-            if errno != 107:
-                self.fail("expected errno=107, got %d" % errno)
+            errno_val = ldap_err.args[0]['errno']
+            if errno_val != errno.ENOTCONN:
+                self.fail("expected errno=%d, got %d"
+                          % (errno.ENOTCONN, errno_val))
             info = ldap_err.args[0]['info']
-            if info != os.strerror(107):
-                self.fail("expected info=%r, got %d" % (os.strerror(107), info))
+            expected_info = os.strerror(errno.ENOTCONN)
+            if info != expected_info:
+                self.fail("expected info=%r, got %d" % (expected_info, info))
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 

From 363e417e37daeb97439bcc34f0a9a50c336ce5f6 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Fri, 13 Jul 2018 21:09:29 -0700
Subject: [PATCH 771/868] Add testing and document support for Python 3.7

Python 3.7 was released on June 27, 2018.
---
 .travis.yml | 7 +++----
 setup.py    | 1 +
 tox.ini     | 3 ++-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 3c7e989..9ce0cdf 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -33,10 +33,12 @@ matrix:
     - python: pypy
       env:
         - TOXENV=pypy
-    - python: 3.7-dev
+    - python: 3.7
       env:
         - TOXENV=py37
         - WITH_GCOV=1
+      dist: xenial
+      sudo: true
     - python: 2.7
       env:
         - TOXENV=py2-nosasltls
@@ -51,9 +53,6 @@ matrix:
     - python: 3.6
       env: TOXENV=doc
   allow_failures:
-     - env:
-        - TOXENV=py37
-        - WITH_GCOV=1
      - env:
         - TOXENV=pypy
 
diff --git a/setup.py b/setup.py
index e1914aa..e66ecbd 100644
--- a/setup.py
+++ b/setup.py
@@ -94,6 +94,7 @@ class OpenLDAP2:
     'Programming Language :: Python :: 3.4',
     'Programming Language :: Python :: 3.5',
     'Programming Language :: Python :: 3.6',
+    'Programming Language :: Python :: 3.7',
     # Note: when updating Python versions, also change .travis.yml and tox.ini
 
     'Topic :: Database',
diff --git a/tox.ini b/tox.ini
index f7751d0..7dee491 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py34,py35,py36,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
+envlist = py27,py34,py35,py36,py37,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
 minver = 1.8
 
 [testenv]
@@ -19,6 +19,7 @@ passenv = WITH_GCOV
 commands = {envpython} -bb -Werror \
     "-Wignore:the imp module is deprecated:DeprecationWarning" \
     "-Wignore:the imp module is deprecated:PendingDeprecationWarning" \
+    "-Wignore:Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated, and in 3.8 it will stop working:DeprecationWarning" \
     -m coverage run --parallel setup.py \
         clean --all \
         test

From be8e3c6ca28ca2468aee5828073583fbe92b0c14 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 30 Jul 2018 19:01:48 +0200
Subject: [PATCH 772/868] Lib/ldap: Provide _trace atributes in non-debug mode

All use of these attributes *should* be guarded by `if __debug__`.
However, that's not always the case. Providing different API based
on __debug__ is unnecessarily fragile.

This is intended as a quick fix for a maintenance release.

Fixes: https://github.com/python-ldap/python-ldap/issues/226
---
 Lib/ldap/__init__.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 068f9e6..951f957 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -23,6 +23,13 @@
     _trace_file = open(_trace_file, 'a')
     atexit.register(_trace_file.close)
   _trace_stack_limit = None
+else:
+  # Any use of the _trace attributes should be guarded by `if __debug__`,
+  # so they should not be needed here.
+  # But, providing different API for debug mode is unnecessarily fragile.
+  _trace_level = 0
+  _trace_file = sys.stderr
+  _trace_stack_limit = None
 
 import _ldap
 assert _ldap.__version__==__version__, \

From ec41070d3fa1d00cb272f86e0c8ca55db51bdf62 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Sat, 14 Jul 2018 10:54:23 +0200
Subject: [PATCH 773/868] Add Python 3.8-dev to Tox config

---
 .travis.yml | 18 ++++++++++++++++--
 tox.ini     |  2 +-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 9ce0cdf..8146639 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -39,6 +39,13 @@ matrix:
         - WITH_GCOV=1
       dist: xenial
       sudo: true
+    - python: 3.8-dev
+      env:
+        - TOXENV=py38
+        - CFLAGS_std="-std=c99"
+        - WITH_GCOV=1
+      dist: xenial
+      sudo: true
     - python: 2.7
       env:
         - TOXENV=py2-nosasltls
@@ -53,6 +60,10 @@ matrix:
     - python: 3.6
       env: TOXENV=doc
   allow_failures:
+     - env:
+        - TOXENV=py38
+        - CFLAGS_std="-std=c99"
+        - WITH_GCOV=1
      - env:
         - TOXENV=pypy
 
@@ -61,7 +72,10 @@ env:
         # -Wno-int-in-bool-context: don't complain about PyMem_MALLOC()
         # -Werror: turn all warnings into fatal errors
         # -Werror=declaration-after-statement: strict ISO C90
-        - CFLAGS="-std=c90 -Wno-int-in-bool-context -Werror -Werror=declaration-after-statement"
+        - CFLAGS_warnings="-Wno-int-in-bool-context -Werror -Werror=declaration-after-statement"
+        # Keep C90 compatibility where possible.
+        # (Python 3.8+ headers use C99 features, so this needs to be overridable.)
+        - CFLAGS_std="-std=c90"
         # pass CFLAGS, CI (for Travis CI) and WITH_GCOV to tox tasks
         - TOX_TESTENV_PASSENV="CFLAGS CI WITH_GCOV"
 
@@ -69,7 +83,7 @@ install:
   - pip install "pip>=7.1.0"
   - pip install tox-travis tox codecov coverage
 
-script: tox
+script: CFLAGS="$CFLAGS_warnings $CFLAGS_std" tox
 
 after_success:
   # gather Python coverage
diff --git a/tox.ini b/tox.ini
index 7dee491..1434ba0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py34,py35,py36,py37,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
+envlist = py27,py34,py35,py36,py37,py38,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
 minver = 1.8
 
 [testenv]

From 7c22697600c3f49b03d393be54d9b2db81cf56c0 Mon Sep 17 00:00:00 2001
From: Simon Pichugin <simon.pichugin@gmail.com>
Date: Mon, 8 Oct 2018 18:03:59 +0200
Subject: [PATCH 774/868] Add support for X-ORIGIN in schema element class
 ObjectClass

---
 Lib/ldap/schema/models.py       | 5 ++++-
 Tests/t_ldap_schema_subentry.py | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index feb7bff..22ba6fb 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -137,7 +137,8 @@ class ObjectClass(SchemaElement):
     'AUXILIARY':None,
     'ABSTRACT':None,
     'MUST':(()),
-    'MAY':()
+    'MAY':(),
+    'X-ORIGIN':(None,)
   }
 
   def _set_attrs(self,l,d):
@@ -146,6 +147,7 @@ def _set_attrs(self,l,d):
     self.desc = d['DESC'][0]
     self.must = d['MUST']
     self.may = d['MAY']
+    self.x_origin = d['X-ORIGIN'][0]
     # Default is STRUCTURAL, see RFC2552 or draft-ietf-ldapbis-syntaxes
     self.kind = 0
     if d['ABSTRACT']!=None:
@@ -168,6 +170,7 @@ def __str__(self):
     result.append({0:' STRUCTURAL',1:' ABSTRACT',2:' AUXILIARY'}[self.kind])
     result.append(self.key_list('MUST',self.must,sep=' $ '))
     result.append(self.key_list('MAY',self.may,sep=' $ '))
+    result.append(self.key_attr('X-ORIGIN',self.x_origin,quoted=1))
     return '( %s )' % ''.join(result)
 
 
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 4e1e09b..5869b9d 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -61,7 +61,7 @@ def test_urlfetch_file(self):
             str(obj),
             "( 2.5.6.9 NAME 'groupOfNames' SUP top STRUCTURAL MUST cn "
             "MAY ( member $ businessCategory $ seeAlso $ owner $ ou $ o "
-            "$ description ) )"
+            "$ description ) X-ORIGIN 'RFC 4519' )"
         )
 
 

From ebc12dacd90da898d35252046d5af96531302ee2 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 25 Oct 2018 17:12:32 +0200
Subject: [PATCH 775/868] Add a test for X-ORIGIN

---
 Tests/t_ldap_schema_subentry.py | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 5869b9d..edce931 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -15,7 +15,7 @@
 import ldif
 from ldap.ldapobject import SimpleLDAPObject
 import ldap.schema
-from ldap.schema.models import ObjectClass
+from ldap.schema.models import ObjectClass, AttributeType
 from slapdtest import SlapdTestCase, requires_ldapi
 
 HERE = os.path.abspath(os.path.dirname(__file__))
@@ -65,6 +65,22 @@ def test_urlfetch_file(self):
         )
 
 
+class TestXOrigin(unittest.TestCase):
+    def get_attribute_type(self, oid):
+        openldap_uri = 'file://{}'.format(TEST_SUBSCHEMA_FILES[1])
+        dn, schema = ldap.schema.urlfetch(openldap_uri)
+        return schema.get_obj(AttributeType, oid)
+
+    def test_origin_none(self):
+        self.assertEqual(
+            self.get_attribute_type('2.5.4.0').x_origin, None)
+
+    def test_origin_string(self):
+        self.assertEqual(
+            self.get_attribute_type('1.3.6.1.4.1.3401.8.2.8').x_origin,
+            'Pretty Good Privacy (PGP)')
+
+
 class TestSubschemaUrlfetchSlapd(SlapdTestCase):
     ldap_object_class = SimpleLDAPObject
 

From 7ce471e238cdd9a4dd8d17baccd1c9e05e6f894a Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sun, 10 Jun 2018 11:18:30 -0700
Subject: [PATCH 776/868] In docs, use intersphinx to link to Python
 documentation

The intersphinx extension can generate automatic links to the
documentation of objects in other projects. For complete details on
intersphinx, see:

http://www.sphinx-doc.org/en/master/ext/intersphinx.html
---
 Doc/bytes_mode.rst      |  9 ++++-----
 Doc/conf.py             |  7 ++++++-
 Doc/installing.rst      | 15 ++++++---------
 Doc/sample_workflow.rst |  5 ++---
 4 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index d7c2aa4..dcd3dcb 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -93,12 +93,11 @@ to be given as well.
 Porting recommendations
 -----------------------
 
-Since end of life of Python 2 is coming in a few years,
-projects are strongly urged to make their code compatible with Python 3.
-General instructions for this are provided `in Python documentation`_ and in
-the `Conservative porting guide`_.
+Since end of life of Python 2 is coming in a few years, projects are strongly
+urged to make their code compatible with Python 3. General instructions for
+this are provided :ref:`in Python documentation <pyporting-howto>` and in the
+`Conservative porting guide`_.
 
-.. _in Python documentation: https://docs.python.org/3/howto/pyporting.html
 .. _Conservative porting guide: https://portingguide.readthedocs.io/en/latest/
 
 
diff --git a/Doc/conf.py b/Doc/conf.py
index eb9f5a0..e1fb9ee 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -31,7 +31,10 @@
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = ['sphinx.ext.autodoc']
+extensions = [
+    'sphinx.ext.autodoc',
+    'sphinx.ext.intersphinx',
+]
 
 try:
     import sphinxcontrib.spelling
@@ -148,3 +151,5 @@
 
 # If false, no module index is generated.
 latex_use_modindex = True
+
+intersphinx_mapping = {'python': ('https://docs.python.org/3', None)}
diff --git a/Doc/installing.rst b/Doc/installing.rst
index babbaf6..90187a9 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -99,10 +99,8 @@ From a source repository::
 If you have more than one Python interpreter installed locally, you should
 use the same one you plan to use python-ldap with.
 
-Further instructions can be found in `Setuptools documentation`_.
-
-
-.. _Setuptools documentation: https://docs.python.org/3/distributing/index.html
+Further instructions can be found in :ref:`Setuptools documentation
+<distributing-index>`.
 
 
 .. _build prerequisites:
@@ -169,11 +167,10 @@ Packages for building and testing::
 setup.cfg
 =========
 
-The file setup.cfg allows to set some build and installation
-parameters for reflecting the local installation of required
-software packages. Only section ``[_ldap]`` is described here.
-More information about other sections can be found in
-`Setuptools documentation`_.
+The file setup.cfg allows to set some build and installation parameters for
+reflecting the local installation of required software packages. Only section
+``[_ldap]`` is described here. More information about other sections can be
+found in :ref:`Setuptools documentation <distributing-index>`.
 
 .. data:: library_dirs
 
diff --git a/Doc/sample_workflow.rst b/Doc/sample_workflow.rst
index c2010c1..8a43553 100644
--- a/Doc/sample_workflow.rst
+++ b/Doc/sample_workflow.rst
@@ -26,15 +26,14 @@ Clone the repository::
     $ git clone https://github.com/python-ldap/python-ldap
     $ cd python-ldap
 
-Create a `virtual environment`_ to ensure you in-development python-ldap won't
-affect the rest of your system::
+Create a :mod:`virtual environment <venv>` to ensure you in-development
+python-ldap won't affect the rest of your system::
 
     $ python3 -m venv __venv__
 
 (For Python 2, install `virtualenv`_ and use it instead of ``python3 -m venv``.)
 
 .. _git: https://git-scm.com/
-.. _virtual environment: https://docs.python.org/3/library/venv.html
 .. _virtualenv: https://virtualenv.pypa.io/en/stable/
 
 Activate the virtual environment::

From 9f5a578eed70368ad8fc089b44ec2118a3c2cefb Mon Sep 17 00:00:00 2001
From: Simon Pichugin <simon.pichugin@gmail.com>
Date: Mon, 5 Nov 2018 17:35:38 +0100
Subject: [PATCH 777/868] Add docstrings for X-ORIGIN

---
 Lib/ldap/schema/models.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 22ba6fb..18d24fb 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -126,6 +126,9 @@ class ObjectClass(SchemaElement):
   sup
     This list of strings contains NAMEs or OIDs of object classes
     this object class is derived from
+  x-origin
+    This string contains the X-ORIGIN text which is typically used to indicate
+    the source of the associated schema element
   """
   schema_attribute = u'objectClasses'
   token_defaults = {
@@ -227,6 +230,9 @@ class AttributeType(SchemaElement):
   sup
     This list of strings contains NAMEs or OIDs of attribute types
     this attribute type is derived from
+  x-origin
+    This string contains the X-ORIGIN text which is typically used to indicate
+    the source of the associated schema element
   """
   schema_attribute = u'attributeTypes'
   token_defaults = {

From 7d1359c9852815a635de9ac01a2767e5b577d512 Mon Sep 17 00:00:00 2001
From: Simon Pichugin <simon.pichugin@gmail.com>
Date: Mon, 26 Nov 2018 02:19:35 +0100
Subject: [PATCH 778/868] Add multi-value support to X-ORIGIN attribute

---
 Lib/ldap/schema/models.py       | 16 ++++++++--------
 Tests/t_ldap_schema_subentry.py | 14 ++++++++++----
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 18d24fb..22affa2 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -128,7 +128,7 @@ class ObjectClass(SchemaElement):
     this object class is derived from
   x-origin
     This string contains the X-ORIGIN text which is typically used to indicate
-    the source of the associated schema element
+    the source of the associated schema element. It can a list of strings
   """
   schema_attribute = u'objectClasses'
   token_defaults = {
@@ -141,7 +141,7 @@ class ObjectClass(SchemaElement):
     'ABSTRACT':None,
     'MUST':(()),
     'MAY':(),
-    'X-ORIGIN':(None,)
+    'X-ORIGIN':()
   }
 
   def _set_attrs(self,l,d):
@@ -150,7 +150,7 @@ def _set_attrs(self,l,d):
     self.desc = d['DESC'][0]
     self.must = d['MUST']
     self.may = d['MAY']
-    self.x_origin = d['X-ORIGIN'][0]
+    self.x_origin = d['X-ORIGIN']
     # Default is STRUCTURAL, see RFC2552 or draft-ietf-ldapbis-syntaxes
     self.kind = 0
     if d['ABSTRACT']!=None:
@@ -173,7 +173,7 @@ def __str__(self):
     result.append({0:' STRUCTURAL',1:' ABSTRACT',2:' AUXILIARY'}[self.kind])
     result.append(self.key_list('MUST',self.must,sep=' $ '))
     result.append(self.key_list('MAY',self.may,sep=' $ '))
-    result.append(self.key_attr('X-ORIGIN',self.x_origin,quoted=1))
+    result.append(self.key_list('X-ORIGIN',self.x_origin,quoted=1))
     return '( %s )' % ''.join(result)
 
 
@@ -232,7 +232,7 @@ class AttributeType(SchemaElement):
     this attribute type is derived from
   x-origin
     This string contains the X-ORIGIN text which is typically used to indicate
-    the source of the associated schema element
+    the source of the associated schema element. It can a list of strings
   """
   schema_attribute = u'attributeTypes'
   token_defaults = {
@@ -248,7 +248,7 @@ class AttributeType(SchemaElement):
     'COLLECTIVE':None,
     'NO-USER-MODIFICATION':None,
     'USAGE':('userApplications',),
-    'X-ORIGIN':(None,),
+    'X-ORIGIN':(),
     'X-ORDERED':(None,),
   }
 
@@ -260,7 +260,7 @@ def _set_attrs(self,l,d):
     self.equality = d['EQUALITY'][0]
     self.ordering = d['ORDERING'][0]
     self.substr = d['SUBSTR'][0]
-    self.x_origin = d['X-ORIGIN'][0]
+    self.x_origin = d['X-ORIGIN']
     self.x_ordered = d['X-ORDERED'][0]
     try:
       syntax = d['SYNTAX'][0]
@@ -311,7 +311,7 @@ def __str__(self):
         3:" USAGE dSAOperation",
       }[self.usage]
     )
-    result.append(self.key_attr('X-ORIGIN',self.x_origin,quoted=1))
+    result.append(self.key_list('X-ORIGIN',self.x_origin,quoted=1))
     result.append(self.key_attr('X-ORDERED',self.x_ordered,quoted=1))
     return '( %s )' % ''.join(result)
 
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index edce931..3fc394d 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -67,18 +67,24 @@ def test_urlfetch_file(self):
 
 class TestXOrigin(unittest.TestCase):
     def get_attribute_type(self, oid):
-        openldap_uri = 'file://{}'.format(TEST_SUBSCHEMA_FILES[1])
+        openldap_uri = 'file://{}'.format(TEST_SUBSCHEMA_FILES[0])
         dn, schema = ldap.schema.urlfetch(openldap_uri)
         return schema.get_obj(AttributeType, oid)
 
     def test_origin_none(self):
         self.assertEqual(
-            self.get_attribute_type('2.5.4.0').x_origin, None)
+            self.get_attribute_type('2.16.840.1.113719.1.301.4.24.1').x_origin,
+            ())
 
     def test_origin_string(self):
         self.assertEqual(
-            self.get_attribute_type('1.3.6.1.4.1.3401.8.2.8').x_origin,
-            'Pretty Good Privacy (PGP)')
+            self.get_attribute_type('2.16.840.1.113730.3.1.2091').x_origin,
+            ('Netscape',))
+
+    def test_origin_multi_valued(self):
+        self.assertEqual(
+            self.get_attribute_type('1.3.6.1.4.1.11.1.3.1.1.3').x_origin,
+            ('RFC4876', 'user defined'))
 
 
 class TestSubschemaUrlfetchSlapd(SlapdTestCase):

From cd35f1c1a50073ab3a49cac7d6c15685fe8e1e38 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 4 Jan 2019 16:20:41 +0100
Subject: [PATCH 779/868] Test the stringification of X-ORIGIN in schema
 attributes

---
 Tests/t_ldap_schema_subentry.py | 56 +++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 3fc394d..fd006a7 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -86,6 +86,62 @@ def test_origin_multi_valued(self):
             self.get_attribute_type('1.3.6.1.4.1.11.1.3.1.1.3').x_origin,
             ('RFC4876', 'user defined'))
 
+    def test_origin_none_str(self):
+        """Check string representation of an attribute without X-ORIGIN"""
+        # This should check that the representation:
+        # - does not contain X-ORIGIN, and
+        # - is still syntactically valid.
+        # Checking the full output makes the test simpler,
+        # though might need to be adjusted in the future.
+        self.assertEqual(
+            str(self.get_attribute_type('2.16.840.1.113719.1.301.4.24.1')),
+            (
+                "( 2.16.840.1.113719.1.301.4.24.1 "
+                + "NAME 'krbHostServer' "
+                + "EQUALITY caseExactIA5Match "
+                + "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )"
+            ),
+        )
+
+    def test_origin_string_str(self):
+        """Check string representation of an attr with single-value X-ORIGIN"""
+        # This should check that the representation:
+        # - has the X-ORIGIN entry 'Netscape' with no parentheses, and
+        # - is still syntactically valid.
+        # Checking the full output makes the test simpler,
+        # though might need to be adjusted in the future.
+        self.assertEqual(
+            str(self.get_attribute_type('2.16.840.1.113730.3.1.2091')),
+            (
+                "( 2.16.840.1.113730.3.1.2091 "
+                + "NAME 'nsslapd-suffix' "
+                + "DESC 'Netscape defined attribute type' "
+                + "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
+                + "X-ORIGIN 'Netscape' )"
+            ),
+        )
+
+    def test_origin_multi_valued_str(self):
+        """Check string representation of an attr with multi-value X-ORIGIN"""
+        # This should check that the representation:
+        # - has a parenthesized X-ORIGIN entry, and
+        # - is still syntactically valid.
+        # Checking the full output makes the test simpler,
+        # though might need to be adjusted in the future.
+        self.assertEqual(
+            str(self.get_attribute_type('1.3.6.1.4.1.11.1.3.1.1.3')),
+            (
+                "( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' "
+                + "DESC 'Maximum time an agent or service allows for a search "
+                + "to complete' "
+                + "EQUALITY integerMatch "
+                + "ORDERING integerOrderingMatch "
+                + "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 "
+                + "SINGLE-VALUE "
+                + "X-ORIGIN ( 'RFC4876' 'user defined' ) )"
+            ),
+        )
+
 
 class TestSubschemaUrlfetchSlapd(SlapdTestCase):
     ldap_object_class = SimpleLDAPObject

From c186345d6846bcf1738ac752540964ccd37bcd0f Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 4 Jan 2019 16:37:16 +0100
Subject: [PATCH 780/868] Test behavior of setting x_origin

---
 Tests/t_ldap_schema_subentry.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index fd006a7..2baea16 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -142,6 +142,24 @@ def test_origin_multi_valued_str(self):
             ),
         )
 
+    def test_set_origin_str(self):
+        """Check that setting X-ORIGIN to a string makes entry unusable"""
+        attr = self.get_attribute_type('2.16.840.1.113719.1.301.4.24.1')
+        attr.x_origin = 'Netscape'
+        self.assertRaises(AssertionError, str, attr)
+
+    def test_set_origin_list(self):
+        """Check that setting X-ORIGIN to a list makes entry unusable"""
+        attr = self.get_attribute_type('2.16.840.1.113719.1.301.4.24.1')
+        attr.x_origin = []
+        self.assertRaises(AssertionError, str, attr)
+
+    def test_set_origin_tuple(self):
+        """Check that setting X-ORIGIN to a tuple works"""
+        attr = self.get_attribute_type('2.16.840.1.113719.1.301.4.24.1')
+        attr.x_origin = ('user defined',)
+        self.assertIn(" X-ORIGIN 'user defined' ", str(attr))
+
 
 class TestSubschemaUrlfetchSlapd(SlapdTestCase):
     ldap_object_class = SimpleLDAPObject

From 2dc4ebd6f698c8aac6f4178bb8ae76bdff73778a Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 4 Jan 2019 16:38:17 +0100
Subject: [PATCH 781/868] Fix x_origin (not x-origin) attribute name in docs

---
 Lib/ldap/schema/models.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 22affa2..96246c2 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -126,7 +126,7 @@ class ObjectClass(SchemaElement):
   sup
     This list of strings contains NAMEs or OIDs of object classes
     this object class is derived from
-  x-origin
+  x_origin
     This string contains the X-ORIGIN text which is typically used to indicate
     the source of the associated schema element. It can a list of strings
   """
@@ -230,7 +230,7 @@ class AttributeType(SchemaElement):
   sup
     This list of strings contains NAMEs or OIDs of attribute types
     this attribute type is derived from
-  x-origin
+  x_origin
     This string contains the X-ORIGIN text which is typically used to indicate
     the source of the associated schema element. It can a list of strings
   """

From 7b76b00af4d31937b3bca9b9498d117f651a9487 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 4 Jan 2019 16:58:21 +0100
Subject: [PATCH 782/868] Fix and reword docs of schema elements

The sequences are always tuples, not lists.
String attributes are None when missing.
---
 Lib/ldap/schema/models.py | 126 ++++++++++++++++++++------------------
 1 file changed, 68 insertions(+), 58 deletions(-)

diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 96246c2..7520b2b 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -106,29 +106,32 @@ class ObjectClass(SchemaElement):
   oid
     OID assigned to the object class
   names
-    This list of strings contains all NAMEs of the object class
+    All NAMEs of the object class (tuple of strings)
   desc
-    This string contains description text (DESC) of the object class
+    Description text (DESC) of the object class (string, or None if missing)
   obsolete
     Integer flag (0 or 1) indicating whether the object class is marked
     as OBSOLETE in the schema
   must
-    This list of strings contains NAMEs or OIDs of all attributes
-    an entry of the object class must have
+    NAMEs or OIDs of all attributes an entry of the object class must have
+    (tuple of strings)
   may
-    This list of strings contains NAMEs or OIDs of additional attributes
-    an entry of the object class may have
+    NAMEs or OIDs of additional attributes an entry of the object class may
+    have (tuple of strings)
   kind
     Kind of an object class:
     0 = STRUCTURAL,
     1 = ABSTRACT,
     2 = AUXILIARY
   sup
-    This list of strings contains NAMEs or OIDs of object classes
-    this object class is derived from
+    NAMEs or OIDs of object classes this object class is derived from
+    (tuple of strings)
   x_origin
-    This string contains the X-ORIGIN text which is typically used to indicate
-    the source of the associated schema element. It can a list of strings
+    Value of the X-ORIGIN extension flag (tuple of strings)
+
+    Although it's not official, X-ORIGIN is used in several LDAP server
+    implementations to indicate the source of the associated schema
+    element
   """
   schema_attribute = u'objectClasses'
   token_defaults = {
@@ -196,11 +199,11 @@ class AttributeType(SchemaElement):
   Class attributes:
 
   oid
-    OID assigned to the attribute type
+    OID assigned to the attribute type (string)
   names
-    This list of strings contains all NAMEs of the attribute type
+    All NAMEs of the attribute type (tuple of strings)
   desc
-    This string contains description text (DESC) of the attribute type
+    Description text (DESC) of the attribute type (string, or None if missing)
   obsolete
     Integer flag (0 or 1) indicating whether the attribute type is marked
     as OBSOLETE in the schema
@@ -208,19 +211,19 @@ class AttributeType(SchemaElement):
     Integer flag (0 or 1) indicating whether the attribute must
     have only one value
   syntax
-    String contains OID of the LDAP syntax assigned to the attribute type
+    OID of the LDAP syntax assigned to the attribute type
   no_user_mod
     Integer flag (0 or 1) indicating whether the attribute is modifiable
     by a client application
   equality
-    String contains NAME or OID of the matching rule used for
-    checking whether attribute values are equal
+    NAME or OID of the matching rule used for checking whether attribute values
+    are equal (string, or None if missing)
   substr
-    String contains NAME or OID of the matching rule used for
-    checking whether an attribute value contains another value
+    NAME or OID of the matching rule used for checking whether an attribute
+    value contains another value (string, or None if missing)
   ordering
-    String contains NAME or OID of the matching rule used for
-    checking whether attribute values are lesser-equal than
+    NAME or OID of the matching rule used for checking whether attribute values
+    are lesser-equal than (string, or None if missing)
   usage
     USAGE of an attribute type:
     0 = userApplications
@@ -228,11 +231,14 @@ class AttributeType(SchemaElement):
     2 = distributedOperation,
     3 = dSAOperation
   sup
-    This list of strings contains NAMEs or OIDs of attribute types
-    this attribute type is derived from
+    NAMEs or OIDs of attribute types this attribute type is derived from
+    (tuple of strings)
   x_origin
-    This string contains the X-ORIGIN text which is typically used to indicate
-    the source of the associated schema element. It can a list of strings
+    Value of the X-ORIGIN extension flag (tuple of strings).
+
+    Although it's not official, X-ORIGIN is used in several LDAP server
+    implementations to indicate the source of the associated schema
+    element
   """
   schema_attribute = u'attributeTypes'
   token_defaults = {
@@ -323,7 +329,7 @@ class LDAPSyntax(SchemaElement):
   oid
     OID assigned to the LDAP syntax
   desc
-    This string contains description text (DESC) of the LDAP syntax
+    Description text (DESC) of the LDAP syntax (string, or None if missing)
   not_human_readable
     Integer flag (0 or 1) indicating whether the attribute type is marked
     as not human-readable (X-NOT-HUMAN-READABLE)
@@ -367,14 +373,15 @@ class MatchingRule(SchemaElement):
   oid
     OID assigned to the matching rule
   names
-    This list of strings contains all NAMEs of the matching rule
+    All NAMEs of the matching rule (tuple of strings)
   desc
-    This string contains description text (DESC) of the matching rule
+    Description text (DESC) of the matching rule
   obsolete
     Integer flag (0 or 1) indicating whether the matching rule is marked
     as OBSOLETE in the schema
   syntax
-    String contains OID of the LDAP syntax this matching rule is usable with
+    OID of the LDAP syntax this matching rule is usable with
+    (string, or None if missing)
   """
   schema_attribute = u'matchingRules'
   token_defaults = {
@@ -412,15 +419,15 @@ class MatchingRuleUse(SchemaElement):
   oid
     OID of the accompanying matching rule
   names
-    This list of strings contains all NAMEs of the matching rule
+    All NAMEs of the matching rule (tuple of strings)
   desc
-    This string contains description text (DESC) of the matching rule
+    Description text (DESC) of the matching rule (string, or None if missing)
   obsolete
     Integer flag (0 or 1) indicating whether the matching rule is marked
     as OBSOLETE in the schema
   applies
-    This list of strings contains NAMEs or OIDs of attribute types
-    for which this matching rule is used
+    NAMEs or OIDs of attribute types for which this matching rule is used
+    (tuple of strings)
   """
   schema_attribute = u'matchingRuleUse'
   token_defaults = {
@@ -458,26 +465,29 @@ class DITContentRule(SchemaElement):
   oid
     OID of the accompanying structural object class
   names
-    This list of strings contains all NAMEs of the DIT content rule
+    All NAMEs of the DIT content rule (tuple of strings)
   desc
-    This string contains description text (DESC) of the DIT content rule
+    Description text (DESC) of the DIT content rule
+    (string, or None if missing)
   obsolete
     Integer flag (0 or 1) indicating whether the DIT content rule is marked
     as OBSOLETE in the schema
   aux
-    This list of strings contains NAMEs or OIDs of all auxiliary
-    object classes usable in an entry of the object class
+    NAMEs or OIDs of all auxiliary object classes usable in an entry of the
+    object class (tuple of strings)
   must
-    This list of strings contains NAMEs or OIDs of all attributes
-    an entry of the object class must have which may extend the
-    list of required attributes of the object classes of an entry
+    NAMEs or OIDs of all attributes an entry of the object class must
+    have, which may extend the list of required attributes of the object
+    classes of an entry.
+    (tuple of strings)
   may
-    This list of strings contains NAMEs or OIDs of additional attributes
-    an entry of the object class may have which may extend the
-    list of optional attributes of the object classes of an entry
+    NAMEs or OIDs of additional attributes an entry of the object class may
+    have. which may extend the list of optional attributes of the object
+    classes of an entry.
+    (tuple of strings)
   nots
-    This list of strings contains NAMEs or OIDs of attributes which
-    may not be present in an entry of the object class
+    NAMEs or OIDs of attributes which may not be present in an entry of the
+    object class. (tuple of strings)
   """
   schema_attribute = u'dITContentRules'
   token_defaults = {
@@ -524,17 +534,18 @@ class DITStructureRule(SchemaElement):
   ruleid
     rule ID of the DIT structure rule (only locally unique)
   names
-    This list of strings contains all NAMEs of the DIT structure rule
+    All NAMEs of the DIT structure rule (tuple of strings)
   desc
-    This string contains description text (DESC) of the DIT structure rule
+    Description text (DESC) of the DIT structure rule
+    (string, or None if missing)
   obsolete
     Integer flag (0 or 1) indicating whether the DIT content rule is marked
     as OBSOLETE in the schema
   form
-    List of strings with NAMEs or OIDs of associated name forms
+    NAMEs or OIDs of associated name forms (tuple of strings)
   sup
-    List of strings with NAMEs or OIDs of allowed structural object classes
-    of superior entries in the DIT
+    NAMEs or OIDs of allowed structural object classes
+    of superior entries in the DIT (tuple of strings)
   """
   schema_attribute = u'dITStructureRules'
 
@@ -582,23 +593,22 @@ class NameForm(SchemaElement):
   oid
     OID of the name form
   names
-    This list of strings contains all NAMEs of the name form
+    All NAMEs of the name form (tuple of strings)
   desc
-    This string contains description text (DESC) of the name form
+    Description text (DESC) of the name form (string, or None if missing)
   obsolete
     Integer flag (0 or 1) indicating whether the name form is marked
     as OBSOLETE in the schema
   form
-    List of strings with NAMEs or OIDs of associated name forms
+    NAMEs or OIDs of associated name forms (tuple of strings)
   oc
-    String with NAME or OID of structural object classes this name form
-    is usable with
+    NAME or OID of structural object classes this name form
+    is usable with (string)
   must
-    This list of strings contains NAMEs or OIDs of all attributes
-    an RDN must contain
+    NAMEs or OIDs of all attributes an RDN must contain (tuple of strings)
   may
-    This list of strings contains NAMEs or OIDs of additional attributes
-    an RDN may contain
+    NAMEs or OIDs of additional attributes an RDN may contain
+    (tuple of strings)
   """
   schema_attribute = u'nameForms'
   token_defaults = {

From 9c48d3e348e76fdb11c707e2ac58d5a1bdc1d0ee Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 4 Jan 2019 17:43:03 +0100
Subject: [PATCH 783/868] Test types and values of ObjectClass and
 AttributeType attributes

---
 Tests/t_ldap_schema_subentry.py | 76 +++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index 2baea16..e05c957 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -161,6 +161,82 @@ def test_set_origin_tuple(self):
         self.assertIn(" X-ORIGIN 'user defined' ", str(attr))
 
 
+class TestAttributes(unittest.TestCase):
+    def get_schema(self):
+        openldap_uri = 'file://{}'.format(TEST_SUBSCHEMA_FILES[0])
+        dn, schema = ldap.schema.urlfetch(openldap_uri)
+        return schema
+
+    def test_empty_attributetype_attrs(self):
+        """Check types and values of attributes of a minimal AttributeType"""
+        # (OID 2.999 is actually "/Example", for use in documentation)
+        attr = AttributeType('( 2.999 )')
+        self.assertEqual(attr.oid, '2.999')
+        self.assertEqual(attr.names, ())
+        self.assertEqual(attr.desc, None)
+        self.assertEqual(attr.obsolete, False)
+        self.assertEqual(attr.single_value, False)
+        self.assertEqual(attr.syntax, None)
+        self.assertEqual(attr.no_user_mod, False)
+        self.assertEqual(attr.equality, None)
+        self.assertEqual(attr.substr, None)
+        self.assertEqual(attr.ordering, None)
+        self.assertEqual(attr.usage, 0)
+        self.assertEqual(attr.sup, ())
+        self.assertEqual(attr.x_origin, ())
+
+    def test_empty_objectclass_attrs(self):
+        """Check types and values of attributes of a minimal ObjectClass"""
+        # (OID 2.999 is actually "/Example", for use in documentation)
+        cls = ObjectClass('( 2.999 )')
+        self.assertEqual(cls.oid, '2.999')
+        self.assertEqual(cls.names, ())
+        self.assertEqual(cls.desc, None)
+        self.assertEqual(cls.obsolete, False)
+        self.assertEqual(cls.must, ())
+        self.assertEqual(cls.may, ())
+        self.assertEqual(cls.kind, 0)
+        self.assertEqual(cls.sup, ('top',))
+        self.assertEqual(cls.x_origin, ())
+
+    def test_attributetype_attrs(self):
+        """Check types and values of an AttributeType object's attributes"""
+        schema = self.get_schema()
+        attr = schema.get_obj(AttributeType, '1.3.6.1.4.1.11.1.3.1.1.3')
+        expected_desc = (
+            'Maximum time an agent or service allows for a search to complete'
+        )
+        self.assertEqual(attr.oid, '1.3.6.1.4.1.11.1.3.1.1.3')
+        self.assertEqual(attr.names, ('searchTimeLimit',))
+        self.assertEqual(attr.desc, expected_desc)
+        self.assertEqual(attr.obsolete, False)
+        self.assertEqual(attr.single_value, True)
+        self.assertEqual(attr.syntax, '1.3.6.1.4.1.1466.115.121.1.27')
+        self.assertEqual(attr.no_user_mod, False)
+        self.assertEqual(attr.equality, 'integerMatch')
+        self.assertEqual(attr.ordering, 'integerOrderingMatch')
+        self.assertEqual(attr.sup, ())
+        self.assertEqual(attr.x_origin, ('RFC4876', 'user defined'))
+
+    def test_objectclass_attrs(self):
+        """Check types and values of an ObjectClass object's attributes"""
+        schema = self.get_schema()
+        cls = schema.get_obj(ObjectClass, '2.5.6.9')
+        expected_may = (
+            'member', 'businessCategory', 'seeAlso', 'owner', 'ou', 'o',
+            'description',
+        )
+        self.assertEqual(cls.oid, '2.5.6.9')
+        self.assertEqual(cls.names, ('groupOfNames',))
+        self.assertEqual(cls.desc, None)
+        self.assertEqual(cls.obsolete, False)
+        self.assertEqual(cls.must, ('cn',))
+        self.assertEqual(cls.may, expected_may)
+        self.assertEqual(cls.kind, 0)
+        self.assertEqual(cls.sup, ('top',))
+        self.assertEqual(cls.x_origin, ('RFC 4519',))
+
+
 class TestSubschemaUrlfetchSlapd(SlapdTestCase):
     ldap_object_class = SimpleLDAPObject
 

From 576d5bf84aa7fc65bb9fdb53b0ad9ee169f4e171 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Mon, 7 Jan 2019 17:38:14 +0100
Subject: [PATCH 784/868] Make initialize() pass extra keyword arguments to
 LDAPObject

Make initialize() pass extra keyword arguments to LDAPObject

Fixes: https://github.com/python-ldap/python-ldap/issues/249

For docs, use signatures and doc from the code (and docstrings) using Sphinx
autodoc.

https://github.com/python-ldap/python-ldap/pull/250
---
 Doc/reference/ldap.rst | 31 ++++++++-----------------------
 Lib/ldap/functions.py  | 11 +++++++++--
 Lib/ldap/ldapobject.py | 27 +++++++++++++++++----------
 3 files changed, 34 insertions(+), 35 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 0ce2e41..b13aa6f 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -63,6 +63,8 @@ This module defines the following functions:
    :py:const:`2` for logging the method calls with arguments and the complete results and
    :py:const:`9` for also logging the traceback of method calls.
 
+   Additional keyword arguments are passed to :class:`LDAPObject`.
+
    .. seealso::
 
       :rfc:`4516` - Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator
@@ -579,33 +581,16 @@ LDAPObject classes
 
 .. py:class:: LDAPObject
 
-   Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`
-   and :py:func:`open()` (deprecated). The connection is automatically unbound
+   Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`.
+   The connection is automatically unbound
    and closed when the LDAP object is deleted.
 
-   Internally :py:class:`LDAPObject` is set to :py:class:`SimpleLDAPObject`
-   by default.
-
-.. py:class:: SimpleLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5]]])
-
-   This basic class wraps all methods of the underlying C API object.
-
-   The arguments are same like for function :py:func:`initialize()`.
-
-.. py:class:: ReconnectLDAPObject(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=5] [, retry_max=1 [, retry_delay=60.0]]]])
-
-   This class is derived from :py:class:`SimpleLDAPObject` and used for automatic
-   reconnects when using the synchronous request methods (see below). This class
-   also implements the pickle protocol.
-
-   The first arguments are same like for function :py:func:`initialize()`.
-
-   For automatic reconnects it has additional arguments:
+   Internally :py:class:`LDAPObject` is set to
+   :py:class:`~ldap.ldapobject.SimpleLDAPObject` by default.
 
-   *retry_max* specifies the number of reconnect attempts before
-   re-raising the :py:exc:`ldap.SERVER_DOWN` exception.
+.. autoclass:: ldap.ldapobject.SimpleLDAPObject
 
-   *retry_delay* specifies the time in seconds between reconnect attempts.
+.. autoclass:: ldap.ldapobject.ReconnectLDAPObject
 
 
 .. _ldap-controls:
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index ae83d08..529c4c8 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -65,7 +65,10 @@ def _ldap_function_call(lock,func,*args,**kwargs):
   return result
 
 
-def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None, bytes_mode=None):
+def initialize(
+    uri, trace_level=0, trace_file=sys.stdout, trace_stack_limit=None,
+    bytes_mode=None, **kwargs
+):
   """
   Return LDAPObject instance by opening LDAP connection to
   LDAP host specified by LDAP URL
@@ -81,8 +84,12 @@ def initialize(uri,trace_level=0,trace_file=sys.stdout,trace_stack_limit=None, b
         Default is to use stdout.
   bytes_mode
         Whether to enable :ref:`bytes_mode` for backwards compatibility under Py2.
+
+  Additional keyword arguments (such as ``bytes_strictness``) are
+  passed to ``LDAPObject``.
   """
-  return LDAPObject(uri,trace_level,trace_file,trace_stack_limit,bytes_mode)
+  return LDAPObject(
+      uri, trace_level, trace_file, trace_stack_limit, bytes_mode, **kwargs)
 
 
 def get_option(option):
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index 8fa71c3..e4e6841 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -76,7 +76,9 @@ class NO_UNIQUE_ENTRY(ldap.NO_SUCH_OBJECT):
 
 class SimpleLDAPObject:
   """
-  Drop-in wrapper class around _ldap.LDAPObject
+  This basic class wraps all methods of the underlying C API object.
+
+  The arguments are same as for the :func:`~ldap.initialize()` function.
   """
 
   CLASSATTR_OPTION_MAPPING = {
@@ -1057,15 +1059,20 @@ def get_naming_contexts(self):
 
 class ReconnectLDAPObject(SimpleLDAPObject):
   """
-  In case of server failure (ldap.SERVER_DOWN) the implementations
-  of all synchronous operation methods (search_s() etc.) are doing
-  an automatic reconnect and rebind and will retry the very same
-  operation.
-
-  This is very handy for broken LDAP server implementations
-  (e.g. in Lotus Domino) which drop connections very often making
-  it impossible to have a long-lasting control flow in the
-  application.
+  :py:class:`SimpleLDAPObject` subclass whose synchronous request methods
+  automatically reconnect and re-try in case of server failure
+  (:exc:`ldap.SERVER_DOWN`).
+
+  The first arguments are same as for the :py:func:`~ldap.initialize()`
+  function.
+  For automatic reconnects it has additional arguments:
+
+  * retry_max: specifies the number of reconnect attempts before
+    re-raising the :py:exc:`ldap.SERVER_DOWN` exception.
+
+  * retry_delay: specifies the time in seconds between reconnect attempts.
+
+  This class also implements the pickle protocol.
   """
 
   __transient_attrs__ = {

From 2059c13bf1adbec16875cf81230ea4f78561136b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Wed, 30 Jan 2019 13:47:34 +0000
Subject: [PATCH 785/868] Lib/ldap/controls/sss: use str instead of basestring
 on Python 3

* Python 3 has no basestring, use str instead
* Add a very minimal test to create a SSSRequestControl


Fixes: https://github.com/python-ldap/python-ldap/issues/255
---
 Lib/ldap/controls/sss.py     |  6 ++++++
 Tests/t_ldap_controls_sss.py | 17 +++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 Tests/t_ldap_controls_sss.py

diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index a5312d2..5cdfbda 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -12,6 +12,8 @@
 ]
 
 
+import sys
+
 import ldap
 from ldap.ldapobject import LDAPObject
 from ldap.controls import (RequestControl, ResponseControl,
@@ -20,6 +22,10 @@
 from pyasn1.type import univ, namedtype, tag, namedval, constraint
 from pyasn1.codec.ber import encoder, decoder
 
+PY2 = sys.version_info[0] <= 2
+if not PY2:
+  basestring = str
+
 
 #    SortKeyList ::= SEQUENCE OF SEQUENCE {
 #                     attributeType   AttributeDescription,
diff --git a/Tests/t_ldap_controls_sss.py b/Tests/t_ldap_controls_sss.py
new file mode 100644
index 0000000..b510fcb
--- /dev/null
+++ b/Tests/t_ldap_controls_sss.py
@@ -0,0 +1,17 @@
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+from ldap.controls import sss
+
+
+class TestControlsPPolicy(unittest.TestCase):
+    def test_create_sss_request_control(self):
+        control = sss.SSSRequestControl(ordering_rules=['-uidNumber'])
+        self.assertEqual(control.ordering_rules, ['-uidNumber'])
+
+
+if __name__ == '__main__':
+    unittest.main()

From 7fb02c0aed8cb97384515d7681c29880326c1909 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Wed, 30 Jan 2019 18:09:21 +0100
Subject: [PATCH 786/868] Add Doc/requirements.txt for Read the Docs build
 (#260)

The documentation build uses docstrings from the code, and so it
needs the code to be importable.
We already use a fake _ldap module for cases where the C compiler
is not available, like on Read the Docs.

Another issue on Read the Docs is that the pyasn1 dependency needs
to be installed. This can't be done automatically via setup.py
install, as that would attempt to build C code.

Instead, add a documentation-only "requirements.txt", which we can
point Read the Docs to.
---
 Doc/requirements.txt | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 Doc/requirements.txt

diff --git a/Doc/requirements.txt b/Doc/requirements.txt
new file mode 100644
index 0000000..7102362
--- /dev/null
+++ b/Doc/requirements.txt
@@ -0,0 +1,2 @@
+pyasn1
+pyasn1_modules

From adf47613f2df5a9b080d00f9b2632da556a61ea8 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 12 Mar 2019 16:01:16 +0100
Subject: [PATCH 787/868] Bump version to 3.2.0 and update the changelog

---
 CHANGES                   | 23 +++++++++++++++++++++++
 Lib/ldap/pkginfo.py       |  2 +-
 Lib/ldapurl.py            |  2 +-
 Lib/ldif.py               |  2 +-
 Lib/slapdtest/__init__.py |  2 +-
 5 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2c04f80..6e37016 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,26 @@
+----------------------------------------------------------------
+Released 3.2.0 2019-03-13
+
+Lib/
+* Add support for X-ORIGIN in ldap.schema's ObjectClass
+* Make initialize() pass extra keyword arguments to LDAPObject
+* ldap.controls.sss: use str instead of basestring on Python 3
+* Provide ldap._trace_* atributes in non-debug mode
+
+Doc/
+* Fix ReST syntax for links to set_option and get_option
+
+Tests/
+* Use intersphinx to link to Python documentation
+* Correct type of some attribute values to bytes
+* Use system-specific ENOTCONN value
+
+Infrastructure:
+* Add testing and document support for Python 3.7
+* Add Python 3.8-dev to Tox and CI configuration
+* Add Doc/requirements.txt for building on Read the Docs
+
+
 ----------------------------------------------------------------
 Released 3.1.0 2018-05-25
 
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index d004c5d..df29b60 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.1.0'
+__version__ = '3.2.0'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7a25eca..6de0645 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.1.0'
+__version__ = '3.2.0'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index 3f13ec6..a26c8ac 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.1.0'
+__version__ = '3.2.0'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 56ba2c9..6b8c986 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.1.0'
+__version__ = '3.2.0'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls

From adf9dc402380572b1d3b5bc6fa1d353bbed35074 Mon Sep 17 00:00:00 2001
From: Jonathon Reinhart <JonathonReinhart@users.noreply.github.com>
Date: Tue, 9 Apr 2019 07:49:52 -0400
Subject: [PATCH 788/868] Update FAQ to include Samba AD-DC error message
 (GH-276)

See https://github.com/python-ldap/python-ldap/issues/275
---
 Doc/faq.rst | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Doc/faq.rst b/Doc/faq.rst
index c2e7e15..38a645f 100644
--- a/Doc/faq.rst
+++ b/Doc/faq.rst
@@ -45,10 +45,10 @@ That used to work, but after an upgrade it does not work anymore. Why?
     providing the full functionality.
 
 **Q**: My script bound to MS Active Directory but a a search operation results
-in the exception :exc:`ldap.OPERATIONS_ERROR` with the diagnostic messages text
-“In order to perform this operation a successful bind must be
-completed on the connection.”
-What's happening here?
+in the exception :exc:`ldap.OPERATIONS_ERROR` with the diagnostic message text
+*“In order to perform this operation a successful bind must be completed on the
+connection.”* Alternatively, a Samba 4 AD returns the diagnostic message
+*"Operation unavailable without authentication"*. What's happening here?
 
     **A**: When searching from the domain level, MS AD returns referrals (search continuations)
     for some objects to indicate to the client where to look for these objects.

From 95e1d1a8aa9e6aa036f085af1ace3c295e78412b Mon Sep 17 00:00:00 2001
From: Daniel Li <lidan@deshaw.com>
Date: Tue, 21 May 2019 10:40:32 -0400
Subject: [PATCH 789/868] Fix thread support check for Python 3

Fixes https://github.com/python-ldap/python-ldap/issues/289.
---
 Lib/ldap/__init__.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 951f957..8d67573 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -54,11 +54,10 @@ def release(self):
 
 try:
   # Check if Python installation was build with thread support
-  import thread
+  import threading
 except ImportError:
   LDAPLockBaseClass = DummyLock
 else:
-  import threading
   LDAPLockBaseClass = threading.Lock
 
 

From 1d373da3746842b4c09f933896f3b37c4b36cd88 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 24 May 2019 13:12:13 +0200
Subject: [PATCH 790/868] Fix TypeError in compare_s, test and document error
 behavior

Pass ``(ldap_res,)`` tuple to string formatting instead of ``ldap_res``.
This changes fixes ``TypeError: not all arguments converted during string
formatting``.

https://github.com/python-ldap/python-ldap/pull/271

Fixes: https://github.com/python-ldap/python-ldap/issues/270
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap.rst |  4 +++-
 Lib/ldap/ldapobject.py |  2 +-
 Tests/t_ldapobject.py  | 12 ++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index b13aa6f..69e2462 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -699,7 +699,9 @@ and wait for and return with the server's result, or with
    and the value *value*. The synchronous forms returns ``True`` or ``False``.
    The asynchronous forms returns the message ID of the initiated request, and
    the result of the asynchronous compare can be obtained using
-   :py:meth:`result()`.
+   :py:meth:`result()`. The operation can fail with an exception, e.g.
+   :py:exc:`ldap.NO_SUCH_OBJECT` when *dn* does not exist or
+   :py:exc:`ldap.UNDEFINED_TYPE` for an invalid attribute.
 
    Note that the asynchronous technique yields the answer
    by raising the exception objects :py:exc:`ldap.COMPARE_TRUE` or
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index e4e6841..f7443fa 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -526,7 +526,7 @@ def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
     except ldap.COMPARE_FALSE:
       return False
     raise ldap.PROTOCOL_ERROR(
-        'Compare operation returned wrong result: %r' % (ldap_res)
+        'Compare operation returned wrong result: %r' % (ldap_res,)
     )
 
   def compare(self,dn,attr,value):
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 0619d51..67adeb2 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -661,6 +661,18 @@ def test_compare_s_false(self):
         result = l.compare_s('cn=Foo1,%s' % base, 'cn', b'Foo2')
         self.assertIs(result, False)
 
+    def test_compare_s_notfound(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+        with self.assertRaises(ldap.NO_SUCH_OBJECT):
+            result = l.compare_s('cn=invalid,%s' % base, 'cn', b'Foo2')
+
+    def test_compare_s_invalidattr(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+        with self.assertRaises(ldap.UNDEFINED_TYPE):
+            result = l.compare_s('cn=Foo1,%s' % base, 'invalidattr', b'invalid')
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From 44a593d1c55a007a43fcf30d2b027ac910ea1b96 Mon Sep 17 00:00:00 2001
From: Florian Best <spaceone@users.noreply.github.com>
Date: Fri, 24 May 2019 13:30:45 +0200
Subject: [PATCH 791/868] Fix escape_dn_chars

https://github.com/python-ldap/python-ldap/pull/268
---
 Lib/ldap/dn.py     | 4 ++--
 Tests/t_ldap_dn.py | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 00c7b06..cabfed8 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -29,10 +29,10 @@ def escape_dn_chars(s):
     s = s.replace(';' ,'\\;')
     s = s.replace('=' ,'\\=')
     s = s.replace('\000' ,'\\\000')
-    if s[0]=='#' or s[0]==' ':
-      s = ''.join(('\\',s))
     if s[-1]==' ':
       s = ''.join((s[:-1],'\\ '))
+    if s[0]=='#' or s[0]==' ':
+      s = ''.join(('\\',s))
   return s
 
 
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index 4b4dd31..fd36f86 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -50,6 +50,11 @@ def test_escape_dn_chars(self):
         self.assertEqual(ldap.dn.escape_dn_chars('#foobar'), '\\#foobar')
         self.assertEqual(ldap.dn.escape_dn_chars('foo bar'), 'foo bar')
         self.assertEqual(ldap.dn.escape_dn_chars(' foobar'), '\\ foobar')
+        self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ ')
+        self.assertEqual(ldap.dn.escape_dn_chars('  '), '\\ \\ ')
+        self.assertEqual(ldap.dn.escape_dn_chars('foobar '), 'foobar\\ ')
+        self.assertEqual(ldap.dn.escape_dn_chars('f+o>o,b<a;r="\00"'), 'f\\+o\\>o\\,b\\<a\\;r\\=\\"\\\x00\\"')
+        self.assertEqual(ldap.dn.escape_dn_chars('foo\\,bar'), 'foo\\\\\\,bar')
 
     def test_str2dn(self):
         """

From 9346fa527ef3486d437ece5647410843b838d886 Mon Sep 17 00:00:00 2001
From: "Bernhard M. Wiedemann" <bwiedemann@suse.de>
Date: Fri, 12 Apr 2019 20:56:30 +0200
Subject: [PATCH 792/868] Make tests pass after 2028

Extend the lifetime of test certs to not expire so soon.

Background:
As part of my work on reproducible builds for openSUSE, I check that software still gives identical build results in the future.
The usual offset is +15 years, because that is how long I expect some software will be used in some places.
This showed up failing tests in our package build.

See https://reproducible-builds.org/ for why this matters.
---
 Lib/slapdtest/certs/ca.conf     |   4 +-
 Lib/slapdtest/certs/ca.pem      | 110 +++++++++++++++---------------
 Lib/slapdtest/certs/client.key  |  52 +++++++--------
 Lib/slapdtest/certs/client.pem  | 112 +++++++++++++++----------------
 Lib/slapdtest/certs/gencerts.sh |   2 +-
 Lib/slapdtest/certs/server.key  |  52 +++++++--------
 Lib/slapdtest/certs/server.pem  | 114 ++++++++++++++++----------------
 7 files changed, 223 insertions(+), 223 deletions(-)

diff --git a/Lib/slapdtest/certs/ca.conf b/Lib/slapdtest/certs/ca.conf
index 5046b0d..d1d89e1 100644
--- a/Lib/slapdtest/certs/ca.conf
+++ b/Lib/slapdtest/certs/ca.conf
@@ -32,7 +32,7 @@ serial = $tmpdir/$ca.crt.srl
 crlnumber = $tmpdir/$ca.crl.srl
 database = $tmpdir/$ca.db
 unique_subject = no
-default_days = 3652
+default_days = 365200
 default_md = sha256
 policy = match_pol
 email_in_dn = no
@@ -40,7 +40,7 @@ preserve = no
 name_opt = $name_opt
 cert_opt = ca_default
 copy_extensions = none
-default_crl_days = 3651
+default_crl_days = 365100
 
 [match_pol]
 countryName = match
diff --git a/Lib/slapdtest/certs/ca.pem b/Lib/slapdtest/certs/ca.pem
index cf2ff33..b52ffaf 100644
--- a/Lib/slapdtest/certs/ca.pem
+++ b/Lib/slapdtest/certs/ca.pem
@@ -5,31 +5,31 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Validity
-            Not Before: Dec  2 11:57:47 2017 GMT
-            Not After : Sep  4 11:57:47 2027 GMT
+            Not Before: Apr 12 18:52:38 2019 GMT
+            Not After : Oct 17 18:52:38 2994 GMT
         Subject: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:af:1f:cf:0f:c5:95:66:2d:eb:85:cc:21:fc:0d:
-                    0f:44:d8:2f:a8:85:08:ef:60:67:57:fa:0b:c5:e4:
-                    b3:fb:f1:6f:cb:30:7a:47:0d:a7:f1:b5:37:81:5f:
-                    f6:39:28:e2:f9:4d:6c:2e:a6:5c:0e:3c:db:4d:c9:
-                    2a:64:ce:0d:15:30:c7:75:52:b8:74:c5:0b:00:4c:
-                    2f:94:1b:dd:fb:83:2c:58:02:73:b0:86:3a:6a:aa:
-                    55:f2:d5:49:99:17:a5:e2:44:ec:dd:62:5f:8d:ce:
-                    77:29:0b:8d:87:23:e2:4b:d6:1c:25:f3:06:a9:ee:
-                    33:6f:ac:ed:22:9e:35:ec:55:e7:1b:38:68:7e:46:
-                    e3:c3:42:ac:06:0b:0a:7a:84:c9:3d:ef:3d:a5:6e:
-                    e9:10:24:c3:28:fe:1f:4a:9a:23:8a:3c:db:0a:66:
-                    5d:07:f8:c5:17:68:53:e4:0e:37:33:c4:d2:ad:58:
-                    62:6b:8a:87:ab:73:eb:bc:2b:ac:07:69:84:8d:e3:
-                    c4:a9:78:9b:6c:1e:03:63:df:b4:96:18:bd:3c:2e:
-                    be:7f:2c:d5:a8:f8:12:b9:ab:27:52:b0:de:38:62:
-                    3c:54:a7:f3:aa:37:a3:11:12:b2:a7:6f:8d:96:10:
-                    ce:01:cb:25:24:a6:51:18:93:69:9b:9e:5c:8a:ff:
-                    fe:89
+                    00:d7:30:73:20:44:7d:83:d4:c7:01:b8:ab:1e:7c:
+                    91:f4:38:ac:9c:41:43:64:0c:31:99:48:70:22:7d:
+                    ae:1b:47:e7:2a:28:4d:f7:46:4e:b4:ba:ae:c0:9d:
+                    d5:1f:4b:7a:79:2f:b9:dc:68:7f:79:84:88:50:51:
+                    3b:7d:dc:d5:57:17:66:45:c0:2c:20:13:f7:99:d6:
+                    9d:e2:12:7c:41:76:82:51:19:2c:b6:ff:46:cb:04:
+                    56:38:22:2a:c3:7a:b5:71:51:49:4e:62:68:a0:99:
+                    6f:de:f3:a2:0f:a2:aa:1b:72:a5:87:bc:42:5a:a7:
+                    22:8d:33:b4:88:a8:dc:5d:72:ca:dd:a0:9a:4e:db:
+                    7d:8b:10:de:c5:41:e9:e9:8d:fa:6c:dd:94:6e:b1:
+                    31:c2:6d:a1:69:6c:7a:3a:b2:76:65:c9:e5:95:38:
+                    62:40:81:c6:29:26:26:d1:d1:c1:f4:5e:fa:24:ef:
+                    13:da:24:13:6f:f5:5c:ba:b1:31:8f:30:94:71:7b:
+                    c6:e5:da:b9:b5:64:39:39:09:c2:4a:80:64:58:1d:
+                    99:f5:65:3c:a7:26:08:95:26:35:7b:fa:e7:20:08:
+                    ff:72:df:9b:8f:9f:da:8b:c3:a7:8b:fc:8c:c0:a5:
+                    31:87:1d:4c:14:f6:cf:90:5e:2e:6e:a6:db:27:08:
+                    eb:df
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -37,44 +37,44 @@ Certificate:
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
             X509v3 Subject Key Identifier: 
-                3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
+                BD:78:D5:4A:F1:90:96:C5:E8:EC:66:49:23:47:03:5F:26:73:86:B2
             X509v3 Authority Key Identifier: 
-                keyid:3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
+                keyid:BD:78:D5:4A:F1:90:96:C5:E8:EC:66:49:23:47:03:5F:26:73:86:B2
 
     Signature Algorithm: sha256WithRSAEncryption
-         0a:e7:dc:38:ce:03:dd:a8:99:11:d0:24:be:ef:1a:18:9d:7c:
-         95:75:4a:4a:29:44:23:28:fc:66:d5:81:ce:05:c2:c0:6b:71:
-         d6:8d:33:a9:53:a6:1c:f1:4e:50:ae:a3:b1:72:d6:69:53:ad:
-         a9:62:a9:45:27:68:17:35:41:97:ec:e9:65:91:62:12:ed:eb:
-         45:3a:9b:cc:09:bc:e3:ad:22:6b:13:6b:b0:67:ef:ce:01:83:
-         5e:6c:95:e2:b3:73:b9:69:9a:33:49:f9:5f:52:4e:39:94:c9:
-         db:93:6f:d8:ba:10:92:ce:fa:12:6b:bc:31:ff:c1:67:70:63:
-         07:dc:53:7a:3a:a3:51:20:15:44:cf:1c:a9:cd:b7:30:1d:8e:
-         55:93:8a:56:8c:3d:e9:8b:ae:0c:77:8d:5c:8b:fd:22:d8:4c:
-         3e:e4:76:e8:d9:e8:c3:98:f4:98:ff:02:60:95:8e:3e:26:7a:
-         e2:fe:2c:0a:a4:52:8d:4c:3d:dd:4c:fd:2f:2c:db:83:4c:2b:
-         25:24:37:78:9a:07:27:52:f9:1c:c0:65:65:cb:50:77:b4:2d:
-         fa:f4:af:bb:42:1c:43:65:c6:01:6e:f1:4b:fe:b8:4a:3c:29:
-         8b:b6:84:1e:17:99:61:98:65:fe:f2:e9:ce:bb:ac:87:69:cb:
-         e6:13:42:bf
+         06:20:1f:eb:42:6a:42:62:b1:ee:69:c8:cd:47:a6:2e:69:95:
+         59:dc:49:09:69:40:93:25:a1:ec:6d:3a:dd:dc:e5:74:ab:33:
+         9d:8f:cc:e3:bb:7a:3f:5b:51:58:74:f7:bd:6c:7c:3c:b6:5a:
+         05:50:a8:8c:c3:fb:5b:75:2a:c2:6c:06:93:4c:a9:93:71:1c:
+         51:e5:be:a1:24:93:e2:79:ca:ea:08:86:90:b9:70:e7:7a:40:
+         bf:f4:d6:71:f4:4d:c0:0f:e0:31:a0:23:46:77:30:72:a9:62:
+         8a:2a:12:c4:dd:3d:86:ae:f7:6b:33:80:26:58:49:53:ff:cd:
+         8a:c6:f6:11:2c:b3:ff:a5:8e:1c:f8:22:e2:1b:8e:04:33:fb:
+         0d:da:31:86:12:9f:d1:03:86:9c:6a:78:5e:3c:5e:8a:52:aa:
+         68:1f:ff:f9:17:75:b0:da:f2:99:3c:80:3c:96:2a:33:07:54:
+         59:84:e7:92:34:0f:99:76:e3:d6:4d:4d:9c:fb:21:35:f9:cb:
+         a5:30:80:8b:9d:61:90:d3:d4:59:3a:2f:f2:f6:20:13:7e:26:
+         dc:50:b0:49:3e:19:fe:eb:7d:cf:b9:1a:5d:5c:3a:76:30:d9:
+         0e:d7:df:de:ce:a9:c4:21:df:63:b9:d0:64:86:0b:28:9a:2e:
+         ab:51:73:e4
 -----BEGIN CERTIFICATE-----
-MIIDijCCAnKgAwIBAgIBATANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MIIDjDCCAnSgAwIBAgIBATANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
 MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
-BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMjAyMTE1NzQ3WhcNMjcwOTA0
-MTE1NzQ3WjBWMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
-BgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNVBAMME1B5dGhvbiBMREFQIFRlc3QgQ0Ew
-ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvH88PxZVmLeuFzCH8DQ9E
-2C+ohQjvYGdX+gvF5LP78W/LMHpHDafxtTeBX/Y5KOL5TWwuplwOPNtNySpkzg0V
-MMd1Urh0xQsATC+UG937gyxYAnOwhjpqqlXy1UmZF6XiROzdYl+NzncpC42HI+JL
-1hwl8wap7jNvrO0injXsVecbOGh+RuPDQqwGCwp6hMk97z2lbukQJMMo/h9KmiOK
-PNsKZl0H+MUXaFPkDjczxNKtWGJrioerc+u8K6wHaYSN48SpeJtsHgNj37SWGL08
-Lr5/LNWo+BK5qydSsN44YjxUp/OqN6MRErKnb42WEM4ByyUkplEYk2mbnlyK//6J
-AgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1Ud
-DgQWBBQ7HzL0/lfRb0mRVfIk8QpmO6Xu1DAfBgNVHSMEGDAWgBQ7HzL0/lfRb0mR
-VfIk8QpmO6Xu1DANBgkqhkiG9w0BAQsFAAOCAQEACufcOM4D3aiZEdAkvu8aGJ18
-lXVKSilEIyj8ZtWBzgXCwGtx1o0zqVOmHPFOUK6jsXLWaVOtqWKpRSdoFzVBl+zp
-ZZFiEu3rRTqbzAm8460iaxNrsGfvzgGDXmyV4rNzuWmaM0n5X1JOOZTJ25Nv2LoQ
-ks76Emu8Mf/BZ3BjB9xTejqjUSAVRM8cqc23MB2OVZOKVow96YuuDHeNXIv9IthM
-PuR26Nnow5j0mP8CYJWOPiZ64v4sCqRSjUw93Uz9Lyzbg0wrJSQ3eJoHJ1L5HMBl
-ZctQd7Qt+vSvu0IcQ2XGAW7xS/64Sjwpi7aEHheZYZhl/vLpzrush2nL5hNCvw==
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwIBcNMTkwNDEyMTg1MjM4WhgPMjk5NDEw
+MTcxODUyMzhaMFYxCzAJBgNVBAYTAkRFMRQwEgYDVQQKDAtweXRob24tbGRhcDET
+MBEGA1UECwwKc2xhcGQtdGVzdDEcMBoGA1UEAwwTUHl0aG9uIExEQVAgVGVzdCBD
+QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANcwcyBEfYPUxwG4qx58
+kfQ4rJxBQ2QMMZlIcCJ9rhtH5yooTfdGTrS6rsCd1R9Lenkvudxof3mEiFBRO33c
+1VcXZkXALCAT95nWneISfEF2glEZLLb/RssEVjgiKsN6tXFRSU5iaKCZb97zog+i
+qhtypYe8QlqnIo0ztIio3F1yyt2gmk7bfYsQ3sVB6emN+mzdlG6xMcJtoWlsejqy
+dmXJ5ZU4YkCBxikmJtHRwfRe+iTvE9okE2/1XLqxMY8wlHF7xuXaubVkOTkJwkqA
+ZFgdmfVlPKcmCJUmNXv65yAI/3Lfm4+f2ovDp4v8jMClMYcdTBT2z5BeLm6m2ycI
+698CAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYD
+VR0OBBYEFL141UrxkJbF6OxmSSNHA18mc4ayMB8GA1UdIwQYMBaAFL141UrxkJbF
+6OxmSSNHA18mc4ayMA0GCSqGSIb3DQEBCwUAA4IBAQAGIB/rQmpCYrHuacjNR6Yu
+aZVZ3EkJaUCTJaHsbTrd3OV0qzOdj8zju3o/W1FYdPe9bHw8tloFUKiMw/tbdSrC
+bAaTTKmTcRxR5b6hJJPiecrqCIaQuXDnekC/9NZx9E3AD+AxoCNGdzByqWKKKhLE
+3T2GrvdrM4AmWElT/82KxvYRLLP/pY4c+CLiG44EM/sN2jGGEp/RA4acanhePF6K
+UqpoH//5F3Ww2vKZPIA8liozB1RZhOeSNA+ZduPWTU2c+yE1+culMICLnWGQ09RZ
+Oi/y9iATfibcULBJPhn+633PuRpdXDp2MNkO19/ezqnEId9judBkhgsomi6rUXPk
 -----END CERTIFICATE-----
diff --git a/Lib/slapdtest/certs/client.key b/Lib/slapdtest/certs/client.key
index 70600ba..7213c0b 100644
--- a/Lib/slapdtest/certs/client.key
+++ b/Lib/slapdtest/certs/client.key
@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDGxvbMEbahViK4
-P6aoWUkciIf1dEYTBuU8M1eShREUZ3Ytq/ee425pXRyxxDrAa8ygRjqs7tauwhgA
-KNuPRGyw7hyZ1Ku4vQObwX9rzyHQ6Fj606U4HHbYfAVb0AF7OzLbhNH3isCRtNcm
-EUSYG1Nkfn9zQkV4pz2KJM4ePt4GyGJV0NhRUdHdwgsWiuRt2EIRPwLXdkf/4svm
-2EahAJax+SMaZYe/lg9w9SBxl6DTaF9lFpoPqzeW+KnXCmE8e+qSWea8EjkzIRXa
-4KJ/EnUMP2fUL+Je2agGF2YfCId9YvLTQV8YDv7Im1Sp0sbIUDoWX14GDUbZ8cBr
-wfOyI0TfAgMBAAECggEATWv1eGp1zcU05Lq1+OA938U1316YZJTM+HOu6jy1+FKL
-7yIJ4nMG8Db6FCswDv5txwdTl0O3jn2+x2Eik1y9UPSNY0U4VU4Zd7MYJC+bJjk5
-XwjMU1yS1aMIm0gbK5pVJrdG6Lm8Y4QiQIt9Qhlyk7PJhGUNlf7ds06+kX0/ETiO
-vx5SatExeKu5F+JRnGFdAN0106SF5vBum+UbrgOSnJmfwX5VoOXARD21ppxgMzAr
-JyGBpgBgy++GpV15gXGuA7DVMIADdHw8hV4OuBLjpkUL+ntArjhpUi7TP7VU3WKR
-uUmvLm9CX1l8O/xZMpt9N1+o71a//7asnz8AMtT6cQKBgQD4FgefUkVnXDA1xKDW
-1JbArVQeHiLGlRdLakRUY/HdGj72YgAOLt3UsrON4VQXl0C6rks/8HKCFaMexBlF
-OecJNWsEVgBEAfsQ+NvrApOQsTszc8Zqna0Kqe2vA0VNa+SAzdHzhBbFcaVkzXJb
-JB7M0/OIt5IaqXg6Y5eX2eZF1QKBgQDNHkIoJ/2hYtlSgXpGaniM+0XemQJgJXig
-edAQdGKKfqwmjSFjByDM01ZaidMu5fEkeGhMRE73IbwNw0pWsMXylD6bI6+sk7yQ
-biM+fslFEEDbgSJe41Jy2eerh5am+dnrMWNhd7QZV1K6tmaqrIzkmIV21/EPXIPp
-BNHO8GV14wKBgGOybrO/GzcTXChvcXeEDWU3AqPr1mvZhHgBJ56GX69MGdtnvL/2
-Y51Th0bQM7wbQ58B5im21j2itl/pzIH+Z/NSbURbz1WFOkEy0SYbbfPq1XCy6Rz1
-apHrgiIf/VzErBp7HBFxlrkYF7Bvw7IOzPXhg3AA3Y0rZ66HUWdr4NdVAoGBAJfC
-E2Bydgy5feC1OypuC9MC9abDviY0kxLoDTCfa2jcX7IGKPWDiJkCo5lI7557Mfax
-vzjuMR5XLzNfkdih4VKgq9FMjeU5SQHy+tB6LZ+Tbuj4md1qgs3GuskGAEh6Auko
-GUc7sVwuZ18NJNiR4Ywf7F8JVajv4gi9MB3Tbr3RAoGARSnVu+6rYSQTyEqvbsaB
-gIW7Ezea5q06GcQF072nk3tNSXuU/52YMlodAJ1UfFPbBAtaa7wEFN8oRG1IyKON
-MGyf6RD8GoInJjaDihkdCsR28RkchwymG1UMPnPzqRxSAb7da5YuMR8PEioVbL68
-dxhsgNi1Wtc2nGqN96qufG0=
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDjt5O6nRrnAWPm
+T0JvRLBHMclll92IWF/O4GEdcJ5fbBxP3BxK0Dv+6aRcR7b2o0f6fk/bgNepXfv/
+MXDQcFlESbfmUNGshFmZr0sjPrYPD1R06TZs+/7RsMXnx1c79mFGEQ4wqzDOBHKQ
+xeDhNJk+BcE0QABsqF8AA2XC2/dK14QCljKLC84k1zTFTnh8duN2eAalaPQFFOoj
+4AnonUnswJ45zIx5V2BdG+oqO5dwo/cEukKgAEL8T2IJ9Cqlmh2sPbMqYC8cODq6
+YcugMznxrfHV5LNThfkvwMe26+vv68r65zalPDy0M+cUMTMyBVY4TL3fejrloY2t
+YMhPJIclAgMBAAECggEAPXdd/u9NRbGQX6hhTFuEIZOEw1F80MLaCaNzU1kExskN
+01icom0W5LX4UZhiAK0OTsUtlRhwHh1qWfXkd777uX0UkKycDC8laGByra7Nwb7n
+ky8oK77Rh5RptyiNmXflxd3wsJ5k7BczPXTMQL3L53vyLMJh2vKPwhcorrJlS+Pi
+JjINMaR4IrDlpMYlrn9NTjsGr+mj/pdmKfU/KVXeKzFcwKTjUnDJNSbGDIC0AxaJ
+dGU0yIX9MPW+p5szcA9o22UWW4LsEFY4YABeCqbm9/UQt3jWVMjCy4AOgr/9HWSR
+DvXI/Xtdl3CTCr8+qDnhBaUI27z+UelZfTBFKUb8AQKBgQD6SmtrTBgEfb6tuxJw
+AAHRuUcWGjatZ7X+meHRC9B7UPxUrKl9tU5NC7Gz6YMt+vr4bNMwykI6Ndj+4tSJ
+KqsAC86v19CH4usMBLZ68MeTRvtQGiPah71syYrxf0uvYOx/KzUUBX240Ls+lEbE
+W33psMoNAezUPpJwKx7CMjcBgQKBgQDo6VaT59bKRc3DXJvqFjd7TPIex+ny6JK+
+8oOwyyFFBwkzfymoOxN4lxSrE6yf7uTemRRn+RIH3UGDottIDqzhjvtcV5uODeIN
+8WzxTbl759qIxt+z7aF7SkwJLJAAZS3qqCXKtMBo7ln4xKaoRLT2RohqD1YXGrg8
+wmYcUZoPpQKBgQCm2QVSuZ8pH0oFNjfMQbT0wbYJnd/lKMXBu4M1f9Ky4gHT0GYM
+Ttirs6f6byfrduvmv2TpmWscsti80SktZywnE7fssMlqTHKzyFB9FBV2sFLHyyUr
+gGFeK9xbsKgbeVkuTPdNKXvtv/eSd/XU38jIB/opQadGtY+ZBqWyfxb8AQKBgBLc
+SlmBzZ/llSr7xdhn4ihG69hYQfacpL13r/hSCqinUDRuWLY5ynLacR8FYdY1pyzr
+Yn6k6bPfU93QA0fLgG5ngK1SntMbBrIwWa0UqS+Cb+zhhd3xIUF1m8CmbibKCrTU
+1vKaPnaAzqJZclFv9uN2hLdp9IO8cyzgZRpn9TzNAoGAUfZF1983qknfBgD8Lgm3
+zzKYtc8q2Ukatfo4VCp66CEprbLcBq5mKx6JiBoMGqU8SI5XVG0F0aHH2n8gImcu
+bO0vtEldDc1ylZ/H7xhHFWlMzmTlsbHdHVtetFfKLTpjq6duvgLA12lJNHNVu3OU
+Z1bRWDeZIP70+jdYrmSoVi8=
 -----END PRIVATE KEY-----
diff --git a/Lib/slapdtest/certs/client.pem b/Lib/slapdtest/certs/client.pem
index 33b95a7..ca2989c 100644
--- a/Lib/slapdtest/certs/client.pem
+++ b/Lib/slapdtest/certs/client.pem
@@ -5,31 +5,31 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Validity
-            Not Before: Dec  2 11:57:48 2017 GMT
-            Not After : Dec  2 11:57:48 2027 GMT
+            Not Before: Apr 12 18:52:38 2019 GMT
+            Not After : Mar  1 18:52:38 3019 GMT
         Subject: C=DE, O=python-ldap, OU=slapd-test, CN=client
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:c6:c6:f6:cc:11:b6:a1:56:22:b8:3f:a6:a8:59:
-                    49:1c:88:87:f5:74:46:13:06:e5:3c:33:57:92:85:
-                    11:14:67:76:2d:ab:f7:9e:e3:6e:69:5d:1c:b1:c4:
-                    3a:c0:6b:cc:a0:46:3a:ac:ee:d6:ae:c2:18:00:28:
-                    db:8f:44:6c:b0:ee:1c:99:d4:ab:b8:bd:03:9b:c1:
-                    7f:6b:cf:21:d0:e8:58:fa:d3:a5:38:1c:76:d8:7c:
-                    05:5b:d0:01:7b:3b:32:db:84:d1:f7:8a:c0:91:b4:
-                    d7:26:11:44:98:1b:53:64:7e:7f:73:42:45:78:a7:
-                    3d:8a:24:ce:1e:3e:de:06:c8:62:55:d0:d8:51:51:
-                    d1:dd:c2:0b:16:8a:e4:6d:d8:42:11:3f:02:d7:76:
-                    47:ff:e2:cb:e6:d8:46:a1:00:96:b1:f9:23:1a:65:
-                    87:bf:96:0f:70:f5:20:71:97:a0:d3:68:5f:65:16:
-                    9a:0f:ab:37:96:f8:a9:d7:0a:61:3c:7b:ea:92:59:
-                    e6:bc:12:39:33:21:15:da:e0:a2:7f:12:75:0c:3f:
-                    67:d4:2f:e2:5e:d9:a8:06:17:66:1f:08:87:7d:62:
-                    f2:d3:41:5f:18:0e:fe:c8:9b:54:a9:d2:c6:c8:50:
-                    3a:16:5f:5e:06:0d:46:d9:f1:c0:6b:c1:f3:b2:23:
-                    44:df
+                    00:e3:b7:93:ba:9d:1a:e7:01:63:e6:4f:42:6f:44:
+                    b0:47:31:c9:65:97:dd:88:58:5f:ce:e0:61:1d:70:
+                    9e:5f:6c:1c:4f:dc:1c:4a:d0:3b:fe:e9:a4:5c:47:
+                    b6:f6:a3:47:fa:7e:4f:db:80:d7:a9:5d:fb:ff:31:
+                    70:d0:70:59:44:49:b7:e6:50:d1:ac:84:59:99:af:
+                    4b:23:3e:b6:0f:0f:54:74:e9:36:6c:fb:fe:d1:b0:
+                    c5:e7:c7:57:3b:f6:61:46:11:0e:30:ab:30:ce:04:
+                    72:90:c5:e0:e1:34:99:3e:05:c1:34:40:00:6c:a8:
+                    5f:00:03:65:c2:db:f7:4a:d7:84:02:96:32:8b:0b:
+                    ce:24:d7:34:c5:4e:78:7c:76:e3:76:78:06:a5:68:
+                    f4:05:14:ea:23:e0:09:e8:9d:49:ec:c0:9e:39:cc:
+                    8c:79:57:60:5d:1b:ea:2a:3b:97:70:a3:f7:04:ba:
+                    42:a0:00:42:fc:4f:62:09:f4:2a:a5:9a:1d:ac:3d:
+                    b3:2a:60:2f:1c:38:3a:ba:61:cb:a0:33:39:f1:ad:
+                    f1:d5:e4:b3:53:85:f9:2f:c0:c7:b6:eb:eb:ef:eb:
+                    ca:fa:e7:36:a5:3c:3c:b4:33:e7:14:31:33:32:05:
+                    56:38:4c:bd:df:7a:3a:e5:a1:8d:ad:60:c8:4f:24:
+                    87:25
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -39,45 +39,45 @@ Certificate:
             X509v3 Extended Key Usage: critical
                 TLS Web Client Authentication
             X509v3 Subject Key Identifier: 
-                67:63:38:F4:B4:BC:F3:6B:BC:74:0E:7C:27:C9:BB:C2:CC:58:AC:16
+                4F:E7:35:C7:C8:C1:01:C3:7C:53:86:B9:BF:AE:8B:D6:45:A2:78:20
             X509v3 Authority Key Identifier: 
-                keyid:3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
+                keyid:BD:78:D5:4A:F1:90:96:C5:E8:EC:66:49:23:47:03:5F:26:73:86:B2
 
     Signature Algorithm: sha256WithRSAEncryption
-         76:24:42:6b:33:4f:d6:59:07:48:5b:04:9c:3c:d3:3f:63:80:
-         75:4d:78:d7:d5:85:b1:77:81:31:a3:91:cb:c9:a3:8c:0e:00:
-         28:08:74:71:6c:fc:83:8c:80:ec:1c:e8:ee:83:e0:7f:49:3b:
-         f3:42:33:5a:1f:68:0c:a5:41:42:ce:bf:77:29:07:f2:18:a7:
-         81:17:d7:76:47:04:d9:8a:dd:e8:5a:26:26:ea:a4:76:70:e1:
-         f1:fa:e1:db:bc:f2:24:b2:37:a8:58:2f:e3:66:89:77:02:55:
-         87:ef:3c:1f:66:ce:4e:86:b3:4c:57:43:86:7f:4c:ab:5a:33:
-         dd:ca:e3:2f:3b:af:b4:43:5a:53:8b:e0:12:da:e7:c0:13:76:
-         b2:68:d5:14:f8:1a:07:ce:8a:87:5c:91:bd:35:d7:83:c6:2a:
-         a4:e0:92:50:01:b9:c2:fa:69:06:5c:8a:80:ee:9c:24:f9:49:
-         64:e3:59:c1:a6:69:29:ce:b7:89:20:a9:7c:d6:9f:df:2a:d1:
-         a4:98:2a:6d:7b:93:6a:52:e3:ae:de:1a:d8:f3:2e:cf:02:7e:
-         ba:9a:fa:f4:b3:b5:6e:9a:23:10:70:53:53:30:d5:8a:32:35:
-         01:52:58:6d:9d:f5:8e:bb:b9:76:bd:41:16:88:26:f8:d3:ce:
-         70:03:c8:59
+         1c:90:5f:cf:18:48:95:4d:9d:d3:8e:6d:d1:69:19:1e:7b:3f:
+         1f:48:7c:c8:0d:2f:c4:53:0f:89:23:f4:be:ea:b4:7a:c6:dd:
+         cc:18:0f:e7:34:ea:2c:d4:07:0d:65:78:e8:20:40:3f:36:ef:
+         2c:00:31:69:e6:20:48:65:be:57:03:0e:69:ff:b9:83:59:99:
+         7d:4d:86:98:14:5b:8e:39:25:3a:a8:6d:51:dc:45:a5:0f:cd:
+         f3:7a:fd:55:af:5f:55:75:20:03:f5:4a:75:6a:79:2f:76:84:
+         f6:4e:3d:1d:59:45:9a:b1:6a:57:6f:16:76:76:f8:df:6e:96:
+         d5:25:27:34:4b:21:d8:c9:9a:36:55:45:a0:43:16:43:68:93:
+         37:af:81:89:06:d1:56:1b:9e:0f:62:40:ad:3c:4c:f5:ef:6c:
+         a2:a4:7f:f2:fa:78:9c:0d:c0:19:f1:10:e8:d8:cf:03:67:3c:
+         2d:4d:f3:5d:67:5c:41:a7:4f:d6:c5:0e:ff:2c:04:dd:23:bb:
+         85:44:8e:25:ac:15:a3:82:fa:a4:4f:fa:1d:87:f0:58:dc:ae:
+         53:05:b9:81:e8:cb:e5:0c:ac:a5:74:68:03:f9:22:a0:45:b6:
+         62:58:e0:98:d9:8c:54:a4:22:03:7a:37:12:eb:7d:b1:ad:45:
+         60:8e:7a:df
 -----BEGIN CERTIFICATE-----
-MIIDkjCCAnqgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MIIDlDCCAnygAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
 MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
-BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMjAyMTE1NzQ4WhcNMjcxMjAy
-MTE1NzQ4WjBJMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
-BgNVBAsMCnNsYXBkLXRlc3QxDzANBgNVBAMMBmNsaWVudDCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMbG9swRtqFWIrg/pqhZSRyIh/V0RhMG5TwzV5KF
-ERRndi2r957jbmldHLHEOsBrzKBGOqzu1q7CGAAo249EbLDuHJnUq7i9A5vBf2vP
-IdDoWPrTpTgcdth8BVvQAXs7MtuE0feKwJG01yYRRJgbU2R+f3NCRXinPYokzh4+
-3gbIYlXQ2FFR0d3CCxaK5G3YQhE/Atd2R//iy+bYRqEAlrH5Ixplh7+WD3D1IHGX
-oNNoX2UWmg+rN5b4qdcKYTx76pJZ5rwSOTMhFdrgon8SdQw/Z9Qv4l7ZqAYXZh8I
-h31i8tNBXxgO/sibVKnSxshQOhZfXgYNRtnxwGvB87IjRN8CAwEAAaN4MHYwDAYD
-VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
-AwIwHQYDVR0OBBYEFGdjOPS0vPNrvHQOfCfJu8LMWKwWMB8GA1UdIwQYMBaAFDsf
-MvT+V9FvSZFV8iTxCmY7pe7UMA0GCSqGSIb3DQEBCwUAA4IBAQB2JEJrM0/WWQdI
-WwScPNM/Y4B1TXjX1YWxd4Exo5HLyaOMDgAoCHRxbPyDjIDsHOjug+B/STvzQjNa
-H2gMpUFCzr93KQfyGKeBF9d2RwTZit3oWiYm6qR2cOHx+uHbvPIksjeoWC/jZol3
-AlWH7zwfZs5OhrNMV0OGf0yrWjPdyuMvO6+0Q1pTi+AS2ufAE3ayaNUU+BoHzoqH
-XJG9NdeDxiqk4JJQAbnC+mkGXIqA7pwk+Ulk41nBpmkpzreJIKl81p/fKtGkmCpt
-e5NqUuOu3hrY8y7PAn66mvr0s7VumiMQcFNTMNWKMjUBUlhtnfWOu7l2vUEWiCb4
-085wA8hZ
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwIBcNMTkwNDEyMTg1MjM4WhgPMzAxOTAz
+MDExODUyMzhaMEkxCzAJBgNVBAYTAkRFMRQwEgYDVQQKDAtweXRob24tbGRhcDET
+MBEGA1UECwwKc2xhcGQtdGVzdDEPMA0GA1UEAwwGY2xpZW50MIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA47eTup0a5wFj5k9Cb0SwRzHJZZfdiFhfzuBh
+HXCeX2wcT9wcStA7/umkXEe29qNH+n5P24DXqV37/zFw0HBZREm35lDRrIRZma9L
+Iz62Dw9UdOk2bPv+0bDF58dXO/ZhRhEOMKswzgRykMXg4TSZPgXBNEAAbKhfAANl
+wtv3SteEApYyiwvOJNc0xU54fHbjdngGpWj0BRTqI+AJ6J1J7MCeOcyMeVdgXRvq
+KjuXcKP3BLpCoABC/E9iCfQqpZodrD2zKmAvHDg6umHLoDM58a3x1eSzU4X5L8DH
+tuvr7+vK+uc2pTw8tDPnFDEzMgVWOEy933o65aGNrWDITySHJQIDAQABo3gwdjAM
+BgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggrBgEF
+BQcDAjAdBgNVHQ4EFgQUT+c1x8jBAcN8U4a5v66L1kWieCAwHwYDVR0jBBgwFoAU
+vXjVSvGQlsXo7GZJI0cDXyZzhrIwDQYJKoZIhvcNAQELBQADggEBAByQX88YSJVN
+ndOObdFpGR57Px9IfMgNL8RTD4kj9L7qtHrG3cwYD+c06izUBw1leOggQD827ywA
+MWnmIEhlvlcDDmn/uYNZmX1NhpgUW445JTqobVHcRaUPzfN6/VWvX1V1IAP1SnVq
+eS92hPZOPR1ZRZqxaldvFnZ2+N9ultUlJzRLIdjJmjZVRaBDFkNokzevgYkG0VYb
+ng9iQK08TPXvbKKkf/L6eJwNwBnxEOjYzwNnPC1N811nXEGnT9bFDv8sBN0ju4VE
+jiWsFaOC+qRP+h2H8FjcrlMFuYHoy+UMrKV0aAP5IqBFtmJY4JjZjFSkIgN6NxLr
+fbGtRWCOet8=
 -----END CERTIFICATE-----
diff --git a/Lib/slapdtest/certs/gencerts.sh b/Lib/slapdtest/certs/gencerts.sh
index 7a971a3..8a99db5 100755
--- a/Lib/slapdtest/certs/gencerts.sh
+++ b/Lib/slapdtest/certs/gencerts.sh
@@ -29,7 +29,7 @@ openssl ca -selfsign \
     -in $CATMPDIR/ca.csr \
     -out $CAOUTDIR/ca.pem \
     -extensions ca_ext \
-    -days 3563 \
+    -days 356300 \
     -batch
 
 # server cert
diff --git a/Lib/slapdtest/certs/server.key b/Lib/slapdtest/certs/server.key
index a48ee56..a891670 100644
--- a/Lib/slapdtest/certs/server.key
+++ b/Lib/slapdtest/certs/server.key
@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDAgcI7Pj89Aw4r
-rb+N8j3t1ynJgXRhQNxbxQcQmUCi8AtpGKNXu+aM9u2HxZ677ALfhsEivtQA5QKz
-Ll5G2G2IQa7uzgIco73OL/kMZIJt7sKfnvfACtSoOlD0IyOzVEEu0AVA7hMHb6Ul
-I0mCNfdk2FWFbc1nUmIAEBhIODbFoNW+Rc6lz94NsUqArDayvWpAsXkUbubQikpi
-KNX1OpOOC9GUbEhwI/G90ZnUg9STk/2oxsvwLlYdOhGhpyfl53tTu7eLMBriMxFl
-UTvkY1GUgPj0fA/giWtCerGOyeKu1hFlbS4LjborsfrlyYPwfwTg3YL4hVnt9fF0
-rpjzY1mlAgMBAAECggEAJY6rSEeiqtKXxynEv3rNXkOmIWwiOn8e/sB32mMr2x4d
-+8kUxR8hocrjGKQTjfJDtTxjHdZBIlOLrU2UkxnSdMzrxidm/hNsCngNjL9nOu9k
-BSRMjakPSCrodFkOtAPyG6H2BG7uQ3siqxYxVzgUJhaWyMtdUZUfDYgWVLCy7udU
-5ML/OTOi7virueMmshjXoyrDug9OpiEMKiLu3ndAaDk/26m05ePAXB6TjW8SFw1B
-qn7cITSG0G5MZ9pOw0KwT9irY1SdppBHVWIg7dkYWRCni0BPCFewastU+GVKH5PJ
-+dYSvafhkEGD1bBu484KN9yX1BcHV41ZKR8pGgMM2QKBgQD3/0R2vZsTxoO1CHNI
-IT7nBnuPIOP45iTFm/SNRY7e4dhQBy6HM6JD3Sr6Iksm8jRoboz+tnAso6l6QHRS
-842uqBiOHdnka2RslDmrEun1lJv1MWuPM8JN0o8pYjVG/IRtaAFnYSEk72UoNy2h
-bHC4OGFNwMbAadVm7DK5OiMfXwKBgQDGuBRxz7jkVZoMbbaeIqmGZAIejWkJweDZ
-AK+txM+6Sg+Li14t190N3Xf6tyyidKhUAEWaINzLjZB+luxNaDXtxqWzLYHCwQKA
-qfrjWVeZOS1clLya7jwl1jJqBtBiGKHv9eRL21hgX/9gX3odxqFMvX3vm6L7F1q1
-5CNApW0ZewKBgGO8qNcsWBLy8oM7G8n1fOvCwqyEaMrwG/fRSeALCnN+1tUQnljH
-nkm2yBMC+cB3Bja9xzylOKXrSDyfcWjvBJsqhX2aacggnKnCTxMLL0aR9sr8jipw
-gYN03Bijo5Oh+MxbWL0v5fmJweATmOljyE1+dzui/QvjRGz5L0kpJXj3AoGBAIa4
-3+t1B4WN312TuB4no8Tf4mvyNQcPcS/Nfk0RxD8o3Lcfal8sHMq8ng3Ux6bv7frd
-IFLo+qfpts+L5HJqNz2X0ljSfkmZ7udp1hTySigwEmfU0rU61H5WZGFrczU+O/Ni
-Qj+HWrgj/Q/KSxEKy+oqAcpDOtB+Odpc6+V1Aa0nAoGBAItWHP9UjTNFqOfyjZhG
-qaUiZd1S2KyRR0l/lVcn+rJ46Yg5i+lMGwHMF1xPyWH4ELz+QCUX3doOI4yB2ikg
-XXFcc8/bqgaR4AfOvP98T86s7+f33kaAKZsgyAFB2cjo+fz8ArTz+GjPeHbiOPaR
-Ra7+BVwl9GE0+bCdirq+99GO
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCsBk0ml3ERFJyg
+I6ujIJYERVU4doTZZd4r4z/LOef0hyiYiIQAc9wetaoZpM+bl4Eherxy9SBaCBwR
+zefbaYQz2f2hdEDb+sISOiTke1eiF2ugYNlS55Wk1KnCnORE9bjcSNLPsscoUSzE
+2bnBSoUwdiVK18YOCZR6GTeC8eA3ekvlR+9g+FBOgQ9+StXPDdq+iIAGXZREJIua
+munErtTOw85De4YFCnzGw3UeCITDD4wFmI2IWphRFwWPsSDwUJfATA8S+7Rm4vwr
+Qj726gUDlicTzPXKhJjXjj6XL7xXHfpQwMPkBCrxesKceHMJ+mrRsuuqHciuixRi
+g94mILElAgMBAAECggEADG5oJOHMye8zYl8xiBhSvvxDrFDkSNGTvJgvhAArQwCB
+boRvBZlZzt5R7Ih8eEH6kvDLrYMJU3hCjwbSOojlhNm7+m7sQPleDPMmt1wyeQQ4
+Qt681cDmj4LOwcGUvWcEdObOVTQWMFOtaIxTYCSCe34OM9pj9Z+7mxc3a78O9PND
+Ib/CwcTA1OyoupzkKirqkdLXwK3x2aT/1TMaPX94taHB51cxXc7AglL9QnuCkuaG
+krqrexy3rGimzsP3OwQGEUjWKcZVSSPT8/k1pPE9hRgOqBy05BfkAzlebdvc3GO5
+AbZk0NX2sfVHl4dTEXs/hTBCTQ3XmaltumQ9MdL+AQKBgQDg2I5QxBA2UHb8vCtK
+f31kfG6YQc4MkoslrrMrtJjZqDYaLZPS1ARPSfYRqcc+7GDreuLmw39f8ZECd+2W
+BYUqzZv9g13R9DY99g0/sINnZGsESwfIdLNNlHvVx2UrD5ybCj4vLhuPsVV7XlWs
+cpl+rcuBVpqy8UIXifQ/Z3xLvwKBgQDD3CLjuC0mcTO2sIWqEHqVkc8CY2NJA2Qh
+C78fwpaCqJUUdWnS69QbRGWgkFJL+oO8lQVQ1bXhZLHyQmy7Z5d5olCH6AW4GRnf
+hBAnKJ+QTm9B6QVWzjUuHuOeCukfiTQbha14pOS9ar3X2QFWjDnzCRrnAxJmoY3H
+BJATLHhMGwKBgQDSxAy7xt4Pm+O9y8Gk5tcq771X+i9k96V54EZRzMuPFDAK3/h2
+o4marZD9Q7Hi2P+NHTc+67klvbKZpsPOYkRPOEdmH9M9cPe7oz8OGa9DpwzuDEsy
+a7p8GZjvbyb1c3/wkWxzG3x4eNnReD9FFHOwHMfr6LvAy4iRuh57pM0NzwKBgDY3
+1DixnV4M7EHgb7/6O9T3vhRtKujlVWyIcen61etpe4tkTV0kB11c+70M9pstyBYG
+MqiD4It6coAbvznJnXcAZcaZhivGVxE237nXVwR9kfLu7JlxD+uqhVwUrSAbvR75
+TGIfU2rUB6We3u30d349wQK+KPPcOQEk1DValBqNAoGBAKfXOXgFBkIVW79fOkup
+aIZXdEmU3Up61Oo0KDbxsg4l73NnnvuEnNMBTx3nT3KCVIAcQL9MNpLX/Z0HjOn1
+aiWVtTNq2OFL0V0HueBhbkFiWp551jTS7LjndCYHpUB/B8/wXP0kxHUm8HrQrRvK
+DhV3zcxsXts1INidXjzzOkPi
 -----END PRIVATE KEY-----
diff --git a/Lib/slapdtest/certs/server.pem b/Lib/slapdtest/certs/server.pem
index 7e75059..25ba06c 100644
--- a/Lib/slapdtest/certs/server.pem
+++ b/Lib/slapdtest/certs/server.pem
@@ -5,31 +5,31 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
         Validity
-            Not Before: Dec  2 11:57:48 2017 GMT
-            Not After : Dec  2 11:57:48 2027 GMT
+            Not Before: Apr 12 18:52:38 2019 GMT
+            Not After : Mar  1 18:52:38 3019 GMT
         Subject: C=DE, O=python-ldap, OU=slapd-test, CN=server cert for localhost
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:c0:81:c2:3b:3e:3f:3d:03:0e:2b:ad:bf:8d:f2:
-                    3d:ed:d7:29:c9:81:74:61:40:dc:5b:c5:07:10:99:
-                    40:a2:f0:0b:69:18:a3:57:bb:e6:8c:f6:ed:87:c5:
-                    9e:bb:ec:02:df:86:c1:22:be:d4:00:e5:02:b3:2e:
-                    5e:46:d8:6d:88:41:ae:ee:ce:02:1c:a3:bd:ce:2f:
-                    f9:0c:64:82:6d:ee:c2:9f:9e:f7:c0:0a:d4:a8:3a:
-                    50:f4:23:23:b3:54:41:2e:d0:05:40:ee:13:07:6f:
-                    a5:25:23:49:82:35:f7:64:d8:55:85:6d:cd:67:52:
-                    62:00:10:18:48:38:36:c5:a0:d5:be:45:ce:a5:cf:
-                    de:0d:b1:4a:80:ac:36:b2:bd:6a:40:b1:79:14:6e:
-                    e6:d0:8a:4a:62:28:d5:f5:3a:93:8e:0b:d1:94:6c:
-                    48:70:23:f1:bd:d1:99:d4:83:d4:93:93:fd:a8:c6:
-                    cb:f0:2e:56:1d:3a:11:a1:a7:27:e5:e7:7b:53:bb:
-                    b7:8b:30:1a:e2:33:11:65:51:3b:e4:63:51:94:80:
-                    f8:f4:7c:0f:e0:89:6b:42:7a:b1:8e:c9:e2:ae:d6:
-                    11:65:6d:2e:0b:8d:ba:2b:b1:fa:e5:c9:83:f0:7f:
-                    04:e0:dd:82:f8:85:59:ed:f5:f1:74:ae:98:f3:63:
-                    59:a5
+                    00:ac:06:4d:26:97:71:11:14:9c:a0:23:ab:a3:20:
+                    96:04:45:55:38:76:84:d9:65:de:2b:e3:3f:cb:39:
+                    e7:f4:87:28:98:88:84:00:73:dc:1e:b5:aa:19:a4:
+                    cf:9b:97:81:21:7a:bc:72:f5:20:5a:08:1c:11:cd:
+                    e7:db:69:84:33:d9:fd:a1:74:40:db:fa:c2:12:3a:
+                    24:e4:7b:57:a2:17:6b:a0:60:d9:52:e7:95:a4:d4:
+                    a9:c2:9c:e4:44:f5:b8:dc:48:d2:cf:b2:c7:28:51:
+                    2c:c4:d9:b9:c1:4a:85:30:76:25:4a:d7:c6:0e:09:
+                    94:7a:19:37:82:f1:e0:37:7a:4b:e5:47:ef:60:f8:
+                    50:4e:81:0f:7e:4a:d5:cf:0d:da:be:88:80:06:5d:
+                    94:44:24:8b:9a:9a:e9:c4:ae:d4:ce:c3:ce:43:7b:
+                    86:05:0a:7c:c6:c3:75:1e:08:84:c3:0f:8c:05:98:
+                    8d:88:5a:98:51:17:05:8f:b1:20:f0:50:97:c0:4c:
+                    0f:12:fb:b4:66:e2:fc:2b:42:3e:f6:ea:05:03:96:
+                    27:13:cc:f5:ca:84:98:d7:8e:3e:97:2f:bc:57:1d:
+                    fa:50:c0:c3:e4:04:2a:f1:7a:c2:9c:78:73:09:fa:
+                    6a:d1:b2:eb:aa:1d:c8:ae:8b:14:62:83:de:26:20:
+                    b1:25
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -39,48 +39,48 @@ Certificate:
             X509v3 Extended Key Usage: critical
                 TLS Web Server Authentication
             X509v3 Subject Key Identifier: 
-                1B:78:45:40:0D:50:8A:8B:3B:C1:0A:F8:3F:7A:48:7B:A6:3C:28:09
+                08:D1:86:1B:82:0A:4F:71:31:E4:F5:31:23:CC:67:3B:FA:84:3B:A0
             X509v3 Authority Key Identifier: 
-                keyid:3B:1F:32:F4:FE:57:D1:6F:49:91:55:F2:24:F1:0A:66:3B:A5:EE:D4
+                keyid:BD:78:D5:4A:F1:90:96:C5:E8:EC:66:49:23:47:03:5F:26:73:86:B2
 
             X509v3 Subject Alternative Name: 
                 DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
     Signature Algorithm: sha256WithRSAEncryption
-         ad:08:3f:7d:b1:09:a1:a5:6c:c3:58:80:1d:e5:33:a5:bb:c0:
-         33:39:95:aa:88:ee:c4:8e:38:3b:59:a7:0e:39:74:6c:fe:11:
-         33:5e:fa:50:cb:20:4b:67:b7:c9:5e:96:a7:9e:d8:47:46:e1:
-         ab:fe:5d:8b:9a:2d:1a:1b:43:08:f9:93:0f:2a:e3:ce:83:4a:
-         94:cd:02:f0:8e:25:f2:41:0d:55:10:f5:4c:5b:39:8b:77:5e:
-         ab:78:16:64:a1:48:d5:e1:f6:69:9a:0f:d8:30:a6:cc:92:4d:
-         81:df:46:74:ab:cf:1d:b7:d4:01:b9:6d:d5:f4:14:b8:d5:54:
-         84:79:11:42:69:55:7f:74:ce:01:96:2f:3f:51:23:b3:11:fb:
-         72:dc:4c:b9:a3:89:ef:31:e4:c0:49:06:fa:8d:09:71:e1:c1:
-         74:a9:ed:f8:96:87:67:16:b5:5d:16:5d:59:70:ff:1c:b5:a1:
-         6c:d2:22:11:3a:0e:6f:76:9b:69:cb:f3:85:a7:79:ad:53:f5:
-         34:e8:87:cc:dd:09:51:25:e0:28:ee:79:a0:a3:dc:0a:dd:f0:
-         1b:e3:c9:5f:14:d3:95:f5:12:4d:23:95:45:2c:3c:32:94:ad:
-         ce:1e:a0:5f:e6:e8:28:c6:f9:c7:fb:57:06:ad:0b:eb:86:ca:
-         0e:d2:a8:67
+         88:60:af:be:11:c4:aa:dc:9b:f1:e7:14:da:20:aa:6f:2f:06:
+         ae:38:b2:7c:ac:90:81:22:51:7e:cb:26:15:6e:fe:67:98:c1:
+         0d:dc:aa:39:98:2b:d2:cc:3c:ff:1a:92:2f:56:0a:a9:6e:d8:
+         9a:3d:c5:4d:6f:cc:91:2e:e3:4e:bf:22:ab:cb:92:1a:a0:8f:
+         43:cd:82:bc:48:55:c4:95:cf:10:6b:6a:31:19:92:7d:e0:06:
+         05:6f:0b:33:e7:2a:37:42:f9:ec:1b:29:99:e1:58:0c:01:a7:
+         c3:8b:58:71:21:9f:61:8c:a7:fb:b6:7e:32:8b:a9:4e:c7:1f:
+         f6:46:e8:dd:ac:a6:4c:53:f8:4d:93:e4:ec:73:ab:0b:be:98:
+         c5:78:c4:92:c0:4c:78:47:52:2f:93:07:67:20:a4:5a:7f:59:
+         7e:4f:48:53:20:0d:37:bb:06:f8:44:42:64:b4:94:15:43:d1:
+         4c:51:f3:97:1d:2d:cd:db:b9:bb:1a:69:10:89:7d:ae:1d:0d:
+         94:78:45:29:cd:c4:42:67:67:96:05:bf:da:aa:23:65:7b:04:
+         ff:b7:ac:9d:ee:0b:e7:0f:c1:c5:0b:48:fe:0f:d6:3f:d8:b4:
+         77:12:bb:f5:91:4f:43:e6:01:3f:a4:c0:ea:8c:c6:68:99:8e:
+         49:e8:c4:8b
 -----BEGIN CERTIFICATE-----
-MIID1TCCAr2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MIID1zCCAr+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
 MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
-BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMjAyMTE1NzQ4WhcNMjcxMjAy
-MTE1NzQ4WjBcMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
-BgNVBAsMCnNsYXBkLXRlc3QxIjAgBgNVBAMMGXNlcnZlciBjZXJ0IGZvciBsb2Nh
-bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAgcI7Pj89Aw4r
-rb+N8j3t1ynJgXRhQNxbxQcQmUCi8AtpGKNXu+aM9u2HxZ677ALfhsEivtQA5QKz
-Ll5G2G2IQa7uzgIco73OL/kMZIJt7sKfnvfACtSoOlD0IyOzVEEu0AVA7hMHb6Ul
-I0mCNfdk2FWFbc1nUmIAEBhIODbFoNW+Rc6lz94NsUqArDayvWpAsXkUbubQikpi
-KNX1OpOOC9GUbEhwI/G90ZnUg9STk/2oxsvwLlYdOhGhpyfl53tTu7eLMBriMxFl
-UTvkY1GUgPj0fA/giWtCerGOyeKu1hFlbS4LjborsfrlyYPwfwTg3YL4hVnt9fF0
-rpjzY1mlAgMBAAGjgacwgaQwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw
-FgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFBt4RUANUIqLO8EK+D96
-SHumPCgJMB8GA1UdIwQYMBaAFDsfMvT+V9FvSZFV8iTxCmY7pe7UMCwGA1UdEQQl
-MCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATANBgkqhkiG9w0B
-AQsFAAOCAQEArQg/fbEJoaVsw1iAHeUzpbvAMzmVqojuxI44O1mnDjl0bP4RM176
-UMsgS2e3yV6Wp57YR0bhq/5di5otGhtDCPmTDyrjzoNKlM0C8I4l8kENVRD1TFs5
-i3deq3gWZKFI1eH2aZoP2DCmzJJNgd9GdKvPHbfUAblt1fQUuNVUhHkRQmlVf3TO
-AZYvP1EjsxH7ctxMuaOJ7zHkwEkG+o0JceHBdKnt+JaHZxa1XRZdWXD/HLWhbNIi
-EToOb3abacvzhad5rVP1NOiHzN0JUSXgKO55oKPcCt3wG+PJXxTTlfUSTSOVRSw8
-MpStzh6gX+boKMb5x/tXBq0L64bKDtKoZw==
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwIBcNMTkwNDEyMTg1MjM4WhgPMzAxOTAz
+MDExODUyMzhaMFwxCzAJBgNVBAYTAkRFMRQwEgYDVQQKDAtweXRob24tbGRhcDET
+MBEGA1UECwwKc2xhcGQtdGVzdDEiMCAGA1UEAwwZc2VydmVyIGNlcnQgZm9yIGxv
+Y2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKwGTSaXcREU
+nKAjq6MglgRFVTh2hNll3ivjP8s55/SHKJiIhABz3B61qhmkz5uXgSF6vHL1IFoI
+HBHN59tphDPZ/aF0QNv6whI6JOR7V6IXa6Bg2VLnlaTUqcKc5ET1uNxI0s+yxyhR
+LMTZucFKhTB2JUrXxg4JlHoZN4Lx4Dd6S+VH72D4UE6BD35K1c8N2r6IgAZdlEQk
+i5qa6cSu1M7DzkN7hgUKfMbDdR4IhMMPjAWYjYhamFEXBY+xIPBQl8BMDxL7tGbi
+/CtCPvbqBQOWJxPM9cqEmNeOPpcvvFcd+lDAw+QEKvF6wpx4cwn6atGy66odyK6L
+FGKD3iYgsSUCAwEAAaOBpzCBpDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF
+oDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUCNGGG4IKT3Ex5PUx
+I8xnO/qEO6AwHwYDVR0jBBgwFoAUvXjVSvGQlsXo7GZJI0cDXyZzhrIwLAYDVR0R
+BCUwI4IJbG9jYWxob3N0hwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMA0GCSqGSIb3
+DQEBCwUAA4IBAQCIYK++EcSq3Jvx5xTaIKpvLwauOLJ8rJCBIlF+yyYVbv5nmMEN
+3Ko5mCvSzDz/GpIvVgqpbtiaPcVNb8yRLuNOvyKry5IaoI9DzYK8SFXElc8Qa2ox
+GZJ94AYFbwsz5yo3QvnsGymZ4VgMAafDi1hxIZ9hjKf7tn4yi6lOxx/2RujdrKZM
+U/hNk+Tsc6sLvpjFeMSSwEx4R1IvkwdnIKRaf1l+T0hTIA03uwb4REJktJQVQ9FM
+UfOXHS3N27m7GmkQiX2uHQ2UeEUpzcRCZ2eWBb/aqiNlewT/t6yd7gvnD8HFC0j+
+D9Y/2LR3Erv1kU9D5gE/pMDqjMZomY5J6MSL
 -----END CERTIFICATE-----

From f4059c4164a8c7c760e0f235471a3282587e75e3 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Wed, 30 Jan 2019 13:55:02 +0100
Subject: [PATCH 793/868] Prefer iterating dict instead of calling dict.keys()

Calling dict.keys() is unnecessary. iter(dict) is equivalent to
dict.keys(). Inspired by Lennart Regebro's talk "Prehistoric Patterns in
Python" from PyCon 2017.

https://www.youtube.com/watch?v=V5-JH23Vk0I
---
 Lib/ldap/modlist.py         |  2 +-
 Lib/ldap/schema/subentry.py | 12 ++++++------
 Tests/t_ldap_syncrepl.py    |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Lib/ldap/modlist.py b/Lib/ldap/modlist.py
index 4acf4e9..bf4e481 100644
--- a/Lib/ldap/modlist.py
+++ b/Lib/ldap/modlist.py
@@ -50,7 +50,7 @@ def modifyModlist(
   case_ignore_attr_types = {v.lower() for v in case_ignore_attr_types or []}
   modlist = []
   attrtype_lower_map = {}
-  for a in old_entry.keys():
+  for a in old_entry:
     attrtype_lower_map[a.lower()]=a
   for attrtype, value in new_entry.items():
     attrtype_lower = attrtype.lower()
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 5ccbce0..215f148 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -23,7 +23,7 @@
     SCHEMA_CLASS_MAPPING[o.schema_attribute] = o
     SCHEMA_ATTR_MAPPING[o] = o.schema_attribute
 
-SCHEMA_ATTRS = SCHEMA_CLASS_MAPPING.keys()
+SCHEMA_ATTRS = list(SCHEMA_CLASS_MAPPING)
 
 
 class SubschemaError(ValueError):
@@ -122,7 +122,7 @@ def __init__(self,sub_schema_sub_entry,check_uniqueness=1):
         self.sed[se_class][se_id] = se_instance
 
         if hasattr(se_instance,'names'):
-          for name in ldap.cidict.cidict({}.fromkeys(se_instance.names)).keys():
+          for name in ldap.cidict.cidict({}.fromkeys(se_instance.names)):
             if check_uniqueness and name in self.name2oid[se_class]:
               self.non_unique_names[se_class][se_id] = None
               raise NameNotUnique(attr_value)
@@ -130,7 +130,7 @@ def __init__(self,sub_schema_sub_entry,check_uniqueness=1):
               self.name2oid[se_class][name] = se_id
 
     # Turn dict into list maybe more handy for applications
-    self.non_unique_oids = self.non_unique_oids.keys()
+    self.non_unique_oids = list(self.non_unique_oids)
 
     return # subSchema.__init__()
 
@@ -168,7 +168,7 @@ def listall(self,schema_element_class,schema_element_filters=None):
           except AttributeError:
             pass
     else:
-      result = avail_se.keys()
+      result = list(avail_se)
     return result
 
 
@@ -422,14 +422,14 @@ def attribute_types(
 
     # Remove all mandantory attribute types from
     # optional attribute type list
-    for a in list(r_may.keys()):
+    for a in list(r_may):
       if a in r_must:
         del r_may[a]
 
     # Apply attr_type_filter to results
     if attr_type_filter:
       for l in [r_must,r_may]:
-        for a in list(l.keys()):
+        for a in list(l):
           for afk,afv in attr_type_filter:
             try:
               schema_attr_type = self.sed[AttributeType][a]
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 73ba1fb..9398de5 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -242,7 +242,7 @@ def syncrepl_present(self, uuids, refreshDeletes=False):
 
         elif (uuids is None) and (refreshDeletes is False):
             deleted_uuids = []
-            for uuid in self.uuid_dn.keys():
+            for uuid in self.uuid_dn:
                 if uuid not in self.present:
                     deleted_uuids.append(uuid)
 

From e6b6e8e3ce3a715fbb004f9f7e381a88a1af6ff7 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 5 Apr 2018 09:56:49 +0200
Subject: [PATCH 794/868] Release GIL around global get/set option call

ldap.set_option() and ldap.get_option() now properly release the GIL
around potentially blocking calls.

Also fixes a problem with make indent by replacing
Py_BEGIN/END_ALLOW_THREADS with PyEval_SaveThread / PyEval_RestoreThread
function calls. python-ldap requires threading support any way.

Fixes: https://github.com/python-ldap/python-ldap/issues/85
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/functions.c   | 14 ++++++---
 Modules/ldapcontrol.c | 25 +++++++++------
 Modules/options.c     | 71 ++++++++++++++++++++++---------------------
 3 files changed, 62 insertions(+), 48 deletions(-)

diff --git a/Modules/functions.c b/Modules/functions.c
index 4731efb..3a43c7c 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -15,13 +15,18 @@ l_ldap_initialize(PyObject *unused, PyObject *args)
     char *uri;
     LDAP *ld = NULL;
     int ret;
+    PyThreadState *save;
 
     if (!PyArg_ParseTuple(args, "s:initialize", &uri))
         return NULL;
 
-    Py_BEGIN_ALLOW_THREADS ret = ldap_initialize(&ld, uri);
-    Py_END_ALLOW_THREADS if (ret != LDAP_SUCCESS)
+    save = PyEval_SaveThread();
+    ret = ldap_initialize(&ld, uri);
+    PyEval_RestoreThread(save);
+
+    if (ret != LDAP_SUCCESS)
         return LDAPerror(ld, "ldap_initialize");
+
     return (PyObject *)newLDAPObject(ld);
 }
 
@@ -75,9 +80,8 @@ l_ldap_str2dn(PyObject *unused, PyObject *args)
             tuple = Py_BuildValue("(O&O&i)",
                                   LDAPberval_to_unicode_object, &ava->la_attr,
                                   LDAPberval_to_unicode_object, &ava->la_value,
-                                  ava->
-                                  la_flags & ~(LDAP_AVA_FREE_ATTR |
-                                               LDAP_AVA_FREE_VALUE));
+                                  ava->la_flags & ~(LDAP_AVA_FREE_ATTR |
+                                                    LDAP_AVA_FREE_VALUE));
             if (!tuple) {
                 Py_DECREF(rdnlist);
                 goto failed;
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index f53e681..6615598 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -339,6 +339,7 @@ encode_assertion_control(PyObject *self, PyObject *args)
     char *assertion_filterstr;
     struct berval ctrl_val;
     LDAP *ld = NULL;
+    PyThreadState *save;
 
     if (!PyArg_ParseTuple(args, "s:encode_assertion_control",
                           &assertion_filterstr)) {
@@ -348,21 +349,27 @@ encode_assertion_control(PyObject *self, PyObject *args)
     /* XXX: ldap_create() is a nasty and slow hack. It's creating a full blown
      * LDAP object just to encode assertion controls.
      */
-    Py_BEGIN_ALLOW_THREADS err = ldap_create(&ld);
-    Py_END_ALLOW_THREADS if (err != LDAP_SUCCESS)
+    save = PyEval_SaveThread();
+    err = ldap_create(&ld);
+    PyEval_RestoreThread(save);
+    if (err != LDAP_SUCCESS)
         return LDAPerror(ld, "ldap_create");
 
-    err =
-        ldap_create_assertion_control_value(ld, assertion_filterstr,
-                                            &ctrl_val);
+    err = ldap_create_assertion_control_value(ld, assertion_filterstr,
+                                              &ctrl_val);
 
     if (err != LDAP_SUCCESS) {
         LDAPerror(ld, "ldap_create_assertion_control_value");
-        Py_BEGIN_ALLOW_THREADS ldap_unbind_ext(ld, NULL, NULL);
-        Py_END_ALLOW_THREADS return NULL;
+        save = PyEval_SaveThread();
+        ldap_unbind_ext(ld, NULL, NULL);
+        PyEval_RestoreThread(save);
+        return NULL;
     }
-    Py_BEGIN_ALLOW_THREADS ldap_unbind_ext(ld, NULL, NULL);
-    Py_END_ALLOW_THREADS res = LDAPberval_to_object(&ctrl_val);
+    save = PyEval_SaveThread();
+    ldap_unbind_ext(ld, NULL, NULL);
+    PyEval_RestoreThread(save);
+    res = LDAPberval_to_object(&ctrl_val);
+
     if (ctrl_val.bv_val != NULL) {
         ber_memfree(ctrl_val.bv_val);
     }
diff --git a/Modules/options.c b/Modules/options.c
index 85560e6..549a672 100644
--- a/Modules/options.c
+++ b/Modules/options.c
@@ -185,11 +185,18 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
         return 0;
     }
 
-    if (self)
+    if (self) {
         LDAP_BEGIN_ALLOW_THREADS(self);
-    res = ldap_set_option(ld, option, ptr);
-    if (self)
+        res = ldap_set_option(ld, option, ptr);
         LDAP_END_ALLOW_THREADS(self);
+    }
+    else {
+        PyThreadState *save;
+
+        save = PyEval_SaveThread();
+        res = ldap_set_option(NULL, option, ptr);
+        PyEval_RestoreThread(save);
+    }
 
     if ((option == LDAP_OPT_SERVER_CONTROLS) ||
         (option == LDAP_OPT_CLIENT_CONTROLS))
@@ -203,6 +210,26 @@ LDAP_set_option(LDAPObject *self, int option, PyObject *value)
     return 1;
 }
 
+static int
+LDAP_int_get_option(LDAPObject *self, int option, void *value)
+{
+    int res;
+
+    if (self != NULL) {
+        LDAP_BEGIN_ALLOW_THREADS(self);
+        res = ldap_get_option(self->ldap, option, value);
+        LDAP_END_ALLOW_THREADS(self);
+    }
+    else {
+        PyThreadState *save;
+
+        save = PyEval_SaveThread();
+        res = ldap_get_option(NULL, option, value);
+        PyEval_RestoreThread(save);
+    }
+    return res;
+}
+
 PyObject *
 LDAP_get_option(LDAPObject *self, int option)
 {
@@ -214,18 +241,11 @@ LDAP_get_option(LDAPObject *self, int option)
     char *strval;
     PyObject *extensions, *v;
     Py_ssize_t i, num_extensions;
-    LDAP *ld;
-
-    ld = self ? self->ldap : NULL;
 
     switch (option) {
     case LDAP_OPT_API_INFO:
         apiinfo.ldapai_info_version = LDAP_API_INFO_VERSION;
-        if (self)
-            LDAP_BEGIN_ALLOW_THREADS(self);
-        res = ldap_get_option(ld, option, &apiinfo);
-        if (self)
-            LDAP_END_ALLOW_THREADS(self);
+        res = LDAP_int_get_option(self, option, &apiinfo);
         if (res != LDAP_OPT_SUCCESS)
             return option_error(res, "ldap_get_option");
 
@@ -236,8 +256,8 @@ LDAP_get_option(LDAPObject *self, int option)
         extensions = PyTuple_New(num_extensions);
         for (i = 0; i < num_extensions; i++)
             PyTuple_SET_ITEM(extensions, i,
-                             PyUnicode_FromString(apiinfo.
-                                                  ldapai_extensions[i]));
+                             PyUnicode_FromString(apiinfo.ldapai_extensions
+                                                  [i]));
 
         /* return api info as a dictionary */
         v = Py_BuildValue("{s:i, s:i, s:i, s:s, s:i, s:O}",
@@ -299,11 +319,7 @@ LDAP_get_option(LDAPObject *self, int option)
     case LDAP_OPT_X_KEEPALIVE_INTERVAL:
 #endif
         /* Integer-valued options */
-        if (self)
-            LDAP_BEGIN_ALLOW_THREADS(self);
-        res = ldap_get_option(ld, option, &intval);
-        if (self)
-            LDAP_END_ALLOW_THREADS(self);
+        res = LDAP_int_get_option(self, option, &intval);
         if (res != LDAP_OPT_SUCCESS)
             return option_error(res, "ldap_get_option");
         return PyInt_FromLong(intval);
@@ -347,11 +363,7 @@ LDAP_get_option(LDAPObject *self, int option)
 #endif
 #endif
         /* String-valued options */
-        if (self)
-            LDAP_BEGIN_ALLOW_THREADS(self);
-        res = ldap_get_option(ld, option, &strval);
-        if (self)
-            LDAP_END_ALLOW_THREADS(self);
+        res = LDAP_int_get_option(self, option, &strval);
         if (res != LDAP_OPT_SUCCESS)
             return option_error(res, "ldap_get_option");
         if (strval == NULL) {
@@ -365,11 +377,7 @@ LDAP_get_option(LDAPObject *self, int option)
     case LDAP_OPT_TIMEOUT:
     case LDAP_OPT_NETWORK_TIMEOUT:
         /* Double-valued timeval options */
-        if (self)
-            LDAP_BEGIN_ALLOW_THREADS(self);
-        res = ldap_get_option(ld, option, &tv);
-        if (self)
-            LDAP_END_ALLOW_THREADS(self);
+        res = LDAP_int_get_option(self, option, &tv);
         if (res != LDAP_OPT_SUCCESS)
             return option_error(res, "ldap_get_option");
         if (tv == NULL) {
@@ -384,12 +392,7 @@ LDAP_get_option(LDAPObject *self, int option)
 
     case LDAP_OPT_SERVER_CONTROLS:
     case LDAP_OPT_CLIENT_CONTROLS:
-        if (self)
-            LDAP_BEGIN_ALLOW_THREADS(self);
-        res = ldap_get_option(ld, option, &lcs);
-        if (self)
-            LDAP_END_ALLOW_THREADS(self);
-
+        res = LDAP_int_get_option(self, option, &lcs);
         if (res != LDAP_OPT_SUCCESS)
             return option_error(res, "ldap_get_option");
 

From 0f1d8a84c0f30a4288d720ed8f3f77c486cd8385 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 30 Jan 2019 16:27:04 +0100
Subject: [PATCH 795/868] Doc: Use the full module in
 ldap.ldapobject.LDAPObject

Previously, the class showed up as `ldap.LDAPObject`, which is wrong.

Fixes: https://github.com/python-ldap/python-ldap/issues/256
---
 Doc/reference/ldap.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 69e2462..1117c07 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -579,7 +579,7 @@ Warnings
 LDAPObject classes
 ==================
 
-.. py:class:: LDAPObject
+.. py:class:: ldap.ldapobject.LDAPObject
 
    Instances of :py:class:`LDAPObject` are returned by :py:func:`initialize()`.
    The connection is automatically unbound

From 43391694378053ea62dad559c27465c0d3373f43 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 30 Jan 2019 17:42:30 +0100
Subject: [PATCH 796/868] Doc: Clarify the relationship between initialize()
 and LDAPObject()

Originally, `ldap.ldapobject.LDAPObject` was meant as a read/write
alias of the "default" connection class.
However, setting module attributes is bad practice (action at distance):
it affects all users of python-ldap, some of which might not be aware
of each other.

Clarify that:
* `initialize()` is a thin wrapper around calling `LDAPObject()`,
* it is fine and recommnended to instantiate LDAPObject-like classes
  directly, and
* it is possible, but not recommended, to set
  `ldap.ldapobject.LDAPObject` to another class.
---
 Doc/reference/ldap.rst | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 1117c07..61f16c7 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -32,7 +32,7 @@ This module defines the following functions:
 .. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None, [bytes_strictness=None]]]]]) -> LDAPObject object
 
    Initializes a new connection object for accessing the given LDAP server,
-   and return an LDAP object (see :ref:`ldap-objects`) used to perform operations
+   and return an :class:`~ldap.ldapobject.LDAPObject` used to perform operations
    on that server.
 
    The *uri* parameter may be a comma- or whitespace-separated list of URIs
@@ -63,7 +63,10 @@ This module defines the following functions:
    :py:const:`2` for logging the method calls with arguments and the complete results and
    :py:const:`9` for also logging the traceback of method calls.
 
-   Additional keyword arguments are passed to :class:`LDAPObject`.
+   This function is a thin wrapper around instantiating
+   :class:`~ldap.ldapobject.LDAPObject`.
+   Any additional keyword arguments are passed to ``LDAPObject``.
+   It is also fine to instantiate a ``LDAPObject`` (or a subclass) directly.
 
    .. seealso::
 
@@ -585,8 +588,13 @@ LDAPObject classes
    The connection is automatically unbound
    and closed when the LDAP object is deleted.
 
-   Internally :py:class:`LDAPObject` is set to
-   :py:class:`~ldap.ldapobject.SimpleLDAPObject` by default.
+   :py:class:`LDAPObject` is an alias of
+   :py:class:`~ldap.ldapobject.SimpleLDAPObject`, the default connection class.
+   If you wish to use a different class, instantiate it directly instead of
+   calling :func:`initialize()`.
+
+   (It is also possible, but not recommended, to change the default by setting
+   ``ldap.ldapobject.LDAPObject`` to a different class.)
 
 .. autoclass:: ldap.ldapobject.SimpleLDAPObject
 

From da432d727138c315846fec5f271f065d7b4bc15e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 2 May 2019 09:40:38 +0100
Subject: [PATCH 797/868] Do not leak serverctrls

---
 Modules/LDAPObject.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index bc26727..ed4df4c 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1171,6 +1171,7 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
         }
         else
             e = "ldap_parse_result";
+        ldap_controls_free(serverctrls);
         ldap_msgfree(msg);
         Py_XDECREF(valuestr);
         return LDAPerror(self->ldap, e);
@@ -1182,6 +1183,7 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
         LDAP_BEGIN_ALLOW_THREADS(self);
         ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &err);
         LDAP_END_ALLOW_THREADS(self);
+        ldap_controls_free(serverctrls);
         ldap_msgfree(msg);
         Py_XDECREF(valuestr);
         return LDAPerror(self->ldap, "LDAPControls_to_List");

From 689f7df6146ed2ecf6e7535c1cbc8643fc51ae15 Mon Sep 17 00:00:00 2001
From: Florian Best <best@univention.de>
Date: Fri, 10 May 2019 16:24:29 +0200
Subject: [PATCH 798/868] Test if reconnection is done after connection loss

---
 Tests/t_ldapobject.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 67adeb2..36e2acf 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -736,6 +736,23 @@ def test104_reconnect_restore(self):
         l2 = pickle.loads(l1_state)
         self.assertEqual(l2.whoami_s(), 'dn:'+bind_dn)
 
+    def test105_reconnect_restore(self):
+        l1 = self.ldap_object_class(self.server.ldap_uri, retry_max=2, retry_delay=1)
+        bind_dn = 'cn=user1,'+self.server.suffix
+        l1.simple_bind_s(bind_dn, 'user1_pw')
+        self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
+        self.server._proc.terminate()
+        self.server.wait()
+        try:
+            l1.whoami_s()
+        except ldap.SERVER_DOWN:
+            pass
+        else:
+            self.assertEqual(True, False)
+        finally:
+            self.server._start_slapd()
+        self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
+
 
 if __name__ == '__main__':
     unittest.main()

From daf266a28ec3720d054aafddad3274ad8740cd46 Mon Sep 17 00:00:00 2001
From: Florian Best <best@univention.de>
Date: Fri, 10 May 2019 13:48:51 +0200
Subject: [PATCH 799/868] Ensure self._l is not left in an only partially
 initialized state

If the timeout is reached and a reconnection was not successfull in that time, a ldap.SERVER_DOWN exception is raised.
If later on, when it's assured that the ldap server is running again, the connection is used again, the reconnection
is not performed and the ldap connection in an incosistent unbind state.

Traceback (most recent call last):
  File "reproduce.py", line 23, in <module>
    _ = lo.search_s('l=school,l=dev', ldap.SCOPE_SUBTREE, '(uid=Administrator)')
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 597, in search_s
    return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 997, in search_ext_s
    return self._apply_method_s(SimpleLDAPObject.search_ext_s,*args,**kwargs)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 935, in _apply_method_s
    return func(self,*args,**kwargs)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 591, in search_ext_s
    return self.result(msgid,all=1,timeout=timeout)[1]
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 503, in result
    resp_type, resp_data, resp_msgid = self.result2(msgid,all,timeout)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 507, in result2
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all,timeout)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 514, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 521, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 106, in _ldap_call
    result = func(*args,**kwargs)
ldap.INSUFFICIENT_ACCESS: {'desc': 'Insufficient access'}
---
 Lib/ldap/ldapobject.py | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index f7443fa..a92b088 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -1166,14 +1166,18 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
             counter_text,uri
           ))
         try:
-          # Do the connect
-          self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
-          self._restore_options()
-          # StartTLS extended operation in case this was called before
-          if self._start_tls:
-            SimpleLDAPObject.start_tls_s(self)
-          # Repeat last simple or SASL bind
-          self._apply_last_bind()
+          try:
+            # Do the connect
+            self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
+            self._restore_options()
+            # StartTLS extended operation in case this was called before
+            if self._start_tls:
+              SimpleLDAPObject.start_tls_s(self)
+            # Repeat last simple or SASL bind
+            self._apply_last_bind()
+          except ldap.LDAPError:
+            SimpleLDAPObject.unbind_s(self)
+            raise
         except (ldap.SERVER_DOWN,ldap.TIMEOUT):
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('*** %s reconnect to %s failed\n' % (
@@ -1185,7 +1189,6 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('=> delay %s...\n' % (retry_delay))
           time.sleep(retry_delay)
-          SimpleLDAPObject.unbind_s(self)
         else:
           if __debug__ and self._trace_level>=1:
             self._trace_file.write('*** %s reconnect to %s successful => repeat last operation\n' % (

From 532ffc0ae16733f8b384f9e544016e9be6319ef3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 2 May 2019 11:00:22 +0100
Subject: [PATCH 800/868] Use slapd -Tt instead of slaptest

If we point SBIN to $openldap_source/servers/slapd, libtool scripts will
munge argv[0] and slapd won't recognise it's slaptest we asked for. So
just request a slapd tool directly.
---
 Lib/slapdtest/_slapdtest.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index f1885ca..2f932bc 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -252,7 +252,6 @@ def _find_commands(self):
         self.PATH_SLAPD = os.environ.get('SLAPD', None)
         if not self.PATH_SLAPD:
             self.PATH_SLAPD = self._find_command('slapd', in_sbin=True)
-        self.PATH_SLAPTEST = self._find_command('slaptest', in_sbin=True)
 
     def _find_command(self, cmd, in_sbin=False):
         if in_sbin:
@@ -378,7 +377,8 @@ def _write_config(self):
     def _test_config(self):
         self._log.debug('testing config %s', self._slapd_conf)
         popen_list = [
-            self.PATH_SLAPTEST,
+            self.PATH_SLAPD,
+            '-Ttest',
             "-f", self._slapd_conf,
             '-u',
         ]

From 2b132f1436d42454526f26fd23081d1ffa3317ba Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 29 Jan 2020 15:08:00 +0100
Subject: [PATCH 801/868] ldap.dn.is_dn: Fix typo in docstring

https://github.com/python-ldap/python-ldap/pull/303
Suggested in https://github.com/python-ldap/python-ldap/pull/272

Co-authored-by: Florian Best <spaceone@users.noreply.github.com>
---
 Lib/ldap/dn.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index cabfed8..a066ac1 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -111,7 +111,7 @@ def explode_rdn(rdn, notypes=False, flags=0):
 
 def is_dn(s,flags=0):
   """
-  Returns True is `s' can be parsed by ldap.dn.str2dn() like as a
+  Returns True if `s' can be parsed by ldap.dn.str2dn() as a
   distinguished host_name (DN), otherwise False is returned.
   """
   try:

From 9cd5d9855ae4bd1ef850c0aa3afa9fcbe7b086a7 Mon Sep 17 00:00:00 2001
From: Florian Best <best@univention.de>
Date: Sun, 8 Dec 2019 20:19:15 +0100
Subject: [PATCH 802/868] Fix typo in documentation

---
 Doc/bytes_mode.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index dcd3dcb..c999421 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -55,7 +55,7 @@ argument to :func:`ldap.initialize`:
     Text values are represented as ``unicode``.
 
 If not given explicitly, python-ldap will default to ``bytes_mode=True``,
-but if an ``unicode`` value supplied to it, if will warn and use that value.
+but if an ``unicode`` value supplied to it, it will warn and use that value.
 
 Backwards-compatible behavior is not scheduled for removal until Python 2
 itself reaches end of life.

From 860ea96ff966058467ae9970e6e42d2ea3a4ea30 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 29 Jan 2020 16:49:57 +0100
Subject: [PATCH 803/868] Test on Python 3.8 and 3.9-dev

---
 .travis.yml | 11 +++++++++--
 setup.py    |  1 +
 tox.ini     |  2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 8146639..8e0e3a2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -39,13 +39,20 @@ matrix:
         - WITH_GCOV=1
       dist: xenial
       sudo: true
-    - python: 3.8-dev
+    - python: 3.8
       env:
         - TOXENV=py38
         - CFLAGS_std="-std=c99"
         - WITH_GCOV=1
       dist: xenial
       sudo: true
+    - python: 3.9-dev
+      env:
+        - TOXENV=py39
+        - CFLAGS_std="-std=c99"
+        - WITH_GCOV=1
+      dist: xenial
+      sudo: true
     - python: 2.7
       env:
         - TOXENV=py2-nosasltls
@@ -61,7 +68,7 @@ matrix:
       env: TOXENV=doc
   allow_failures:
      - env:
-        - TOXENV=py38
+        - TOXENV=py39
         - CFLAGS_std="-std=c99"
         - WITH_GCOV=1
      - env:
diff --git a/setup.py b/setup.py
index e66ecbd..6974785 100644
--- a/setup.py
+++ b/setup.py
@@ -95,6 +95,7 @@ class OpenLDAP2:
     'Programming Language :: Python :: 3.5',
     'Programming Language :: Python :: 3.6',
     'Programming Language :: Python :: 3.7',
+    'Programming Language :: Python :: 3.8',
     # Note: when updating Python versions, also change .travis.yml and tox.ini
 
     'Topic :: Database',
diff --git a/tox.ini b/tox.ini
index 1434ba0..be72317 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py34,py35,py36,py37,py38,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
+envlist = py27,py34,py35,py36,py37,py38,py39,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
 minver = 1.8
 
 [testenv]

From 6fb4ea430e29ea5e93251458b6c926c0619ea154 Mon Sep 17 00:00:00 2001
From: Thomas Grainger <tagrain@gmail.com>
Date: Tue, 18 Feb 2020 09:44:40 +0000
Subject: [PATCH 804/868] fix grammar in docs

---
 Doc/bytes_mode.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index c999421..38f9e73 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -55,7 +55,7 @@ argument to :func:`ldap.initialize`:
     Text values are represented as ``unicode``.
 
 If not given explicitly, python-ldap will default to ``bytes_mode=True``,
-but if an ``unicode`` value supplied to it, it will warn and use that value.
+but if an ``unicode`` value is supplied to it, it will warn and use that value.
 
 Backwards-compatible behavior is not scheduled for removal until Python 2
 itself reaches end of life.

From 9eb8b95a68168f04a72af5cf8db4c57338cf1836 Mon Sep 17 00:00:00 2001
From: Thomas Grainger <tagrain@gmail.com>
Date: Tue, 18 Feb 2020 09:51:32 +0000
Subject: [PATCH 805/868] Update Doc/bytes_mode.rst

---
 Doc/bytes_mode.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index 38f9e73..0d20745 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -55,7 +55,7 @@ argument to :func:`ldap.initialize`:
     Text values are represented as ``unicode``.
 
 If not given explicitly, python-ldap will default to ``bytes_mode=True``,
-but if an ``unicode`` value is supplied to it, it will warn and use that value.
+but if a ``unicode`` value is supplied to it, it will warn and use that value.
 
 Backwards-compatible behavior is not scheduled for removal until Python 2
 itself reaches end of life.

From 7196171da7113aa12723db91003cc0424f8d0eaf Mon Sep 17 00:00:00 2001
From: johnthagen <johnthagen@users.noreply.github.com>
Date: Tue, 25 Feb 2020 07:07:55 -0500
Subject: [PATCH 806/868] Add LICENSE file metadata to package distributions

Add LICENSE file metadata to package distributions

https://github.com/python-ldap/python-ldap/pull/315
Co-authored-by: Petr Viktorin <encukou@gmail.com>
---
 setup.cfg | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/setup.cfg b/setup.cfg
index c654606..01d43a0 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,3 +1,7 @@
+# Package metadata (for Setuptools 30.3 and later)
+[metadata]
+license_file = LICENCE
+
 # Example for setup.cfg
 # You have to edit this file to reflect your system configuation
 

From 9005ba96eceed0e5712a0824cc707b98310cc483 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 6 May 2020 14:57:42 +0200
Subject: [PATCH 807/868] Doc: Use bytes for attribute values in example

https://github.com/python-ldap/python-ldap/pull/317

Fixes: https://github.com/python-ldap/python-ldap/issues/306
---
 Doc/reference/ldif.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/reference/ldif.rst b/Doc/reference/ldif.rst
index c508f7d..87dcb70 100644
--- a/Doc/reference/ldif.rst
+++ b/Doc/reference/ldif.rst
@@ -61,11 +61,11 @@ Example
 The following example demonstrates how to write LDIF output
 of an LDAP entry with :mod:`ldif` module.
 
->>> import sys,ldif
->>> entry={'objectClass':['top','person'],'cn':['Michael Stroeder'],'sn':['Stroeder']}
+>>> import sys, ldif
+>>> entry={'objectClass': [b'top', b'person'], 'cn': [b'Michael Stroeder'], 'sn': [b'Stroeder']}
 >>> dn='cn=Michael Stroeder,ou=Test'
 >>> ldif_writer=ldif.LDIFWriter(sys.stdout)
->>> ldif_writer.unparse(dn,entry)
+>>> ldif_writer.unparse(dn, entry)
 dn: cn=Michael Stroeder,ou=Test
 cn: Michael Stroeder
 objectClass: top

From 8dd59eaffa696bcf8bc70c259db87f65c6500bce Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 6 May 2020 15:55:18 +0200
Subject: [PATCH 808/868] Doc: Remove duplicate entry for NO_OBJECT_CLASS_MODS

This fixes the build with newer versions of Sphinx.

https://github.com/python-ldap/python-ldap/pull/330
---
 Doc/reference/ldap.rst | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 61f16c7..3254375 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -458,10 +458,6 @@ The module defines the following exceptions:
 
 .. py:exception:: NO_MEMORY
 
-.. py:exception:: NO_OBJECT_CLASS_MODS
-
-   Object class modifications are not allowed.
-
 .. py:exception:: NO_RESULTS_RETURNED
 
 .. py:exception:: NO_SUCH_ATTRIBUTE

From 7e084aec1ba9ced25b44fd3db77e65242a827806 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Wed, 6 May 2020 15:48:46 +0100
Subject: [PATCH 809/868] Get rid of expected failures in tokenizer tests

https://github.com/python-ldap/python-ldap/pull/283
---
 Lib/ldap/schema/tokenizer.py     | 10 +++++++---
 Tests/t_ldap_schema_tokenizer.py |  6 ++----
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index 20958c0..69823f2 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -13,12 +13,16 @@
     r"|"              # or
     r"([^'$()\s]+)"   # string of length >= 1 without '$() or whitespace
     r"|"              # or
-    r"('.*?'(?!\w))"  # any string or empty string surrounded by single quotes
-                      # except if right quote is succeeded by alphanumeric char
+    r"('(?:[^'\\]|\\\\|\\.)*?'(?!\w))"
+                      # any string or empty string surrounded by unescaped
+                      # single quotes except if right quote is succeeded by
+                      # alphanumeric char
     r"|"              # or
     r"([^\s]+?)",     # residue, all non-whitespace strings
 ).findall
 
+UNESCAPE_PATTERN = re.compile(r"\\(.)")
+
 
 def split_tokens(s):
     """
@@ -30,7 +34,7 @@ def split_tokens(s):
         if unquoted:
             parts.append(unquoted)
         elif quoted:
-            parts.append(quoted[1:-1])
+            parts.append(UNESCAPE_PATTERN.sub(r'\1', quoted[1:-1]))
         elif opar:
             parens += 1
             parts.append(opar)
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index c858177..0890379 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -44,8 +44,8 @@
 
 # broken schema of Oracle Internet Directory
 TESTCASES_BROKEN_OID = (
-    ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH']),
-    ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
+    "BLUBB DI 'BLU B B ER'MUST 'BLAH' ", #['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH']
+    "BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", #["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]
 )
 
 # for quoted single quotes inside string values
@@ -104,14 +104,12 @@ def test_utf8(self):
         """
         self._run_split_tokens_tests(TESTCASES_UTF8)
 
-    @unittest.expectedFailure
     def test_broken_oid(self):
         """
         run test cases specified in constant TESTCASES_BROKEN_OID
         """
         self._run_failure_tests(TESTCASES_BROKEN_OID)
 
-    @unittest.expectedFailure
     def test_escaped_quotes(self):
         """
         run test cases specified in constant TESTCASES_ESCAPED_QUOTES

From 7d92e0fb76e9d5da63638ecde2c615f8d0084f75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 2 May 2019 09:33:25 +0100
Subject: [PATCH 810/868] Pass message type as is

---
 Modules/LDAPObject.c | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index ed4df4c..8ce9adb 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1081,7 +1081,7 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
     struct timeval *tvp;
     int res_type;
     LDAPMessage *msg = NULL;
-    PyObject *result_str, *retval, *pmsg, *pyctrls = 0;
+    PyObject *retval, *pmsg, *pyctrls = 0;
     int res_msgid = 0;
     char *retoid = 0;
     PyObject *valuestr = NULL;
@@ -1193,27 +1193,19 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
     pmsg =
         LDAPmessage_to_python(self->ldap, msg, add_ctrls, add_intermediates);
 
-    if (res_type == 0) {
-        result_str = Py_None;
-        Py_INCREF(Py_None);
-    }
-    else {
-        result_str = PyInt_FromLong(res_type);
-    }
-
     if (pmsg == NULL) {
         retval = NULL;
     }
     else {
         /* s handles NULL, but O does not */
         if (add_extop) {
-            retval = Py_BuildValue("(OOiOsO)", result_str, pmsg, res_msgid,
+            retval = Py_BuildValue("(iOiOsO)", res_type, pmsg, res_msgid,
                                    pyctrls, retoid,
                                    valuestr ? valuestr : Py_None);
         }
         else {
             retval =
-                Py_BuildValue("(OOiO)", result_str, pmsg, res_msgid, pyctrls);
+                Py_BuildValue("(iOiO)", res_type, pmsg, res_msgid, pyctrls);
         }
 
         if (pmsg != Py_None) {
@@ -1222,7 +1214,6 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
     }
     Py_XDECREF(valuestr);
     Py_XDECREF(pyctrls);
-    Py_DECREF(result_str);
     return retval;
 }
 

From f754e35dcbc65bea6c879e6a68de3e5889a43460 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 2 May 2019 10:38:20 +0100
Subject: [PATCH 811/868] Attach msgid/controls/... to exceptions (Closes #177,
 #208)

Closes:
https://github.com/python-ldap/python-ldap/issues/177 (msgid)
https://github.com/python-ldap/python-ldap/issues/208 (controls)
---
 Modules/LDAPObject.c |   3 +-
 Modules/constants.c  | 110 ++++++++++++++++++++++++++++++++++---------
 Modules/constants.h  |   1 +
 3 files changed, 91 insertions(+), 23 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 8ce9adb..73dc0fe 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1172,9 +1172,8 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
         else
             e = "ldap_parse_result";
         ldap_controls_free(serverctrls);
-        ldap_msgfree(msg);
         Py_XDECREF(valuestr);
-        return LDAPerror(self->ldap, e);
+        return LDAPraise_for_message(self->ldap, e, msg);
     }
 
     if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
diff --git a/Modules/constants.c b/Modules/constants.c
index f8da373..bc7c2dc 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -3,6 +3,7 @@
 
 #include "common.h"
 #include "constants.h"
+#include "ldapcontrol.h"
 #include "lber.h"
 #include "ldap.h"
 
@@ -48,29 +49,48 @@ LDAPerr(int errnum)
 
 /* Convert an LDAP error into an informative python exception */
 PyObject *
-LDAPerror(LDAP *l, char *msg)
+LDAPraise_for_message(LDAP *l, char *msg, LDAPMessage *m)
 {
     if (l == NULL) {
         PyErr_SetFromErrno(LDAPexception_class);
+        ldap_msgfree(m);
         return NULL;
     }
     else {
-        int myerrno, errnum, opt_errnum;
+        int myerrno, errnum, opt_errnum, msgid = -1, msgtype = 0;
         PyObject *errobj;
         PyObject *info;
         PyObject *str;
         PyObject *pyerrno;
-        char *matched, *error;
+        PyObject *pyresult;
+        PyObject *pyctrls = NULL;
+        char *matched = NULL,
+             *error = NULL,
+             **refs = NULL;
+        LDAPControl **serverctrls = NULL;
 
         /* at first save errno for later use before it gets overwritten by another call */
         myerrno = errno;
 
-        opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
-        if (opt_errnum != LDAP_OPT_SUCCESS)
-            errnum = opt_errnum;
+        if (m != NULL) {
+            msgid = ldap_msgid(m);
+            msgtype = ldap_msgtype(m);
+            ldap_parse_result(l, m, &errnum, &matched, &error, &refs,
+                              &serverctrls, 1);
+        }
 
-        if (errnum == LDAP_NO_MEMORY)
-            return PyErr_NoMemory();
+        if (msgtype <= 0) {
+            opt_errnum = ldap_get_option(l, LDAP_OPT_ERROR_NUMBER, &errnum);
+            if (opt_errnum != LDAP_OPT_SUCCESS)
+                errnum = opt_errnum;
+
+            if (errnum == LDAP_NO_MEMORY) {
+                return PyErr_NoMemory();
+            }
+
+            ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched);
+            ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error);
+        }
 
         if (errnum >= LDAP_ERROR_MIN && errnum <= LDAP_ERROR_MAX)
             errobj = errobjects[errnum + LDAP_ERROR_OFFSET];
@@ -78,8 +98,32 @@ LDAPerror(LDAP *l, char *msg)
             errobj = LDAPexception_class;
 
         info = PyDict_New();
-        if (info == NULL)
+        if (info == NULL) {
+            ldap_memfree(matched);
+            ldap_memfree(error);
+            ldap_memvfree((void **)refs);
+            ldap_controls_free(serverctrls);
             return NULL;
+        }
+
+        if (msgtype > 0) {
+            pyresult = PyInt_FromLong(msgtype);
+            if (pyresult)
+                PyDict_SetItemString(info, "msgtype", pyresult);
+            Py_XDECREF(pyresult);
+        }
+
+        if (msgid >= 0) {
+            pyresult = PyInt_FromLong(msgid);
+            if (pyresult)
+                PyDict_SetItemString(info, "msgid", pyresult);
+            Py_XDECREF(pyresult);
+        }
+
+        pyresult = PyInt_FromLong(errnum);
+        if (pyresult)
+            PyDict_SetItemString(info, "result", pyresult);
+        Py_XDECREF(pyresult);
 
         str = PyUnicode_FromString(ldap_err2string(errnum));
         if (str)
@@ -93,8 +137,21 @@ LDAPerror(LDAP *l, char *msg)
             Py_XDECREF(pyerrno);
         }
 
-        if (ldap_get_option(l, LDAP_OPT_MATCHED_DN, &matched) >= 0
-            && matched != NULL) {
+        if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
+            int err = LDAP_NO_MEMORY;
+
+            ldap_set_option(l, LDAP_OPT_ERROR_NUMBER, &err);
+            ldap_memfree(matched);
+            ldap_memfree(error);
+            ldap_memvfree((void **)refs);
+            ldap_controls_free(serverctrls);
+            return PyErr_NoMemory();
+        }
+        ldap_controls_free(serverctrls);
+        PyDict_SetItemString(info, "ctrls", pyctrls);
+        Py_XDECREF(pyctrls);
+
+        if (matched != NULL) {
             if (*matched != '\0') {
                 str = PyUnicode_FromString(matched);
                 if (str)
@@ -104,27 +161,38 @@ LDAPerror(LDAP *l, char *msg)
             ldap_memfree(matched);
         }
 
-        if (errnum == LDAP_REFERRAL) {
+        if (errnum == LDAP_REFERRAL && refs != NULL && refs[0] != NULL) {
+            /* Keep old behaviour, overshadow error message */
+            char err[1024];
+
+            snprintf(err, sizeof(err), "Referral:\n%s", refs[0]);
+            str = PyUnicode_FromString(err);
+            PyDict_SetItemString(info, "info", str);
+            Py_XDECREF(str);
+        }
+        else if (msg != NULL || (error != NULL && *error != '\0')) {
+            msg = msg ? msg : error;
+
             str = PyUnicode_FromString(msg);
             if (str)
                 PyDict_SetItemString(info, "info", str);
             Py_XDECREF(str);
         }
-        else if (ldap_get_option(l, LDAP_OPT_ERROR_STRING, &error) >= 0) {
-            if (error != NULL && *error != '\0') {
-                str = PyUnicode_FromString(error);
-                if (str)
-                    PyDict_SetItemString(info, "info", str);
-                Py_XDECREF(str);
-            }
-            ldap_memfree(error);
-        }
+
         PyErr_SetObject(errobj, info);
         Py_DECREF(info);
+        ldap_memvfree((void **)refs);
+        ldap_memfree(error);
         return NULL;
     }
 }
 
+PyObject *
+LDAPerror(LDAP *l, char *msg)
+{
+    return LDAPraise_for_message(l, msg, NULL);
+}
+
 /* initialise the module constants */
 
 int
diff --git a/Modules/constants.h b/Modules/constants.h
index 8a390b5..f1d84a5 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -12,6 +12,7 @@ extern PyObject *LDAPconstant(int);
 
 extern PyObject *LDAPexception_class;
 extern PyObject *LDAPerror(LDAP *, char *msg);
+extern PyObject *LDAPraise_for_message(LDAP *, char *msg, LDAPMessage *m);
 PyObject *LDAPerr(int errnum);
 
 #ifndef LDAP_CONTROL_PAGE_OID

From 07f44122f1f4b4e2b1550a6dc6e13d0d14e664ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 2 May 2019 10:43:15 +0100
Subject: [PATCH 812/868] Sample test for previous commit

---
 Tests/t_cext.py | 36 +++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 96c3b2c..668107e 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -381,30 +381,36 @@ def test_compare(self):
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
         self.assertEqual(result, _ldap.RES_ADD)
+
         # try a false compare
         m = l.compare_ext(dn, "userPassword", "bad_string")
-        try:
+        with self.assertRaises(_ldap.COMPARE_FALSE) as e:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        except _ldap.COMPARE_FALSE:
-            pass
-        else:
-            self.fail("expected COMPARE_FALSE, got %r" % r)
+
+        self.assertEqual(e.exception.args[0]['msgid'], m)
+        self.assertEqual(e.exception.args[0]['msgtype'], _ldap.RES_COMPARE)
+        self.assertEqual(e.exception.args[0]['result'], 5)
+        self.assertFalse(e.exception.args[0]['ctrls'])
+
         # try a true compare
         m = l.compare_ext(dn, "userPassword", "the_password")
-        try:
+        with self.assertRaises(_ldap.COMPARE_TRUE) as e:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        except _ldap.COMPARE_TRUE:
-            pass
-        else:
-            self.fail("expected COMPARE_TRUE, got %r" % r)
+
+        self.assertEqual(e.exception.args[0]['msgid'], m)
+        self.assertEqual(e.exception.args[0]['msgtype'], _ldap.RES_COMPARE)
+        self.assertEqual(e.exception.args[0]['result'], 6)
+        self.assertFalse(e.exception.args[0]['ctrls'])
+
         # try a compare on bad attribute
         m = l.compare_ext(dn, "badAttribute", "ignoreme")
-        try:
+        with self.assertRaises(_ldap.error) as e:
             r = l.result4(m, _ldap.MSG_ALL, self.timeout)
-        except _ldap.error:
-            pass
-        else:
-            self.fail("expected LDAPError, got %r" % r)
+
+        self.assertEqual(e.exception.args[0]['msgid'], m)
+        self.assertEqual(e.exception.args[0]['msgtype'], _ldap.RES_COMPARE)
+        self.assertEqual(e.exception.args[0]['result'], 17)
+        self.assertFalse(e.exception.args[0]['ctrls'])
 
     def test_delete_no_such_object(self):
         """

From 972490c9cb916f7954c372a718e0050943d5dffe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 2 May 2019 10:48:25 +0100
Subject: [PATCH 813/868] refs is now unused

---
 Modules/LDAPObject.c | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 73dc0fe..9f67273 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1086,7 +1086,6 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
     char *retoid = 0;
     PyObject *valuestr = NULL;
     int result = LDAP_SUCCESS;
-    char **refs = NULL;
     LDAPControl **serverctrls = 0;
 
     if (!PyArg_ParseTuple
@@ -1157,23 +1156,15 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
         }
 
         LDAP_BEGIN_ALLOW_THREADS(self);
-        rc = ldap_parse_result(self->ldap, msg, &result, NULL, NULL, &refs,
+        rc = ldap_parse_result(self->ldap, msg, &result, NULL, NULL, NULL,
                                &serverctrls, 0);
         LDAP_END_ALLOW_THREADS(self);
     }
 
     if (result != LDAP_SUCCESS) {       /* result error */
-        char *e, err[1024];
-
-        if (result == LDAP_REFERRAL && refs && refs[0]) {
-            snprintf(err, sizeof(err), "Referral:\n%s", refs[0]);
-            e = err;
-        }
-        else
-            e = "ldap_parse_result";
         ldap_controls_free(serverctrls);
         Py_XDECREF(valuestr);
-        return LDAPraise_for_message(self->ldap, e, msg);
+        return LDAPraise_for_message(self->ldap, "ldap_parse_result", msg);
     }
 
     if (!(pyctrls = LDAPControls_to_List(serverctrls))) {

From 785729194f133fd7947c2366a941363a57380429 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Thu, 30 Apr 2020 12:11:16 +0100
Subject: [PATCH 814/868] Add .errnum to LDAPExceptions

---
 Doc/reference/ldap.rst | 3 +++
 Modules/constants.c    | 6 +++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 3254375..1f093ab 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -321,6 +321,9 @@ The module defines the following exceptions:
    is set to a truncated form of the name provided or alias dereferenced
    for the lowest entry (object or alias) that was matched.
 
+   Most exceptions from protocol results also carry the :py:attr:`errnum`
+   attribute.
+
 
 .. py:exception:: ADMINLIMIT_EXCEEDED
 
diff --git a/Modules/constants.c b/Modules/constants.c
index bc7c2dc..a1c79d1 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -198,7 +198,7 @@ LDAPerror(LDAP *l, char *msg)
 int
 LDAPinit_constants(PyObject *m)
 {
-    PyObject *exc;
+    PyObject *exc, *nobj;
 
     /* simple constants */
 
@@ -228,6 +228,10 @@ LDAPinit_constants(PyObject *m)
 #define add_err(n) do {  \
     exc = PyErr_NewException("ldap." #n, LDAPexception_class, NULL);  \
     if (exc == NULL) return -1;  \
+    nobj = PyLong_FromLong(LDAP_##n); \
+    if (nobj == NULL) return -1; \
+    if (PyObject_SetAttrString(exc, "errnum", nobj) != 0) return -1; \
+    Py_DECREF(nobj); \
     errobjects[LDAP_##n+LDAP_ERROR_OFFSET] = exc;  \
     if (PyModule_AddObject(m, #n, exc) != 0) return -1;  \
     Py_INCREF(exc);  \

From 18a261effe2498f49560a35b2adbee438c2ebcb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Mon, 18 May 2020 13:44:50 +0100
Subject: [PATCH 815/868] Drop unused/unusable argument

---
 Modules/LDAPObject.c  | 38 +++++++++++++++++++-------------------
 Modules/constants.c   | 12 +++++-------
 Modules/constants.h   |  4 ++--
 Modules/functions.c   |  2 +-
 Modules/ldapcontrol.c |  4 ++--
 Modules/message.c     | 14 +++++++-------
 6 files changed, 36 insertions(+), 38 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 9f67273..0f52d22 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -415,7 +415,7 @@ l_ldap_unbind_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_unbind_ext");
+        return LDAPerror(self->ldap);
 
     self->valid = 0;
     Py_INCREF(Py_None);
@@ -461,7 +461,7 @@ l_ldap_abandon_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_abandon_ext");
+        return LDAPerror(self->ldap);
 
     Py_INCREF(Py_None);
     return Py_None;
@@ -517,7 +517,7 @@ l_ldap_add_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_add_ext");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -568,7 +568,7 @@ l_ldap_simple_bind(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_simple_bind");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -727,7 +727,7 @@ l_ldap_sasl_bind_s(LDAPObject *self, PyObject *args)
                                              servercred->bv_len);
     }
     else if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "l_ldap_sasl_bind_s");
+        return LDAPerror(self->ldap);
     return PyInt_FromLong(ldaperror);
 }
 
@@ -806,7 +806,7 @@ l_ldap_sasl_interactive_bind_s(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (msgid != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_sasl_interactive_bind_s");
+        return LDAPerror(self->ldap);
     return PyInt_FromLong(msgid);
 }
 #endif
@@ -854,7 +854,7 @@ l_ldap_cancel(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_cancel");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -908,7 +908,7 @@ l_ldap_compare_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_compare_ext");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -954,7 +954,7 @@ l_ldap_delete_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_delete_ext");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -1011,7 +1011,7 @@ l_ldap_modify_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_modify_ext");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -1061,7 +1061,7 @@ l_ldap_rename(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_rename");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -1108,7 +1108,7 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
     LDAP_END_ALLOW_THREADS(self);
 
     if (res_type < 0)   /* LDAP or system error */
-        return LDAPerror(self->ldap, "ldap_result4");
+        return LDAPerror(self->ldap);
 
     if (res_type == 0) {
         /* Polls return (None, None, None, None); timeouts raise an exception */
@@ -1164,7 +1164,7 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
     if (result != LDAP_SUCCESS) {       /* result error */
         ldap_controls_free(serverctrls);
         Py_XDECREF(valuestr);
-        return LDAPraise_for_message(self->ldap, "ldap_parse_result", msg);
+        return LDAPraise_for_message(self->ldap, msg);
     }
 
     if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
@@ -1176,7 +1176,7 @@ l_ldap_result4(LDAPObject *self, PyObject *args)
         ldap_controls_free(serverctrls);
         ldap_msgfree(msg);
         Py_XDECREF(valuestr);
-        return LDAPerror(self->ldap, "LDAPControls_to_List");
+        return LDAPerror(self->ldap);
     }
     ldap_controls_free(serverctrls);
 
@@ -1277,7 +1277,7 @@ l_ldap_search_ext(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_search_ext");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -1324,7 +1324,7 @@ l_ldap_whoami_s(LDAPObject *self, PyObject *args)
 
     if (ldaperror != LDAP_SUCCESS) {
         ber_bvfree(bvalue);
-        return LDAPerror(self->ldap, "ldap_whoami_s");
+        return LDAPerror(self->ldap);
     }
 
     result = LDAPberval_to_unicode_object(bvalue);
@@ -1351,7 +1351,7 @@ l_ldap_start_tls_s(LDAPObject *self, PyObject *args)
     LDAP_END_ALLOW_THREADS(self);
     if (ldaperror != LDAP_SUCCESS) {
         ldap_set_option(self->ldap, LDAP_OPT_ERROR_NUMBER, &ldaperror);
-        return LDAPerror(self->ldap, "ldap_start_tls_s");
+        return LDAPerror(self->ldap);
     }
 
     Py_INCREF(Py_None);
@@ -1443,7 +1443,7 @@ l_ldap_passwd(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_passwd");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
@@ -1494,7 +1494,7 @@ l_ldap_extended_operation(LDAPObject *self, PyObject *args)
     LDAPControl_List_DEL(client_ldcs);
 
     if (ldaperror != LDAP_SUCCESS)
-        return LDAPerror(self->ldap, "ldap_extended_operation");
+        return LDAPerror(self->ldap);
 
     return PyInt_FromLong(msgid);
 }
diff --git a/Modules/constants.c b/Modules/constants.c
index a1c79d1..a447310 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -49,7 +49,7 @@ LDAPerr(int errnum)
 
 /* Convert an LDAP error into an informative python exception */
 PyObject *
-LDAPraise_for_message(LDAP *l, char *msg, LDAPMessage *m)
+LDAPraise_for_message(LDAP *l, LDAPMessage *m)
 {
     if (l == NULL) {
         PyErr_SetFromErrno(LDAPexception_class);
@@ -170,10 +170,8 @@ LDAPraise_for_message(LDAP *l, char *msg, LDAPMessage *m)
             PyDict_SetItemString(info, "info", str);
             Py_XDECREF(str);
         }
-        else if (msg != NULL || (error != NULL && *error != '\0')) {
-            msg = msg ? msg : error;
-
-            str = PyUnicode_FromString(msg);
+        else if (error != NULL && *error != '\0') {
+            str = PyUnicode_FromString(error);
             if (str)
                 PyDict_SetItemString(info, "info", str);
             Py_XDECREF(str);
@@ -188,9 +186,9 @@ LDAPraise_for_message(LDAP *l, char *msg, LDAPMessage *m)
 }
 
 PyObject *
-LDAPerror(LDAP *l, char *msg)
+LDAPerror(LDAP *l)
 {
-    return LDAPraise_for_message(l, msg, NULL);
+    return LDAPraise_for_message(l, NULL);
 }
 
 /* initialise the module constants */
diff --git a/Modules/constants.h b/Modules/constants.h
index f1d84a5..b815094 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -11,8 +11,8 @@ extern int LDAPinit_constants(PyObject *m);
 extern PyObject *LDAPconstant(int);
 
 extern PyObject *LDAPexception_class;
-extern PyObject *LDAPerror(LDAP *, char *msg);
-extern PyObject *LDAPraise_for_message(LDAP *, char *msg, LDAPMessage *m);
+extern PyObject *LDAPerror(LDAP *);
+extern PyObject *LDAPraise_for_message(LDAP *, LDAPMessage *m);
 PyObject *LDAPerr(int errnum);
 
 #ifndef LDAP_CONTROL_PAGE_OID
diff --git a/Modules/functions.c b/Modules/functions.c
index 3a43c7c..2a567fd 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -25,7 +25,7 @@ l_ldap_initialize(PyObject *unused, PyObject *args)
     PyEval_RestoreThread(save);
 
     if (ret != LDAP_SUCCESS)
-        return LDAPerror(ld, "ldap_initialize");
+        return LDAPerror(ld);
 
     return (PyObject *)newLDAPObject(ld);
 }
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 6615598..17f52cb 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -353,13 +353,13 @@ encode_assertion_control(PyObject *self, PyObject *args)
     err = ldap_create(&ld);
     PyEval_RestoreThread(save);
     if (err != LDAP_SUCCESS)
-        return LDAPerror(ld, "ldap_create");
+        return LDAPerror(ld);
 
     err = ldap_create_assertion_control_value(ld, assertion_filterstr,
                                               &ctrl_val);
 
     if (err != LDAP_SUCCESS) {
-        LDAPerror(ld, "ldap_create_assertion_control_value");
+        LDAPerror(ld);
         save = PyEval_SaveThread();
         ldap_unbind_ext(ld, NULL, NULL);
         PyEval_RestoreThread(save);
diff --git a/Modules/message.c b/Modules/message.c
index 2c05488..d225a1d 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -53,7 +53,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
         if (dn == NULL) {
             Py_DECREF(result);
             ldap_msgfree(m);
-            return LDAPerror(ld, "ldap_get_dn");
+            return LDAPerror(ld);
         }
 
         attrdict = PyDict_New();
@@ -69,7 +69,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
             Py_DECREF(result);
             ldap_msgfree(m);
             ldap_memfree(dn);
-            return LDAPerror(ld, "ldap_get_entry_controls");
+            return LDAPerror(ld);
         }
 
         /* convert serverctrls to list of tuples */
@@ -81,7 +81,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
             ldap_msgfree(m);
             ldap_memfree(dn);
             ldap_controls_free(serverctrls);
-            return LDAPerror(ld, "LDAPControls_to_List");
+            return LDAPerror(ld);
         }
         ldap_controls_free(serverctrls);
 
@@ -201,7 +201,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
             Py_DECREF(reflist);
             Py_DECREF(result);
             ldap_msgfree(m);
-            return LDAPerror(ld, "ldap_parse_reference");
+            return LDAPerror(ld);
         }
         /* convert serverctrls to list of tuples */
         if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
@@ -212,7 +212,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
             Py_DECREF(result);
             ldap_msgfree(m);
             ldap_controls_free(serverctrls);
-            return LDAPerror(ld, "LDAPControls_to_List");
+            return LDAPerror(ld);
         }
         ldap_controls_free(serverctrls);
         if (refs) {
@@ -255,7 +255,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
                      0) != LDAP_SUCCESS) {
                     Py_DECREF(result);
                     ldap_msgfree(m);
-                    return LDAPerror(ld, "ldap_parse_intermediate");
+                    return LDAPerror(ld);
                 }
                 /* convert serverctrls to list of tuples */
                 if (!(pyctrls = LDAPControls_to_List(serverctrls))) {
@@ -267,7 +267,7 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
                     ldap_controls_free(serverctrls);
                     ldap_memfree(retoid);
                     ber_bvfree(retdata);
-                    return LDAPerror(ld, "LDAPControls_to_List");
+                    return LDAPerror(ld);
                 }
                 ldap_controls_free(serverctrls);
 

From 5f083fe45c4d0f12f86adadc904a514c95a676de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Mon, 18 May 2020 13:45:33 +0100
Subject: [PATCH 816/868] Fix error in test failure reporting

---
 Tests/t_ldapobject.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 36e2acf..a64b5f0 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -465,7 +465,7 @@ def test004_enotconn(self):
             info = ldap_err.args[0]['info']
             expected_info = os.strerror(errno.ENOTCONN)
             if info != expected_info:
-                self.fail("expected info=%r, got %d" % (expected_info, info))
+                self.fail("expected info=%r, got %r" % (expected_info, info))
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 

From 63058a0b774ee8ebbbcdac5af72344a8b42c052f Mon Sep 17 00:00:00 2001
From: Eyal Cherevatzki <eyal.3555@pm.me>
Date: Thu, 28 May 2020 09:59:10 +0300
Subject: [PATCH 817/868] docs: python-tox no longer exists in Debian Buster
 (#307)

Co-authored-by: Christian Heimes <christian@python.org>
Co-authored-by: eyal0803 <eyal.3555@gmail.com>
---
 Doc/installing.rst | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 90187a9..514cf99 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -146,8 +146,12 @@ Debian
 Packages for building and testing::
 
    # apt-get install build-essential python3-dev python2.7-dev \
-       libldap2-dev libsasl2-dev slapd ldap-utils python-tox \
+       libldap2-dev libsasl2-dev slapd ldap-utils tox \
        lcov valgrind
+       
+.. note::
+   
+   On older releases ``tox`` was called ``python-tox``.
 
 Fedora
 ------

From a7671d84bc9aea322c6cb36468a91c02543ebf9d Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 16:17:02 +0200
Subject: [PATCH 818/868] Don't overallocate memory in attrs_from_List()

Allocate ``(strlen + 1) * sizeof(char)`` instead of
``(strlen + 1) * sizeof(char*)`` for a ``char[]`` in
``attrs_from_List()``.

https://github.com/python-ldap/python-ldap/pull/340

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index 0f52d22..a2ff626 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -335,7 +335,7 @@ attrs_from_List(PyObject *attrlist, char ***attrsp)
              * internal values that must be treated like const char. Python
              * 3.7 actually returns a const char.
              */
-            attrs[i] = (char *)PyMem_NEW(char *, strlen + 1);
+            attrs[i] = (char *)PyMem_NEW(char, strlen + 1);
 
             if (attrs[i] == NULL)
                 goto nomem;

From f8f10a9ac34952e0c2a2c47fc9234c48eb3b2f11 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 16:34:58 +0200
Subject: [PATCH 819/868] Document that TLS options are backend specific

https://github.com/python-ldap/python-ldap/pull/338

Fixes: https://github.com/python-ldap/python-ldap/issues/301
---
 Doc/reference/ldap.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 1f093ab..f438121 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -223,6 +223,8 @@ TLS options
 
 .. py:data:: OPT_X_TLS
 
+.. py:data:: OPT_X_TLS_NEWCTX
+
 .. py:data:: OPT_X_TLS_ALLOW
 
 .. py:data:: OPT_X_TLS_CACERTDIR
@@ -249,6 +251,12 @@ TLS options
 
 .. py:data:: OPT_X_TLS_TRY
 
+.. note::
+
+   OpenLDAP supports several TLS/SSL libraries. OpenSSL is the most common
+   backend. Some options may not be available when libldap uses NSS, GnuTLS,
+   or Apple's Secure Transport backend.
+
 .. _ldap-keepalive-options:
 
 Keepalive options

From 269df1793df386687a6eab880c4a6c28cde61533 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 16:56:22 +0200
Subject: [PATCH 820/868] Deprecate cidict's strlist functions

The functions are undocumented, untested, unused, and can now be trivialy
implemented with set operations.

https://github.com/python-ldap/python-ldap/pull/336

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/cidict.py | 16 ++++++++++++++++
 Tests/t_cidict.py  | 14 ++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 4f7e091..875d5f5 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -5,6 +5,7 @@
 
 See https://www.python-ldap.org/ for details.
 """
+import warnings
 
 from ldap import __version__
 
@@ -62,6 +63,11 @@ def strlist_minus(a,b):
   Return list of all items in a which are not in b (a - b).
   a,b are supposed to be lists of case-insensitive strings.
   """
+  warnings.warn(
+    "strlist functions are deprecated and will be removed in 3.4",
+    category=DeprecationWarning,
+    stacklevel=2,
+  )
   temp = cidict()
   for elt in b:
     temp[elt] = elt
@@ -77,6 +83,11 @@ def strlist_intersection(a,b):
   """
   Return intersection of two lists of case-insensitive strings a,b.
   """
+  warnings.warn(
+    "strlist functions are deprecated and will be removed in 3.4",
+    category=DeprecationWarning,
+    stacklevel=2,
+  )
   temp = cidict()
   for elt in a:
     temp[elt] = elt
@@ -92,6 +103,11 @@ def strlist_union(a,b):
   """
   Return union of two lists of case-insensitive strings a,b.
   """
+  warnings.warn(
+    "strlist functions are deprecated and will be removed in 3.4",
+    category=DeprecationWarning,
+    stacklevel=2,
+  )
   temp = cidict()
   for elt in a:
     temp[elt] = elt
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index fa5a39b..b96a26e 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -7,6 +7,7 @@
 
 import os
 import unittest
+import warnings
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
@@ -48,6 +49,19 @@ def test_cidict(self):
         self.assertEqual(cix.has_key("abcdef"), False)
         self.assertEqual(cix.has_key("AbCDef"), False)
 
+    def test_strlist_deprecated(self):
+        strlist_funcs = [
+            ldap.cidict.strlist_intersection,
+            ldap.cidict.strlist_minus,
+            ldap.cidict.strlist_union
+        ]
+        for strlist_func in strlist_funcs:
+            with warnings.catch_warnings(record=True) as w:
+                warnings.resetwarnings()
+                warnings.simplefilter("always", DeprecationWarning)
+                strlist_func(["a"], ["b"])
+            self.assertEqual(len(w), 1)
+
 
 if __name__ == '__main__':
     unittest.main()

From ed802af28187fa13d668349ad4ed38327434f3ff Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 27 May 2020 16:27:52 +0200
Subject: [PATCH 821/868] Run make indent on C code

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c  | 2 ++
 Modules/ldapcontrol.c | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index a2ff626..e06f47c 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -126,6 +126,7 @@ Tuple_to_LDAPMod(PyObject *tup, int no_op)
     }
 
     lm = PyMem_NEW(LDAPMod, 1);
+
     if (lm == NULL)
         goto nomem;
 
@@ -236,6 +237,7 @@ List_to_LDAPMods(PyObject *list, int no_op)
     }
 
     lms = PyMem_NEW(LDAPMod *, len + 1);
+
     if (lms == NULL)
         goto nomem;
 
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 17f52cb..5e2d2ff 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -82,6 +82,7 @@ Tuple_to_LDAPControl(PyObject *tup)
         return NULL;
 
     lc = PyMem_NEW(LDAPControl, 1);
+
     if (lc == NULL) {
         PyErr_NoMemory();
         return NULL;
@@ -91,6 +92,7 @@ Tuple_to_LDAPControl(PyObject *tup)
 
     len = strlen(oid);
     lc->ldctl_oid = PyMem_NEW(char, len + 1);
+
     if (lc->ldctl_oid == NULL) {
         PyErr_NoMemory();
         LDAPControl_DEL(lc);
@@ -137,6 +139,7 @@ LDAPControls_from_object(PyObject *list, LDAPControl ***controls_ret)
 
     len = PySequence_Length(list);
     ldcs = PyMem_NEW(LDAPControl *, len + 1);
+
     if (ldcs == NULL) {
         PyErr_NoMemory();
         return 0;

From a8fd053d84172c73957cd147cac3ddf5f404979a Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Wed, 27 May 2020 16:27:36 +0200
Subject: [PATCH 822/868] Fix broken print() migration

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Demo/pyasn1/readentrycontrol.py   | 14 +++++++-------
 Demo/pyasn1/sss_highest_number.py |  6 +++---
 Demo/schema_tree.py               |  6 +++---
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/Demo/pyasn1/readentrycontrol.py b/Demo/pyasn1/readentrycontrol.py
index 10faa2b..a857be2 100644
--- a/Demo/pyasn1/readentrycontrol.py
+++ b/Demo/pyasn1/readentrycontrol.py
@@ -39,8 +39,8 @@
   serverctrls = [pr]
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
-print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
-print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
+print("resp_ctrls[0].dn:", resp_ctrls[0].dn)
+print("resp_ctrls[0].entry:", pprint.pformat(resp_ctrls[0].entry))
 
 print("""#---------------------------------------------------------------------------
 # Modify entry
@@ -56,7 +56,7 @@
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
 print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
-print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
+print("resp_ctrls[0].entry:",pprint.pformat(resp_ctrls[0].entry))
 
 pr = PostReadControl(criticality=True,attrList=['uidNumber','gidNumber','entryCSN'])
 
@@ -67,7 +67,7 @@
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
 print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
-print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
+print("resp_ctrls[0].entry:",pprint.pformat(resp_ctrls[0].entry))
 
 print("""#---------------------------------------------------------------------------
 # Rename entry
@@ -83,7 +83,7 @@
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
 print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
-print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
+print("resp_ctrls[0].entry:",pprint.pformat(resp_ctrls[0].entry))
 
 pr = PreReadControl(criticality=True,attrList=['uid'])
 msg_id = l.rename(
@@ -94,7 +94,7 @@
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
 print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
-print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
+print("resp_ctrls[0].entry:",pprint.pformat(resp_ctrls[0].entry))
 
 print("""#---------------------------------------------------------------------------
 # Delete entry
@@ -108,4 +108,4 @@
 )
 _,_,_,resp_ctrls = l.result3(msg_id)
 print("resp_ctrls[0].dn:",resp_ctrls[0].dn)
-print("resp_ctrls[0].entry:";pprint.pprint(resp_ctrls[0].entry))
+print("resp_ctrls[0].entry:",pprint.pformat(resp_ctrls[0].entry))
diff --git a/Demo/pyasn1/sss_highest_number.py b/Demo/pyasn1/sss_highest_number.py
index 5f5bdc5..020dcdb 100644
--- a/Demo/pyasn1/sss_highest_number.py
+++ b/Demo/pyasn1/sss_highest_number.py
@@ -38,9 +38,9 @@ class MyLDAPObject(LDAPObject,ResultProcessor):
   except ldap.SIZELIMIT_EXCEEDED:
     pass
   # print result
-  print 'Highest value of %s' % (id_attr)
+  print('Highest value of %s' % (id_attr))
   if ldap_result:
     dn,entry = ldap_result[0]
-    print '->',entry[id_attr]
+    print('->',entry[id_attr])
   else:
-    print 'not found'
+    print('not found')
diff --git a/Demo/schema_tree.py b/Demo/schema_tree.py
index 648bb86..bda5f64 100644
--- a/Demo/schema_tree.py
+++ b/Demo/schema_tree.py
@@ -15,9 +15,9 @@ def PrintSchemaTree(schema,se_class,se_tree,se_oid,level):
   """ASCII text output for console"""
   se_obj = schema.get_obj(se_class,se_oid)
   if se_obj!=None:
-    print('|    '*(level-1)+'+---'*(level>0), \)
-          ', '.join(se_obj.names), \
-          '(%s)' % se_obj.oid
+    print('|    '*(level-1)+'+---'*(level>0),
+          ', '.join(se_obj.names),
+          '(%s)' % se_obj.oid)
   for sub_se_oid in se_tree[se_oid]:
     print('|    '*(level+1))
     PrintSchemaTree(schema,se_class,se_tree,sub_se_oid,level+1)

From 9b6aabb9586994c70597a12fff6518023dc65f2d Mon Sep 17 00:00:00 2001
From: KOVACS Krisztian <hidden@balabit.com>
Date: Fri, 5 Jun 2020 18:44:50 +0200
Subject: [PATCH 823/868] Tests and documentation for msgid for exceptions
 raised from result4()

---
 Doc/reference/ldap.rst |  8 ++++++++
 Tests/t_ldapobject.py  | 14 ++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index f438121..ce30ed9 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -329,6 +329,14 @@ The module defines the following exceptions:
    is set to a truncated form of the name provided or alias dereferenced
    for the lowest entry (object or alias) that was matched.
 
+   For use in asynchronous operations an optional field :py:const:`msg_id` is
+   also set in the dictionary in cases where the exception can be associated
+   with a request. This can be used in asynchronous code where
+   :py:meth:`result()` returns an exception that is effectively the result of a
+   previously started asynchronous operation. For example, this is the case for
+   asynchronous (:py:meth:`compare()`), where the boolean result is always
+   raised as an exception (:py:exc:`COMPARE_TRUE` or :py:exc:`COMPARE_FALSE`).
+
    Most exceptions from protocol results also carry the :py:attr:`errnum`
    attribute.
 
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index a64b5f0..24711b2 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -673,6 +673,20 @@ def test_compare_s_invalidattr(self):
         with self.assertRaises(ldap.UNDEFINED_TYPE):
             result = l.compare_s('cn=Foo1,%s' % base, 'invalidattr', b'invalid')
 
+    def test_compare_true_exception_contains_message_id(self):
+        base = self.server.suffix
+        l = self._ldap_conn
+        msgid = l.compare('cn=Foo1,%s' % base, 'cn', b'Foo1')
+        with self.assertRaises(ldap.COMPARE_TRUE) as cm:
+            l.result()
+        self.assertEqual(cm.exception.args[0]["msgid"], msgid)
+
+    def test_async_search_no_such_object_exception_contains_message_id(self):
+        msgid = self._ldap_conn.search("CN=XXX", ldap.SCOPE_SUBTREE)
+        with self.assertRaises(ldap.NO_SUCH_OBJECT) as cm:
+            self._ldap_conn.result()
+        self.assertEqual(cm.exception.args[0]["msgid"], msgid)
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From e2bcd627830f0eb4a2900045b84375d32fa04868 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Jun 2020 18:47:42 +0200
Subject: [PATCH 824/868] Reword the msgid documentation to make it terser

---
 Doc/reference/ldap.rst | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index ce30ed9..799afe1 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -329,13 +329,12 @@ The module defines the following exceptions:
    is set to a truncated form of the name provided or alias dereferenced
    for the lowest entry (object or alias) that was matched.
 
-   For use in asynchronous operations an optional field :py:const:`msg_id` is
-   also set in the dictionary in cases where the exception can be associated
-   with a request. This can be used in asynchronous code where
-   :py:meth:`result()` returns an exception that is effectively the result of a
-   previously started asynchronous operation. For example, this is the case for
-   asynchronous (:py:meth:`compare()`), where the boolean result is always
-   raised as an exception (:py:exc:`COMPARE_TRUE` or :py:exc:`COMPARE_FALSE`).
+   The field :py:const:`msgid` is set in the dictionary where the
+   exception can be associated with an asynchronous request.
+   This can be used in asynchronous code where :py:meth:`result()` raises the
+   result of an operation as an exception. For example, this is the case for
+   :py:meth:`compare()`, always raises the boolean result as an exception
+   (:py:exc:`COMPARE_TRUE` or :py:exc:`COMPARE_FALSE`).
 
    Most exceptions from protocol results also carry the :py:attr:`errnum`
    attribute.

From def231c0673739edf43c9faadf2047313bca3ebe Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 19:15:48 +0200
Subject: [PATCH 825/868] Tox: replace setup.py test with unittest discover

setup.py test is deprecated and causes issues with testing our code.
There are cases where the wrong shared library is picked up.

The ``unittest discover`` approach avoids building the extension twice.

python-ldap should move to pytest eventually.

https://github.com/python-ldap/python-ldap/pull/335
Fixes: https://github.com/python-ldap/python-ldap/issues/326
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .coveragerc |  7 ++++---
 .travis.yml |  4 ----
 tox.ini     | 38 ++++++++++++++++++++++----------------
 3 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/.coveragerc b/.coveragerc
index fc432b9..738d86f 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -1,9 +1,10 @@
 [run]
 branch = True
 source =
-    Lib/
-omit =
-    Lib/slapdtest.py
+   ldap
+   ldif
+   ldapurl
+   slapdtest
 
 [paths]
 source =
diff --git a/.travis.yml b/.travis.yml
index 8e0e3a2..067ee37 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -67,10 +67,6 @@ matrix:
     - python: 3.6
       env: TOXENV=doc
   allow_failures:
-     - env:
-        - TOXENV=py39
-        - CFLAGS_std="-std=c99"
-        - WITH_GCOV=1
      - env:
         - TOXENV=pypy
 
diff --git a/tox.ini b/tox.ini
index be72317..6d9f85a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -16,43 +16,49 @@ passenv = WITH_GCOV
 # - 'ignore:the imp module is deprecated' is required to ignore import of 'imp'
 #   in distutils. Python < 3.6 use PendingDeprecationWarning; Python >= 3.6 use
 #   DeprecationWarning.
+# - 'ignore:lib2to3 package' for Python 3.9
 commands = {envpython} -bb -Werror \
     "-Wignore:the imp module is deprecated:DeprecationWarning" \
     "-Wignore:the imp module is deprecated:PendingDeprecationWarning" \
     "-Wignore:Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated, and in 3.8 it will stop working:DeprecationWarning" \
-    -m coverage run --parallel setup.py \
-        clean --all \
-        test
+    "-Wignore:lib2to3 package is deprecated and may not be able to parse Python 3.10+:PendingDeprecationWarning" \
+    -m coverage run --parallel -m unittest discover -v -s Tests -p 't_*'
 
 [testenv:py27]
 # No warnings with Python 2.7
 passenv = {[testenv]passenv}
-commands = {envpython} \
-    -m coverage run --parallel setup.py test
+commands =
+    {envpython} -m coverage run --parallel \
+        -m unittest discover -v -s Tests -p 't_*'
 
 [testenv:py34]
 # No warnings with Python 3.4
 passenv = {[testenv]passenv}
-commands = {envpython} \
-    -m coverage run --parallel setup.py test
+commands = {[testenv:py27]commands}
 
 [testenv:py2-nosasltls]
 basepython = python2
-deps = {[testenv]deps}
+# don't install, install dependencies manually
+skip_install = true
+deps =
+    {[testenv]deps}
+    pyasn1
+    pyasn1_modules
 passenv = {[testenv]passenv}
 setenv =
     CI_DISABLED=LDAPI:SASL:TLS
-# rebuild without SASL and TLS, run without LDAPI
-commands = {envpython} \
-    -m coverage run --parallel setup.py \
-        clean --all \
-        build_ext -UHAVE_SASL,HAVE_TLS \
-        test
+# build and install without SASL and TLS, run without LDAPI
+commands =
+    {envpython} setup.py clean --all
+    {envpython} setup.py build_ext -UHAVE_SASL,HAVE_TLS
+    {envpython} setup.py install --single-version-externally-managed --root=/
+    {[testenv:py27]commands}
 
 [testenv:py3-nosasltls]
 basepython = python3
-deps = {[testenv]deps}
-passenv = {[testenv]passenv}
+skip_install = {[testenv:py2-nosasltls]skip_install}
+deps = {[testenv:py2-nosasltls]deps}
+passenv = {[testenv:py2-nosasltls]passenv}
 setenv = {[testenv:py2-nosasltls]setenv}
 commands = {[testenv:py2-nosasltls]commands}
 

From c803bfc7479566c0c36f4eb2d9e5596a0b30d221 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 19:28:56 +0200
Subject: [PATCH 826/868] Improve TLS documentation

See: https://github.com/python-ldap/python-ldap/issues/55

https://github.com/python-ldap/python-ldap/pull/339

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap.rst        | 145 ++++++++++++++++++++++++++++++++--
 Doc/spelling_wordlist.txt     |   2 +
 Lib/ldap/constants.py         |   1 -
 Makefile                      |   5 ++
 Modules/constants_generated.h |   4 -
 5 files changed, 145 insertions(+), 12 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 799afe1..1d1b025 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -83,6 +83,12 @@ This module defines the following functions:
    This function sets the value of the global option specified by *option* to
    *invalue*.
 
+   .. note::
+
+      Most global settings do not affect existing :py:class:`LDAPObject`
+      connections. Applications should call :py:func:`set_option()` before
+      they establish connections with :py:func:`initialize`.
+
 .. versionchanged:: 3.1
 
    The deprecated functions ``ldap.init()`` and ``ldap.open()`` were removed.
@@ -221,35 +227,158 @@ SASL options
 TLS options
 :::::::::::
 
-.. py:data:: OPT_X_TLS
+.. warning::
+
+   libldap does not materialize all TLS settings immediately. You must use
+   :py:const:`OPT_X_TLS_NEWCTX` with value ``0`` to instruct libldap to
+   apply pending TLS settings and create a new internal TLS context::
+
+      conn = ldap.initialize("ldap://ldap.example")
+      conn.set_option(ldap.OPT_X_TLS_CACERTFILE, '/path/to/ca.pem')
+      conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
+      conn.start_tls_s()
+      conn.simple_bind_s(dn, password)
+
 
 .. py:data:: OPT_X_TLS_NEWCTX
 
-.. py:data:: OPT_X_TLS_ALLOW
+   set and apply TLS settings to internal TLS context. Value ``0`` creates
+   a new client-side context.
+
+.. py:data:: OPT_X_TLS_PACKAGE
+
+   Get TLS implementation, known values are
+
+   * ``GnuTLS``
+   * ``MozNSS`` (Mozilla NSS)
+   * ``OpenSSL``
+
 
 .. py:data:: OPT_X_TLS_CACERTDIR
 
+   get/set path to directory with CA certs
+
 .. py:data:: OPT_X_TLS_CACERTFILE
 
+   get/set path to PEM file with CA certs
+
 .. py:data:: OPT_X_TLS_CERTFILE
 
-.. py:data:: OPT_X_TLS_CIPHER_SUITE
+   get/set path to file with PEM encoded cert for client cert authentication,
+   requires :py:const:`OPT_X_TLS_KEYFILE`.
 
-.. py:data:: OPT_X_TLS_CTX
+.. py:data:: OPT_X_TLS_KEYFILE
+
+   get/set path to file with PEM encoded key for client cert authentication,
+   requires :py:const:`OPT_X_TLS_CERTFILE`.
+
+
+.. py:data:: OPT_X_TLS_CRLCHECK
+
+   get/set certificate revocation list (CRL) check mode. CRL validation
+   requires :py:const:`OPT_X_TLS_CRLFILE`.
+
+   :py:const:`OPT_X_TLS_CRL_NONE`
+      Don't perform CRL checks
+
+   :py:const:`OPT_X_TLS_CRL_PEER`
+      Perform CRL check for peer's end entity cert.
+
+   :py:const:`OPT_X_TLS_CRL_ALL`
+      Perform CRL checks for the whole cert chain
+
+.. py:data:: OPT_X_TLS_CRLFILE
+
+   get/set path to CRL file
+
+.. py:data:: OPT_X_TLS_CRL_ALL
+
+   value for :py:const:`OPT_X_TLS_CRLCHECK`
+
+.. py:data:: OPT_X_TLS_CRL_NONE
+
+   value for :py:const:`OPT_X_TLS_CRLCHECK`
+
+.. py:data:: OPT_X_TLS_CRL_PEER
+
+   value for :py:const:`OPT_X_TLS_CRLCHECK`
+
+
+.. py:data:: OPT_X_TLS_REQUIRE_CERT
+
+   get/set validation strategy for server cert.
+
+   :py:const:`OPT_X_TLS_NEVER`
+      Don't check server cert and host name
+
+   :py:const:`OPT_X_TLS_ALLOW`
+      Used internally by slapd server.
+
+   :py:const:`OPT_X_TLS_DEMAND`
+      Validate peer cert chain and host name
+
+   :py:const:`OPT_X_TLS_HARD`
+      Same as :py:const:`OPT_X_TLS_DEMAND`
+
+.. py:data:: OPT_X_TLS_ALLOW
+
+   Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
 
 .. py:data:: OPT_X_TLS_DEMAND
 
+   Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+
 .. py:data:: OPT_X_TLS_HARD
 
-.. py:data:: OPT_X_TLS_KEYFILE
+   Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
 
 .. py:data:: OPT_X_TLS_NEVER
 
+   Value for :py:const:`OPT_X_TLS_REQUIRE_CERT`
+
+.. py:data:: OPT_X_TLS_TRY
+
+   .. deprecated:: 3.3.0
+      This value is only used by slapd server internally. It will be removed
+      in the future.
+
+
+.. py:data:: OPT_X_TLS_CIPHER
+
+   get cipher suite name from TLS session
+
+.. py:data:: OPT_X_TLS_CIPHER_SUITE
+
+   get/set allowed cipher suites
+
+.. py:data:: OPT_X_TLS_CTX
+
+   get address of internal memory address of TLS context (**DO NOT USE**)
+
+.. py:data:: OPT_X_TLS_PEERCERT
+
+   Get peer's certificate as binary ASN.1 data structure (not supported)
+
+.. py:data:: OPT_X_TLS_PROTOCOL_MIN
+
+   get/set minimum protocol version (wire protocol version as int)
+
+   * ``0x303`` for TLS 1.2
+   * ``0x304`` for TLS 1.3
+
+.. py:data:: OPT_X_TLS_VERSION
+
+   Get negotiated TLS protocol version as string
+
 .. py:data:: OPT_X_TLS_RANDOM_FILE
 
-.. py:data:: OPT_X_TLS_REQUIRE_CERT
+   get/set path to /dev/urandom (**DO NOT USE**)
 
-.. py:data:: OPT_X_TLS_TRY
+.. py:data:: OPT_X_TLS
+
+   .. deprecated:: 3.3.0
+      The option is deprecated in OpenLDAP and should no longer be used. It
+      will be removed in the future.
 
 .. note::
 
@@ -579,6 +708,8 @@ The above exceptions are raised when a result code from an underlying API
 call does not indicate success.
 
 
+.. _ldap-warnings:
+
 Warnings
 ========
 
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index 3ee0e85..d13c079 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -39,6 +39,7 @@ defresult
 dereferenced
 dereferencing
 desc
+dev
 directoryOperation
 distinguished
 distributedOperation
@@ -145,6 +146,7 @@ UDP
 Umich
 unparsing
 unsigend
+urandom
 uri
 urlPrefix
 urlscheme
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index 7a7982b..641d49c 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -281,7 +281,6 @@ class Str(Constant):
     TLSInt('OPT_X_TLS_DEMAND'),
     TLSInt('OPT_X_TLS_ALLOW'),
     TLSInt('OPT_X_TLS_TRY'),
-    TLSInt('OPT_X_TLS_PEERCERT', optional=True),
 
     TLSInt('OPT_X_TLS_VERSION', optional=True),
     TLSInt('OPT_X_TLS_CIPHER', optional=True),
diff --git a/Makefile b/Makefile
index 2d3293e..8ec46a6 100644
--- a/Makefile
+++ b/Makefile
@@ -12,6 +12,11 @@ AUTOPEP8_OPTS=--aggressive
 .PHONY: all
 all:
 
+Modules/constants_generated.h: Lib/ldap/constants.py
+	$(PYTHON) $^ > $@
+	indent Modules/constants_generated.h
+	rm -f Modules/constants_generated.h~
+
 .PHONY: clean
 clean:
 	rm -rf build dist *.egg-info .tox MANIFEST
diff --git a/Modules/constants_generated.h b/Modules/constants_generated.h
index 455852e..3231e63 100644
--- a/Modules/constants_generated.h
+++ b/Modules/constants_generated.h
@@ -213,10 +213,6 @@ add_int(OPT_X_TLS_DEMAND);
 add_int(OPT_X_TLS_ALLOW);
 add_int(OPT_X_TLS_TRY);
 
-#if defined(LDAP_OPT_X_TLS_PEERCERT)
-add_int(OPT_X_TLS_PEERCERT);
-#endif
-
 #if defined(LDAP_OPT_X_TLS_VERSION)
 add_int(OPT_X_TLS_VERSION);
 #endif

From 9a91bbd8150a9d7b59b0dadd195d8f2c142a401b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Fri, 5 Jun 2020 19:22:53 +0100
Subject: [PATCH 827/868] Extract new password in passwd_s

Fixes: https://github.com/python-ldap/python-ldap/issues/246

https://github.com/python-ldap/python-ldap/pull/299
---
 Doc/reference/ldap.rst     | 10 +++++++++-
 Lib/ldap/extop/__init__.py |  1 +
 Lib/ldap/extop/passwd.py   | 33 ++++++++++++++++++++++++++++++++
 Lib/ldap/ldapobject.py     | 15 +++++++++++----
 Tests/t_ldapobject.py      | 39 ++++++++++++++++++++++++++++++++++++++
 5 files changed, 93 insertions(+), 5 deletions(-)
 create mode 100644 Lib/ldap/extop/passwd.py

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 1d1b025..06ecb90 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -963,7 +963,7 @@ and wait for and return with the server's result, or with
 
 .. py:method:: LDAPObject.passwd(user, oldpw, newpw [, serverctrls=None [, clientctrls=None]]) -> int
 
-.. py:method:: LDAPObject.passwd_s(user, oldpw, newpw [, serverctrls=None [, clientctrls=None]]) -> None
+.. py:method:: LDAPObject.passwd_s(user, oldpw, newpw [, serverctrls=None [, clientctrls=None] [, extract_newpw=False]]]) -> (respoid, respvalue)
 
    Perform a ``LDAP Password Modify Extended Operation`` operation
    on the entry specified by *user*.
@@ -974,6 +974,13 @@ and wait for and return with the server's result, or with
    of the specified *user* which is sometimes used when a user changes
    his own password.
 
+   *respoid* is always :py:const:`None`. *respvalue* is also
+   :py:const:`None` unless *newpw* was :py:const:`None`. This requests that
+   the server generate a new random password. If *extract_newpw* is
+   :py:const:`True`, this password is a bytes object available through
+   ``respvalue.genPasswd``, otherwise *respvalue* is the raw ASN.1 response
+   (this is deprecated and only for backwards compatibility).
+
    *serverctrls* and *clientctrls* like described in section :ref:`ldap-controls`.
 
    The asynchronous version returns the initiated message id.
@@ -983,6 +990,7 @@ and wait for and return with the server's result, or with
    .. seealso::
 
       :rfc:`3062` - LDAP Password Modify Extended Operation
+      :py:mod:`ldap.extop.passwd`
 
 
 
diff --git a/Lib/ldap/extop/__init__.py b/Lib/ldap/extop/__init__.py
index 874166d..39e653a 100644
--- a/Lib/ldap/extop/__init__.py
+++ b/Lib/ldap/extop/__init__.py
@@ -65,3 +65,4 @@ def decodeResponseValue(self,value):
 
 # Import sub-modules
 from ldap.extop.dds import *
+from ldap.extop.passwd import PasswordModifyResponse
diff --git a/Lib/ldap/extop/passwd.py b/Lib/ldap/extop/passwd.py
new file mode 100644
index 0000000..0a8346a
--- /dev/null
+++ b/Lib/ldap/extop/passwd.py
@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+"""
+ldap.extop.passwd - Classes for Password Modify extended operation
+(see RFC 3062)
+
+See https://www.python-ldap.org/ for details.
+"""
+
+from ldap.extop import ExtendedResponse
+
+# Imports from pyasn1
+from pyasn1.type import namedtype, univ, tag
+from pyasn1.codec.der import decoder
+
+
+class PasswordModifyResponse(ExtendedResponse):
+    responseName = None
+
+    class PasswordModifyResponseValue(univ.Sequence):
+        componentType = namedtype.NamedTypes(
+            namedtype.OptionalNamedType(
+                'genPasswd',
+                univ.OctetString().subtype(
+                    implicitTag=tag.Tag(tag.tagClassContext,
+                                        tag.tagFormatSimple, 0)
+                )
+            )
+        )
+
+    def decodeResponseValue(self, value):
+        respValue, _ = decoder.decode(value, asn1Spec=self.PasswordModifyResponseValue())
+        self.genPasswd = bytes(respValue.getComponentByName('genPasswd'))
+        return self.genPasswd
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index a92b088..ab654e1 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -27,7 +27,7 @@
 
 from ldap.schema import SCHEMA_ATTRS
 from ldap.controls import LDAPControl,DecodeControlTuples,RequestControlTuples
-from ldap.extop import ExtendedRequest,ExtendedResponse
+from ldap.extop import ExtendedRequest,ExtendedResponse,PasswordModifyResponse
 from ldap.compat import reraise
 
 from ldap import LDAPError
@@ -656,9 +656,16 @@ def passwd(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
         newpw = self._bytesify_input('newpw', newpw)
     return self._ldap_call(self._l.passwd,user,oldpw,newpw,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
-  def passwd_s(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
-    msgid = self.passwd(user,oldpw,newpw,serverctrls,clientctrls)
-    return self.extop_result(msgid,all=1,timeout=self.timeout)
+  def passwd_s(self, user, oldpw, newpw, serverctrls=None, clientctrls=None, extract_newpw=False):
+    msgid = self.passwd(user, oldpw, newpw, serverctrls, clientctrls)
+    respoid, respvalue = self.extop_result(msgid, all=1, timeout=self.timeout)
+
+    if respoid != PasswordModifyResponse.responseName:
+      raise ldap.PROTOCOL_ERROR("Unexpected OID %s in extended response!" % respoid)
+    if extract_newpw and respvalue:
+      respvalue = PasswordModifyResponse(PasswordModifyResponse.responseName, respvalue)
+
+    return respoid, respvalue
 
   def rename(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls=None):
     """
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 24711b2..1ec0028 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -687,6 +687,45 @@ def test_async_search_no_such_object_exception_contains_message_id(self):
             self._ldap_conn.result()
         self.assertEqual(cm.exception.args[0]["msgid"], msgid)
 
+    def test_passwd_s(self):
+        l = self._ldap_conn
+
+        # first, create a user to change password on
+        dn = "cn=PasswordTest," + self.server.suffix
+        result, pmsg, msgid, ctrls = l.add_ext_s(
+            dn,
+            [
+                ('objectClass', b'person'),
+                ('sn', b'PasswordTest'),
+                ('cn', b'PasswordTest'),
+                ('userPassword', b'initial'),
+            ]
+        )
+        self.assertEqual(result, ldap.RES_ADD)
+        self.assertIsInstance(msgid, int)
+        self.assertEqual(pmsg, [])
+        self.assertEqual(ctrls, [])
+
+        # try changing password with a wrong old-pw
+        with self.assertRaises(ldap.UNWILLING_TO_PERFORM):
+            l.passwd_s(dn, "bogus", "ignored")
+
+        # have the server generate a new random pw
+        respoid, respvalue = l.passwd_s(dn, "initial", None, extract_newpw=True)
+        self.assertEqual(respoid, None)
+
+        password = respvalue.genPasswd
+        self.assertIsInstance(password, bytes)
+        if PY2:
+            password = password.decode('utf-8')
+
+        # try changing password back
+        respoid, respvalue = l.passwd_s(dn, password, "initial")
+        self.assertEqual(respoid, None)
+        self.assertEqual(respvalue, None)
+
+        l.delete_s(dn)
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """

From 2a2cef38feb7f259ea6b5735a6ce3e46812e217d Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 15:25:04 +0100
Subject: [PATCH 828/868] cidict: Rewrite in terms of MutableMapping

The UserDict API is not specified when it comes to extending:
it is not clear which methods can be safely overridden.

The MutableMapping ABC fixes this problem by providing an explicit
set of abstract methods, in terms of which the rest of the API
is implemented.

Switch to using MutableMapping for cidict.
---
 Lib/ldap/cidict.py | 71 +++++++++++++++++++++++-----------------------
 1 file changed, 36 insertions(+), 35 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 875d5f5..db57468 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -5,57 +5,58 @@
 
 See https://www.python-ldap.org/ for details.
 """
+from collections import MutableMapping
 import warnings
 
 from ldap import __version__
 
-from ldap.compat import IterableUserDict
 
+class cidict(MutableMapping):
+    """
+    Case-insensitive but case-respecting dictionary.
+    """
 
-class cidict(IterableUserDict):
-  """
-  Case-insensitive but case-respecting dictionary.
-  """
+    def __init__(self, default=None):
+        self._keys = {}
+        self._data = {}
+        if default:
+            self.update(default)
+
+    # MutableMapping abstract methods
 
-  def __init__(self,default=None):
-    self._keys = {}
-    IterableUserDict.__init__(self,{})
-    self.update(default or {})
+    def __getitem__(self, key):
+        return self._data[key.lower()]
 
-  def __getitem__(self,key):
-    return self.data[key.lower()]
+    def __setitem__(self, key, value):
+        lower_key = key.lower()
+        self._keys[lower_key] = key
+        self._data[lower_key] = value
 
-  def __setitem__(self,key,value):
-    lower_key = key.lower()
-    self._keys[lower_key] = key
-    self.data[lower_key] = value
+    def __delitem__(self, key):
+        lower_key = key.lower()
+        del self._keys[lower_key]
+        del self._data[lower_key]
 
-  def __delitem__(self,key):
-    lower_key = key.lower()
-    del self._keys[lower_key]
-    del self.data[lower_key]
+    def __iter__(self):
+        return iter(self._keys.values())
 
-  def update(self,dict):
-    for key, value in dict.items():
-      self[key] = value
+    def __len__(self):
+        return len(self._keys)
 
-  def has_key(self,key):
-    return key in self
+    # Specializations for performance
 
-  def __contains__(self,key):
-    return IterableUserDict.__contains__(self, key.lower())
+    def __contains__(self, key):
+        return key.lower() in self._keys
 
-  def __iter__(self):
-    return iter(self.keys())
+    def clear(self):
+        self._keys.clear()
+        self._data.clear()
 
-  def keys(self):
-    return self._keys.values()
+    # Backwards compatibility
 
-  def items(self):
-    result = []
-    for k in self._keys.values():
-      result.append((k,self[k]))
-    return result
+    def has_key(self, key):
+        """Compatibility with python-ldap 2.x"""
+        return key in self
 
 
 def strlist_minus(a,b):

From dada91afdba682f4d755f972b3d94a6e9e08f385 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 15:47:52 +0100
Subject: [PATCH 829/868] cidict: Re-add the `data` attribute

---
 Lib/ldap/cidict.py | 11 +++++++++++
 Tests/t_cidict.py  | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index db57468..3dcfe48 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -58,6 +58,17 @@ def has_key(self, key):
         """Compatibility with python-ldap 2.x"""
         return key in self
 
+    @property
+    def data(self):
+        """Compatibility with older IterableUserDict-based implementation"""
+        warnings.warn(
+            'ldap.cidict.cidict.data is an internal attribute; it may be ' +
+            'removed at any time',
+            category=DeprecationWarning,
+            stacklevel=2,
+        )
+        return self._data
+
 
 def strlist_minus(a,b):
   """
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index b96a26e..6878617 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -62,6 +62,16 @@ def test_strlist_deprecated(self):
                 strlist_func(["a"], ["b"])
             self.assertEqual(len(w), 1)
 
+    def test_cidict_data(self):
+        """test the deprecated data atrtribute"""
+        d = ldap.cidict.cidict({'A': 1, 'B': 2})
+        with warnings.catch_warnings(record=True) as w:
+            warnings.resetwarnings()
+            warnings.simplefilter('always', DeprecationWarning)
+            data = d.data
+        assert data == {'a': 1, 'b': 2}
+        self.assertEqual(len(w), 1)
+
 
 if __name__ == '__main__':
     unittest.main()

From 3e11046243b0b29fa48b84ce74082920796cdd78 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 14 Mar 2018 16:16:05 +0100
Subject: [PATCH 830/868] ldapurl.LDAPUrlExtensions: Rewrite in terms of
 MutableMapping

The UserDict API is not specified when it comes to extending:
it is not clear which methods can be safely overridden.

The MutableMapping ABC fixes this problem by providing an explicit
set of abstract methods, in terms of which the rest of the API
is implemented.

Switch to using MutableMapping for LDAPUrlExtensions.
---
 Lib/ldapurl.py | 102 ++++++++++++++++++++++++++-----------------------
 1 file changed, 55 insertions(+), 47 deletions(-)

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 6de0645..04f78ad 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -16,7 +16,9 @@
   'LDAPUrlExtension','LDAPUrlExtensions','LDAPUrl'
 ]
 
-from ldap.compat import UserDict, quote, unquote
+from collections import MutableMapping
+
+from ldap.compat import quote, unquote
 
 LDAP_SCOPE_BASE = 0
 LDAP_SCOPE_ONELEVEL = 1
@@ -130,58 +132,64 @@ def __ne__(self,other):
     return not self.__eq__(other)
 
 
-class LDAPUrlExtensions(UserDict):
-  """
-  Models a collection of LDAP URL extensions as
-  dictionary type
-  """
-
-  def __init__(self,default=None):
-    UserDict.__init__(self)
-    for k,v in (default or {}).items():
-      self[k]=v
-
-  def __setitem__(self,name,value):
+class LDAPUrlExtensions(MutableMapping):
     """
-    value
-        Either LDAPUrlExtension instance, (critical,exvalue)
-        or string'ed exvalue
+    Models a collection of LDAP URL extensions as
+    a mapping type
     """
-    assert isinstance(value,LDAPUrlExtension)
-    assert name==value.extype
-    self.data[name] = value
 
-  def values(self):
-    return [
-      self[k]
-      for k in self.keys()
-    ]
-
-  def __str__(self):
-    return ','.join(str(v) for v in self.values())
-
-  def __repr__(self):
-    return '<%s.%s instance at %s: %s>' % (
-      self.__class__.__module__,
-      self.__class__.__name__,
-      hex(id(self)),
-      self.data
-    )
+    def __init__(self, default=None):
+        self._data = {}
+        if default is not None:
+            self.update(default)
+
+    def __setitem__(self, name, value):
+        """
+        value
+            Either LDAPUrlExtension instance, (critical,exvalue)
+            or string'ed exvalue
+        """
+        assert isinstance(value, LDAPUrlExtension)
+        assert name == value.extype
+        self._data[name] = value
+
+    def __getitem__(self, name):
+        return self._data[name]
+
+    def __delitem__(self, name):
+        del self._data[name]
+
+    def __iter__(self):
+        return iter(self._data)
+
+    def __len__(self):
+        return len(self._data)
+
+    def __str__(self):
+        return ','.join(str(v) for v in self.values())
+
+    def __repr__(self):
+        return '<%s.%s instance at %s: %s>' % (
+            self.__class__.__module__,
+            self.__class__.__name__,
+            hex(id(self)),
+            self._data
+        )
 
-  def __eq__(self,other):
-    assert isinstance(other,self.__class__),TypeError(
-      "other has to be instance of %s" % (self.__class__)
-    )
-    return self.data==other.data
+    def __eq__(self,other):
+        assert isinstance(other, self.__class__), TypeError(
+            "other has to be instance of %s" % (self.__class__)
+            )
+        return self._data == other._data
 
-  def parse(self,extListStr):
-    for extension_str in extListStr.strip().split(','):
-      if extension_str:
-        e = LDAPUrlExtension(extension_str)
-        self[e.extype] = e
+    def parse(self,extListStr):
+        for extension_str in extListStr.strip().split(','):
+            if extension_str:
+                e = LDAPUrlExtension(extension_str)
+                self[e.extype] = e
 
-  def unparse(self):
-    return ','.join([ v.unparse() for v in self.values() ])
+    def unparse(self):
+        return ','.join(v.unparse() for v in self.values())
 
 
 class LDAPUrl(object):

From 917f9c34c0860f0fe5b8ce26cbd56fad466d7238 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 27 Mar 2018 15:35:35 +0200
Subject: [PATCH 831/868] ldapurl: Replace asserts with proper checks

---
 Lib/ldapurl.py | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 04f78ad..1edc2fe 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -149,8 +149,13 @@ def __setitem__(self, name, value):
             Either LDAPUrlExtension instance, (critical,exvalue)
             or string'ed exvalue
         """
-        assert isinstance(value, LDAPUrlExtension)
-        assert name == value.extype
+        if not isinstance(value, LDAPUrlExtension):
+            raise TypeError("value must be LDAPUrlExtension, not "
+                            + type(value).__name__)
+        if name != value.extype:
+            raise ValueError(
+                "key {!r} does not match extension type {!r}".format(
+                    name, value.extype))
         self._data[name] = value
 
     def __getitem__(self, name):
@@ -177,9 +182,8 @@ def __repr__(self):
         )
 
     def __eq__(self,other):
-        assert isinstance(other, self.__class__), TypeError(
-            "other has to be instance of %s" % (self.__class__)
-            )
+        if not isinstance(other, self.__class__):
+            return NotImplemented
         return self._data == other._data
 
     def parse(self,extListStr):
@@ -374,17 +378,23 @@ def htmlHREF(self,urlPrefix='',hrefText=None,hrefTarget=None):
     hrefTarget
         string added as link target attribute
     """
-    assert type(urlPrefix)==StringType, "urlPrefix must be StringType"
+    if not isinstance(urlPrefix, str):
+        raise TypeError("urlPrefix must be str, not "
+                        + type(urlPrefix).__name__)
     if hrefText is None:
-      hrefText = self.unparse()
-    assert type(hrefText)==StringType, "hrefText must be StringType"
+        hrefText = self.unparse()
+    if not isinstance(hrefText, str):
+        raise TypeError("hrefText must be str, not "
+                        + type(hrefText).__name__)
     if hrefTarget is None:
-      target = ''
+        target = ''
     else:
-      assert type(hrefTarget)==StringType, "hrefTarget must be StringType"
-      target = ' target="%s"' % hrefTarget
+        if not isinstance(hrefTarget, str):
+            raise TypeError("hrefTarget must be str, not "
+                            + type(hrefTarget).__name__)
+        target = ' target="%s"' % hrefTarget
     return '<a%s href="%s%s">%s</a>' % (
-      target,urlPrefix,self.unparse(),hrefText
+        target, urlPrefix, self.unparse(), hrefText
     )
 
   def __str__(self):

From 89f66f8dfa0be86a90dc1684135ab1d2fd04240d Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 27 Mar 2018 15:42:36 +0200
Subject: [PATCH 832/868] ldapurl: Update docstring of
 LDAPUrlExtensions.__setitem__

---
 Lib/ldapurl.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 1edc2fe..7ed1d8a 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -144,10 +144,12 @@ def __init__(self, default=None):
             self.update(default)
 
     def __setitem__(self, name, value):
-        """
+        """Store an extension
+
+        name
+            string
         value
-            Either LDAPUrlExtension instance, (critical,exvalue)
-            or string'ed exvalue
+            LDAPUrlExtension instance, whose extype nust match `name`
         """
         if not isinstance(value, LDAPUrlExtension):
             raise TypeError("value must be LDAPUrlExtension, not "

From 6f2a45d77a82a34d20ba1bd21246d0ef0433faea Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 27 Mar 2018 15:43:30 +0200
Subject: [PATCH 833/868] Lib: Add __slots__ to cidict and LDAPUrlExtensions

---
 Lib/ldap/cidict.py | 1 +
 Lib/ldapurl.py     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 3dcfe48..cf13388 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -15,6 +15,7 @@ class cidict(MutableMapping):
     """
     Case-insensitive but case-respecting dictionary.
     """
+    __slots__ = ('_keys', '_data')
 
     def __init__(self, default=None):
         self._keys = {}
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7ed1d8a..ecfc539 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -137,6 +137,7 @@ class LDAPUrlExtensions(MutableMapping):
     Models a collection of LDAP URL extensions as
     a mapping type
     """
+    __slots__ = ('_data', )
 
     def __init__(self, default=None):
         self._data = {}

From b1b3b5a91b252afabf9c3d125ef648907dae5527 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Jun 2020 20:55:07 +0200
Subject: [PATCH 834/868] Import MutableMapping from collections.abc, except on
 legacy Python

---
 Lib/ldap/cidict.py | 2 +-
 Lib/ldap/compat.py | 2 ++
 Lib/ldapurl.py     | 4 +---
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index cf13388..48aeacb 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -5,9 +5,9 @@
 
 See https://www.python-ldap.org/ for details.
 """
-from collections import MutableMapping
 import warnings
 
+from ldap.compat import MutableMapping
 from ldap import __version__
 
 
diff --git a/Lib/ldap/compat.py b/Lib/ldap/compat.py
index cbfeef5..901457b 100644
--- a/Lib/ldap/compat.py
+++ b/Lib/ldap/compat.py
@@ -10,6 +10,7 @@
     from urllib import unquote as urllib_unquote
     from urllib import urlopen
     from urlparse import urlparse
+    from collections import MutableMapping
 
     def unquote(uri):
         """Specialized unquote that uses UTF-8 for parsing."""
@@ -33,6 +34,7 @@ def unquote(uri):
     IterableUserDict = UserDict
     from urllib.parse import quote, quote_plus, unquote, urlparse
     from urllib.request import urlopen
+    from collections.abc import MutableMapping
 
     def reraise(exc_type, exc_value, exc_traceback):
         """Re-raise an exception given information from sys.exc_info()
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index ecfc539..a3dd7ff 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -16,9 +16,7 @@
   'LDAPUrlExtension','LDAPUrlExtensions','LDAPUrl'
 ]
 
-from collections import MutableMapping
-
-from ldap.compat import quote, unquote
+from ldap.compat import quote, unquote, MutableMapping
 
 LDAP_SCOPE_BASE = 0
 LDAP_SCOPE_ONELEVEL = 1

From 72a4707bd4a5265f0419d591fa8166251674178d Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 21:08:36 +0200
Subject: [PATCH 835/868] Fix NULL deref and checks in LDAPmessage_to_python

The function LDAPmessage_to_python() had some potential NULL pointer
derefs and missed a couple of errors checks. It's still not perfect but
a bit better now.

https://github.com/python-ldap/python-ldap/pull/342

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/message.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/Modules/message.c b/Modules/message.c
index d225a1d..22aa313 100644
--- a/Modules/message.c
+++ b/Modules/message.c
@@ -273,20 +273,35 @@ LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
 
                 valuestr = LDAPberval_to_object(retdata);
                 ber_bvfree(retdata);
+                if (valuestr == NULL) {
+                    ldap_memfree(retoid);
+                    Py_DECREF(result);
+                    ldap_msgfree(m);
+                    return NULL;
+                }
+
                 pyoid = PyUnicode_FromString(retoid);
                 ldap_memfree(retoid);
                 if (pyoid == NULL) {
+                    Py_DECREF(valuestr);
+                    Py_DECREF(result);
+                    ldap_msgfree(m);
+                    return NULL;
+                }
+
+                valtuple = Py_BuildValue("(NNN)", pyoid, valuestr, pyctrls);
+                if (valtuple == NULL) {
+                    Py_DECREF(result);
+                    ldap_msgfree(m);
+                    return NULL;
+                }
+
+                if (PyList_Append(result, valtuple) == -1) {
+                    Py_DECREF(valtuple);
                     Py_DECREF(result);
                     ldap_msgfree(m);
                     return NULL;
                 }
-                valtuple = Py_BuildValue("(OOO)", pyoid,
-                                         valuestr ? valuestr : Py_None,
-                                         pyctrls);
-                Py_DECREF(pyoid);
-                Py_DECREF(valuestr);
-                Py_XDECREF(pyctrls);
-                PyList_Append(result, valtuple);
                 Py_DECREF(valtuple);
             }
         }

From 0870889b01ef696f32f53bb269312133b465d1f2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 29 May 2020 12:10:09 +0200
Subject: [PATCH 836/868] Check valid connection in LDAPObject.set/get_option

set_option() and get_option() now verify that LDAPObject is valid. This
fixes an assertion error and possible segfault after unbind_ext().

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/Modules/LDAPObject.c b/Modules/LDAPObject.c
index e06f47c..da18d57 100644
--- a/Modules/LDAPObject.c
+++ b/Modules/LDAPObject.c
@@ -1365,14 +1365,16 @@ l_ldap_start_tls_s(LDAPObject *self, PyObject *args)
 /* ldap_set_option */
 
 static PyObject *
-l_ldap_set_option(PyObject *self, PyObject *args)
+l_ldap_set_option(LDAPObject *self, PyObject *args)
 {
     PyObject *value;
     int option;
 
     if (!PyArg_ParseTuple(args, "iO:set_option", &option, &value))
         return NULL;
-    if (!LDAP_set_option((LDAPObject *)self, option, value))
+    if (not_valid(self))
+        return NULL;
+    if (!LDAP_set_option(self, option, value))
         return NULL;
     Py_INCREF(Py_None);
     return Py_None;
@@ -1381,13 +1383,15 @@ l_ldap_set_option(PyObject *self, PyObject *args)
 /* ldap_get_option */
 
 static PyObject *
-l_ldap_get_option(PyObject *self, PyObject *args)
+l_ldap_get_option(LDAPObject *self, PyObject *args)
 {
     int option;
 
     if (!PyArg_ParseTuple(args, "i:get_option", &option))
         return NULL;
-    return LDAP_get_option((LDAPObject *)self, option);
+    if (not_valid(self))
+        return NULL;
+    return LDAP_get_option(self, option);
 }
 
 /* ldap_passwd */

From cb4eb7897439683ef7a5f2c43504cf897bfcbc8b Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 29 May 2020 12:09:55 +0200
Subject: [PATCH 837/868] Allow LDAP connection from file descriptor

``ldap.initialize()`` now takes an optional fileno argument to create an
LDAP connection from a connected socket.

See: https://github.com/python-ldap/python-ldap/issues/178
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/reference/ldap.rst      | 16 ++++++++-
 Lib/ldap/functions.py       |  9 +++--
 Lib/ldap/ldapobject.py      | 16 ++++++---
 Lib/slapdtest/_slapdtest.py | 12 +++++--
 Modules/functions.c         | 72 +++++++++++++++++++++++++++++++++++++
 Tests/t_cext.py             | 59 ++++++++++++++++++++++++++----
 Tests/t_ldapobject.py       | 27 ++++++++++++++
 setup.py                    |  1 +
 8 files changed, 197 insertions(+), 15 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 06ecb90..164e2b6 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -29,7 +29,7 @@ Functions
 
 This module defines the following functions:
 
-.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None, [bytes_strictness=None]]]]]) -> LDAPObject object
+.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None, [bytes_strictness=None, [fileno=None]]]]]]) -> LDAPObject object
 
    Initializes a new connection object for accessing the given LDAP server,
    and return an :class:`~ldap.ldapobject.LDAPObject` used to perform operations
@@ -40,6 +40,16 @@ This module defines the following functions:
    when using multiple URIs you cannot determine to which URI your client
    gets connected.
 
+   If *fileno* parameter is given then the file descriptor will be used to
+   connect to an LDAP server. The *fileno* must either be a socket file
+   descriptor as :class:`int` or a file-like object with a *fileno()* method
+   that returns a socket file descriptor. The socket file descriptor must
+   already be connected. :class:`~ldap.ldapobject.LDAPObject` does not take
+   ownership of the file descriptor. It must be kept open during operations
+   and explicitly closed after the :class:`~ldap.ldapobject.LDAPObject` is
+   unbound. The internal connection type is determined from the URI, ``TCP``
+   for ``ldap://`` / ``ldaps://``, ``IPC`` (``AF_UNIX``) for ``ldapi://``.
+
    Note that internally the OpenLDAP function
    `ldap_initialize(3) <https://www.openldap.org/software/man.cgi?query=ldap_init&sektion=3>`_
    is called which just initializes the LDAP connection struct in the C API
@@ -72,6 +82,10 @@ This module defines the following functions:
 
       :rfc:`4516` - Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator
 
+   .. versionadded:: 3.3
+
+      The *fileno* argument was added.
+
 
 .. py:function:: get_option(option) -> int|string
 
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 529c4c8..31ab00f 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -67,7 +67,7 @@ def _ldap_function_call(lock,func,*args,**kwargs):
 
 def initialize(
     uri, trace_level=0, trace_file=sys.stdout, trace_stack_limit=None,
-    bytes_mode=None, **kwargs
+    bytes_mode=None, fileno=None, **kwargs
 ):
   """
   Return LDAPObject instance by opening LDAP connection to
@@ -84,12 +84,17 @@ def initialize(
         Default is to use stdout.
   bytes_mode
         Whether to enable :ref:`bytes_mode` for backwards compatibility under Py2.
+  fileno
+        If not None the socket file descriptor is used to connect to an
+        LDAP server.
 
   Additional keyword arguments (such as ``bytes_strictness``) are
   passed to ``LDAPObject``.
   """
   return LDAPObject(
-      uri, trace_level, trace_file, trace_stack_limit, bytes_mode, **kwargs)
+      uri, trace_level, trace_file, trace_stack_limit, bytes_mode,
+      fileno=fileno, **kwargs
+  )
 
 
 def get_option(option):
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index ab654e1..b44d90c 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -96,14 +96,21 @@ class SimpleLDAPObject:
   def __init__(
     self,uri,
     trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None,
-    bytes_strictness=None,
+    bytes_strictness=None, fileno=None
   ):
     self._trace_level = trace_level or ldap._trace_level
     self._trace_file = trace_file or ldap._trace_file
     self._trace_stack_limit = trace_stack_limit
     self._uri = uri
     self._ldap_object_lock = self._ldap_lock('opcall')
-    self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
+    if fileno is not None:
+      if hasattr(fileno, "fileno"):
+        fileno = fileno.fileno()
+      self._l = ldap.functions._ldap_function_call(
+        ldap._ldap_module_lock, _ldap.initialize_fd, fileno, uri
+      )
+    else:
+      self._l = ldap.functions._ldap_function_call(ldap._ldap_module_lock,_ldap.initialize,uri)
     self.timeout = -1
     self.protocol_version = ldap.VERSION3
 
@@ -1093,7 +1100,7 @@ class ReconnectLDAPObject(SimpleLDAPObject):
   def __init__(
     self,uri,
     trace_level=0,trace_file=None,trace_stack_limit=5,bytes_mode=None,
-    bytes_strictness=None, retry_max=1, retry_delay=60.0
+    bytes_strictness=None, retry_max=1, retry_delay=60.0, fileno=None
   ):
     """
     Parameters like SimpleLDAPObject.__init__() with these
@@ -1109,7 +1116,8 @@ def __init__(
     self._last_bind = None
     SimpleLDAPObject.__init__(self, uri, trace_level, trace_file,
                               trace_stack_limit, bytes_mode,
-                              bytes_strictness=bytes_strictness)
+                              bytes_strictness=bytes_strictness,
+                              fileno=fileno)
     self._reconnect_lock = ldap.LDAPLock(desc='reconnect lock within %s' % (repr(self)))
     self._retry_max = retry_max
     self._retry_delay = retry_delay
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 2f932bc..de4c3e5 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -179,7 +179,7 @@ class SlapdObject(object):
     root_cn = 'Manager'
     root_pw = 'password'
     slapd_loglevel = 'stats stats2'
-    local_host = '127.0.0.1'
+    local_host = LOCALHOST
     testrunsubdirs = (
         'schema',
     )
@@ -214,7 +214,7 @@ def __init__(self):
         self._schema_prefix = os.path.join(self.testrundir, 'schema')
         self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
-        self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
+        self.ldap_uri = "ldap://%s:%d/" % (self.local_host, self._port)
         if HAVE_LDAPI:
             ldapi_path = os.path.join(self.testrundir, 'ldapi')
             self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
@@ -243,6 +243,14 @@ def __init__(self):
     def root_dn(self):
         return 'cn={self.root_cn},{self.suffix}'.format(self=self)
 
+    @property
+    def hostname(self):
+        return self.local_host
+
+    @property
+    def port(self):
+        return self._port
+
     def _find_commands(self):
         self.PATH_LDAPADD = self._find_command('ldapadd')
         self.PATH_LDAPDELETE = self._find_command('ldapdelete')
diff --git a/Modules/functions.c b/Modules/functions.c
index 2a567fd..74740a9 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -30,6 +30,75 @@ l_ldap_initialize(PyObject *unused, PyObject *args)
     return (PyObject *)newLDAPObject(ld);
 }
 
+#ifdef HAVE_LDAP_INIT_FD
+
+/* initialize_fd(fileno, url)
+ *
+ * ldap_init_fd() is not a private API but it's not in a public header either
+ * SSSD has been using the function for a while, so it's probably OK.
+ */
+
+#ifndef LDAP_PROTO_TCP
+#define LDAP_PROTO_TCP 1
+#define LDAP_PROTO_UDP 2
+#define LDAP_PROTO_IPC 3
+#endif
+
+extern int
+  ldap_init_fd(ber_socket_t fd, int proto, LDAP_CONST char *url, LDAP **ldp);
+
+static PyObject *
+l_ldap_initialize_fd(PyObject *unused, PyObject *args)
+{
+    char *url;
+    LDAP *ld = NULL;
+    int ret;
+    int fd;
+    int proto = -1;
+    LDAPURLDesc *lud = NULL;
+
+    PyThreadState *save;
+
+    if (!PyArg_ParseTuple(args, "is:initialize_fd", &fd, &url))
+        return NULL;
+
+    /* Get LDAP protocol from scheme */
+    ret = ldap_url_parse(url, &lud);
+    if (ret != LDAP_SUCCESS)
+        return LDAPerr(ret);
+
+    if (strcmp(lud->lud_scheme, "ldap") == 0) {
+        proto = LDAP_PROTO_TCP;
+    }
+    else if (strcmp(lud->lud_scheme, "ldaps") == 0) {
+        proto = LDAP_PROTO_TCP;
+    }
+    else if (strcmp(lud->lud_scheme, "ldapi") == 0) {
+        proto = LDAP_PROTO_IPC;
+    }
+#ifdef LDAP_CONNECTIONLESS
+    else if (strcmp(lud->lud_scheme, "cldap") == 0) {
+        proto = LDAP_PROTO_UDP;
+    }
+#endif
+    else {
+        ldap_free_urldesc(lud);
+        PyErr_SetString(PyExc_ValueError, "unsupported URL scheme");
+	return NULL;
+    }
+    ldap_free_urldesc(lud);
+
+    save = PyEval_SaveThread();
+    ret = ldap_init_fd((ber_socket_t) fd, proto, url, &ld);
+    PyEval_RestoreThread(save);
+
+    if (ret != LDAP_SUCCESS)
+        return LDAPerror(ld);
+
+    return (PyObject *)newLDAPObject(ld);
+}
+#endif /* HAVE_LDAP_INIT_FD */
+
 /* ldap_str2dn */
 
 static PyObject *
@@ -137,6 +206,9 @@ l_ldap_get_option(PyObject *self, PyObject *args)
 
 static PyMethodDef methods[] = {
     {"initialize", (PyCFunction)l_ldap_initialize, METH_VARARGS},
+#ifdef HAVE_LDAP_INIT_FD
+    {"initialize_fd", (PyCFunction)l_ldap_initialize_fd, METH_VARARGS},
+#endif
     {"str2dn", (PyCFunction)l_ldap_str2dn, METH_VARARGS},
     {"set_option", (PyCFunction)l_ldap_set_option, METH_VARARGS},
     {"get_option", (PyCFunction)l_ldap_get_option, METH_VARARGS},
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 668107e..a19d3c3 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -7,8 +7,10 @@
 
 from __future__ import unicode_literals
 
+import contextlib
 import errno
 import os
+import socket
 import unittest
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
@@ -92,14 +94,35 @@ def _open_conn(self, bind=True):
         """
         l = _ldap.initialize(self.server.ldap_uri)
         if bind:
-            # Perform a simple bind
-            l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
-            m = l.simple_bind(self.server.root_dn, self.server.root_pw)
-            result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
-            self.assertEqual(result, _ldap.RES_BIND)
-            self.assertEqual(type(msgid), type(0))
+            self._bind_conn(l)
         return l
 
+    @contextlib.contextmanager
+    def _open_conn_fd(self, bind=True):
+        sock = socket.create_connection(
+            (self.server.hostname, self.server.port)
+        )
+        try:
+            l = _ldap.initialize_fd(sock.fileno(), self.server.ldap_uri)
+            if bind:
+                self._bind_conn(l)
+            yield sock, l
+        finally:
+            try:
+                sock.close()
+            except OSError:
+                # already closed
+                pass
+
+    def _bind_conn(self, l):
+        # Perform a simple bind
+        l.set_option(_ldap.OPT_PROTOCOL_VERSION, _ldap.VERSION3)
+        m = l.simple_bind(self.server.root_dn, self.server.root_pw)
+        result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ONE, self.timeout)
+        self.assertEqual(result, _ldap.RES_BIND)
+        self.assertEqual(type(msgid), type(0))
+
+
     # Test for the existence of a whole bunch of constants
     # that the C module is supposed to export
     def test_constants(self):
@@ -224,6 +247,30 @@ def test_test_flags(self):
     def test_simple_bind(self):
         l = self._open_conn()
 
+    def test_simple_bind_fileno(self):
+        with self._open_conn_fd() as (sock, l):
+            self.assertEqual(l.whoami_s(), "dn:" + self.server.root_dn)
+
+    def test_simple_bind_fileno_invalid(self):
+        with open(os.devnull) as f:
+            l = _ldap.initialize_fd(f.fileno(), self.server.ldap_uri)
+            with self.assertRaises(_ldap.SERVER_DOWN):
+                self._bind_conn(l)
+
+    def test_simple_bind_fileno_closed(self):
+        with self._open_conn_fd() as (sock, l):
+            self.assertEqual(l.whoami_s(), "dn:" + self.server.root_dn)
+            sock.close()
+            with self.assertRaises(_ldap.SERVER_DOWN):
+                l.whoami_s()
+
+    def test_simple_bind_fileno_rebind(self):
+        with self._open_conn_fd() as (sock, l):
+            self.assertEqual(l.whoami_s(), "dn:" + self.server.root_dn)
+            l.unbind_ext()
+            with self.assertRaises(_ldap.LDAPError):
+                self._bind_conn(l)
+
     def test_simple_anonymous_bind(self):
         l = self._open_conn(bind=False)
         m = l.simple_bind("", "")
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 1ec0028..459ba76 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -20,6 +20,7 @@
 import contextlib
 import linecache
 import os
+import socket
 import unittest
 import warnings
 import pickle
@@ -103,6 +104,9 @@ def setUp(self):
             # open local LDAP connection
             self._ldap_conn = self._open_ldap_conn(bytes_mode=False)
 
+    def tearDown(self):
+        del self._ldap_conn
+
     def test_reject_bytes_base(self):
         base = self.server.suffix
         l = self._ldap_conn
@@ -807,5 +811,28 @@ def test105_reconnect_restore(self):
         self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
 
 
+class Test03_SimpleLDAPObjectWithFileno(Test00_SimpleLDAPObject):
+    def _get_bytes_ldapobject(self, explicit=True, **kwargs):
+        raise unittest.SkipTest("Test opens two sockets")
+
+    def _search_wrong_type(self, bytes_mode, strictness):
+        raise unittest.SkipTest("Test opens two sockets")
+
+    def _open_ldap_conn(self, who=None, cred=None, **kwargs):
+        if hasattr(self, '_sock'):
+            raise RuntimeError("socket already connected")
+        self._sock = socket.create_connection(
+            (self.server.hostname, self.server.port)
+        )
+        return super(Test03_SimpleLDAPObjectWithFileno, self)._open_ldap_conn(
+            who=who, cred=cred, fileno=self._sock.fileno(), **kwargs
+        )
+
+    def tearDown(self):
+        self._sock.close()
+        del self._sock
+        super(Test03_SimpleLDAPObjectWithFileno, self).tearDown()
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/setup.py b/setup.py
index 6974785..4559d84 100644
--- a/setup.py
+++ b/setup.py
@@ -145,6 +145,7 @@ class OpenLDAP2:
           ('LDAPMODULE_VERSION', pkginfo.__version__),
           ('LDAPMODULE_AUTHOR', pkginfo.__author__),
           ('LDAPMODULE_LICENSE', pkginfo.__license__),
+          ('HAVE_LDAP_INIT_FD', None),
         ]
     ),
   ],

From d5996ec34a4f8bab17acfa358b5e2f7733b40b47 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Jun 2020 21:45:56 +0200
Subject: [PATCH 838/868] Do not ignore warnings in tox config (#343)

It looks like all the warnings were caused by setuptools.
Since we don't use setuptools in tests any more, we can remove the warnings.
---
 tox.ini | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/tox.ini b/tox.ini
index 6d9f85a..92933b8 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,15 +13,7 @@ deps = coverage
 passenv = WITH_GCOV
 # - Enable BytesWarning
 # - Turn all warnings into exceptions.
-# - 'ignore:the imp module is deprecated' is required to ignore import of 'imp'
-#   in distutils. Python < 3.6 use PendingDeprecationWarning; Python >= 3.6 use
-#   DeprecationWarning.
-# - 'ignore:lib2to3 package' for Python 3.9
 commands = {envpython} -bb -Werror \
-    "-Wignore:the imp module is deprecated:DeprecationWarning" \
-    "-Wignore:the imp module is deprecated:PendingDeprecationWarning" \
-    "-Wignore:Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated, and in 3.8 it will stop working:DeprecationWarning" \
-    "-Wignore:lib2to3 package is deprecated and may not be able to parse Python 3.10+:PendingDeprecationWarning" \
     -m coverage run --parallel -m unittest discover -v -s Tests -p 't_*'
 
 [testenv:py27]

From 450b2f370080d288dc6c54c3cd963da1672e7bf2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 5 Jun 2020 22:16:50 +0200
Subject: [PATCH 839/868] Make indent again

https://github.com/python-ldap/python-ldap/pull/344

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/constants.c | 4 +---
 Modules/functions.c | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/Modules/constants.c b/Modules/constants.c
index a447310..88658c5 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -64,9 +64,7 @@ LDAPraise_for_message(LDAP *l, LDAPMessage *m)
         PyObject *pyerrno;
         PyObject *pyresult;
         PyObject *pyctrls = NULL;
-        char *matched = NULL,
-             *error = NULL,
-             **refs = NULL;
+        char *matched = NULL, *error = NULL, **refs = NULL;
         LDAPControl **serverctrls = NULL;
 
         /* at first save errno for later use before it gets overwritten by another call */
diff --git a/Modules/functions.c b/Modules/functions.c
index 74740a9..9e0312d 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -84,7 +84,7 @@ l_ldap_initialize_fd(PyObject *unused, PyObject *args)
     else {
         ldap_free_urldesc(lud);
         PyErr_SetString(PyExc_ValueError, "unsupported URL scheme");
-	return NULL;
+        return NULL;
     }
     ldap_free_urldesc(lud);
 

From 39ea8e5bc4a7bfba05e0edbfff2afcf04156a072 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Jun 2020 23:51:06 +0200
Subject: [PATCH 840/868] Limit coverage version to <5.0 again to work around
 CI issues (#346)

---
 .travis.yml | 5 ++++-
 tox.ini     | 8 ++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 067ee37..4bd7d72 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -84,7 +84,10 @@ env:
 
 install:
   - pip install "pip>=7.1.0"
-  - pip install tox-travis tox codecov coverage
+  - pip install tox-travis tox codecov
+  # Coverage 5.0+ has issues similar to:
+  #   https://github.com/nedbat/coveragepy/issues/915
+  - pip install "coverage<5.0"
 
 script: CFLAGS="$CFLAGS_warnings $CFLAGS_std" tox
 
diff --git a/tox.ini b/tox.ini
index 92933b8..2faa94d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,7 +9,9 @@ envlist = py27,py34,py35,py36,py37,py38,py39,{py2,py3}-nosasltls,doc,py3-trace,c
 minver = 1.8
 
 [testenv]
-deps = coverage
+# Coverage 5.0+ has issues similar to:
+#   https://github.com/nedbat/coveragepy/issues/915
+deps = coverage<5.0
 passenv = WITH_GCOV
 # - Enable BytesWarning
 # - Turn all warnings into exceptions.
@@ -75,7 +77,9 @@ deps = {[testenv:pypy]deps}
 commands = {[testenv:pypy]commands}
 
 [testenv:coverage-report]
-deps = coverage
+# Coverage 5.0+ has issues similar to:
+#   https://github.com/nedbat/coveragepy/issues/915
+deps = coverage<5.0
 skip_install = true
 commands =
     {envpython} -m coverage combine

From c00694ee4b9b6d51bfbf75700adaff40b354e37c Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 8 Jun 2020 11:18:59 +0200
Subject: [PATCH 841/868] Remove coverage

At the moment coverage is causing more trouble than it's worth. Codecov
isn't giving meaningful results and we aren't using coverage to increase
test coverage.

https://github.com/python-ldap/python-ldap/pull/349
Fixes: https://github.com/python-ldap/python-ldap/issues/348
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml |  8 --------
 tox.ini     | 21 ++++-----------------
 2 files changed, 4 insertions(+), 25 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 4bd7d72..22224ca 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -85,14 +85,6 @@ env:
 install:
   - pip install "pip>=7.1.0"
   - pip install tox-travis tox codecov
-  # Coverage 5.0+ has issues similar to:
-  #   https://github.com/nedbat/coveragepy/issues/915
-  - pip install "coverage<5.0"
 
 script: CFLAGS="$CFLAGS_warnings $CFLAGS_std" tox
 
-after_success:
-  # gather Python coverage
-  - python -m coverage combine
-  # send Python and GCOV coverage
-  - codecov
diff --git a/tox.ini b/tox.ini
index 2faa94d..81a38bf 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,25 +5,22 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py34,py35,py36,py37,py38,py39,{py2,py3}-nosasltls,doc,py3-trace,coverage-report
+envlist = py27,py34,py35,py36,py37,py38,py39,{py2,py3}-nosasltls,doc,py3-trace
 minver = 1.8
 
 [testenv]
-# Coverage 5.0+ has issues similar to:
-#   https://github.com/nedbat/coveragepy/issues/915
-deps = coverage<5.0
+deps =
 passenv = WITH_GCOV
 # - Enable BytesWarning
 # - Turn all warnings into exceptions.
 commands = {envpython} -bb -Werror \
-    -m coverage run --parallel -m unittest discover -v -s Tests -p 't_*'
+    -m unittest discover -v -s Tests -p 't_*'
 
 [testenv:py27]
 # No warnings with Python 2.7
 passenv = {[testenv]passenv}
 commands =
-    {envpython} -m coverage run --parallel \
-        -m unittest discover -v -s Tests -p 't_*'
+    {envpython} -m unittest discover -v -s Tests -p 't_*'
 
 [testenv:py34]
 # No warnings with Python 3.4
@@ -76,16 +73,6 @@ basepython = pypy3.5
 deps = {[testenv:pypy]deps}
 commands = {[testenv:pypy]commands}
 
-[testenv:coverage-report]
-# Coverage 5.0+ has issues similar to:
-#   https://github.com/nedbat/coveragepy/issues/915
-deps = coverage<5.0
-skip_install = true
-commands =
-    {envpython} -m coverage combine
-    {envpython} -m coverage report --show-missing
-    {envpython} -m coverage html
-
 [testenv:doc]
 basepython = python3
 deps =

From 8f79376cfcb6327b2ecbd19df715b4a8da52649b Mon Sep 17 00:00:00 2001
From: Firstyear <william.brown@suse.com>
Date: Thu, 18 Jun 2020 19:03:28 +1000
Subject: [PATCH 842/868] Syncrepl fails to parse SyncInfoMessage when the
 message is a syncIdSet

Previously, the SyncInfoMessage parser used a for loop to test for the
presence of each named choice with with the structure. However, because
refreshDelete and refreshPresent both are able to be fully resolved
as defaults, and due to how pyasn1 accesses named types, it was not
checking the choice tag, and would return a fully populated refreshDelete
to the caller instead.

This fixes the parser to always return the inner component, and retrieves
the name based on the current choice of the tagged item.

Author: William Brown <william@blackhats.net.au>

https://github.com/python-ldap/python-ldap/pull/351
---
 Lib/ldap/syncrepl.py     | 49 ++++++++++++++++++++--------------------
 Tests/t_ldap_syncrepl.py | 44 +++++++++++++++++++++++++++++++++++-
 2 files changed, 68 insertions(+), 25 deletions(-)

diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index 0de5cec..f6ac2d1 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -314,34 +314,35 @@ def __init__(self, encodedMessage):
         self.refreshPresent = None
         self.syncIdSet = None
 
-        for attr in ['newcookie', 'refreshDelete', 'refreshPresent', 'syncIdSet']:
-            comp = d[0].getComponentByName(attr)
-
-            if comp is not None and comp.hasValue():
-
-                if attr == 'newcookie':
-                    self.newcookie = str(comp)
-                    return
+        # Due to the way pyasn1 works, refreshDelete and refreshPresent are both
+        # valid in the components as they are fully populated defaults. We must
+        # get the component directly from the message, not by iteration.
+        attr = d[0].getName()
+        comp = d[0].getComponent()
+
+        if comp is not None and comp.hasValue():
+            if attr == 'newcookie':
+                self.newcookie = str(comp)
+                return
 
-                val = {}
+            val = {}
 
-                cookie = comp.getComponentByName('cookie')
-                if cookie.hasValue():
-                    val['cookie'] = str(cookie)
+            cookie = comp.getComponentByName('cookie')
+            if cookie.hasValue():
+                val['cookie'] = str(cookie)
 
-                if attr.startswith('refresh'):
-                    val['refreshDone'] = bool(comp.getComponentByName('refreshDone'))
-                elif attr == 'syncIdSet':
-                    uuids = []
-                    ids = comp.getComponentByName('syncUUIDs')
-                    for i in range(len(ids)):
-                        uuid = UUID(bytes=bytes(ids.getComponentByPosition(i)))
-                        uuids.append(str(uuid))
-                    val['syncUUIDs'] = uuids
-                    val['refreshDeletes'] = bool(comp.getComponentByName('refreshDeletes'))
+            if attr.startswith('refresh'):
+                val['refreshDone'] = bool(comp.getComponentByName('refreshDone'))
+            elif attr == 'syncIdSet':
+                uuids = []
+                ids = comp.getComponentByName('syncUUIDs')
+                for i in range(len(ids)):
+                    uuid = UUID(bytes=bytes(ids.getComponentByPosition(i)))
+                    uuids.append(str(uuid))
+                val['syncUUIDs'] = uuids
+                val['refreshDeletes'] = bool(comp.getComponentByName('refreshDeletes'))
 
-                setattr(self, attr, val)
-                return
+            setattr(self, attr, val)
 
 
 class SyncreplConsumer:
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 9398de5..b8a6ab6 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -10,6 +10,7 @@
 import shelve
 import sys
 import unittest
+import binascii
 
 if sys.version_info[0] <= 2:
     PY2 = True
@@ -21,7 +22,7 @@
 
 import ldap
 from ldap.ldapobject import SimpleLDAPObject
-from ldap.syncrepl import SyncreplConsumer
+from ldap.syncrepl import SyncreplConsumer, SyncInfoMessage
 
 from slapdtest import SlapdObject, SlapdTestCase
 
@@ -445,6 +446,47 @@ def setUp(self):
         )
         self.suffix = self.server.suffix.encode('utf-8')
 
+class DecodeSyncreplProtoTests(unittest.TestCase):
+    """
+    Tests of the ASN.1 decoder for tricky cases or past issues to ensure that
+    syncrepl messages are handled correctly.
+    """
+
+    def test_syncidset_message(self):
+        """
+        A syncrepl server may send a sync info message, with a syncIdSet
+        of uuids to delete. A regression was found in the original
+        sync info message implementation due to how the choice was
+        evaluated, because refreshPresent and refreshDelete were both
+        able to be fully expressed as defaults, causing the parser
+        to mistakenly catch a syncIdSet as a refreshPresent/refereshDelete.
+
+        This tests that a syncIdSet request is properly decoded.
+
+        reference: https://tools.ietf.org/html/rfc4533#section-2.5
+        """
+
+        # This is a dump of a syncidset message from wireshark + 389-ds
+        msg = """
+        a36b04526c6461706b64632e6578616d706c652e636f6d3a333839303123636e
+        3d6469726563746f7279206d616e616765723a64633d6578616d706c652c6463
+        3d636f6d3a286f626a656374436c6173733d2a2923330101ff311204108dc446
+        01a93611ea8aaff248c5fa5780
+        """.replace(' ', '').replace('\n', '')
+
+        msgraw = binascii.unhexlify(msg)
+        sim = SyncInfoMessage(msgraw)
+        self.assertEqual(sim.refreshDelete, None)
+        self.assertEqual(sim.refreshPresent, None)
+        self.assertEqual(sim.newcookie, None)
+        self.assertEqual(sim.syncIdSet,
+            {
+                'cookie': 'ldapkdc.example.com:38901#cn=directory manager:dc=example,dc=com:(objectClass=*)#3',
+                'syncUUIDs': ['8dc44601-a936-11ea-8aaf-f248c5fa5780'],
+                'refreshDeletes': True
+            }
+        )
+
 
 if __name__ == '__main__':
     unittest.main()

From f50b1977baeaa02ac2862a1cee5a40bb2735d53f Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 9 Jun 2020 13:18:59 +0200
Subject: [PATCH 843/868] Use openldap.h on OpenLDAP 2.4.48

OpenLDAP 2.4.48 added openldap.h, which defines ldap_init_fd. Use the
header file with 2.4.48 and define the function for older versions.

The patch also cleans up #include. All OpenLDAP includes are now in
common.h and use global includes ``#include <ldap.h>`` instead of local
includes ``#include "ldap.h"``.

Fixes: https://github.com/python-ldap/python-ldap/issues/353
See: https://bugs.openldap.org/show_bug.cgi?id=8671
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/LDAPObject.h  |  6 ------
 Modules/berval.h      |  1 -
 Modules/common.h      | 27 +++++++++++++++++++++++++++
 Modules/constants.c   |  2 --
 Modules/constants.h   |  2 --
 Modules/functions.c   | 15 +--------------
 Modules/ldapcontrol.c |  2 --
 Modules/ldapcontrol.h |  1 -
 Modules/message.h     |  2 --
 9 files changed, 28 insertions(+), 30 deletions(-)

diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index a456bce..1b6066d 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -5,12 +5,6 @@
 
 #include "common.h"
 
-#include "lber.h"
-#include "ldap.h"
-#if LDAP_API_VERSION < 2040
-#error Current python-ldap requires OpenLDAP 2.4.x
-#endif
-
 #if PYTHON_API_VERSION < 1007
 typedef PyObject *_threadstate;
 #else
diff --git a/Modules/berval.h b/Modules/berval.h
index 2aa9c97..9c42724 100644
--- a/Modules/berval.h
+++ b/Modules/berval.h
@@ -4,7 +4,6 @@
 #define __h_berval
 
 #include "common.h"
-#include "lber.h"
 
 PyObject *LDAPberval_to_object(const struct berval *bv);
 PyObject *LDAPberval_to_unicode_object(const struct berval *bv);
diff --git a/Modules/common.h b/Modules/common.h
index affa5f9..bde943c 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -12,6 +12,33 @@
 #include "config.h"
 #endif
 
+#include <lber.h>
+#include <ldap.h>
+#include <ldap_features.h>
+
+#if LDAP_API_VERSION < 2040
+#error Current python-ldap requires OpenLDAP 2.4.x
+#endif
+
+#if LDAP_VENDOR_VERSION >= 20448
+  /* openldap.h with ldap_init_fd() was introduced in 2.4.48
+   * see https://bugs.openldap.org/show_bug.cgi?id=8671
+   */
+#include <openldap.h>
+#ifndef HAVE_LDAP_INIT_FD
+#define HAVE_LDAP_INIT_FD
+#endif
+#else
+  /* ldap_init_fd() has been around for a very long time
+   * SSSD has been defining the function for a while, so it's probably OK.
+   */
+#define LDAP_PROTO_TCP 1
+#define LDAP_PROTO_UDP 2
+#define LDAP_PROTO_IPC 3
+extern int ldap_init_fd(ber_socket_t fd, int proto, LDAP_CONST char *url,
+                        LDAP **ldp);
+#endif
+
 #if defined(MS_WINDOWS)
 #include <winsock.h>
 #else /* unix */
diff --git a/Modules/constants.c b/Modules/constants.c
index 88658c5..8b902e0 100644
--- a/Modules/constants.c
+++ b/Modules/constants.c
@@ -4,8 +4,6 @@
 #include "common.h"
 #include "constants.h"
 #include "ldapcontrol.h"
-#include "lber.h"
-#include "ldap.h"
 
 /* the base exception class */
 
diff --git a/Modules/constants.h b/Modules/constants.h
index b815094..7b9ce53 100644
--- a/Modules/constants.h
+++ b/Modules/constants.h
@@ -4,8 +4,6 @@
 #define __h_constants_
 
 #include "common.h"
-#include "lber.h"
-#include "ldap.h"
 
 extern int LDAPinit_constants(PyObject *m);
 extern PyObject *LDAPconstant(int);
diff --git a/Modules/functions.c b/Modules/functions.c
index 9e0312d..e392047 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -32,20 +32,7 @@ l_ldap_initialize(PyObject *unused, PyObject *args)
 
 #ifdef HAVE_LDAP_INIT_FD
 
-/* initialize_fd(fileno, url)
- *
- * ldap_init_fd() is not a private API but it's not in a public header either
- * SSSD has been using the function for a while, so it's probably OK.
- */
-
-#ifndef LDAP_PROTO_TCP
-#define LDAP_PROTO_TCP 1
-#define LDAP_PROTO_UDP 2
-#define LDAP_PROTO_IPC 3
-#endif
-
-extern int
-  ldap_init_fd(ber_socket_t fd, int proto, LDAP_CONST char *url, LDAP **ldp);
+/* initialize_fd(fileno, url) */
 
 static PyObject *
 l_ldap_initialize_fd(PyObject *unused, PyObject *args)
diff --git a/Modules/ldapcontrol.c b/Modules/ldapcontrol.c
index 5e2d2ff..e287e9a 100644
--- a/Modules/ldapcontrol.c
+++ b/Modules/ldapcontrol.c
@@ -6,8 +6,6 @@
 #include "berval.h"
 #include "constants.h"
 
-#include "lber.h"
-
 /* Prints to stdout the contents of an array of LDAPControl objects */
 
 /* XXX: This is a debugging tool, and the printf generates some warnings
diff --git a/Modules/ldapcontrol.h b/Modules/ldapcontrol.h
index de694c0..74cae42 100644
--- a/Modules/ldapcontrol.h
+++ b/Modules/ldapcontrol.h
@@ -4,7 +4,6 @@
 #define __h_ldapcontrol
 
 #include "common.h"
-#include "ldap.h"
 
 void LDAPinit_control(PyObject *d);
 void LDAPControl_List_DEL(LDAPControl **);
diff --git a/Modules/message.h b/Modules/message.h
index 2978ea5..ed73f32 100644
--- a/Modules/message.h
+++ b/Modules/message.h
@@ -4,8 +4,6 @@
 #define __h_message
 
 #include "common.h"
-#include "lber.h"
-#include "ldap.h"
 
 extern PyObject *LDAPmessage_to_python(LDAP *ld, LDAPMessage *m, int add_ctrls,
                                        int add_intermediates);

From d45ad6afc8453e71df8520934ad42ee109c29bc4 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 9 Jun 2020 14:05:36 +0200
Subject: [PATCH 844/868] Drop HAVE_LDAP_INIT_FD

python-ldap requires OpenLDAP 2.4.0 that provides ldap_init_fd.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Modules/common.h    | 3 ---
 Modules/functions.c | 5 -----
 setup.py            | 1 -
 3 files changed, 9 deletions(-)

diff --git a/Modules/common.h b/Modules/common.h
index bde943c..1ce2eb8 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -25,9 +25,6 @@
    * see https://bugs.openldap.org/show_bug.cgi?id=8671
    */
 #include <openldap.h>
-#ifndef HAVE_LDAP_INIT_FD
-#define HAVE_LDAP_INIT_FD
-#endif
 #else
   /* ldap_init_fd() has been around for a very long time
    * SSSD has been defining the function for a while, so it's probably OK.
diff --git a/Modules/functions.c b/Modules/functions.c
index e392047..ce4a924 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -30,8 +30,6 @@ l_ldap_initialize(PyObject *unused, PyObject *args)
     return (PyObject *)newLDAPObject(ld);
 }
 
-#ifdef HAVE_LDAP_INIT_FD
-
 /* initialize_fd(fileno, url) */
 
 static PyObject *
@@ -84,7 +82,6 @@ l_ldap_initialize_fd(PyObject *unused, PyObject *args)
 
     return (PyObject *)newLDAPObject(ld);
 }
-#endif /* HAVE_LDAP_INIT_FD */
 
 /* ldap_str2dn */
 
@@ -193,9 +190,7 @@ l_ldap_get_option(PyObject *self, PyObject *args)
 
 static PyMethodDef methods[] = {
     {"initialize", (PyCFunction)l_ldap_initialize, METH_VARARGS},
-#ifdef HAVE_LDAP_INIT_FD
     {"initialize_fd", (PyCFunction)l_ldap_initialize_fd, METH_VARARGS},
-#endif
     {"str2dn", (PyCFunction)l_ldap_str2dn, METH_VARARGS},
     {"set_option", (PyCFunction)l_ldap_set_option, METH_VARARGS},
     {"get_option", (PyCFunction)l_ldap_get_option, METH_VARARGS},
diff --git a/setup.py b/setup.py
index 4559d84..6974785 100644
--- a/setup.py
+++ b/setup.py
@@ -145,7 +145,6 @@ class OpenLDAP2:
           ('LDAPMODULE_VERSION', pkginfo.__version__),
           ('LDAPMODULE_AUTHOR', pkginfo.__author__),
           ('LDAPMODULE_LICENSE', pkginfo.__license__),
-          ('HAVE_LDAP_INIT_FD', None),
         ]
     ),
   ],

From 578b0b7103f87fe0ce46aadf034b3be9225ea290 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 18 Jun 2020 16:05:06 +0200
Subject: [PATCH 845/868] Document the LDAPError fields

Also, correct the note on COMPARE_FALSE and COMPARE_TRUE

https://github.com/python-ldap/python-ldap/pull/355
---
 Doc/reference/ldap.rst | 49 +++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 24 deletions(-)

diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 164e2b6..a6d6928 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -462,26 +462,27 @@ The module defines the following exceptions:
    are instead turned into exceptions, raised as soon an the error condition
    is detected.
 
-   The exceptions are accompanied by a dictionary possibly
-   containing an string value for the key :py:const:`desc`
-   (giving an English description of the error class)
-   and/or a string value for the key :py:const:`info`
-   (giving a string containing more information that the server may have sent).
-
-   A third possible field of this dictionary is :py:const:`matched` and
-   is set to a truncated form of the name provided or alias dereferenced
-   for the lowest entry (object or alias) that was matched.
-
-   The field :py:const:`msgid` is set in the dictionary where the
-   exception can be associated with an asynchronous request.
-   This can be used in asynchronous code where :py:meth:`result()` raises the
-   result of an operation as an exception. For example, this is the case for
-   :py:meth:`compare()`, always raises the boolean result as an exception
-   (:py:exc:`COMPARE_TRUE` or :py:exc:`COMPARE_FALSE`).
-
-   Most exceptions from protocol results also carry the :py:attr:`errnum`
-   attribute.
-
+   The exceptions are accompanied by a dictionary with additional information.
+   All fields are optional and more fields may be added in the future.
+   Currently, ``python-ldap`` may set the following fields:
+
+   * ``'result'``: a numeric code of the error class.
+   * ``'desc'``: string giving a description of the error class, as provided
+     by calling OpenLDAP's ``ldap_err2string`` on the ``result``.
+   * ``'info'``: string containing more information that the server may
+     have sent. The value is server-specific: for example, the OpenLDAP server
+     may send different info messages than Active Directory or 389-DS.
+   * ``'matched'``: truncated form of the name provided or alias.
+     dereferenced for the lowest entry (object or alias) that was matched.
+   * ``'msgid'``: ID of the matching asynchronous request.
+     This can be used in asynchronous code where :py:meth:`result()` raises the
+     result of an operation as an exception. For example, this is the case for
+     :py:meth:`~LDAPObject.compare()`, always raises the boolean result as an
+     exception (:py:exc:`COMPARE_TRUE` or :py:exc:`COMPARE_FALSE`).
+   * ``'ctrls'``: list of :py:class:`ldap.controls.LDAPControl` instances
+     attached to the error.
+   * ``'errno'``: the C ``errno``, usually set by system calls or ``libc``
+     rather than the LDAP libraries.
 
 .. py:exception:: ADMINLIMIT_EXCEEDED
 
@@ -515,14 +516,14 @@ The module defines the following exceptions:
 .. py:exception:: COMPARE_FALSE
 
    A compare operation returned false.
-   (This exception should never be seen because :py:meth:`compare()` returns
-   a boolean result.)
+   (This exception should only be seen asynchronous operations, because
+   :py:meth:`~LDAPObject.compare_s()` returns a boolean result.)
 
 .. py:exception:: COMPARE_TRUE
 
    A compare operation returned true.
-   (This exception should never be seen because :py:meth:`compare()` returns
-   a boolean result.)
+   (This exception should only be seen asynchronous operations, because
+   :py:meth:`~LDAPObject.compare_s()` returns a boolean result.)
 
 .. py:exception:: CONFIDENTIALITY_REQUIRED
 

From c345916ded5c911442f52ca33eb34d96c81b6771 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Jun 2020 22:39:34 +0200
Subject: [PATCH 846/868] Bump version to 3.3.0

---
 Lib/ldap/pkginfo.py       | 2 +-
 Lib/ldapurl.py            | 2 +-
 Lib/ldif.py               | 2 +-
 Lib/slapdtest/__init__.py | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index df29b60..d99d2d0 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -2,6 +2,6 @@
 """
 meta attributes for packaging which does not import any dependencies
 """
-__version__ = '3.2.0'
+__version__ = '3.3.0'
 __author__ = u'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index a3dd7ff..7a0017c 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -4,7 +4,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.2.0'
+__version__ = '3.3.0'
 
 __all__ = [
   # constants
diff --git a/Lib/ldif.py b/Lib/ldif.py
index a26c8ac..f07f42d 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -6,7 +6,7 @@
 
 from __future__ import unicode_literals
 
-__version__ = '3.2.0'
+__version__ = '3.3.0'
 
 __all__ = [
   # constants
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 6b8c986..02ed317 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -5,7 +5,7 @@
 See https://www.python-ldap.org/ for details.
 """
 
-__version__ = '3.2.0'
+__version__ = '3.3.0'
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls

From e885b621562a3c987934be3fba3873d21026bf5c Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 5 Jun 2020 22:36:47 +0200
Subject: [PATCH 847/868] CHANGES: Prepare release entry for 3.3.0

---
 CHANGES | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/CHANGES b/CHANGES
index 6e37016..711b665 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,54 @@
+Released 3.3.0 2020-06-18
+
+Highlights:
+* ``LDAPError`` now contains additional fields, such as ctrls, result, msgid
+* ``passwd_s`` can now extract the newly generated password
+* LDAP connections can now be made from a file descriptor
+
+This release is tested on Python 3.8, and the beta of Python 3.9.
+
+The following undocumented functions are deprecated and scheduled for removal:
+- ``ldap.cidict.strlist_intersection``
+- ``ldap.cidict.strlist_minus``
+- ``ldap.cidict.strlist_union``
+
+Modules/
+* Ensure ReconnectLDAPObject is not left in an inconsistent state after
+  a reconnection timeout
+* Syncrepl now correctly parses SyncInfoMessage when the message is a syncIdSet
+* Release GIL around global get/set option call
+* Do not leak serverctrls in result functions
+* Don't overallocate memory in attrs_from_List()
+* Fix thread support check for Python 3
+* With OpenLDAP 2.4.48, use the new header openldap.h
+
+Lib/
+* Fix some edge cases regarding quoting in the schema tokenizer
+* Fix escaping a single space in ldap.escape_dn_chars
+* Fix string formatting in ldap.compare_ext_s
+* Prefer iterating dict instead of calling dict.keys()
+
+Doc/
+* Clarify the relationship between initialize() and LDAPObject()
+* Improve documentation of TLS options
+* Update FAQ to include Samba AD-DC error message
+  "Operation unavailable without authentication"
+* Fix several incorrect examples and demos
+  (but note that these are not yet tested)
+* Update Debian installation instructions for Debian Buster
+* Typo fixes in docs and docstrings
+
+Test/
+* Test and document error cases in ldap.compare_s
+* Test if reconnection is done after connection loss
+* Make test certificates valid for the far future
+* Use slapd -Tt instead of slaptest
+
+Infrastructure:
+* Mark the LICENCE file as a license for setuptools
+* Use "unittest discover" rather than "setup.py test" to run tests
+
+
 ----------------------------------------------------------------
 Released 3.2.0 2019-03-13
 

From 6aacd6f3634223bfa988b0fa679ffc58d5aead3e Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 18 Jun 2020 16:42:56 +0200
Subject: [PATCH 848/868] Adjust notes for the release process

- Git tags should be signed
- Need to check python-ldap.org
---
 Doc/contributing.rst | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index e6481fe..b11c18b 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -221,10 +221,13 @@ If you are tasked with releasing python-ldap, remember to:
 * Merge all that (using pull requests).
 * Run ``python setup.py sdist``, and smoke-test the resulting package
   (install in a clean virtual environment, import ``ldap``).
-* Create Git tag ``python-ldap-{version}``, and push it to GitHub and Pagure.
+* Create GPG-signed Git tag: ``git tag -s python-ldap-{version}``.
+  Push it to GitHub and Pagure.
 * Release the ``sdist`` on PyPI.
 * Announce the release on the mailing list.
   Mention the Git hash.
 * Add the release's log from ``CHANGES`` on the `GitHub release page`_.
+* Check that python-ldap.org shows the latest version; if not, adjust
+  things at readthedocs.org
 
 .. _GitHub release page: https://github.com/python-ldap/python-ldap/releases

From 2be2c6bb8f44792d506cb1759fe06ff4cda3c5cf Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 22 Jun 2020 10:51:42 +0200
Subject: [PATCH 849/868] Remove Python 2 support

python-ldap 3.4 will require Python 3.6 or newer.

https://github.com/python-ldap/python-ldap/pull/358

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml                 |  24 +--
 Doc/bytes_mode.rst          | 138 +++-------------
 Doc/faq.rst                 |   2 +-
 Doc/reference/ldap.rst      |  22 ++-
 Doc/reference/ldapurl.rst   |   3 +-
 Doc/sample_workflow.rst     |   2 -
 Lib/ldap/cidict.py          |   2 +-
 Lib/ldap/compat.py          | 136 +++-------------
 Lib/ldap/controls/sss.py    |   6 +-
 Lib/ldap/dn.py              |   4 -
 Lib/ldap/functions.py       |   3 -
 Lib/ldap/ldapobject.py      | 312 ++++--------------------------------
 Lib/ldap/schema/models.py   |   4 +-
 Lib/ldap/schema/subentry.py |   3 +-
 Lib/ldapurl.py              |   3 +-
 Lib/ldif.py                 |   6 +-
 Lib/slapdtest/_slapdtest.py |   6 +-
 Modules/LDAPObject.h        |  10 +-
 Modules/ldapmodule.c        |   7 -
 Tests/t_bind.py             |  24 ---
 Tests/t_cext.py             |   3 -
 Tests/t_edit.py             |  11 --
 Tests/t_ldap_dn.py          |   3 -
 Tests/t_ldap_syncrepl.py    |  20 ---
 Tests/t_ldapobject.py       | 310 +++--------------------------------
 Tests/t_ldapurl.py          |   6 +-
 Tests/t_ldif.py             |   3 -
 setup.py                    |  18 +--
 tox.ini                     |  37 +----
 29 files changed, 134 insertions(+), 994 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 22224ca..021fa40 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,25 +14,14 @@ addons:
 # Note: when updating Python versions, also change setup.py and tox.ini
 matrix:
   include:
-    - python: 2.7
-      env:
-        - TOXENV=py27
-        - WITH_GCOV=1
-    - python: 3.4
-      env:
-        - TOXENV=py34
-        - WITH_GCOV=1
-    - python: 3.5
-      env:
-        - TOXENV=py35
-        - WITH_GCOV=1
     - python: 3.6
       env:
         - TOXENV=py36
         - WITH_GCOV=1
-    - python: pypy
+    - python: pypy3
       env:
-        - TOXENV=pypy
+        - TOXENV=pypy3
+        - CFLAGS_std="-std=c99"
     - python: 3.7
       env:
         - TOXENV=py37
@@ -53,10 +42,6 @@ matrix:
         - WITH_GCOV=1
       dist: xenial
       sudo: true
-    - python: 2.7
-      env:
-        - TOXENV=py2-nosasltls
-        - WITH_GCOV=1
     - python: 3.6
       env:
         - TOXENV=py3-nosasltls
@@ -68,7 +53,7 @@ matrix:
       env: TOXENV=doc
   allow_failures:
      - env:
-        - TOXENV=pypy
+        - TOXENV=pypy3
 
 env:
     global:
@@ -87,4 +72,3 @@ install:
   - pip install tox-travis tox codecov
 
 script: CFLAGS="$CFLAGS_warnings $CFLAGS_std" tox
-
diff --git a/Doc/bytes_mode.rst b/Doc/bytes_mode.rst
index 0d20745..3a984bf 100644
--- a/Doc/bytes_mode.rst
+++ b/Doc/bytes_mode.rst
@@ -1,34 +1,12 @@
 .. _text-bytes:
+.. _bytes_mode:
 
 Bytes/text management
 =====================
 
-Python 3 introduces a hard distinction between *text* (``str``) – sequences of
-characters (formally, *Unicode codepoints*) – and ``bytes`` – sequences of
-8-bit values used to encode *any* kind of data for storage or transmission.
-
-Python 2 has the same distinction between ``str`` (bytes) and
-``unicode`` (text).
-However, values can be implicitly converted between these types as needed,
-e.g. when comparing or writing to disk or the network.
-The implicit encoding and decoding can be a source of subtle bugs when not
-designed and tested adequately.
-
-In python-ldap 2.x (for Python 2), bytes were used for all fields,
-including those guaranteed to be text.
-
-From version 3.0, python-ldap uses text where appropriate.
-On Python 2, the :ref:`bytes mode <bytes_mode>` setting influences how text is
-handled.
-
-
-What's text, and what's bytes
------------------------------
-
 The LDAP protocol states that some fields (distinguished names, relative
 distinguished names, attribute names, queries) be encoded in UTF-8.
-In python-ldap, these are represented as text (``str`` on Python 3,
-``unicode`` on Python 2).
+In python-ldap, these are represented as text (``str`` on Python 3).
 
 Attribute *values*, on the other hand, **MAY**
 contain any type of data, including text.
@@ -38,102 +16,26 @@ Thus, attribute values are *always* treated as ``bytes``.
 Encoding/decoding to other formats – text, images, etc. – is left to the caller.
 
 
-.. _bytes_mode:
-
-The bytes mode
---------------
-
-In Python 3, text values are represented as ``str``, the Unicode text type.
-
-In Python 2, the behavior of python-ldap 3.0 is influenced by a ``bytes_mode``
-argument to :func:`ldap.initialize`:
-
-``bytes_mode=True`` (backwards compatible):
-    Text values are represented as bytes (``str``) encoded using UTF-8.
-
-``bytes_mode=False`` (future compatible):
-    Text values are represented as ``unicode``.
-
-If not given explicitly, python-ldap will default to ``bytes_mode=True``,
-but if a ``unicode`` value is supplied to it, it will warn and use that value.
-
-Backwards-compatible behavior is not scheduled for removal until Python 2
-itself reaches end of life.
-
-
-Errors, warnings, and automatic encoding
-----------------------------------------
-
-While the type of values *returned* from python-ldap is always given by
-``bytes_mode``, for Python 2 the behavior for “wrong-type” values *passed in*
-can be controlled by the ``bytes_strictness`` argument to
-:func:`ldap.initialize`:
+Historical note
+---------------
 
-``bytes_strictness='error'`` (default if ``bytes_mode`` is specified):
-  A ``TypeError`` is raised.
-
-``bytes_strictness='warn'`` (default when ``bytes_mode`` is not given explicitly):
-  A warning is raised, and the value is encoded/decoded
-  using the UTF-8 encoding.
-
-  The warnings are of type :class:`~ldap.LDAPBytesWarning`, which
-  is a subclass of :class:`BytesWarning` designed to be easily
-  :ref:`filtered out <filter-bytes-warning>` if needed.
-
-``bytes_strictness='silent'``:
-  The value is automatically encoded/decoded using the UTF-8 encoding.
-
-On Python 3, ``bytes_strictness`` is ignored and a ``TypeError`` is always
-raised.
-
-When setting ``bytes_strictness``, an explicit value for ``bytes_mode`` needs
-to be given as well.
-
-
-Porting recommendations
------------------------
-
-Since end of life of Python 2 is coming in a few years, projects are strongly
-urged to make their code compatible with Python 3. General instructions for
-this are provided :ref:`in Python documentation <pyporting-howto>` and in the
-`Conservative porting guide`_.
-
-.. _Conservative porting guide: https://portingguide.readthedocs.io/en/latest/
-
-
-When porting from python-ldap 2.x, users are advised to update their code
-to set ``bytes_mode=False``, and fix any resulting failures.
-
-The typical usage is as follows.
-Note that only the result's *values* are of the ``bytes`` type:
-
-.. code-block:: pycon
-
-    >>> import ldap
-    >>> con = ldap.initialize('ldap://localhost:389', bytes_mode=False)
-    >>> con.simple_bind_s(u'login', u'secret_password')
-    >>> results = con.search_s(u'ou=people,dc=example,dc=org', ldap.SCOPE_SUBTREE, u"(cn=Raphaël)")
-    >>> results
-    [
-        ("cn=Raphaël,ou=people,dc=example,dc=org", {
-            'cn': [b'Rapha\xc3\xabl'],
-            'sn': [b'Barrois'],
-        }),
-    ]
-
-
-.. _filter-bytes-warning:
-
-Filtering warnings
-------------------
+Python 3 introduced a hard distinction between *text* (``str``) – sequences of
+characters (formally, *Unicode codepoints*) – and ``bytes`` – sequences of
+8-bit values used to encode *any* kind of data for storage or transmission.
 
-The bytes mode warnings can be filtered out and ignored with a
-simple filter.
+Python 2 had the same distinction between ``str`` (bytes) and
+``unicode`` (text).
+However, values could be implicitly converted between these types as needed,
+e.g. when comparing or writing to disk or the network.
+The implicit encoding and decoding can be a source of subtle bugs when not
+designed and tested adequately.
 
-.. code-block:: python
+In python-ldap 2.x (for Python 2), bytes were used for all fields,
+including those guaranteed to be text.
 
-   import warnings
-   import ldap
+From version 3.0 to 3.3, python-ldap uses text where appropriate.
+On Python 2, special ``bytes_mode`` and ``bytes_strictness`` settings
+influenced how text was handled.
 
-   if hasattr(ldap, 'LDAPBytesWarning'):
-       warnings.simplefilter('ignore', ldap.LDAPBytesWarning)
+From version 3.3 on, only Python 3 is supported. The “bytes mode” settings
+are deprecated and do nothing.
diff --git a/Doc/faq.rst b/Doc/faq.rst
index 38a645f..2152873 100644
--- a/Doc/faq.rst
+++ b/Doc/faq.rst
@@ -29,7 +29,7 @@ Usage
 .. _pyldap: https://pypi.org/project/pyldap/
 
 
-**Q**: Does it work with Python 2.6? (1.5|2.0|2.1|2.2|2.3|2.4|2.5)?
+**Q**: Does it work with Python 2.7? (1.5|2.0|2.1|2.2|2.3|2.4|2.5|2.6|2.7)?
 
   **A**: No. Old versions of python-ldap are still available from PyPI, though.
 
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index a6d6928..89c9806 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -29,7 +29,7 @@ Functions
 
 This module defines the following functions:
 
-.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [bytes_mode=None, [bytes_strictness=None, [fileno=None]]]]]]) -> LDAPObject object
+.. py:function:: initialize(uri [, trace_level=0 [, trace_file=sys.stdout [, trace_stack_limit=None, [fileno=None]]]]) -> LDAPObject object
 
    Initializes a new connection object for accessing the given LDAP server,
    and return an :class:`~ldap.ldapobject.LDAPObject` used to perform operations
@@ -63,10 +63,6 @@ This module defines the following functions:
    *trace_file* specifies a file-like object as target of the debug log and
    *trace_stack_limit* specifies the stack limit of tracebacks in debug log.
 
-   The *bytes_mode* and *bytes_strictness* arguments specify text/bytes
-   behavior under Python 2.
-   See :ref:`text-bytes` for a complete documentation.
-
    Possible values for *trace_level* are
    :py:const:`0` for no logging,
    :py:const:`1` for only logging the method calls with arguments,
@@ -78,6 +74,10 @@ This module defines the following functions:
    Any additional keyword arguments are passed to ``LDAPObject``.
    It is also fine to instantiate a ``LDAPObject`` (or a subclass) directly.
 
+   The function additionally takes *bytes_mode* and *bytes_strictness* keyword
+   arguments, which are deprecated and ignored. See :ref:`bytes_mode` for
+   details.
+
    .. seealso::
 
       :rfc:`4516` - Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator
@@ -86,6 +86,10 @@ This module defines the following functions:
 
       The *fileno* argument was added.
 
+   .. deprecated:: 3.4
+
+      *bytes_mode* and *bytes_strictness* arguments are deprecated.
+
 
 .. py:function:: get_option(option) -> int|string
 
@@ -730,12 +734,16 @@ Warnings
 
 .. py:class:: LDAPBytesWarning
 
-    Raised when bytes/text mismatch in non-strict bytes mode.
+    This warning is deprecated. python-ldap no longer raises it.
 
-    See :ref:`bytes_mode` for details.
+    It used to be raised under Python 2 when bytes/text mismatch in non-strict
+    bytes mode. See :ref:`bytes_mode` for details.
 
     .. versionadded:: 3.0.0
 
+    .. versionchanged:: 3.4.0
+
+      Deprecated.
 
 .. _ldap-objects:
 
diff --git a/Doc/reference/ldapurl.rst b/Doc/reference/ldapurl.rst
index 96b5ed2..de86de7 100644
--- a/Doc/reference/ldapurl.rst
+++ b/Doc/reference/ldapurl.rst
@@ -9,8 +9,7 @@
 
 This module parses and generates LDAP URLs.    It is implemented in pure Python
 and does not rely on any  non-standard modules. Therefore it can be used stand-
-alone without  the rest of the python-ldap package.  Compatibility note: This
-module has been solely tested on Python 2.x and above.
+alone without  the rest of the python-ldap package.
 
 .. seealso::
 
diff --git a/Doc/sample_workflow.rst b/Doc/sample_workflow.rst
index 8a43553..60d60ca 100644
--- a/Doc/sample_workflow.rst
+++ b/Doc/sample_workflow.rst
@@ -31,8 +31,6 @@ python-ldap won't affect the rest of your system::
 
     $ python3 -m venv __venv__
 
-(For Python 2, install `virtualenv`_ and use it instead of ``python3 -m venv``.)
-
 .. _git: https://git-scm.com/
 .. _virtualenv: https://virtualenv.pypa.io/en/stable/
 
diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index 48aeacb..a5ac29e 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -7,7 +7,7 @@
 """
 import warnings
 
-from ldap.compat import MutableMapping
+from collections.abc import MutableMapping
 from ldap import __version__
 
 
diff --git a/Lib/ldap/compat.py b/Lib/ldap/compat.py
index 901457b..a287ce4 100644
--- a/Lib/ldap/compat.py
+++ b/Lib/ldap/compat.py
@@ -1,115 +1,23 @@
 """Compatibility wrappers for Py2/Py3."""
-
-import sys
-import os
-
-if sys.version_info[0] < 3:
-    from UserDict import UserDict, IterableUserDict
-    from urllib import quote
-    from urllib import quote_plus
-    from urllib import unquote as urllib_unquote
-    from urllib import urlopen
-    from urlparse import urlparse
-    from collections import MutableMapping
-
-    def unquote(uri):
-        """Specialized unquote that uses UTF-8 for parsing."""
-        uri = uri.encode('ascii')
-        unquoted = urllib_unquote(uri)
-        return unquoted.decode('utf-8')
-
-    # Old-style of re-raising an exception is SyntaxError in Python 3,
-    # so hide behind exec() so the Python 3 parser doesn't see it
-    exec('''def reraise(exc_type, exc_value, exc_traceback):
-        """Re-raise an exception given information from sys.exc_info()
-
-        Note that unlike six.reraise, this does not support replacing the
-        traceback. All arguments must come from a single sys.exc_info() call.
-        """
-        raise exc_type, exc_value, exc_traceback
-    ''')
-
-else:
-    from collections import UserDict
-    IterableUserDict = UserDict
-    from urllib.parse import quote, quote_plus, unquote, urlparse
-    from urllib.request import urlopen
-    from collections.abc import MutableMapping
-
-    def reraise(exc_type, exc_value, exc_traceback):
-        """Re-raise an exception given information from sys.exc_info()
-
-        Note that unlike six.reraise, this does not support replacing the
-        traceback. All arguments must come from a single sys.exc_info() call.
-        """
-        # In Python 3, all exception info is contained in one object.
-        raise exc_value
-
-try:
-    from shutil import which
-except ImportError:
-    # shutil.which() from Python 3.6
-    # "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
-    # 2011, 2012, 2013, 2014, 2015, 2016, 2017 Python Software Foundation;
-    # All Rights Reserved"
-    def which(cmd, mode=os.F_OK | os.X_OK, path=None):
-        """Given a command, mode, and a PATH string, return the path which
-        conforms to the given mode on the PATH, or None if there is no such
-        file.
-
-        `mode` defaults to os.F_OK | os.X_OK. `path` defaults to the result
-        of os.environ.get("PATH"), or can be overridden with a custom search
-        path.
-
-        """
-        # Check that a given file can be accessed with the correct mode.
-        # Additionally check that `file` is not a directory, as on Windows
-        # directories pass the os.access check.
-        def _access_check(fn, mode):
-            return (os.path.exists(fn) and os.access(fn, mode)
-                    and not os.path.isdir(fn))
-
-        # If we're given a path with a directory part, look it up directly rather
-        # than referring to PATH directories. This includes checking relative to the
-        # current directory, e.g. ./script
-        if os.path.dirname(cmd):
-            if _access_check(cmd, mode):
-                return cmd
-            return None
-
-        if path is None:
-            path = os.environ.get("PATH", os.defpath)
-        if not path:
-            return None
-        path = path.split(os.pathsep)
-
-        if sys.platform == "win32":
-            # The current directory takes precedence on Windows.
-            if not os.curdir in path:
-                path.insert(0, os.curdir)
-
-            # PATHEXT is necessary to check on Windows.
-            pathext = os.environ.get("PATHEXT", "").split(os.pathsep)
-            # See if the given file matches any of the expected path extensions.
-            # This will allow us to short circuit when given "python.exe".
-            # If it does match, only test that one, otherwise we have to try
-            # others.
-            if any(cmd.lower().endswith(ext.lower()) for ext in pathext):
-                files = [cmd]
-            else:
-                files = [cmd + ext for ext in pathext]
-        else:
-            # On other platforms you don't have things like PATHEXT to tell you
-            # what file suffixes are executable, so just pass on cmd as-is.
-            files = [cmd]
-
-        seen = set()
-        for dir in path:
-            normdir = os.path.normcase(dir)
-            if not normdir in seen:
-                seen.add(normdir)
-                for thefile in files:
-                    name = os.path.join(dir, thefile)
-                    if _access_check(name, mode):
-                        return name
-        return None
+import warnings
+
+warnings.warn(
+    "The ldap.compat module is deprecated and will be removed in the future",
+    DeprecationWarning,
+)
+
+from collections import UserDict
+IterableUserDict = UserDict
+from urllib.parse import quote, quote_plus, unquote, urlparse
+from urllib.request import urlopen
+from collections.abc import MutableMapping
+from shutil import which
+
+def reraise(exc_type, exc_value, exc_traceback):
+    """Re-raise an exception given information from sys.exc_info()
+
+    Note that unlike six.reraise, this does not support replacing the
+    traceback. All arguments must come from a single sys.exc_info() call.
+    """
+    # In Python 3, all exception info is contained in one object.
+    raise exc_value
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 5cdfbda..5001987 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -22,10 +22,6 @@
 from pyasn1.type import univ, namedtype, tag, namedval, constraint
 from pyasn1.codec.ber import encoder, decoder
 
-PY2 = sys.version_info[0] <= 2
-if not PY2:
-  basestring = str
-
 
 #    SortKeyList ::= SEQUENCE OF SEQUENCE {
 #                     attributeType   AttributeDescription,
@@ -63,7 +59,7 @@ def __init__(
     ):
         RequestControl.__init__(self,self.controlType,criticality)
         self.ordering_rules = ordering_rules
-        if isinstance(ordering_rules, basestring):
+        if isinstance(ordering_rules, str):
             ordering_rules = [ordering_rules]
         for rule in ordering_rules:
             rule = rule.split(':')
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index a066ac1..886ff87 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -3,8 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-import sys
 from ldap.pkginfo import __version__
 
 import _ldap
@@ -47,8 +45,6 @@ def str2dn(dn,flags=0):
   """
   if not dn:
     return []
-  if sys.version_info[0] < 3 and isinstance(dn, unicode):
-      dn = dn.encode('utf-8')
   return ldap.functions._ldap_function_call(None,_ldap.str2dn,dn,flags)
 
 
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 31ab00f..8c9dc62 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -27,9 +27,6 @@
   # Tracing is only supported in debugging mode
   import traceback
 
-# See _raise_byteswarning in ldapobject.py
-_LDAP_WARN_SKIP_FRAME = True
-
 
 def _ldap_function_call(lock,func,*args,**kwargs):
   """
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index b44d90c..e29ee9d 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -3,9 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 from os import strerror
 
 from ldap.pkginfo import __version__, __author__, __license__
@@ -28,43 +25,19 @@
 from ldap.schema import SCHEMA_ATTRS
 from ldap.controls import LDAPControl,DecodeControlTuples,RequestControlTuples
 from ldap.extop import ExtendedRequest,ExtendedResponse,PasswordModifyResponse
-from ldap.compat import reraise
 
 from ldap import LDAPError
 
-PY2 = sys.version_info[0] <= 2
-if PY2:
-  text_type = unicode
-else:
-  text_type = str
-
-
-# See SimpleLDAPObject._bytesify_input
-_LDAP_WARN_SKIP_FRAME = True
 
 class LDAPBytesWarning(BytesWarning):
-  """python-ldap bytes mode warning
-  """
-
-def _raise_byteswarning(message):
-    """Raise LDAPBytesWarning
-    """
+    """Python 2 bytes mode warning"""
 
-    # Call stacks that raise the warning tend to be complicated, so
-    # getting a useful stacklevel is tricky.
-    # We walk stack frames, ignoring functions in uninteresting files,
-    # based on the _LDAP_WARN_SKIP_FRAME marker in globals().
-    stacklevel = 2
-    try:
-        getframe = sys._getframe
-    except AttributeError:
-        pass
-    else:
-        frame = sys._getframe(stacklevel)
-        while frame and frame.f_globals.get('_LDAP_WARN_SKIP_FRAME'):
-            stacklevel += 1
-            frame = frame.f_back
-    warnings.warn(message, LDAPBytesWarning, stacklevel=stacklevel+1)
+    def __init__(self, *args, **kwargs):
+        warnings.warn(
+            "LDAPBytesWarning is deprecated and will be removed in the future",
+            DeprecationWarning,
+        )
+        super().__init__(*args, **kwargs)
 
 
 class NO_UNIQUE_ENTRY(ldap.NO_SUCH_OBJECT):
@@ -114,185 +87,16 @@ def __init__(
     self.timeout = -1
     self.protocol_version = ldap.VERSION3
 
-    # Bytes mode
-    # ----------
-
-    if PY2:
-        if bytes_mode is None:
-            bytes_mode = True
-            if bytes_strictness is None:
-                _raise_byteswarning(
-                  "Under Python 2, python-ldap uses bytes by default. "
-                  "This will be removed in Python 3 (no bytes for "
-                  "DN/RDN/field names). "
-                  "Please call initialize(..., bytes_mode=False) explicitly.")
-                bytes_strictness = 'warn'
-        else:
-            if bytes_strictness is None:
-                bytes_strictness = 'error'
-    else:
-        if bytes_mode:
-            raise ValueError("bytes_mode is *not* supported under Python 3.")
-        bytes_mode = False
-        bytes_strictness = 'error'
-    self.bytes_mode = bytes_mode
-    self.bytes_strictness = bytes_strictness
-
-  def _bytesify_input(self, arg_name, value):
-    """Adapt a value following bytes_mode in Python 2.
-
-    In Python 3, returns the original value unmodified.
-
-    With bytes_mode ON, takes bytes or None and returns bytes or None.
-    With bytes_mode OFF, takes unicode or None and returns bytes or None.
-
-    For the wrong argument type (unicode or bytes, respectively),
-    behavior depends on the bytes_strictness setting.
-    In all cases, bytes or None are returned (or an exception is raised).
-    """
-    if not PY2:
-      return value
-    if value is None:
-      return value
-
-    elif self.bytes_mode:
-      if isinstance(value, bytes):
-        return value
-      elif self.bytes_strictness == 'silent':
-        pass
-      elif self.bytes_strictness == 'warn':
-        _raise_byteswarning(
-            "Received non-bytes value for '{}' in bytes mode; "
-            "please choose an explicit "
-            "option for bytes_mode on your LDAP connection".format(arg_name))
-      else:
-          raise TypeError(
-            "All provided fields *must* be bytes when bytes mode is on; "
-            "got type '{}' for '{}'.".format(type(value).__name__, arg_name)
-          )
-      return value.encode('utf-8')
-    else:
-      if isinstance(value, unicode):
-        return value.encode('utf-8')
-      elif self.bytes_strictness == 'silent':
-        pass
-      elif self.bytes_strictness == 'warn':
-        _raise_byteswarning(
-            "Received non-text value for '{}' with bytes_mode off and "
-            "bytes_strictness='warn'".format(arg_name))
-      else:
-        raise TypeError(
-          "All provided fields *must* be text when bytes mode is off; "
-          "got type '{}' for '{}'.".format(type(value).__name__, arg_name)
-        )
-      return value
-
-  def _bytesify_modlist(self, arg_name, modlist, with_opcode):
-    """Adapt a modlist according to bytes_mode.
-
-    A modlist is a tuple of (op, attr, value), where:
-    - With bytes_mode ON, attr is checked to be bytes
-    - With bytes_mode OFF, attr is converted from unicode to bytes
-    - value is *always* bytes
-    """
-    if not PY2:
-      return modlist
-    if with_opcode:
-      return tuple(
-        (op, self._bytesify_input(arg_name, attr), val)
-        for op, attr, val in modlist
-      )
-    else:
-      return tuple(
-        (self._bytesify_input(arg_name, attr), val)
-        for attr, val in modlist
-      )
-
-  def _unbytesify_text_value(self, value):
-    """Adapt a 'known text, UTF-8 encoded' returned value following bytes_mode.
-
-    With bytes_mode ON, takes bytes or None and returns bytes or None.
-    With bytes_mode OFF, takes bytes or None and returns unicode or None.
-
-    This function should only be applied on field *values*; distinguished names
-    or field *names* are already natively handled in result4.
-    """
-    if value is None:
-      return value
-
-    # Preserve logic of assertions only under Python 2
-    if PY2:
-      assert isinstance(value, bytes), "Expected bytes value, got text instead (%r)" % (value,)
-
-    if self.bytes_mode:
-      return value
-    else:
-      return value.decode('utf-8')
-
-  def _maybe_rebytesify_text(self, value):
-    """Re-encodes text to bytes if needed by bytes_mode.
+    if bytes_mode:
+        raise ValueError("bytes_mode is *not* supported under Python 3.")
 
-    Takes unicode (and checks for it), and returns:
-    - bytes under bytes_mode
-    - unicode otherwise.
-    """
-    if not PY2:
-      return value
+  @property
+  def bytes_mode(self):
+    return False
 
-    if value is None:
-      return value
-
-    assert isinstance(value, text_type), "Should return text, got bytes instead (%r)" % (value,)
-    if not self.bytes_mode:
-      return value
-    else:
-      return value.encode('utf-8')
-
-  def _bytesify_result_value(self, result_value):
-    """Applies bytes_mode to a result value.
-
-    Such a value can either be:
-    - a dict mapping an attribute name to its list of values
-      (where attribute names are unicode and values bytes)
-    - a list of referals (which are unicode)
-    """
-    if not PY2:
-      return result_value
-    if hasattr(result_value, 'items'):
-      # It's a attribute_name: [values] dict
-      return {
-        self._maybe_rebytesify_text(key): value
-        for (key, value) in result_value.items()
-      }
-    elif isinstance(result_value, bytes):
-      return result_value
-    else:
-      # It's a list of referals
-      # Example value:
-      # [u'ldap://DomainDnsZones.xxxx.root.local/DC=DomainDnsZones,DC=xxxx,DC=root,DC=local']
-      return [self._maybe_rebytesify_text(referal) for referal in result_value]
-
-  def _bytesify_results(self, results, with_ctrls=False):
-    """Converts a "results" object according to bytes_mode.
-
-    Takes:
-    - a list of (dn, {field: [values]}) if with_ctrls is False
-    - a list of (dn, {field: [values]}, ctrls) if with_ctrls is True
-
-    And, if bytes_mode is on, converts dn and fields to bytes.
-    """
-    if not PY2:
-      return results
-    if with_ctrls:
-      return [
-        (self._maybe_rebytesify_text(dn), self._bytesify_result_value(fields), ctrls)
-        for (dn, fields, ctrls) in results
-      ]
-    else:
-      return [
-        (self._maybe_rebytesify_text(dn), self._bytesify_result_value(fields))
-        for (dn, fields) in results
-      ]
+  @property
+  def bytes_strictness(self):
+    return 'error'
 
   def _ldap_lock(self,desc=''):
     if ldap.LIBLDAP_R:
@@ -326,7 +130,6 @@ def _ldap_call(self,func,*args,**kwargs):
       finally:
         self._ldap_object_lock.release()
     except LDAPError as e:
-      exc_type,exc_value,exc_traceback = sys.exc_info()
       try:
         if 'info' not in e.args[0] and 'errno' in e.args[0]:
           e.args[0]['info'] = strerror(e.args[0]['errno'])
@@ -334,10 +137,7 @@ def _ldap_call(self,func,*args,**kwargs):
         pass
       if __debug__ and self._trace_level>=2:
         self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
-      try:
-        reraise(exc_type, exc_value, exc_traceback)
-      finally:
-        exc_type = exc_value = exc_traceback = None
+      raise
     else:
       if __debug__ and self._trace_level>=2:
         if not diagnostic_message_success is None:
@@ -413,9 +213,6 @@ def add_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
         The parameter modlist is similar to the one passed to modify(),
         except that no operation integer need be included in the tuples.
     """
-    if PY2:
-        dn = self._bytesify_input('dn', dn)
-        modlist = self._bytesify_modlist('modlist', modlist, with_opcode=False)
     return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def add_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
@@ -440,9 +237,6 @@ def simple_bind(self,who=None,cred=None,serverctrls=None,clientctrls=None):
     """
     simple_bind([who='' [,cred='']]) -> int
     """
-    if PY2:
-        who = self._bytesify_input('who', who)
-        cred = self._bytesify_input('cred', cred)
     return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def simple_bind_s(self,who=None,cred=None,serverctrls=None,clientctrls=None):
@@ -519,9 +313,6 @@ def compare_ext(self,dn,attr,value,serverctrls=None,clientctrls=None):
         A design bug in the library prevents value from containing
         nul characters.
     """
-    if PY2:
-        dn = self._bytesify_input('dn', dn)
-        attr = self._bytesify_input('attr', attr)
     return self._ldap_call(self._l.compare_ext,dn,attr,value,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
@@ -552,7 +343,6 @@ def delete_ext(self,dn,serverctrls=None,clientctrls=None):
         form returns the message id of the initiated request, and the
         result can be obtained from a subsequent call to result().
     """
-    dn = self._bytesify_input('dn', dn)
     return self._ldap_call(self._l.delete_ext,dn,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def delete_ext_s(self,dn,serverctrls=None,clientctrls=None):
@@ -601,9 +391,6 @@ def modify_ext(self,dn,modlist,serverctrls=None,clientctrls=None):
     """
     modify_ext(dn, modlist[,serverctrls=None[,clientctrls=None]]) -> int
     """
-    if PY2:
-        dn = self._bytesify_input('dn', dn)
-        modlist = self._bytesify_modlist('modlist', modlist, with_opcode=True)
     return self._ldap_call(self._l.modify_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def modify_ext_s(self,dn,modlist,serverctrls=None,clientctrls=None):
@@ -657,10 +444,6 @@ def modrdn_s(self,dn,newrdn,delold=1):
     return self.rename_s(dn,newrdn,None,delold)
 
   def passwd(self,user,oldpw,newpw,serverctrls=None,clientctrls=None):
-    if PY2:
-        user = self._bytesify_input('user', user)
-        oldpw = self._bytesify_input('oldpw', oldpw)
-        newpw = self._bytesify_input('newpw', newpw)
     return self._ldap_call(self._l.passwd,user,oldpw,newpw,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def passwd_s(self, user, oldpw, newpw, serverctrls=None, clientctrls=None, extract_newpw=False):
@@ -689,10 +472,6 @@ def rename(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls
         This actually corresponds to the rename* routines in the
         LDAP-EXT C API library.
     """
-    if PY2:
-        dn = self._bytesify_input('dn', dn)
-        newrdn = self._bytesify_input('newrdn', newrdn)
-        newsuperior = self._bytesify_input('newsuperior', newsuperior)
     return self._ldap_call(self._l.rename,dn,newrdn,newsuperior,delold,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
 
   def rename_s(self,dn,newrdn,newsuperior=None,delold=1,serverctrls=None,clientctrls=None):
@@ -781,8 +560,6 @@ def result4(self,msgid=ldap.RES_ANY,all=1,timeout=None,add_ctrls=0,add_intermedi
       if add_ctrls:
         resp_data = [ (t,r,DecodeControlTuples(c,resp_ctrl_classes)) for t,r,c in resp_data ]
     decoded_resp_ctrls = DecodeControlTuples(resp_ctrls,resp_ctrl_classes)
-    if resp_data is not None:
-        resp_data = self._bytesify_results(resp_data, with_ctrls=add_ctrls)
     return resp_type, resp_data, resp_msgid, decoded_resp_ctrls, resp_name, resp_value
 
   def search_ext(self,base,scope,filterstr=None,attrlist=None,attrsonly=0,serverctrls=None,clientctrls=None,timeout=-1,sizelimit=0):
@@ -830,24 +607,8 @@ def search_ext(self,base,scope,filterstr=None,attrlist=None,attrsonly=0,serverct
         The amount of search results retrieved can be limited with the
         sizelimit parameter if non-zero.
     """
-
-    if PY2:
-        base = self._bytesify_input('base', base)
-        if filterstr is None:
-          # workaround for default argument,
-          # see https://github.com/python-ldap/python-ldap/issues/147
-          if self.bytes_mode:
-            filterstr = b'(objectClass=*)'
-          else:
-            filterstr = u'(objectClass=*)'
-        else:
-          filterstr = self._bytesify_input('filterstr', filterstr)
-        if attrlist is not None:
-            attrlist = tuple(self._bytesify_input('attrlist', a)
-                             for a in attrlist)
-    else:
-      if filterstr is None:
-        filterstr = '(objectClass=*)'
+    if filterstr is None:
+      filterstr = '(objectClass=*)'
     return self._ldap_call(
       self._l.search_ext,
       base,scope,filterstr,
@@ -944,12 +705,8 @@ def search_subschemasubentry_s(self,dn=None):
 
     Returns: None or text/bytes depending on bytes_mode.
     """
-    if self.bytes_mode:
-      empty_dn = b''
-      attrname = b'subschemaSubentry'
-    else:
-      empty_dn = u''
-      attrname = u'subschemaSubentry'
+    empty_dn = u''
+    attrname = u'subschemaSubentry'
     if dn is None:
       dn = empty_dn
     try:
@@ -972,9 +729,8 @@ def search_subschemasubentry_s(self,dn=None):
             # If dn was already root DSE we can return here
             return None
         else:
-          # With legacy bytes mode, return bytes; otherwise, since this is a DN,
-          # RFCs impose that the field value *can* be decoded to UTF-8.
-          return self._unbytesify_text_value(search_subschemasubentry_dn)
+          if search_subschemasubentry_dn is not None:
+            return search_subschemasubentry_dn.decode('utf-8')
     except IndexError:
       return None
 
@@ -1002,14 +758,9 @@ def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     """
     Returns the sub schema sub entry's data
     """
-    if self.bytes_mode:
-      filterstr = b'(objectClass=subschema)'
-      if attrs is None:
-        attrs = [attr.encode('utf-8') for attr in SCHEMA_ATTRS]
-    else:
-      filterstr = u'(objectClass=subschema)'
-      if attrs is None:
-        attrs = SCHEMA_ATTRS
+    filterstr = u'(objectClass=subschema)'
+    if attrs is None:
+      attrs = SCHEMA_ATTRS
     try:
       subschemasubentry = self.read_s(
         subschemasubentry_dn,
@@ -1044,12 +795,8 @@ def read_rootdse_s(self, filterstr=None, attrlist=None):
     """
     convenience wrapper around read_s() for reading rootDSE
     """
-    if self.bytes_mode:
-      base = b''
-      attrlist = attrlist or [b'*', b'+']
-    else:
-      base = u''
-      attrlist = attrlist or [u'*', u'+']
+    base = u''
+    attrlist = attrlist or [u'*', u'+']
     ldap_rootdse = self.read_s(
       base,
       filterstr=filterstr,
@@ -1062,10 +809,7 @@ def get_naming_contexts(self):
     returns all attribute values of namingContexts in rootDSE
     if namingContexts is not present (not readable) then empty list is returned
     """
-    if self.bytes_mode:
-      name = b'namingContexts'
-    else:
-      name = u'namingContexts'
+    name = u'namingContexts'
     return self.read_rootdse_s(
       attrlist=[name]
     ).get(name, [])
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 7520b2b..0ebd61e 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -7,7 +7,7 @@
 import sys
 
 import ldap.cidict
-from ldap.compat import IterableUserDict
+from collections import UserDict as IterableUserDict
 
 from ldap.schema.tokenizer import split_tokens,extract_tokens
 
@@ -47,7 +47,7 @@ class SchemaElement:
   }
 
   def __init__(self,schema_element_str=None):
-    if sys.version_info >= (3, 0) and isinstance(schema_element_str, bytes):
+    if isinstance(schema_element_str, bytes):
       schema_element_str = schema_element_str.decode('utf-8')
     if schema_element_str:
       l = split_tokens(schema_element_str)
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 215f148..86e996f 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -5,10 +5,9 @@
 """
 
 import copy
+from urllib.request import urlopen
 
 import ldap.cidict,ldap.schema
-
-from ldap.compat import urlopen
 from ldap.schema.models import *
 
 import ldapurl
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 7a0017c..0e03fcc 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -16,7 +16,8 @@
   'LDAPUrlExtension','LDAPUrlExtensions','LDAPUrl'
 ]
 
-from ldap.compat import quote, unquote, MutableMapping
+from collections.abc import MutableMapping
+from urllib.parse import quote, unquote
 
 LDAP_SCOPE_BASE = 0
 LDAP_SCOPE_ONELEVEL = 1
diff --git a/Lib/ldif.py b/Lib/ldif.py
index f07f42d..0afebd8 100644
--- a/Lib/ldif.py
+++ b/Lib/ldif.py
@@ -3,9 +3,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 __version__ = '3.3.0'
 
 __all__ = [
@@ -25,7 +22,8 @@
 from io import StringIO
 import warnings
 
-from ldap.compat import urlparse, urlopen
+from urllib.parse import urlparse
+from urllib.request import urlopen
 
 attrtype_pattern = r'[\w;.-]+(;[\w_-]+)*'
 attrvalue_pattern = r'(([^,]|\\,)+|".*?")'
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index de4c3e5..cebd0df 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -4,9 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 import os
 import socket
 import sys
@@ -16,12 +13,13 @@
 import atexit
 from logging.handlers import SysLogHandler
 import unittest
+from shutil import which
+from urllib.parse import quote_plus
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
 import ldap
-from ldap.compat import quote_plus, which
 
 HERE = os.path.abspath(os.path.dirname(__file__))
 
diff --git a/Modules/LDAPObject.h b/Modules/LDAPObject.h
index 1b6066d..4af0b38 100644
--- a/Modules/LDAPObject.h
+++ b/Modules/LDAPObject.h
@@ -5,15 +5,9 @@
 
 #include "common.h"
 
-#if PYTHON_API_VERSION < 1007
-typedef PyObject *_threadstate;
-#else
-typedef PyThreadState *_threadstate;
-#endif
-
 typedef struct {
     PyObject_HEAD LDAP *ldap;
-    _threadstate _save;         /* for thread saving on referrals */
+    PyThreadState *_save;         /* for thread saving on referrals */
     int valid;
 } LDAPObject;
 
@@ -36,7 +30,7 @@ extern LDAPObject *newLDAPObject(LDAP *);
 #define LDAP_END_ALLOW_THREADS( l )                                     \
 	{                                                               \
 	  LDAPObject *lo = (l);                                         \
-	  _threadstate _save = lo->_save;                               \
+	  PyThreadState *_save = lo->_save;                               \
 	  lo->_save = NULL;                                             \
 	  PyEval_RestoreThread( _save );                                \
 	}
diff --git a/Modules/ldapmodule.c b/Modules/ldapmodule.c
index 8bd55ab..34d5a24 100644
--- a/Modules/ldapmodule.c
+++ b/Modules/ldapmodule.c
@@ -72,13 +72,6 @@ init_ldap_module(void)
     LDAPinit_functions(d);
     LDAPinit_control(d);
 
-    /* Marker for LDAPBytesWarning stack walking
-     * See _raise_byteswarning in ldapobject.py
-     */
-    if (PyModule_AddIntConstant(m, "_LDAP_WARN_SKIP_FRAME", 1) != 0) {
-        return NULL;
-    }
-
     /* Check for errors */
     if (PyErr_Occurred())
         Py_FatalError("can't initialize module _ldap");
diff --git a/Tests/t_bind.py b/Tests/t_bind.py
index 3e2b67f..ba90c4c 100644
--- a/Tests/t_bind.py
+++ b/Tests/t_bind.py
@@ -1,14 +1,3 @@
-from __future__ import unicode_literals
-
-import sys
-
-if sys.version_info[0] <= 2:
-    PY2 = True
-    text_type = unicode
-else:
-    PY2 = False
-    text_type = str
-
 import os
 import unittest
 
@@ -44,19 +33,6 @@ def test_unicode_bind(self):
         l = self._get_ldapobject(False)
         l.simple_bind("CN=user", self.unicode_val)
 
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_unicode_bind_bytesmode(self):
-        l = self._get_ldapobject(True)
-        with self.assertRaises(TypeError):
-            l.simple_bind_s(self.dn_unicode, self.unicode_val_bytes)
-
-        with self.assertRaises(TypeError):
-            l.simple_bind_s(self.dn_bytes, self.unicode_val)
-
-        # Works when encoded to UTF-8
-        with self.assertRaises(ldap.INVALID_CREDENTIALS):
-            l.simple_bind_s(self.dn_bytes, self.unicode_val_bytes)
-
     def test_unicode_bind_no_bytesmode(self):
         l = self._get_ldapobject(False)
         with self.assertRaises(TypeError):
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index a19d3c3..2fa4f56 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -4,9 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 import contextlib
 import errno
 import os
diff --git a/Tests/t_edit.py b/Tests/t_edit.py
index a5b3f65..f79ff18 100644
--- a/Tests/t_edit.py
+++ b/Tests/t_edit.py
@@ -1,14 +1,3 @@
-from __future__ import unicode_literals
-
-import sys
-
-if sys.version_info[0] <= 2:
-    PY2 = True
-    text_type = unicode
-else:
-    PY2 = False
-    text_type = str
-
 import os
 import unittest
 
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index fd36f86..d62ec71 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -4,9 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 # from Python's standard lib
 import os
 import unittest
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index b8a6ab6..7ec9707 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -4,19 +4,11 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-
 import os
 import shelve
-import sys
 import unittest
 import binascii
 
-if sys.version_info[0] <= 2:
-    PY2 = True
-else:
-    PY2 = False
-
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
@@ -434,18 +426,6 @@ def setUp(self):
         self.suffix = self.server.suffix
 
 
-@unittest.skipUnless(PY2, "no bytes_mode under Py3")
-class TestSyncreplBytesMode(BaseSyncreplTests, SlapdTestCase):
-    def setUp(self):
-        super(TestSyncreplBytesMode, self).setUp()
-        self.tester = SyncreplClient(
-            self.server.ldap_uri,
-            self.server.root_dn.encode('utf-8'),
-            self.server.root_pw.encode('utf-8'),
-            bytes_mode=True
-        )
-        self.suffix = self.server.suffix.encode('utf-8')
-
 class DecodeSyncreplProtoTests(unittest.TestCase):
     """
     Tests of the ASN.1 decoder for tricky cases or past issues to ensure that
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 459ba76..75da0f4 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -4,25 +4,11 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
-import sys
-
-if sys.version_info[0] <= 2:
-    PY2 = True
-    text_type = unicode
-else:
-    PY2 = False
-    text_type = str
-
 import errno
-import contextlib
 import linecache
 import os
 import socket
 import unittest
-import warnings
 import pickle
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
@@ -115,44 +101,29 @@ def test_reject_bytes_base(self):
             l.search_s(
                 base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', ['*']
             )
-        if PY2:
-            self.assertIn(
-                u"got type 'str' for 'base'", text_type(e.exception)
-            )
-        elif sys.version_info >= (3, 5, 0):
-            # Python 3.4.x does not include 'search_ext()' in message
-            self.assertEqual(
-                "search_ext() argument 1 must be str, not bytes",
-                text_type(e.exception)
-            )
+        # Python 3.4.x does not include 'search_ext()' in message
+        self.assertEqual(
+            "search_ext() argument 1 must be str, not bytes",
+            str(e.exception)
+        )
 
         with self.assertRaises(TypeError) as e:
             l.search_s(
                 base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*']
             )
-        if PY2:
-            self.assertIn(
-                u"got type 'str' for 'filterstr'", text_type(e.exception)
-            )
-        elif sys.version_info >= (3, 5, 0):
-            self.assertEqual(
-                "search_ext() argument 3 must be str, not bytes",
-                text_type(e.exception)
-            )
+        self.assertEqual(
+            "search_ext() argument 3 must be str, not bytes",
+            str(e.exception)
+        )
 
         with self.assertRaises(TypeError) as e:
             l.search_s(
                 base, ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*']
             )
-        if PY2:
-            self.assertIn(
-                u"got type 'str' for 'attrlist'", text_type(e.exception)
-            )
-        elif sys.version_info >= (3, 5, 0):
-            self.assertEqual(
-                ('attrs_from_List(): expected string in list', b'*'),
-                e.exception.args
-            )
+        self.assertEqual(
+            ('attrs_from_List(): expected string in list', b'*'),
+            e.exception.args
+        )
 
     def test_search_keys_are_text(self):
         base = self.server.suffix
@@ -161,143 +132,12 @@ def test_search_keys_are_text(self):
         result.sort()
         dn, fields = result[0]
         self.assertEqual(dn, 'cn=Foo1,%s' % base)
-        self.assertEqual(type(dn), text_type)
+        self.assertEqual(type(dn), str)
         for key, values in fields.items():
-            self.assertEqual(type(key), text_type)
+            self.assertEqual(type(key), str)
             for value in values:
                 self.assertEqual(type(value), bytes)
 
-    def _get_bytes_ldapobject(self, explicit=True, **kwargs):
-        if explicit:
-            kwargs.setdefault('bytes_mode', True)
-        else:
-            kwargs = {}
-        return self._open_ldap_conn(
-            who=self.server.root_dn.encode('utf-8'),
-            cred=self.server.root_pw.encode('utf-8'),
-            **kwargs
-        )
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_bytesmode_search_requires_bytes(self):
-        l = self._get_bytes_ldapobject()
-        base = self.server.suffix
-
-        with self.assertRaises(TypeError):
-            l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*'])
-        with self.assertRaises(TypeError):
-            l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
-        with self.assertRaises(TypeError):
-            l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_bytesmode_search_results_have_bytes(self):
-        l = self._get_bytes_ldapobject()
-        base = self.server.suffix
-        result = l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
-        result.sort()
-        dn, fields = result[0]
-        self.assertEqual(dn, b'cn=Foo1,%s' % base)
-        self.assertEqual(type(dn), bytes)
-        for key, values in fields.items():
-            self.assertEqual(type(key), bytes)
-            for value in values:
-                self.assertEqual(type(value), bytes)
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_bytesmode_search_defaults(self):
-        l = self._get_bytes_ldapobject()
-        base = 'cn=Foo1,' + self.server.suffix
-        kwargs = dict(
-            base=base.encode('utf-8'),
-            scope=ldap.SCOPE_SUBTREE,
-            # filterstr=b'(objectClass=*)'
-        )
-        expected = [
-            (
-                base,
-                {'cn': [b'Foo1'], 'objectClass': [b'organizationalRole']}
-            ),
-        ]
-
-        result = l.search_s(**kwargs)
-        self.assertEqual(result, expected)
-        result = l.search_st(**kwargs)
-        self.assertEqual(result, expected)
-        result = l.search_ext_s(**kwargs)
-        self.assertEqual(result, expected)
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_unset_bytesmode_search_warns_bytes(self):
-        l = self._get_bytes_ldapobject(explicit=False)
-        base = self.server.suffix
-
-        l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, '(cn=Foo*)', [b'*'])
-        l.search_s(base.encode('utf-8'), ldap.SCOPE_SUBTREE, b'(cn=Foo*)', ['*'])
-        l.search_s(base, ldap.SCOPE_SUBTREE, b'(cn=Foo*)', [b'*'])
-
-    def _search_wrong_type(self, bytes_mode, strictness):
-        if bytes_mode:
-            l = self._get_bytes_ldapobject(bytes_strictness=strictness)
-        else:
-            l = self._open_ldap_conn(bytes_mode=False,
-                                     bytes_strictness=strictness)
-        base = 'cn=Foo1,' + self.server.suffix
-        if not bytes_mode:
-            base = base.encode('utf-8')
-        result = l.search_s(base, scope=ldap.SCOPE_SUBTREE)
-        return result[0][-1]['cn']
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_bytesmode_silent(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            self._search_wrong_type(bytes_mode=True, strictness='silent')
-        self.assertEqual(w, [])
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_bytesmode_warn(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            self._search_wrong_type(bytes_mode=True, strictness='warn')
-        self.assertEqual(len(w), 1)
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_bytesmode_error(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            with self.assertRaises(TypeError):
-                self._search_wrong_type(bytes_mode=True, strictness='error')
-        self.assertEqual(w, [])
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_textmode_silent(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            self._search_wrong_type(bytes_mode=True, strictness='silent')
-        self.assertEqual(w, [])
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_textmode_warn(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            self._search_wrong_type(bytes_mode=True, strictness='warn')
-        self.assertEqual(len(w), 1)
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_textmode_error(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            with self.assertRaises(TypeError):
-                self._search_wrong_type(bytes_mode=True, strictness='error')
-        self.assertEqual(w, [])
-
     def test_search_accepts_unicode_dn(self):
         base = self.server.suffix
         l = self._ldap_conn
@@ -319,7 +159,7 @@ def test_attrlist_accepts_unicode(self):
         result.sort()
 
         for dn, attrs in result:
-            self.assertIsInstance(dn, text_type)
+            self.assertIsInstance(dn, str)
             self.assertEqual(attrs, {})
 
     def test001_search_subtree(self):
@@ -422,7 +262,7 @@ def test_find_unique_entry(self):
     def test_search_subschema(self):
         l = self._ldap_conn
         dn = l.search_subschemasubentry_s()
-        self.assertIsInstance(dn, text_type)
+        self.assertIsInstance(dn, str)
         self.assertEqual(dn, "cn=Subschema")
         subschema = l.read_subschemasubentry_s(dn)
         self.assertIsInstance(subschema, dict)
@@ -437,25 +277,6 @@ def test_search_subschema(self):
             ]
         )
 
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_search_subschema_have_bytes(self):
-        l = self._get_bytes_ldapobject()
-        dn = l.search_subschemasubentry_s()
-        self.assertIsInstance(dn, bytes)
-        self.assertEqual(dn, b"cn=Subschema")
-        subschema = l.read_subschemasubentry_s(dn)
-        self.assertIsInstance(subschema, dict)
-        self.assertEqual(
-            sorted(subschema),
-            [
-                b'attributeTypes',
-                b'ldapSyntaxes',
-                b'matchingRuleUse',
-                b'matchingRules',
-                b'objectClasses'
-            ]
-        )
-
     def test004_enotconn(self):
         l = self.ldap_object_class('ldap://127.0.0.1:42')
         try:
@@ -516,45 +337,9 @@ def test_simple_bind_noarg(self):
         l.simple_bind_s(None, None)
         self.assertEqual(l.whoami_s(), u'')
 
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_ldapbyteswarning(self):
-        self.assertIsSubclass(ldap.LDAPBytesWarning, BytesWarning)
-        self.assertIsSubclass(ldap.LDAPBytesWarning, Warning)
-        self.assertIsInstance(self.server.suffix, text_type)
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            conn = self._get_bytes_ldapobject(explicit=False)
-            result = conn.search_s(
-                self.server.suffix,
-                ldap.SCOPE_SUBTREE,
-                b'(cn=Foo*)',
-                attrlist=[b'*'],
-            )
-            self.assertEqual(len(result), 4)
-
-        # ReconnectLDAP only emits one warning
-        self.assertGreaterEqual(len(w), 1, w)
-        msg = w[-1]
-        self.assertIs(msg.category, ldap.LDAPBytesWarning)
-        self.assertEqual(
-            text_type(msg.message),
-            "Received non-bytes value for 'base' in bytes "
-            "mode; please choose an explicit option for bytes_mode on your "
-            "LDAP connection"
-        )
-
-    @contextlib.contextmanager
-    def catch_byteswarnings(self, *args, **kwargs):
-        with warnings.catch_warnings(record=True) as w:
-            conn = self._get_bytes_ldapobject(*args, **kwargs)
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            yield conn, w
-
     def _check_byteswarning(self, warning, expected_message):
         self.assertIs(warning.category, ldap.LDAPBytesWarning)
-        self.assertIn(expected_message, text_type(warning.message))
+        self.assertIn(expected_message, str(warning.message))
 
         def _normalize(filename):
             # Python 2 likes to report the ".pyc" file in warnings,
@@ -571,44 +356,6 @@ def _normalize(filename):
             linecache.getline(warning.filename, warning.lineno)
         )
 
-    def _test_byteswarning_level_search(self, methodname):
-        with self.catch_byteswarnings(explicit=False) as (conn, w):
-            method = getattr(conn, methodname)
-            result = method(
-                self.server.suffix.encode('utf-8'),
-                ldap.SCOPE_SUBTREE,
-                '(cn=Foo*)',
-                attrlist=['*'],  # CORRECT LINE
-            )
-            self.assertEqual(len(result), 4)
-
-        self.assertEqual(len(w), 2, w)
-
-        self._check_byteswarning(
-            w[0], u"Received non-bytes value for 'filterstr'")
-
-        self._check_byteswarning(
-            w[1], u"Received non-bytes value for 'attrlist'")
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_byteswarning_level_search(self):
-        self._test_byteswarning_level_search('search_s')
-        self._test_byteswarning_level_search('search_st')
-        self._test_byteswarning_level_search('search_ext_s')
-
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_byteswarning_initialize(self):
-        with warnings.catch_warnings(record=True) as w:
-            warnings.resetwarnings()
-            warnings.simplefilter('always', ldap.LDAPBytesWarning)
-            bytes_uri = self.server.ldap_uri.decode('utf-8')
-            self.ldap_object_class(bytes_uri)  # CORRECT LINE
-
-        self.assertEqual(len(w), 1, w)
-
-        self._check_byteswarning(
-            w[0], u"Under Python 2, python-ldap uses bytes by default.")
-
     @requires_tls()
     def test_multiple_starttls(self):
         # Test for openldap does not re-register nss shutdown callbacks
@@ -642,17 +389,6 @@ def test_dse(self):
             [self.server.suffix.encode('utf-8')]
         )
 
-    @unittest.skipUnless(PY2, "no bytes_mode under Py3")
-    def test_dse_bytes(self):
-        l = self._get_bytes_ldapobject()
-        dse = l.read_rootdse_s()
-        self.assertIsInstance(dse, dict)
-        self.assertEqual(dse[u'supportedLDAPVersion'], [b'3'])
-        self.assertEqual(
-            l.get_naming_contexts(),
-            [self.server.suffix.encode('utf-8')]
-        )
-
     def test_compare_s_true(self):
         base = self.server.suffix
         l = self._ldap_conn
@@ -720,8 +456,6 @@ def test_passwd_s(self):
 
         password = respvalue.genPasswd
         self.assertIsInstance(password, bytes)
-        if PY2:
-            password = password.decode('utf-8')
 
         # try changing password back
         respoid, respvalue = l.passwd_s(dn, password, "initial")
@@ -777,8 +511,6 @@ def test103_reconnect_get_state(self):
                 str('_trace_level'): ldap._trace_level,
                 str('_trace_stack_limit'): 5,
                 str('_uri'): self.server.ldap_uri,
-                str('bytes_mode'): l1.bytes_mode,
-                str('bytes_strictness'): l1.bytes_strictness,
                 str('timeout'): -1,
             },
         )
@@ -812,12 +544,6 @@ def test105_reconnect_restore(self):
 
 
 class Test03_SimpleLDAPObjectWithFileno(Test00_SimpleLDAPObject):
-    def _get_bytes_ldapobject(self, explicit=True, **kwargs):
-        raise unittest.SkipTest("Test opens two sockets")
-
-    def _search_wrong_type(self, bytes_mode, strictness):
-        raise unittest.SkipTest("Test opens two sockets")
-
     def _open_ldap_conn(self, who=None, cred=None, **kwargs):
         if hasattr(self, '_sock'):
             raise RuntimeError("socket already connected")
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 1408efc..398dc89 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -4,17 +4,13 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 import os
 import unittest
+from urllib.parse import quote
 
 # Switch off processing .ldaprc or ldap.conf before importing _ldap
 os.environ['LDAPNOINIT'] = '1'
 
-from ldap.compat import quote
-
 import ldapurl
 from ldapurl import LDAPUrl
 
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 048b3f4..254e68d 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -4,9 +4,6 @@
 
 See https://www.python-ldap.org/ for details.
 """
-
-from __future__ import unicode_literals
-
 import os
 import textwrap
 import unittest
diff --git a/setup.py b/setup.py
index 6974785..22c7c74 100644
--- a/setup.py
+++ b/setup.py
@@ -7,15 +7,10 @@
 import sys,os
 from setuptools import setup, Extension
 
-if sys.version_info[0] == 2 and sys.version_info[1] < 7:
-    raise RuntimeError('This software requires Python 2.7 or 3.x.')
-if sys.version_info[0] >= 3 and sys.version_info < (3, 4):
-    raise RuntimeError('The C API from Python 3.4+ is required.')
+if sys.version_info < (3, 6):
+    raise RuntimeError('The C API from Python 3.6+ is required.')
 
-if sys.version_info[0] >= 3:
-    from configparser import ConfigParser
-else:
-    from ConfigParser import ConfigParser
+from configparser import ConfigParser
 
 sys.path.insert(0, os.path.join(os.getcwd(), 'Lib/ldap'))
 import pkginfo
@@ -88,14 +83,11 @@ class OpenLDAP2:
     'Programming Language :: C',
 
     'Programming Language :: Python',
-    'Programming Language :: Python :: 2',
-    'Programming Language :: Python :: 2.7',
     'Programming Language :: Python :: 3',
-    'Programming Language :: Python :: 3.4',
-    'Programming Language :: Python :: 3.5',
     'Programming Language :: Python :: 3.6',
     'Programming Language :: Python :: 3.7',
     'Programming Language :: Python :: 3.8',
+    'Programming Language :: Python :: 3.9',
     # Note: when updating Python versions, also change .travis.yml and tox.ini
 
     'Topic :: Database',
@@ -169,6 +161,6 @@ class OpenLDAP2:
     'pyasn1_modules >= 0.1.5',
   ],
   zip_safe=False,
-  python_requires='>=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*',
+  python_requires='>=3.6',
   test_suite = 'Tests',
 )
diff --git a/tox.ini b/tox.ini
index 81a38bf..13a0e9b 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@
 
 [tox]
 # Note: when updating Python versions, also change setup.py and .travis.yml
-envlist = py27,py34,py35,py36,py37,py38,py39,{py2,py3}-nosasltls,doc,py3-trace
+envlist = py36,py37,py38,py39,py3-nosasltls,doc,py3-trace
 minver = 1.8
 
 [testenv]
@@ -16,19 +16,8 @@ passenv = WITH_GCOV
 commands = {envpython} -bb -Werror \
     -m unittest discover -v -s Tests -p 't_*'
 
-[testenv:py27]
-# No warnings with Python 2.7
-passenv = {[testenv]passenv}
-commands =
-    {envpython} -m unittest discover -v -s Tests -p 't_*'
-
-[testenv:py34]
-# No warnings with Python 3.4
-passenv = {[testenv]passenv}
-commands = {[testenv:py27]commands}
-
-[testenv:py2-nosasltls]
-basepython = python2
+[testenv:py3-nosasltls]
+basepython = python3
 # don't install, install dependencies manually
 skip_install = true
 deps =
@@ -43,15 +32,7 @@ commands =
     {envpython} setup.py clean --all
     {envpython} setup.py build_ext -UHAVE_SASL,HAVE_TLS
     {envpython} setup.py install --single-version-externally-managed --root=/
-    {[testenv:py27]commands}
-
-[testenv:py3-nosasltls]
-basepython = python3
-skip_install = {[testenv:py2-nosasltls]skip_install}
-deps = {[testenv:py2-nosasltls]deps}
-passenv = {[testenv:py2-nosasltls]passenv}
-setenv = {[testenv:py2-nosasltls]setenv}
-commands = {[testenv:py2-nosasltls]commands}
+    {[testenv]commands}
 
 [testenv:py3-trace]
 basepython = python3
@@ -62,17 +43,11 @@ setenv =
     PYTHON_LDAP_TRACE_FILE={envtmpdir}/trace.log
 commands = {[testenv]commands}
 
-[testenv:pypy]
-# PyPy doesn't have working setup.py test
+[testenv:pypy3]
+basepython = pypy3
 deps = pytest
 commands = {envpython} -m pytest
 
-[testenv:pypy35]
-# PyPy-5.9.0
-basepython = pypy3.5
-deps = {[testenv:pypy]deps}
-commands = {[testenv:pypy]commands}
-
 [testenv:doc]
 basepython = python3
 deps =

From 08907384778a5bb08399865b519221380c30b9dc Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 29 Jun 2020 13:41:51 +0200
Subject: [PATCH 850/868] Add words to spellchecker

it looks like sphinxcontrib-spelling 5.1.2 does not like GPG and
readthedocs.

https://github.com/python-ldap/python-ldap/pull/361

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/spelling_wordlist.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index d13c079..fb4a990 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -56,6 +56,7 @@ filterstr
 filterStr
 formatOID
 func
+GPG
 Heimdal
 hostport
 hrefTarget
@@ -105,6 +106,7 @@ processResultsCount
 Proxied
 py
 rdn
+readthedocs
 reentrant
 refmodule
 refreshAndPersist

From 6f06059b746cdae69715fd1bef1386ef93419a14 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 29 Jun 2020 13:42:31 +0200
Subject: [PATCH 851/868] Force Python 3 tox on Travis CI

pip may point to Python 2 but setup.py requires Python 3. Tox sdist may
fail when tox is installed for Python 2 on Travis CI.

https://github.com/python-ldap/python-ldap/pull/362

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 021fa40..3549799 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -68,7 +68,7 @@ env:
         - TOX_TESTENV_PASSENV="CFLAGS CI WITH_GCOV"
 
 install:
-  - pip install "pip>=7.1.0"
-  - pip install tox-travis tox codecov
+  - python3 -m pip install "pip>=7.1.0"
+  - python3 -m pip install tox-travis tox codecov
 
-script: CFLAGS="$CFLAGS_warnings $CFLAGS_std" tox
+script: CFLAGS="$CFLAGS_warnings $CFLAGS_std" python3 -m tox

From 605a34b4a776bba9f79aa4fb399bf468bd497566 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 29 Jun 2020 15:41:22 +0200
Subject: [PATCH 852/868] Fix macOS SDK builds without ldap_init_fd

Fix macOS SDK builds without ldap_init_fd

macOS system libldap 2.4.28 does not have ldap_init_fd symbol. Disable
initialize_fd when Apple libldap 2.4.28 is detected.

Also run some macOS tests on Travis CI. Since the SDK does not ship
slapd, testing is rather limited.

https://github.com/python-ldap/python-ldap/pull/360
Fixes: https://github.com/python-ldap/python-ldap/issues/359
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 .travis.yml                   |  9 +++++++++
 Doc/reference/ldap.rst        |  8 ++++++++
 Lib/ldap/constants.py         |  1 +
 Lib/ldap/ldapobject.py        |  2 ++
 Lib/slapdtest/__init__.py     |  1 +
 Lib/slapdtest/_slapdtest.py   |  8 ++++++++
 Modules/common.h              |  5 +++++
 Modules/constants_generated.h |  8 ++++++++
 Modules/functions.c           |  4 ++++
 Tests/t_cext.py               |  5 ++++-
 Tests/t_ldapobject.py         |  2 ++
 setup.py                      |  4 +++-
 tox.ini                       | 20 ++++++++++++++++++++
 13 files changed, 75 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 3549799..17d46bf 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,4 +1,5 @@
 language: python
+group: travis_latest
 
 sudo: false
 
@@ -14,6 +15,13 @@ addons:
 # Note: when updating Python versions, also change setup.py and tox.ini
 matrix:
   include:
+    - os: osx
+      osx_image: xcode11.4
+      language: minimal
+      env:
+        - TOXENV=macos
+        - CFLAGS_warnings="-Wall -Werror=declaration-after-statement"
+        - CFLAGS_std="-std=c99"
     - python: 3.6
       env:
         - TOXENV=py36
@@ -25,6 +33,7 @@ matrix:
     - python: 3.7
       env:
         - TOXENV=py37
+        - CFLAGS_std="-std=c99"
         - WITH_GCOV=1
       dist: xenial
       sudo: true
diff --git a/Doc/reference/ldap.rst b/Doc/reference/ldap.rst
index 89c9806..16220f3 100644
--- a/Doc/reference/ldap.rst
+++ b/Doc/reference/ldap.rst
@@ -49,6 +49,8 @@ This module defines the following functions:
    and explicitly closed after the :class:`~ldap.ldapobject.LDAPObject` is
    unbound. The internal connection type is determined from the URI, ``TCP``
    for ``ldap://`` / ``ldaps://``, ``IPC`` (``AF_UNIX``) for ``ldapi://``.
+   The parameter is not available on macOS when python-ldap is compiled with system
+   libldap, see :py:const:`INIT_FD_AVAIL`.
 
    Note that internally the OpenLDAP function
    `ldap_initialize(3) <https://www.openldap.org/software/man.cgi?query=ldap_init&sektion=3>`_
@@ -139,6 +141,12 @@ General
    Integer where a non-zero value indicates that python-ldap was built with
    support for SSL/TLS (OpenSSL or similar libs).
 
+.. py:data:: INIT_FD_AVAIL
+
+   Integer where a non-zero value indicates that python-ldap supports
+   :py:func:`initialize` from a file descriptor. The feature is generally
+   available except on macOS when python-ldap is compiled with system libldap.
+
 
 .. _ldap-options:
 
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index 641d49c..5e178a1 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -344,6 +344,7 @@ class Str(Constant):
     Feature('LIBLDAP_R', 'HAVE_LIBLDAP_R'),
     Feature('SASL_AVAIL', 'HAVE_SASL'),
     Feature('TLS_AVAIL', 'HAVE_TLS'),
+    Feature('INIT_FD_AVAIL', 'HAVE_LDAP_INIT_FD'),
 
     Str("CONTROL_MANAGEDSAIT"),
     Str("CONTROL_PROXY_AUTHZ"),
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index e29ee9d..dcdeea5 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -77,6 +77,8 @@ def __init__(
     self._uri = uri
     self._ldap_object_lock = self._ldap_lock('opcall')
     if fileno is not None:
+      if not hasattr(_ldap, "initialize_fd"):
+        raise ValueError("libldap does not support initialize_fd")
       if hasattr(fileno, "fileno"):
         fileno = fileno.fileno()
       self._l = ldap.functions._ldap_function_call(
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 02ed317..1371bef 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -9,4 +9,5 @@
 
 from slapdtest._slapdtest import SlapdObject, SlapdTestCase, SysLogHandler
 from slapdtest._slapdtest import requires_ldapi, requires_sasl, requires_tls
+from slapdtest._slapdtest import requires_init_fd
 from slapdtest._slapdtest import skip_unless_ci
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index cebd0df..25b3b22 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -107,6 +107,14 @@ def requires_ldapi():
     else:
         return identity
 
+def requires_init_fd():
+    if not ldap.INIT_FD_AVAIL:
+        return skip_unless_ci(
+            "test needs ldap.INIT_FD", feature='INIT_FD')
+    else:
+        return identity
+
+
 def _add_sbin(path):
     """Add /sbin and related directories to a command search path"""
     directories = path.split(os.pathsep)
diff --git a/Modules/common.h b/Modules/common.h
index 1ce2eb8..886024f 100644
--- a/Modules/common.h
+++ b/Modules/common.h
@@ -24,11 +24,16 @@
   /* openldap.h with ldap_init_fd() was introduced in 2.4.48
    * see https://bugs.openldap.org/show_bug.cgi?id=8671
    */
+#define HAVE_LDAP_INIT_FD 1
 #include <openldap.h>
+#elif (defined(__APPLE__) && (LDAP_VENDOR_VERSION == 20428))
+/* macOS system libldap 2.4.28 does not have ldap_init_fd symbol */
+#undef HAVE_LDAP_INIT_FD
 #else
   /* ldap_init_fd() has been around for a very long time
    * SSSD has been defining the function for a while, so it's probably OK.
    */
+#define HAVE_LDAP_INIT_FD 1
 #define LDAP_PROTO_TCP 1
 #define LDAP_PROTO_UDP 2
 #define LDAP_PROTO_IPC 3
diff --git a/Modules/constants_generated.h b/Modules/constants_generated.h
index 3231e63..4a4cdb3 100644
--- a/Modules/constants_generated.h
+++ b/Modules/constants_generated.h
@@ -329,6 +329,14 @@ if (PyModule_AddIntConstant(m, "TLS_AVAIL", 0) != 0)
     return -1;
 #endif
 
+#ifdef HAVE_LDAP_INIT_FD
+if (PyModule_AddIntConstant(m, "INIT_FD_AVAIL", 1) != 0)
+    return -1;
+#else
+if (PyModule_AddIntConstant(m, "INIT_FD_AVAIL", 0) != 0)
+    return -1;
+#endif
+
 add_string(CONTROL_MANAGEDSAIT);
 add_string(CONTROL_PROXY_AUTHZ);
 add_string(CONTROL_SUBENTRIES);
diff --git a/Modules/functions.c b/Modules/functions.c
index ce4a924..b811708 100644
--- a/Modules/functions.c
+++ b/Modules/functions.c
@@ -30,6 +30,7 @@ l_ldap_initialize(PyObject *unused, PyObject *args)
     return (PyObject *)newLDAPObject(ld);
 }
 
+#ifdef HAVE_LDAP_INIT_FD
 /* initialize_fd(fileno, url) */
 
 static PyObject *
@@ -82,6 +83,7 @@ l_ldap_initialize_fd(PyObject *unused, PyObject *args)
 
     return (PyObject *)newLDAPObject(ld);
 }
+#endif
 
 /* ldap_str2dn */
 
@@ -190,7 +192,9 @@ l_ldap_get_option(PyObject *self, PyObject *args)
 
 static PyMethodDef methods[] = {
     {"initialize", (PyCFunction)l_ldap_initialize, METH_VARARGS},
+#ifdef HAVE_LDAP_INIT_FD
     {"initialize_fd", (PyCFunction)l_ldap_initialize_fd, METH_VARARGS},
+#endif
     {"str2dn", (PyCFunction)l_ldap_str2dn, METH_VARARGS},
     {"set_option", (PyCFunction)l_ldap_set_option, METH_VARARGS},
     {"get_option", (PyCFunction)l_ldap_get_option, METH_VARARGS},
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index 2fa4f56..c271531 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -15,7 +15,7 @@
 
 # import the plain C wrapper module
 import _ldap
-from slapdtest import SlapdTestCase, requires_tls
+from slapdtest import SlapdTestCase, requires_tls, requires_init_fd
 
 
 class TestLdapCExtension(SlapdTestCase):
@@ -248,12 +248,14 @@ def test_simple_bind_fileno(self):
         with self._open_conn_fd() as (sock, l):
             self.assertEqual(l.whoami_s(), "dn:" + self.server.root_dn)
 
+    @requires_init_fd()
     def test_simple_bind_fileno_invalid(self):
         with open(os.devnull) as f:
             l = _ldap.initialize_fd(f.fileno(), self.server.ldap_uri)
             with self.assertRaises(_ldap.SERVER_DOWN):
                 self._bind_conn(l)
 
+    @requires_init_fd()
     def test_simple_bind_fileno_closed(self):
         with self._open_conn_fd() as (sock, l):
             self.assertEqual(l.whoami_s(), "dn:" + self.server.root_dn)
@@ -261,6 +263,7 @@ def test_simple_bind_fileno_closed(self):
             with self.assertRaises(_ldap.SERVER_DOWN):
                 l.whoami_s()
 
+    @requires_init_fd()
     def test_simple_bind_fileno_rebind(self):
         with self._open_conn_fd() as (sock, l):
             self.assertEqual(l.whoami_s(), "dn:" + self.server.root_dn)
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 75da0f4..da937a3 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -19,6 +19,7 @@
 
 from slapdtest import SlapdTestCase
 from slapdtest import requires_ldapi, requires_sasl, requires_tls
+from slapdtest import requires_init_fd
 
 
 LDIF_TEMPLATE = """dn: %(suffix)s
@@ -543,6 +544,7 @@ def test105_reconnect_restore(self):
         self.assertEqual(l1.whoami_s(), 'dn:'+bind_dn)
 
 
+@requires_init_fd()
 class Test03_SimpleLDAPObjectWithFileno(Test00_SimpleLDAPObject):
     def _open_ldap_conn(self, who=None, cred=None, **kwargs):
         if hasattr(self, '_sock'):
diff --git a/setup.py b/setup.py
index 22c7c74..20c31c5 100644
--- a/setup.py
+++ b/setup.py
@@ -8,7 +8,9 @@
 from setuptools import setup, Extension
 
 if sys.version_info < (3, 6):
-    raise RuntimeError('The C API from Python 3.6+ is required.')
+  raise RuntimeError(
+    'The C API from Python 3.6+ is required, found %s' % sys.version_info
+  )
 
 from configparser import ConfigParser
 
diff --git a/tox.ini b/tox.ini
index 13a0e9b..e33de28 100644
--- a/tox.ini
+++ b/tox.ini
@@ -43,6 +43,26 @@ setenv =
     PYTHON_LDAP_TRACE_FILE={envtmpdir}/trace.log
 commands = {[testenv]commands}
 
+[testenv:macos]
+# Travis CI macOS image does not have slapd
+# SDK libldap does not support ldap_init_fd
+basepython = python3
+deps = {[testenv]deps}
+passenv = {[testenv]passenv}
+setenv =
+    CI_DISABLED=INIT_FD
+commands =
+    {envpython} -m unittest -v \
+        Tests/t_cidict.py \
+        Tests/t_ldap_dn.py \
+        Tests/t_ldap_filter.py \
+        Tests/t_ldap_functions.py \
+        Tests/t_ldap_modlist.py \
+        Tests/t_ldap_schema_tokenizer.py \
+        Tests/t_ldapurl.py \
+        Tests/t_ldif.py \
+        Tests/t_untested_mods.py
+
 [testenv:pypy3]
 basepython = pypy3
 deps = pytest

From 2e34d75e64628d02e32dadaa87bfa35447fa503c Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Mon, 13 Jul 2020 14:53:41 +0200
Subject: [PATCH 853/868] Prepare auto-formatting with black (#364)

Also removes autopep8 and prepares configuration for import sorter
isort.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Doc/contributing.rst |  2 +-
 Makefile             | 14 ++++++++------
 pyproject.toml       |  8 ++++++++
 3 files changed, 17 insertions(+), 7 deletions(-)
 create mode 100644 pyproject.toml

diff --git a/Doc/contributing.rst b/Doc/contributing.rst
index b11c18b..1fc1365 100644
--- a/Doc/contributing.rst
+++ b/Doc/contributing.rst
@@ -108,7 +108,7 @@ Notable targets are:
     Note that no backups are made – please commit any other changes before
     using this target.
 
-    Requires the ``indent`` program and the ``autopep8`` Python module.
+    Requires the ``indent`` program and the ``black`` Python module.
 
 .. _PEP 7: https://www.python.org/dev/peps/pep-0007/
 .. _PEP 8: https://www.python.org/dev/peps/pep-0008/
diff --git a/Makefile b/Makefile
index 8ec46a6..f7360a6 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,7 @@ LCOV_REPORT_OPTIONS=--show-details -no-branch-coverage \
 	--title "python-ldap LCOV report"
 SCAN_REPORT=build/scan_report
 PYTHON_SUPP=/usr/share/doc/python3-devel/valgrind-python.supp
-AUTOPEP8_OPTS=--aggressive
+
 
 .NOTPARALLEL:
 
@@ -85,13 +85,15 @@ valgrind: build $(PYTHON_SUPP)
 	fi
 
 # Code autoformatter
-.PHONY: autoformat indent autopep8
-autoformat: indent autopep8
+.PHONY: autoformat indent black black-check
+autoformat: indent black
 
 indent:
 	indent Modules/*.c Modules/*.h
 	rm -f Modules/*.c~ Modules/*.h~
 
-autopep8:
-	$(PYTHON) -m autopep8 -r -i -j0 $(AUTOPEP8_OPTS) \
-	    Demo Lib Tests setup.py
+black:
+	$(PYTHON) -m black $(CURDIR)
+
+black-check:
+	$(PYTHON) -m black $(CURDIR) --check
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 0000000..dda8dbc
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,8 @@
+[tool.black]
+line-length = 88
+target-version = ['py36', 'py37', 'py38']
+
+[tool.isort]
+line_length=88
+known_first_party=['ldap', '_ldap', 'ldapurl', 'ldif', 'slapdtest']
+sections=['FUTURE', 'STDLIB', 'THIRDPARTY', 'FIRSTPARTY', 'LOCALFOLDER']

From f881387c698d82c71dba4deaf32910302cda918c Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 31 Jul 2020 10:01:05 +0200
Subject: [PATCH 854/868] Show stderr of slapd -Ttest

Related: #370
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/slapdtest/_slapdtest.py | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 25b3b22..5206957 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -392,17 +392,19 @@ def _test_config(self):
         self._log.debug('testing config %s', self._slapd_conf)
         popen_list = [
             self.PATH_SLAPD,
-            '-Ttest',
+            "-Ttest",
             "-f", self._slapd_conf,
-            '-u',
+            "-u",
+            "-v",
+            "-d", "config"
         ]
-        if self._log.isEnabledFor(logging.DEBUG):
-            popen_list.append('-v')
-            popen_list.extend(['-d', 'config'])
-        else:
-            popen_list.append('-Q')
-        proc = subprocess.Popen(popen_list)
-        if proc.wait() != 0:
+        p = subprocess.run(
+            popen_list,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT
+        )
+        if p.returncode != 0:
+            self._log.error(p.stdout.decode("utf-8"))
             raise RuntimeError("configuration test failed")
         self._log.info("config ok: %s", self._slapd_conf)
 

From 5740c5f7bf47f2c4134857e61e8dc0d3b02dd69c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi@yaal.fr>
Date: Tue, 1 Sep 2020 14:27:28 +0200
Subject: [PATCH 855/868] Tox can pass positional arguments to test runners

---
 tox.ini | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tox.ini b/tox.ini
index e33de28..65773a2 100644
--- a/tox.ini
+++ b/tox.ini
@@ -14,7 +14,7 @@ passenv = WITH_GCOV
 # - Enable BytesWarning
 # - Turn all warnings into exceptions.
 commands = {envpython} -bb -Werror \
-    -m unittest discover -v -s Tests -p 't_*'
+    -m unittest discover -v -s Tests -p 't_*' {posargs}
 
 [testenv:py3-nosasltls]
 basepython = python3
@@ -52,7 +52,7 @@ passenv = {[testenv]passenv}
 setenv =
     CI_DISABLED=INIT_FD
 commands =
-    {envpython} -m unittest -v \
+    {envpython} -m unittest -v {posargs} \
         Tests/t_cidict.py \
         Tests/t_ldap_dn.py \
         Tests/t_ldap_filter.py \
@@ -66,7 +66,7 @@ commands =
 [testenv:pypy3]
 basepython = pypy3
 deps = pytest
-commands = {envpython} -m pytest
+commands = {envpython} -m pytest {posargs}
 
 [testenv:doc]
 basepython = python3

From e54b9f64e74883c4cf5816bead3fbc8a0936b1f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi@yaal.fr>
Date: Tue, 1 Sep 2020 13:14:45 +0200
Subject: [PATCH 856/868] pytest-ldap documentation link

---
 Doc/reference/slapdtest.rst | 4 ++++
 Doc/spelling_wordlist.txt   | 1 +
 2 files changed, 5 insertions(+)

diff --git a/Doc/reference/slapdtest.rst b/Doc/reference/slapdtest.rst
index bd54bb6..9274d00 100644
--- a/Doc/reference/slapdtest.rst
+++ b/Doc/reference/slapdtest.rst
@@ -14,6 +14,8 @@ This module is pure Python and does not rely on any non-standard modules.
 Therefore it can be used stand-alone without the rest of the python-ldap
 package.
 
+For pytest fixtures, check `pytest-ldap`_.
+
 Functions
 ^^^^^^^^^
 
@@ -26,3 +28,5 @@ Classes
 
 .. autoclass:: slapdtest.SlapdTestCase
    :members:
+
+.. _pytest-ldap: https://pypi.org/project/pytest-ldap/
diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index fb4a990..b0e9fc9 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -105,6 +105,7 @@ previousDN
 processResultsCount
 Proxied
 py
+pytest
 rdn
 readthedocs
 reentrant

From ca684f882aae7845a128b6d215df5400e58a2cc3 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Wed, 30 Sep 2020 15:51:16 +0200
Subject: [PATCH 857/868] Update Doc/reference/slapdtest.rst

---
 Doc/reference/slapdtest.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Doc/reference/slapdtest.rst b/Doc/reference/slapdtest.rst
index 9274d00..7517e66 100644
--- a/Doc/reference/slapdtest.rst
+++ b/Doc/reference/slapdtest.rst
@@ -14,7 +14,7 @@ This module is pure Python and does not rely on any non-standard modules.
 Therefore it can be used stand-alone without the rest of the python-ldap
 package.
 
-For pytest fixtures, check `pytest-ldap`_.
+Test fixtures for the popular `pytest` framework are developed in an external project, `pytest-ldap`_.
 
 Functions
 ^^^^^^^^^

From 7dc1e62592a0ff179d14633d474607a0eddfe88d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi@yaal.fr>
Date: Thu, 29 Oct 2020 10:54:40 +0100
Subject: [PATCH 858/868] SlapdObject directory based configuration method, and
 slapadd implementation (#382)

https://github.com/python-ldap/python-ldap/pull/382
---
 Doc/spelling_wordlist.txt   |   2 +
 Lib/slapdtest/_slapdtest.py | 132 +++++++++++++++++++-----------------
 Tests/t_ldap_syncrepl.py    |  59 ++++++++++------
 Tests/t_ldapobject.py       |  48 +++++++++++++
 4 files changed, 156 insertions(+), 85 deletions(-)

diff --git a/Doc/spelling_wordlist.txt b/Doc/spelling_wordlist.txt
index b0e9fc9..c24ab48 100644
--- a/Doc/spelling_wordlist.txt
+++ b/Doc/spelling_wordlist.txt
@@ -129,8 +129,10 @@ serverctrls
 sessionSourceIp
 sessionSourceName
 sessionTrackingIdentifier
+slapadd
 sizelimit
 slapd
+startup
 stderr
 stdout
 str
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 5206957..6784cf1 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -23,34 +23,33 @@
 
 HERE = os.path.abspath(os.path.dirname(__file__))
 
-# a template string for generating simple slapd.conf file
-SLAPD_CONF_TEMPLATE = r"""
-serverID %(serverid)s
-moduleload back_%(database)s
-%(include_directives)s
-loglevel %(loglevel)s
-allow bind_v2
-
-authz-regexp
-  "gidnumber=%(root_gid)s\\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth"
-  "%(rootdn)s"
-
-database %(database)s
-directory "%(directory)s"
-suffix "%(suffix)s"
-rootdn "%(rootdn)s"
-rootpw "%(rootpw)s"
-
-TLSCACertificateFile "%(cafile)s"
-TLSCertificateFile "%(servercert)s"
-TLSCertificateKeyFile "%(serverkey)s"
-# ignore missing client cert but fail with invalid client cert
-TLSVerifyClient try
-
-authz-regexp
-    "C=DE, O=python-ldap, OU=slapd-test, CN=([A-Za-z]+)"
-    "ldap://ou=people,dc=local???($1)"
-
+# a template string for generating simple slapd.d file
+SLAPD_CONF_TEMPLATE = r"""dn: cn=config
+objectClass: olcGlobal
+cn: config
+olcServerID: %(serverid)s
+olcLogLevel: %(loglevel)s
+olcAllows: bind_v2
+olcAuthzRegexp: {0}"gidnumber=%(root_gid)s\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth" "%(rootdn)s"
+olcAuthzRegexp: {1}"C=DE, O=python-ldap, OU=slapd-test, CN=([A-Za-z]+)" "ldap://ou=people,dc=local???($1)"
+olcTLSCACertificateFile: %(cafile)s
+olcTLSCertificateFile: %(servercert)s
+olcTLSCertificateKeyFile: %(serverkey)s
+olcTLSVerifyClient: try
+
+dn: cn=module,cn=config
+objectClass: olcModuleList
+cn: module
+olcModuleLoad: back_%(database)s
+
+dn: olcDatabase=%(database)s,cn=config
+objectClass: olcDatabaseConfig
+objectClass: olcMdbConfig
+olcDatabase: %(database)s
+olcSuffix: %(suffix)s
+olcRootDN: %(rootdn)s
+olcRootPW: %(rootpw)s
+olcDbDirectory: %(directory)s
 """
 
 LOCALHOST = '127.0.0.1'
@@ -175,6 +174,9 @@ class SlapdObject(object):
     manager, the slapd server is shut down and the temporary data store is
     removed.
 
+    :param openldap_schema_files: A list of schema names or schema paths to
+        load at startup. By default this only contains `core`.
+
     .. versionchanged:: 3.1
 
         Added context manager functionality
@@ -187,10 +189,10 @@ class SlapdObject(object):
     slapd_loglevel = 'stats stats2'
     local_host = LOCALHOST
     testrunsubdirs = (
-        'schema',
+        'slapd.d',
     )
     openldap_schema_files = (
-        'core.schema',
+        'core.ldif',
     )
 
     TMPDIR = os.environ.get('TMP', os.getcwd())
@@ -217,8 +219,7 @@ def __init__(self):
         self._port = self._avail_tcp_port()
         self.server_id = self._port % 4096
         self.testrundir = os.path.join(self.TMPDIR, 'python-ldap-test-%d' % self._port)
-        self._schema_prefix = os.path.join(self.testrundir, 'schema')
-        self._slapd_conf = os.path.join(self.testrundir, 'slapd.conf')
+        self._slapd_conf = os.path.join(self.testrundir, 'slapd.d')
         self._db_directory = os.path.join(self.testrundir, "openldap-data")
         self.ldap_uri = "ldap://%s:%d/" % (self.local_host, self._port)
         if HAVE_LDAPI:
@@ -262,6 +263,7 @@ def _find_commands(self):
         self.PATH_LDAPDELETE = self._find_command('ldapdelete')
         self.PATH_LDAPMODIFY = self._find_command('ldapmodify')
         self.PATH_LDAPWHOAMI = self._find_command('ldapwhoami')
+        self.PATH_SLAPADD = self._find_command('slapadd')
 
         self.PATH_SLAPD = os.environ.get('SLAPD', None)
         if not self.PATH_SLAPD:
@@ -292,7 +294,6 @@ def setup_rundir(self):
         os.mkdir(self.testrundir)
         os.mkdir(self._db_directory)
         self._create_sub_dirs(self.testrunsubdirs)
-        self._ln_schema_files(self.openldap_schema_files, self.SCHEMADIR)
 
     def _cleanup_rundir(self):
         """
@@ -337,17 +338,8 @@ def gen_config(self):
         for generating specific static configuration files you have to
         override this method
         """
-        include_directives = '\n'.join(
-            'include "{schema_prefix}/{schema_file}"'.format(
-                schema_prefix=self._schema_prefix,
-                schema_file=schema_file,
-            )
-            for schema_file in self.openldap_schema_files
-        )
         config_dict = {
             'serverid': hex(self.server_id),
-            'schema_prefix':self._schema_prefix,
-            'include_directives': include_directives,
             'loglevel': self.slapd_loglevel,
             'database': self.database,
             'directory': self._db_directory,
@@ -371,29 +363,28 @@ def _create_sub_dirs(self, dir_names):
             self._log.debug('Create directory %s', dir_name)
             os.mkdir(dir_name)
 
-    def _ln_schema_files(self, file_names, source_dir):
-        """
-        write symbolic links to original schema files
-        """
-        for fname in file_names:
-            ln_source = os.path.join(source_dir, fname)
-            ln_target = os.path.join(self._schema_prefix, fname)
-            self._log.debug('Create symlink %s -> %s', ln_source, ln_target)
-            os.symlink(ln_source, ln_target)
-
     def _write_config(self):
-        """Writes the slapd.conf file out, and returns the path to it."""
-        self._log.debug('Writing config to %s', self._slapd_conf)
-        with open(self._slapd_conf, 'w') as config_file:
-            config_file.write(self.gen_config())
-        self._log.info('Wrote config to %s', self._slapd_conf)
+        """Loads the slapd.d configuration."""
+        self._log.debug("importing configuration: %s", self._slapd_conf)
+
+        self.slapadd(self.gen_config(), ["-n0"])
+        ldif_paths = [
+            schema
+            if os.path.exists(schema)
+            else os.path.join(self.SCHEMADIR, schema)
+            for schema in self.openldap_schema_files
+        ]
+        for ldif_path in ldif_paths:
+            self.slapadd(None, ["-n0", "-l", ldif_path])
+
+        self._log.debug("import ok: %s", self._slapd_conf)
 
     def _test_config(self):
         self._log.debug('testing config %s', self._slapd_conf)
         popen_list = [
             self.PATH_SLAPD,
             "-Ttest",
-            "-f", self._slapd_conf,
+            "-F", self._slapd_conf,
             "-u",
             "-v",
             "-d", "config"
@@ -417,8 +408,7 @@ def _start_slapd(self):
             urls.append(self.ldapi_uri)
         slapd_args = [
             self.PATH_SLAPD,
-            '-f', self._slapd_conf,
-            '-F', self.testrundir,
+            '-F', self._slapd_conf,
             '-h', ' '.join(urls),
         ]
         if self._log.isEnabledFor(logging.DEBUG):
@@ -523,10 +513,14 @@ def _cli_popen(self, ldapcommand, extra_args=None, ldap_uri=None,
                    stdin_data=None):  # pragma: no cover
         if ldap_uri is None:
             ldap_uri = self.default_ldap_uri
-        args = [
-            ldapcommand,
-            '-H', ldap_uri,
-        ] + self._cli_auth_args() + (extra_args or [])
+
+        if ldapcommand.split("/")[-1].startswith("ldap"):
+            args = [ldapcommand, '-H', ldap_uri] + self._cli_auth_args()
+        else:
+            args = [ldapcommand, '-F', self._slapd_conf]
+
+        args += (extra_args or [])
+
         self._log.debug('Run command: %r', ' '.join(args))
         proc = subprocess.Popen(
             args, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
@@ -577,6 +571,16 @@ def ldapdelete(self, dn, recursive=False, extra_args=None):
         extra_args.append(dn)
         self._cli_popen(self.PATH_LDAPDELETE, extra_args=extra_args)
 
+    def slapadd(self, ldif, extra_args=None):
+        """
+        Runs slapadd on this slapd instance, passing it the ldif content
+        """
+        self._cli_popen(
+            self.PATH_SLAPADD,
+            stdin_data=ldif.encode("utf-8") if ldif else None,
+            extra_args=extra_args,
+        )
+
     def __enter__(self):
         self.start()
         return self
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 7ec9707..5110414 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -19,27 +19,44 @@
 from slapdtest import SlapdObject, SlapdTestCase
 
 # a template string for generating simple slapd.conf file
-SLAPD_CONF_PROVIDER_TEMPLATE = r"""
-serverID %(serverid)s
-moduleload back_%(database)s
-moduleload syncprov
-include "%(schema_prefix)s/core.schema"
-loglevel %(loglevel)s
-allow bind_v2
-
-authz-regexp
-  "gidnumber=%(root_gid)s\\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth"
-  "%(rootdn)s"
-
-database %(database)s
-directory "%(directory)s"
-suffix "%(suffix)s"
-rootdn "%(rootdn)s"
-rootpw "%(rootpw)s"
-overlay syncprov
-syncprov-checkpoint 100 10
-syncprov-sessionlog 100
-index objectclass,entryCSN,entryUUID eq
+SLAPD_CONF_PROVIDER_TEMPLATE = r"""dn: cn=config
+objectClass: olcGlobal
+cn: config
+olcServerID: %(serverid)s
+olcLogLevel: %(loglevel)s
+olcAllows: bind_v2
+olcAuthzRegexp: {0}"gidnumber=%(root_gid)s\+uidnumber=%(root_uid)s,cn=peercred,cn=external,cn=auth" "%(rootdn)s"
+olcAuthzRegexp: {1}"C=DE, O=python-ldap, OU=slapd-test, CN=([A-Za-z]+)" "ldap://ou=people,dc=local???($1)"
+olcTLSCACertificateFile: %(cafile)s
+olcTLSCertificateFile: %(servercert)s
+olcTLSCertificateKeyFile: %(serverkey)s
+olcTLSVerifyClient: try
+
+dn: cn=module,cn=config
+objectClass: olcModuleList
+cn: module
+olcModuleLoad: back_%(database)s
+olcModuleLoad: syncprov
+
+dn: olcDatabase=%(database)s,cn=config
+objectClass: olcDatabaseConfig
+objectClass: olcMdbConfig
+olcDatabase: %(database)s
+olcSuffix: %(suffix)s
+olcRootDN: %(rootdn)s
+olcRootPW: %(rootpw)s
+olcDbDirectory: %(directory)s
+olcDbIndex: objectclass,entryCSN,entryUUID eq
+
+dn: olcOverlay=syncprov,olcDatabase={1}%(database)s,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcSyncProvConfig
+olcOverlay: syncprov
+olcSpCheckpoint: 100 10
+olcSpSessionlog: 100
+"""
+
+OTHER_CONF = r"""
 """
 
 # Define initial data load, both as an LDIF and as a dictionary.
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index da937a3..6d44ff1 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -62,6 +62,25 @@
 
 """
 
+SCHEMA_TEMPLATE = """dn: cn=mySchema,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: mySchema
+olcAttributeTypes: ( 1.3.6.1.4.1.56207.1.1.1 NAME 'myAttribute'
+    DESC 'fobar attribute'
+    EQUALITY caseExactMatch
+    ORDERING caseExactOrderingMatch
+    SUBSTR caseExactSubstringsMatch
+    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+    SINGLE-VALUE
+    USAGE userApplications
+    X-ORIGIN 'foobar' )
+olcObjectClasses: ( 1.3.6.1.4.1.56207.1.2.2 NAME 'myClass'
+    DESC 'foobar objectclass'
+    SUP top
+    STRUCTURAL
+    MUST myAttribute
+    X-ORIGIN 'foobar' )"""
+
 
 class Test00_SimpleLDAPObject(SlapdTestCase):
     """
@@ -94,6 +113,14 @@ def setUp(self):
     def tearDown(self):
         del self._ldap_conn
 
+    def reset_connection(self):
+        try:
+            del self._ldap_conn
+        except AttributeError:
+            pass
+
+        self._ldap_conn = self._open_ldap_conn(bytes_mode=False)
+
     def test_reject_bytes_base(self):
         base = self.server.suffix
         l = self._ldap_conn
@@ -465,6 +492,22 @@ def test_passwd_s(self):
 
         l.delete_s(dn)
 
+    def test_slapadd(self):
+        with self.assertRaises(ldap.INVALID_DN_SYNTAX):
+            self._ldap_conn.add_s("myAttribute=foobar,ou=Container,%s" % self.server.suffix, [
+                ("objectClass", b'myClass'),
+                ("myAttribute", b'foobar'),
+            ])
+
+        self.server.slapadd(SCHEMA_TEMPLATE, ["-n0"])
+        self.server.restart()
+        self.reset_connection()
+
+        self._ldap_conn.add_s("myAttribute=foobar,ou=Container,%s" % self.server.suffix, [
+            ("objectClass", b'myClass'),
+            ("myAttribute", b'foobar'),
+        ])
+
 
 class Test01_ReconnectLDAPObject(Test00_SimpleLDAPObject):
     """
@@ -561,6 +604,11 @@ def tearDown(self):
         del self._sock
         super(Test03_SimpleLDAPObjectWithFileno, self).tearDown()
 
+    def reset_connection(self):
+        self._sock.close()
+        del self._sock
+        super(Test03_SimpleLDAPObjectWithFileno, self).reset_connection()
+
 
 if __name__ == '__main__':
     unittest.main()

From 3ea12d65d70678a3cca479383dd2f65b01f3b973 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sun, 1 Nov 2020 11:33:14 -0800
Subject: [PATCH 859/868] Fix CI failure on docs

Use backticks around setup.cfg as it is a filename.

This resolves a failure that occurs in sphinxcontrib.spelling due to
trying to import setup.cfg.
---
 Doc/installing.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Doc/installing.rst b/Doc/installing.rst
index 514cf99..5677822 100644
--- a/Doc/installing.rst
+++ b/Doc/installing.rst
@@ -168,10 +168,10 @@ Packages for building and testing::
    newer are required.
 
 
-setup.cfg
-=========
+``setup.cfg``
+=============
 
-The file setup.cfg allows to set some build and installation parameters for
+The file ``setup.cfg`` allows to set some build and installation parameters for
 reflecting the local installation of required software packages. Only section
 ``[_ldap]`` is described here. More information about other sections can be
 found in :ref:`Setuptools documentation <distributing-index>`.

From 4fc9038290d874cc1da6b611159c634a000aa1fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi.rivard@aquilenet.fr>
Date: Fri, 13 Nov 2020 21:45:03 +0100
Subject: [PATCH 860/868] slapdtest: Rework waiting for SlapdObject startup

This gives a chance to SlapdObject to start faster.
Notably it does not start by sleeping 1.5s anymore.

https://github.com/python-ldap/python-ldap/pull/390
---
 Lib/slapdtest/_slapdtest.py | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 6784cf1..141f459 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -208,9 +208,6 @@ class SlapdObject(object):
     BIN_PATH = os.environ.get('BIN', os.environ.get('PATH', os.defpath))
     SBIN_PATH = os.environ.get('SBIN', _add_sbin(BIN_PATH))
 
-    # time in secs to wait before trying to access slapd via LDAP (again)
-    _start_sleep = 1.5
-
     # create loggers once, multiple calls mess up refleak tests
     _log = combined_logger('python-ldap-test')
 
@@ -418,20 +415,22 @@ def _start_slapd(self):
         self._log.info('starting slapd: %r', ' '.join(slapd_args))
         self._proc = subprocess.Popen(slapd_args)
         # Waits until the LDAP server socket is open, or slapd crashed
+        deadline = time.monotonic() + 10
         # no cover to avoid spurious coverage changes, see
         # https://github.com/python-ldap/python-ldap/issues/127
-        for _ in range(10):  # pragma: no cover
+        while True:  # pragma: no cover
             if self._proc.poll() is not None:
                 self._stopped()
                 raise RuntimeError("slapd exited before opening port")
-            time.sleep(self._start_sleep)
             try:
                 self._log.debug(
                     "slapd connection check to %s", self.default_ldap_uri
                 )
                 self.ldapwhoami()
             except RuntimeError:
-                pass
+                if time.monotonic() >= deadline:
+                    break
+                time.sleep(0.2)
             else:
                 return
         raise RuntimeError("slapd did not start properly")

From 3484d574d9c9daa6fdda1d4b0e0a949021b48564 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi.rivard@aquilenet.fr>
Date: Fri, 13 Nov 2020 21:54:44 +0100
Subject: [PATCH 861/868] Remove Python 2 syntax (#383)

https://github.com/python-ldap/python-ldap/pull/383
---
 .gitignore                        |  3 ++
 Demo/Lib/ldap/async/deltree.py    |  2 --
 Demo/Lib/ldapurl/urlsearch.py     |  1 -
 Demo/initialize.py                |  1 -
 Demo/ldapcontrols.py              |  1 -
 Demo/ldapurl_search.py            |  2 --
 Demo/matchedvalues.py             |  3 +-
 Demo/options.py                   |  2 --
 Demo/page_control.py              |  3 --
 Demo/paged_search_ext_s.py        |  1 -
 Demo/passwd_ext_op.py             |  1 -
 Demo/pyasn1/dds.py                |  2 --
 Demo/pyasn1/derefcontrol.py       |  1 -
 Demo/pyasn1/noopsearch.py         |  2 --
 Demo/pyasn1/ppolicy.py            |  2 --
 Demo/pyasn1/psearch.py            |  2 --
 Demo/pyasn1/readentrycontrol.py   |  1 -
 Demo/pyasn1/sessiontrack.py       |  2 --
 Demo/pyasn1/syncrepl.py           |  2 --
 Demo/rename.py                    |  1 -
 Demo/resiter.py                   |  1 -
 Demo/sasl_bind.py                 |  1 -
 Demo/schema.py                    |  1 -
 Demo/schema_tree.py               |  7 ++--
 Demo/simple.py                    |  3 +-
 Demo/simplebrowse.py              |  1 -
 Doc/conf.py                       |  1 -
 Lib/ldap/__init__.py              |  6 ++--
 Lib/ldap/asyncsearch.py           |  2 +-
 Lib/ldap/constants.py             | 11 +++----
 Lib/ldap/controls/__init__.py     |  3 +-
 Lib/ldap/controls/deref.py        |  1 -
 Lib/ldap/controls/libldap.py      |  3 +-
 Lib/ldap/controls/openldap.py     |  1 -
 Lib/ldap/controls/pagedresults.py |  1 -
 Lib/ldap/controls/ppolicy.py      |  1 -
 Lib/ldap/controls/psearch.py      |  1 -
 Lib/ldap/controls/pwdpolicy.py    |  1 -
 Lib/ldap/controls/readentry.py    |  1 -
 Lib/ldap/controls/sessiontrack.py |  1 -
 Lib/ldap/controls/simple.py       |  1 -
 Lib/ldap/controls/sss.py          |  1 -
 Lib/ldap/controls/vlv.py          |  1 -
 Lib/ldap/dn.py                    |  2 +-
 Lib/ldap/extop/__init__.py        |  4 +--
 Lib/ldap/extop/dds.py             |  1 -
 Lib/ldap/extop/passwd.py          |  1 -
 Lib/ldap/filter.py                |  2 +-
 Lib/ldap/functions.py             |  2 +-
 Lib/ldap/ldapobject.py            | 28 ++++++++--------
 Lib/ldap/logger.py                |  3 +-
 Lib/ldap/pkginfo.py               |  3 +-
 Lib/ldap/schema/models.py         | 24 +++++++-------
 Lib/ldap/schema/subentry.py       |  8 ++---
 Lib/ldap/syncrepl.py              |  1 -
 Lib/ldapurl.py                    | 22 ++++++-------
 Lib/slapdtest/__init__.py         |  1 -
 Lib/slapdtest/_slapdtest.py       |  3 +-
 Tests/__init__.py                 |  2 --
 Tests/t_cext.py                   |  9 +++--
 Tests/t_cidict.py                 |  1 -
 Tests/t_edit.py                   |  2 +-
 Tests/t_ldap_dn.py                |  1 -
 Tests/t_ldap_filter.py            |  1 -
 Tests/t_ldap_functions.py         |  1 -
 Tests/t_ldap_modlist.py           |  5 ++-
 Tests/t_ldap_options.py           |  4 +--
 Tests/t_ldap_sasl.py              |  7 ++--
 Tests/t_ldap_schema_subentry.py   |  1 -
 Tests/t_ldap_schema_tokenizer.py  |  1 -
 Tests/t_ldap_syncrepl.py          | 11 +++----
 Tests/t_ldapobject.py             | 55 +++++++++++++++----------------
 Tests/t_ldapurl.py                |  5 ++-
 Tests/t_ldif.py                   |  1 -
 74 files changed, 114 insertions(+), 184 deletions(-)

diff --git a/.gitignore b/.gitignore
index 5f6d042..bab2187 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,6 @@ PKG-INFO
 
 # generated in the sample workflow
 /__venv__/
+
+# test dirs
+python-ldap-test-*
diff --git a/Demo/Lib/ldap/async/deltree.py b/Demo/Lib/ldap/async/deltree.py
index d3fc620..9db52c8 100644
--- a/Demo/Lib/ldap/async/deltree.py
+++ b/Demo/Lib/ldap/async/deltree.py
@@ -1,5 +1,3 @@
-from __future__ import print_function
-
 import ldap,ldap.async
 
 class DeleteLeafs(ldap.async.AsyncSearchHandler):
diff --git a/Demo/Lib/ldapurl/urlsearch.py b/Demo/Lib/ldapurl/urlsearch.py
index b293aa2..c58a195 100644
--- a/Demo/Lib/ldapurl/urlsearch.py
+++ b/Demo/Lib/ldapurl/urlsearch.py
@@ -3,7 +3,6 @@
 
 No output of LDAP data is produced except trace output.
 """
-from __future__ import print_function
 import sys,getpass,ldap,ldapurl
 
 try:
diff --git a/Demo/initialize.py b/Demo/initialize.py
index 952b3f4..ab78cdb 100644
--- a/Demo/initialize.py
+++ b/Demo/initialize.py
@@ -7,7 +7,6 @@
 ldaps://localhost:1391 (LDAP over SSL)
 ldapi://%2ftmp%2fopenldap2 (domain socket /tmp/openldap2)
 """
-from __future__ import print_function
 
 import sys,os,ldap
 
diff --git a/Demo/ldapcontrols.py b/Demo/ldapcontrols.py
index a5ba8d3..eec86b4 100644
--- a/Demo/ldapcontrols.py
+++ b/Demo/ldapcontrols.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 import ldap,ldapurl,pprint
 
 from ldap.controls import LDAPControl,BooleanControl
diff --git a/Demo/ldapurl_search.py b/Demo/ldapurl_search.py
index 07ffbca..614ba1a 100644
--- a/Demo/ldapurl_search.py
+++ b/Demo/ldapurl_search.py
@@ -1,5 +1,3 @@
-from __future__ import print_function
-
 import sys,pprint,ldap
 
 from ldap.ldapobject import LDAPObject
diff --git a/Demo/matchedvalues.py b/Demo/matchedvalues.py
index 7a6e7b6..bbc2a1b 100644
--- a/Demo/matchedvalues.py
+++ b/Demo/matchedvalues.py
@@ -27,7 +27,6 @@
 # Matched values control: (mail=*@example.org)
 # dn: uid=jsmith,ou=People,dc=example,dc=com
 # mail: jsmith@example.org
-from __future__ import print_function
 
 import ldap
 from ldap.controls import MatchedValuesControl
@@ -37,7 +36,7 @@ def print_result(search_result):
         print("dn: %s" % search_result[n][0])
         for attr in search_result[n][1].keys():
             for i in range(len(search_result[n][1][attr])):
-                print("%s: %s" % (attr, search_result[n][1][attr][i]))
+                print("{}: {}".format(attr, search_result[n][1][attr][i]))
         print
 
 
diff --git a/Demo/options.py b/Demo/options.py
index 28a0437..7a8ee9d 100644
--- a/Demo/options.py
+++ b/Demo/options.py
@@ -1,5 +1,3 @@
-from __future__ import print_function
-
 import ldap
 
 host="localhost:1390"
diff --git a/Demo/page_control.py b/Demo/page_control.py
index 8238ede..b92cbf8 100644
--- a/Demo/page_control.py
+++ b/Demo/page_control.py
@@ -1,6 +1,3 @@
-# -*- coding: utf-8 -*-
-from __future__ import print_function
-
 url = "ldap://localhost:1390"
 base = "dc=stroeder,dc=de"
 search_flt = r'(objectClass=*)'
diff --git a/Demo/paged_search_ext_s.py b/Demo/paged_search_ext_s.py
index d0f8291..3a1a4ac 100644
--- a/Demo/paged_search_ext_s.py
+++ b/Demo/paged_search_ext_s.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 url = "ldap://localhost:1390/"
 base = "dc=stroeder,dc=de"
 search_flt = r'(objectClass=*)'
diff --git a/Demo/passwd_ext_op.py b/Demo/passwd_ext_op.py
index cc5d22c..6c69548 100644
--- a/Demo/passwd_ext_op.py
+++ b/Demo/passwd_ext_op.py
@@ -1,7 +1,6 @@
 """
 Example showing the use of the password extended operation.
 """
-from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
diff --git a/Demo/pyasn1/dds.py b/Demo/pyasn1/dds.py
index c803a1d..1927060 100644
--- a/Demo/pyasn1/dds.py
+++ b/Demo/pyasn1/dds.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Demo script for Dynamic Entries (see RFC 2589)
 
@@ -8,7 +7,6 @@
 pyasn1-modules
 python-ldap 2.4+
 """
-from __future__ import print_function
 
 from ldap.extop.dds import RefreshRequest,RefreshResponse
 
diff --git a/Demo/pyasn1/derefcontrol.py b/Demo/pyasn1/derefcontrol.py
index 0e7153d..9565a9e 100644
--- a/Demo/pyasn1/derefcontrol.py
+++ b/Demo/pyasn1/derefcontrol.py
@@ -3,7 +3,6 @@
 This sample script demonstrates the use of the dereference control
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
 """
-from __future__ import print_function
 
 import pprint,ldap,ldap.modlist,ldap.resiter
 
diff --git a/Demo/pyasn1/noopsearch.py b/Demo/pyasn1/noopsearch.py
index 2045f50..a239c0e 100644
--- a/Demo/pyasn1/noopsearch.py
+++ b/Demo/pyasn1/noopsearch.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Demo script for counting searching with OpenLDAP's no-op control
 
@@ -9,7 +8,6 @@
 pyasn1-modules
 python-ldap 2.4+
 """
-from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
diff --git a/Demo/pyasn1/ppolicy.py b/Demo/pyasn1/ppolicy.py
index cf6b2ac..c143bf1 100644
--- a/Demo/pyasn1/ppolicy.py
+++ b/Demo/pyasn1/ppolicy.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Demo script for Password Policy Controls
 (see https://tools.ietf.org/html/draft-behera-ldap-password-policy)
@@ -9,7 +8,6 @@
 pyasn1-modules
 python-ldap 2.4+
 """
-from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
diff --git a/Demo/pyasn1/psearch.py b/Demo/pyasn1/psearch.py
index 3bd59e6..2703a25 100644
--- a/Demo/pyasn1/psearch.py
+++ b/Demo/pyasn1/psearch.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Demo script for Persistent Search Control
 (see https://tools.ietf.org/html/draft-ietf-ldapext-psearch)
@@ -10,7 +9,6 @@
 pyasn1-modules
 python-ldap 2.4+
 """
-from __future__ import print_function
 
 import sys,ldap,ldapurl,getpass
 
diff --git a/Demo/pyasn1/readentrycontrol.py b/Demo/pyasn1/readentrycontrol.py
index a857be2..b3ea6e8 100644
--- a/Demo/pyasn1/readentrycontrol.py
+++ b/Demo/pyasn1/readentrycontrol.py
@@ -4,7 +4,6 @@
 
 Originally contributed by Andreas Hasenack <ahasenack@terra.com.br>
 """
-from __future__ import print_function
 
 import pprint,ldap,ldap.modlist
 
diff --git a/Demo/pyasn1/sessiontrack.py b/Demo/pyasn1/sessiontrack.py
index 58a34e8..491172c 100644
--- a/Demo/pyasn1/sessiontrack.py
+++ b/Demo/pyasn1/sessiontrack.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python
-# -*- coding: utf-8 -*-
 """
 demo_track_ldap_session.py
 
@@ -8,7 +7,6 @@
 https://tools.ietf.org/html/draft-wahl-ldap-session-03
 """
 
-from __future__ import print_function
 
 __version__ = '0.1'
 
diff --git a/Demo/pyasn1/syncrepl.py b/Demo/pyasn1/syncrepl.py
index 7103bc6..f1f24e1 100644
--- a/Demo/pyasn1/syncrepl.py
+++ b/Demo/pyasn1/syncrepl.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python
-# -*- coding: utf-8 -*-
 """
 This script implements a syncrepl consumer which syncs data from an OpenLDAP
 server to a local (shelve) database.
@@ -8,7 +7,6 @@
 
 The bound user needs read access to the attributes entryDN and entryCSN.
 """
-from __future__ import print_function
 
 # Import modules from Python standard lib
 import logging
diff --git a/Demo/rename.py b/Demo/rename.py
index 91d7528..edb78a8 100644
--- a/Demo/rename.py
+++ b/Demo/rename.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 import ldap
 from getpass import getpass
 
diff --git a/Demo/resiter.py b/Demo/resiter.py
index 96e9c90..9fc14e4 100644
--- a/Demo/resiter.py
+++ b/Demo/resiter.py
@@ -4,7 +4,6 @@
 
 See https://www.python-ldap.org for details.
 """
-from __future__ import print_function
 
 import ldap,ldap.resiter
 
diff --git a/Demo/sasl_bind.py b/Demo/sasl_bind.py
index 667221c..8453d08 100644
--- a/Demo/sasl_bind.py
+++ b/Demo/sasl_bind.py
@@ -1,6 +1,5 @@
 # For documentation, see comments in Module/LDAPObject.c and the
 # ldap.sasl module documentation.
-from __future__ import print_function
 
 import ldap,ldap.sasl
 
diff --git a/Demo/schema.py b/Demo/schema.py
index 03f90a8..bdad5e0 100644
--- a/Demo/schema.py
+++ b/Demo/schema.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 import sys,ldap,ldap.schema
 
 schema_attrs = ldap.schema.SCHEMA_ATTRS
diff --git a/Demo/schema_tree.py b/Demo/schema_tree.py
index bda5f64..2b182e9 100644
--- a/Demo/schema_tree.py
+++ b/Demo/schema_tree.py
@@ -4,7 +4,6 @@
 
 Usage: schema_oc_tree.py [--html] [LDAP URL]
 """
-from __future__ import print_function
 
 import sys,getopt,ldap,ldap.schema
 
@@ -28,10 +27,10 @@ def HTMLSchemaTree(schema,se_class,se_tree,se_oid,level):
   se_obj = schema.get_obj(se_class,se_oid)
   if se_obj!=None:
     print("""
-    <dt><strong>%s (%s)</strong></dt>
+    <dt><strong>{} ({})</strong></dt>
     <dd>
-      %s
-    """ % (', '.join(se_obj.names),se_obj.oid,se_obj.desc))
+      {}
+    """.format(', '.join(se_obj.names),se_obj.oid,se_obj.desc))
   if se_tree[se_oid]:
     print('<dl>')
     for sub_se_oid in se_tree[se_oid]:
diff --git a/Demo/simple.py b/Demo/simple.py
index 5fa0425..c82659c 100644
--- a/Demo/simple.py
+++ b/Demo/simple.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 import sys,getpass
 import ldap
 
@@ -86,7 +85,7 @@
 	("labeleduri",			["labeleduri"]),
 	("manager",			["cn=Jaga Indulska"]),
 	("reports",			["reports"]),
-	("jpegPhoto",			[open("/www/leonard/leonard.jpg","r").read()]),
+	("jpegPhoto",			[open("/www/leonard/leonard.jpg").read()]),
 	("uid",				["leonard"]),
 	("userPassword",		[""])
 
diff --git a/Demo/simplebrowse.py b/Demo/simplebrowse.py
index 9d13800..fd4563a 100644
--- a/Demo/simplebrowse.py
+++ b/Demo/simplebrowse.py
@@ -3,7 +3,6 @@
 #
 # simple LDAP server browsing example
 #
-from __future__ import print_function
 
 import ldap
 from traceback import print_exc
diff --git a/Doc/conf.py b/Doc/conf.py
index e1fb9ee..0fa396b 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 #
 # python-ldap documentation build configuration file, created by
 # sphinx-quickstart on Sat Mar 29 15:08:17 2008.
diff --git a/Lib/ldap/__init__.py b/Lib/ldap/__init__.py
index 8d67573..b179707 100644
--- a/Lib/ldap/__init__.py
+++ b/Lib/ldap/__init__.py
@@ -33,7 +33,7 @@
 
 import _ldap
 assert _ldap.__version__==__version__, \
-       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
+       ImportError(f'ldap {__version__} and _ldap {_ldap.__version__} version mismatch!')
 from _ldap import *
 # call into libldap to initialize it right now
 LIBLDAP_API_INFO = _ldap.get_option(_ldap.OPT_API_INFO)
@@ -83,14 +83,14 @@ def acquire(self):
     if __debug__:
       global _trace_level
       if _trace_level>=self._min_trace_level:
-        _trace_file.write('***%s.acquire() %s %s\n' % (self.__class__.__name__,repr(self),self._desc))
+        _trace_file.write('***{}.acquire() {} {}\n'.format(self.__class__.__name__,repr(self),self._desc))
     return self._lock.acquire()
 
   def release(self):
     if __debug__:
       global _trace_level
       if _trace_level>=self._min_trace_level:
-        _trace_file.write('***%s.release() %s %s\n' % (self.__class__.__name__,repr(self),self._desc))
+        _trace_file.write('***{}.release() {} {}\n'.format(self.__class__.__name__,repr(self),self._desc))
     return self._lock.release()
 
 
diff --git a/Lib/ldap/asyncsearch.py b/Lib/ldap/asyncsearch.py
index 6514dd0..6c6929d 100644
--- a/Lib/ldap/asyncsearch.py
+++ b/Lib/ldap/asyncsearch.py
@@ -30,7 +30,7 @@ def __init__(self,receivedResultType,expectedResultTypes):
     Exception.__init__(self)
 
   def __str__(self):
-    return 'Received wrong result type %s (expected one of %s).' % (
+    return 'Received wrong result type {} (expected one of {}).'.format(
       self.receivedResultType,
       ', '.join(self.expectedResultTypes),
     )
diff --git a/Lib/ldap/constants.py b/Lib/ldap/constants.py
index 5e178a1..b6ec0d3 100644
--- a/Lib/ldap/constants.py
+++ b/Lib/ldap/constants.py
@@ -13,16 +13,15 @@
 # This module cannot import anything from ldap.
 # When building documentation, it is used to initialize ldap.__init__.
 
-from __future__ import print_function
 
-class Constant(object):
+class Constant:
     """Base class for a definition of an OpenLDAP constant
     """
 
     def __init__(self, name, optional=False, requirements=(), doc=None):
         self.name = name
         if optional:
-            self_requirement = 'defined(LDAP_{})'.format(self.name)
+            self_requirement = f'defined(LDAP_{self.name})'
             requirements = list(requirements) + [self_requirement]
         self.requirements = requirements
         self.doc = self.__doc__ = doc
@@ -50,7 +49,7 @@ class TLSInt(Int):
     def __init__(self, *args, **kwargs):
         requrements = list(kwargs.get('requirements', ()))
         kwargs['requirements'] = ['HAVE_TLS'] + requrements
-        super(TLSInt, self).__init__(*args, **kwargs)
+        super().__init__(*args, **kwargs)
 
 
 class Feature(Constant):
@@ -70,7 +69,7 @@ class Feature(Constant):
 
 
     def __init__(self, name, c_feature, **kwargs):
-        super(Feature, self).__init__(name, **kwargs)
+        super().__init__(name, **kwargs)
         self.c_feature = c_feature
 
 
@@ -392,7 +391,7 @@ def pop_requirement():
             if requirement not in current_requirements:
                 current_requirements.append(requirement)
                 print()
-                print('#if {}'.format(requirement))
+                print(f'#if {requirement}')
 
         print(definition.c_template.format(self=definition))
 
diff --git a/Lib/ldap/controls/__init__.py b/Lib/ldap/controls/__init__.py
index 811b3be..7355716 100644
--- a/Lib/ldap/controls/__init__.py
+++ b/Lib/ldap/controls/__init__.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 controls.py - support classes for LDAP controls
 
@@ -13,7 +12,7 @@
 
 import _ldap
 assert _ldap.__version__==__version__, \
-       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
+       ImportError(f'ldap {__version__} and _ldap {_ldap.__version__} version mismatch!')
 
 import ldap
 
diff --git a/Lib/ldap/controls/deref.py b/Lib/ldap/controls/deref.py
index b9994eb..e5b2a7e 100644
--- a/Lib/ldap/controls/deref.py
+++ b/Lib/ldap/controls/deref.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.deref - classes for
 (see https://tools.ietf.org/html/draft-masarati-ldap-deref)
diff --git a/Lib/ldap/controls/libldap.py b/Lib/ldap/controls/libldap.py
index f6ea42c..9a10237 100644
--- a/Lib/ldap/controls/libldap.py
+++ b/Lib/ldap/controls/libldap.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 controls.libldap - LDAP controls wrapper classes with en-/decoding done
 by OpenLDAP functions
@@ -10,7 +9,7 @@
 
 import _ldap
 assert _ldap.__version__==__version__, \
-       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
+       ImportError(f'ldap {__version__} and _ldap {_ldap.__version__} version mismatch!')
 
 import ldap
 
diff --git a/Lib/ldap/controls/openldap.py b/Lib/ldap/controls/openldap.py
index 5da2dd3..24040ed 100644
--- a/Lib/ldap/controls/openldap.py
+++ b/Lib/ldap/controls/openldap.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.openldap - classes for OpenLDAP-specific controls
 
diff --git a/Lib/ldap/controls/pagedresults.py b/Lib/ldap/controls/pagedresults.py
index efdd040..12ca573 100644
--- a/Lib/ldap/controls/pagedresults.py
+++ b/Lib/ldap/controls/pagedresults.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.paged - classes for Simple Paged control
 (see RFC 2696)
diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index 67efe3a..ebc456a 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.ppolicy - classes for Password Policy controls
 (see https://tools.ietf.org/html/draft-behera-ldap-password-policy)
diff --git a/Lib/ldap/controls/psearch.py b/Lib/ldap/controls/psearch.py
index 002a88e..32900c8 100644
--- a/Lib/ldap/controls/psearch.py
+++ b/Lib/ldap/controls/psearch.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.psearch - classes for Persistent Search Control
 (see https://tools.ietf.org/html/draft-ietf-ldapext-psearch)
diff --git a/Lib/ldap/controls/pwdpolicy.py b/Lib/ldap/controls/pwdpolicy.py
index cf9c197..54f1a70 100644
--- a/Lib/ldap/controls/pwdpolicy.py
+++ b/Lib/ldap/controls/pwdpolicy.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.pwdpolicy - classes for Password Policy controls
 (see https://tools.ietf.org/html/draft-vchu-ldap-pwd-policy)
diff --git a/Lib/ldap/controls/readentry.py b/Lib/ldap/controls/readentry.py
index 57cefef..c5db424 100644
--- a/Lib/ldap/controls/readentry.py
+++ b/Lib/ldap/controls/readentry.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.readentry - classes for the Read Entry controls
 (see RFC 4527)
diff --git a/Lib/ldap/controls/sessiontrack.py b/Lib/ldap/controls/sessiontrack.py
index 9c8a057..a1fb8b3 100644
--- a/Lib/ldap/controls/sessiontrack.py
+++ b/Lib/ldap/controls/sessiontrack.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.sessiontrack - class for session tracking control
 (see draft-wahl-ldap-session)
diff --git a/Lib/ldap/controls/simple.py b/Lib/ldap/controls/simple.py
index d413034..05f6760 100644
--- a/Lib/ldap/controls/simple.py
+++ b/Lib/ldap/controls/simple.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.simple - classes for some very simple LDAP controls
 
diff --git a/Lib/ldap/controls/sss.py b/Lib/ldap/controls/sss.py
index 5001987..e6ee368 100644
--- a/Lib/ldap/controls/sss.py
+++ b/Lib/ldap/controls/sss.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.sss - classes for Server Side Sorting
 (see RFC 2891)
diff --git a/Lib/ldap/controls/vlv.py b/Lib/ldap/controls/vlv.py
index 9fea2f0..5fc7ce8 100644
--- a/Lib/ldap/controls/vlv.py
+++ b/Lib/ldap/controls/vlv.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.controls.vlv - classes for Virtual List View
 (see draft-ietf-ldapext-ldapv3-vlv)
diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py
index 886ff87..a9d9684 100644
--- a/Lib/ldap/dn.py
+++ b/Lib/ldap/dn.py
@@ -7,7 +7,7 @@
 
 import _ldap
 assert _ldap.__version__==__version__, \
-       ImportError('ldap %s and _ldap %s version mismatch!' % (__version__,_ldap.__version__))
+       ImportError(f'ldap {__version__} and _ldap {_ldap.__version__} version mismatch!')
 
 import ldap.functions
 
diff --git a/Lib/ldap/extop/__init__.py b/Lib/ldap/extop/__init__.py
index 39e653a..dc9aea2 100644
--- a/Lib/ldap/extop/__init__.py
+++ b/Lib/ldap/extop/__init__.py
@@ -28,7 +28,7 @@ def __init__(self,requestName,requestValue):
     self.requestValue = requestValue
 
   def __repr__(self):
-    return '%s(%s,%s)' % (self.__class__.__name__,self.requestName,self.requestValue)
+    return f'{self.__class__.__name__}({self.requestName},{self.requestValue})'
 
   def encodedRequestValue(self):
     """
@@ -53,7 +53,7 @@ def __init__(self,responseName,encodedResponseValue):
     self.responseValue = self.decodeResponseValue(encodedResponseValue)
 
   def __repr__(self):
-    return '%s(%s,%s)' % (self.__class__.__name__,self.responseName,self.responseValue)
+    return f'{self.__class__.__name__}({self.responseName},{self.responseValue})'
 
   def decodeResponseValue(self,value):
     """
diff --git a/Lib/ldap/extop/dds.py b/Lib/ldap/extop/dds.py
index 4d156e8..7fab081 100644
--- a/Lib/ldap/extop/dds.py
+++ b/Lib/ldap/extop/dds.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.extop.dds - Classes for Dynamic Entries extended operations
 (see RFC 2589)
diff --git a/Lib/ldap/extop/passwd.py b/Lib/ldap/extop/passwd.py
index 0a8346a..13e9f25 100644
--- a/Lib/ldap/extop/passwd.py
+++ b/Lib/ldap/extop/passwd.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.extop.passwd - Classes for Password Modify extended operation
 (see RFC 3062)
diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py
index 3dba7f7..782737a 100644
--- a/Lib/ldap/filter.py
+++ b/Lib/ldap/filter.py
@@ -71,7 +71,7 @@ def time_span_filter(
         if from_timestamp < 0:
             from_timestamp = until_timestamp + from_timestamp
     if from_timestamp > until_timestamp:
-        raise ValueError('from_timestamp %r must not be greater than until_timestamp %r' % (
+        raise ValueError('from_timestamp {!r} must not be greater than until_timestamp {!r}'.format(
             from_timestamp, until_timestamp
         ))
     return (
diff --git a/Lib/ldap/functions.py b/Lib/ldap/functions.py
index 8c9dc62..8658db4 100644
--- a/Lib/ldap/functions.py
+++ b/Lib/ldap/functions.py
@@ -41,7 +41,7 @@ def _ldap_function_call(lock,func,*args,**kwargs):
     lock.acquire()
   if __debug__:
     if ldap._trace_level>=1:
-      ldap._trace_file.write('*** %s.%s %s\n' % (
+      ldap._trace_file.write('*** {}.{} {}\n'.format(
         '_ldap',func.__name__,
         pprint.pformat((args,kwargs))
       ))
diff --git a/Lib/ldap/ldapobject.py b/Lib/ldap/ldapobject.py
index dcdeea5..40091ad 100644
--- a/Lib/ldap/ldapobject.py
+++ b/Lib/ldap/ldapobject.py
@@ -114,7 +114,7 @@ def _ldap_call(self,func,*args,**kwargs):
     self._ldap_object_lock.acquire()
     if __debug__:
       if self._trace_level>=1:
-        self._trace_file.write('*** %s %s - %s\n%s\n' % (
+        self._trace_file.write('*** {} {} - {}\n{}\n'.format(
           repr(self),
           self._uri,
           '.'.join((self.__class__.__name__,func.__name__)),
@@ -138,7 +138,7 @@ def _ldap_call(self,func,*args,**kwargs):
       except IndexError:
         pass
       if __debug__ and self._trace_level>=2:
-        self._trace_file.write('=> LDAPError - %s: %s\n' % (e.__class__.__name__,str(e)))
+        self._trace_file.write('=> LDAPError - {}: {}\n'.format(e.__class__.__name__,str(e)))
       raise
     else:
       if __debug__ and self._trace_level>=2:
@@ -159,7 +159,7 @@ def __getattr__(self,name):
     elif name in self.__dict__:
       return self.__dict__[name]
     else:
-      raise AttributeError('%s has no attribute %s' % (
+      raise AttributeError('{} has no attribute {}'.format(
         self.__class__.__name__,repr(name)
       ))
 
@@ -326,7 +326,7 @@ def compare_ext_s(self,dn,attr,value,serverctrls=None,clientctrls=None):
     except ldap.COMPARE_FALSE:
       return False
     raise ldap.PROTOCOL_ERROR(
-        'Compare operation returned wrong result: %r' % (ldap_res,)
+        f'Compare operation returned wrong result: {ldap_res!r}'
     )
 
   def compare(self,dn,attr,value):
@@ -384,7 +384,7 @@ def extop_s(self,extreq,serverctrls=None,clientctrls=None,extop_resp_class=None)
     if extop_resp_class:
       respoid,respvalue = res
       if extop_resp_class.responseName!=respoid:
-        raise ldap.PROTOCOL_ERROR("Wrong OID in extended response! Expected %s, got %s" % (extop_resp_class.responseName,respoid))
+        raise ldap.PROTOCOL_ERROR(f"Wrong OID in extended response! Expected {extop_resp_class.responseName}, got {respoid}")
       return extop_resp_class(extop_resp_class.responseName,respvalue)
     else:
       return res
@@ -707,8 +707,8 @@ def search_subschemasubentry_s(self,dn=None):
 
     Returns: None or text/bytes depending on bytes_mode.
     """
-    empty_dn = u''
-    attrname = u'subschemaSubentry'
+    empty_dn = ''
+    attrname = 'subschemaSubentry'
     if dn is None:
       dn = empty_dn
     try:
@@ -760,7 +760,7 @@ def read_subschemasubentry_s(self,subschemasubentry_dn,attrs=None):
     """
     Returns the sub schema sub entry's data
     """
-    filterstr = u'(objectClass=subschema)'
+    filterstr = '(objectClass=subschema)'
     if attrs is None:
       attrs = SCHEMA_ATTRS
     try:
@@ -797,8 +797,8 @@ def read_rootdse_s(self, filterstr=None, attrlist=None):
     """
     convenience wrapper around read_s() for reading rootDSE
     """
-    base = u''
-    attrlist = attrlist or [u'*', u'+']
+    base = ''
+    attrlist = attrlist or ['*', '+']
     ldap_rootdse = self.read_s(
       base,
       filterstr=filterstr,
@@ -811,7 +811,7 @@ def get_naming_contexts(self):
     returns all attribute values of namingContexts in rootDSE
     if namingContexts is not present (not readable) then empty list is returned
     """
-    name = u'namingContexts'
+    name = 'namingContexts'
     return self.read_rootdse_s(
       attrlist=[name]
     ).get(name, [])
@@ -923,7 +923,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
       while reconnect_counter:
         counter_text = '%d. (of %d)' % (retry_max-reconnect_counter+1,retry_max)
         if __debug__ and self._trace_level>=1:
-          self._trace_file.write('*** Trying %s reconnect to %s...\n' % (
+          self._trace_file.write('*** Trying {} reconnect to {}...\n'.format(
             counter_text,uri
           ))
         try:
@@ -941,7 +941,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
             raise
         except (ldap.SERVER_DOWN,ldap.TIMEOUT):
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('*** %s reconnect to %s failed\n' % (
+            self._trace_file.write('*** {} reconnect to {} failed\n'.format(
               counter_text,uri
             ))
           reconnect_counter = reconnect_counter-1
@@ -952,7 +952,7 @@ def reconnect(self,uri,retry_max=1,retry_delay=60.0):
           time.sleep(retry_delay)
         else:
           if __debug__ and self._trace_level>=1:
-            self._trace_file.write('*** %s reconnect to %s successful => repeat last operation\n' % (
+            self._trace_file.write('*** {} reconnect to {} successful => repeat last operation\n'.format(
               counter_text,uri
             ))
           self._reconnects_done = self._reconnects_done + 1
diff --git a/Lib/ldap/logger.py b/Lib/ldap/logger.py
index 4db961e..ae66bd0 100644
--- a/Lib/ldap/logger.py
+++ b/Lib/ldap/logger.py
@@ -1,11 +1,10 @@
-# -*- coding: utf-8 -*-
 """
 Helper class for using logging as trace file object
 """
 
 import logging
 
-class logging_file_class(object):
+class logging_file_class:
 
     def __init__(self, logging_level):
         self._logging_level = logging_level
diff --git a/Lib/ldap/pkginfo.py b/Lib/ldap/pkginfo.py
index d99d2d0..2d88dc0 100644
--- a/Lib/ldap/pkginfo.py
+++ b/Lib/ldap/pkginfo.py
@@ -1,7 +1,6 @@
-# -*- coding: utf-8 -*-
 """
 meta attributes for packaging which does not import any dependencies
 """
 __version__ = '3.3.0'
-__author__ = u'python-ldap project'
+__author__ = 'python-ldap project'
 __license__ = 'Python style'
diff --git a/Lib/ldap/schema/models.py b/Lib/ldap/schema/models.py
index 0ebd61e..d73420c 100644
--- a/Lib/ldap/schema/models.py
+++ b/Lib/ldap/schema/models.py
@@ -69,9 +69,9 @@ def key_attr(self,key,value,quoted=0):
     assert value is None or type(value)==str,TypeError("value has to be of str, was %r" % value)
     if value:
       if quoted:
-        return " %s '%s'" % (key,value.replace("'","\\'"))
+        return " {} '{}'".format(key,value.replace("'","\\'"))
       else:
-        return " %s %s" % (key,value)
+        return f" {key} {value}"
     else:
       return ""
 
@@ -84,9 +84,9 @@ def key_list(self,key,values,sep=' ',quoted=0):
     else:
       quoted_values = values
     if len(values)==1:
-      return ' %s %s' % (key,quoted_values[0])
+      return ' {} {}'.format(key,quoted_values[0])
     else:
-      return ' %s ( %s )' % (key,sep.join(quoted_values))
+      return ' {} ( {} )'.format(key,sep.join(quoted_values))
 
   def __str__(self):
     result = [str(self.oid)]
@@ -133,7 +133,7 @@ class ObjectClass(SchemaElement):
     implementations to indicate the source of the associated schema
     element
   """
-  schema_attribute = u'objectClasses'
+  schema_attribute = 'objectClasses'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -240,7 +240,7 @@ class AttributeType(SchemaElement):
     implementations to indicate the source of the associated schema
     element
   """
-  schema_attribute = u'attributeTypes'
+  schema_attribute = 'attributeTypes'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -334,7 +334,7 @@ class LDAPSyntax(SchemaElement):
     Integer flag (0 or 1) indicating whether the attribute type is marked
     as not human-readable (X-NOT-HUMAN-READABLE)
   """
-  schema_attribute = u'ldapSyntaxes'
+  schema_attribute = 'ldapSyntaxes'
   token_defaults = {
     'DESC':(None,),
     'X-NOT-HUMAN-READABLE':(None,),
@@ -383,7 +383,7 @@ class MatchingRule(SchemaElement):
     OID of the LDAP syntax this matching rule is usable with
     (string, or None if missing)
   """
-  schema_attribute = u'matchingRules'
+  schema_attribute = 'matchingRules'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -429,7 +429,7 @@ class MatchingRuleUse(SchemaElement):
     NAMEs or OIDs of attribute types for which this matching rule is used
     (tuple of strings)
   """
-  schema_attribute = u'matchingRuleUse'
+  schema_attribute = 'matchingRuleUse'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -489,7 +489,7 @@ class DITContentRule(SchemaElement):
     NAMEs or OIDs of attributes which may not be present in an entry of the
     object class. (tuple of strings)
   """
-  schema_attribute = u'dITContentRules'
+  schema_attribute = 'dITContentRules'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
@@ -547,7 +547,7 @@ class DITStructureRule(SchemaElement):
     NAMEs or OIDs of allowed structural object classes
     of superior entries in the DIT (tuple of strings)
   """
-  schema_attribute = u'dITStructureRules'
+  schema_attribute = 'dITStructureRules'
 
   token_defaults = {
     'NAME':(()),
@@ -610,7 +610,7 @@ class NameForm(SchemaElement):
     NAMEs or OIDs of additional attributes an RDN may contain
     (tuple of strings)
   """
-  schema_attribute = u'nameForms'
+  schema_attribute = 'nameForms'
   token_defaults = {
     'NAME':(()),
     'DESC':(None,),
diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
index 86e996f..b83d819 100644
--- a/Lib/ldap/schema/subentry.py
+++ b/Lib/ldap/schema/subentry.py
@@ -191,7 +191,7 @@ def tree(self,schema_element_class,schema_element_filters=None):
         # This helps with falsely assigned OIDs.
         continue
       assert se_obj.__class__==schema_element_class, \
-        "Schema element referenced by %s must be of class %s but was %s" % (
+        "Schema element referenced by {} must be of class {} but was {}".format(
           se_oid,schema_element_class.__name__,se_obj.__class__
         )
       for s in se_obj.sup or ('_',):
@@ -216,7 +216,7 @@ def getoid(self,se_class,nameoroid,raise_keyerror=0):
         result_oid = self.name2oid[se_class][nameoroid_stripped]
       except KeyError:
         if raise_keyerror:
-          raise KeyError('No registered %s-OID for nameoroid %s' % (se_class.__name__,repr(nameoroid_stripped)))
+          raise KeyError('No registered {}-OID for nameoroid {}'.format(se_class.__name__,repr(nameoroid_stripped)))
         else:
           result_oid = nameoroid_stripped
     return result_oid
@@ -249,7 +249,7 @@ def get_obj(self,se_class,nameoroid,default=None,raise_keyerror=0):
       se_obj = self.sed[se_class][se_oid]
     except KeyError:
       if raise_keyerror:
-        raise KeyError('No ldap.schema.%s instance with nameoroid %s and se_oid %s' % (
+        raise KeyError('No ldap.schema.{} instance with nameoroid {} and se_oid {}'.format(
           se_class.__name__,repr(nameoroid),repr(se_oid))
         )
       else:
@@ -461,7 +461,7 @@ def urlfetch(uri,trace_level=0):
 
     l=ldap.initialize(ldap_url.initializeUrl(),trace_level)
     l.protocol_version = ldap.VERSION3
-    l.simple_bind_s(ldap_url.who or u'', ldap_url.cred or u'')
+    l.simple_bind_s(ldap_url.who or '', ldap_url.cred or '')
     subschemasubentry_dn = l.search_subschemasubentry_s(ldap_url.dn)
     if subschemasubentry_dn is None:
       s_temp = None
diff --git a/Lib/ldap/syncrepl.py b/Lib/ldap/syncrepl.py
index f6ac2d1..1708b46 100644
--- a/Lib/ldap/syncrepl.py
+++ b/Lib/ldap/syncrepl.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 ldap.syncrepl - for implementing syncrepl consumer (see RFC 4533)
 
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index 0e03fcc..cf3b6a3 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -62,7 +62,7 @@ def ldapUrlEscape(s):
   """Returns URL encoding of string s"""
   return quote(s).replace(',','%2C').replace('/','%2F')
 
-class LDAPUrlExtension(object):
+class LDAPUrlExtension:
   """
   Class for parsing and unparsing LDAP URL extensions
   as described in RFC 4516.
@@ -103,9 +103,9 @@ def _parse(self,extension):
 
   def unparse(self):
     if self.exvalue is None:
-      return '%s%s' % ('!'*(self.critical>0),self.extype)
+      return '{}{}'.format('!'*(self.critical>0),self.extype)
     else:
-      return '%s%s=%s' % (
+      return '{}{}={}'.format(
         '!'*(self.critical>0),
         self.extype,quote(self.exvalue or '')
       )
@@ -114,7 +114,7 @@ def __str__(self):
     return self.unparse()
 
   def __repr__(self):
-    return '<%s.%s instance at %s: %s>' % (
+    return '<{}.{} instance at {}: {}>'.format(
       self.__class__.__module__,
       self.__class__.__name__,
       hex(id(self)),
@@ -176,7 +176,7 @@ def __str__(self):
         return ','.join(str(v) for v in self.values())
 
     def __repr__(self):
-        return '<%s.%s instance at %s: %s>' % (
+        return '<{}.{} instance at {}: {}>'.format(
             self.__class__.__module__,
             self.__class__.__name__,
             hex(id(self)),
@@ -198,7 +198,7 @@ def unparse(self):
         return ','.join(v.unparse() for v in self.values())
 
 
-class LDAPUrl(object):
+class LDAPUrl:
   """
   Class for parsing and unparsing LDAP URLs
   as described in RFC 4516.
@@ -340,7 +340,7 @@ def initializeUrl(self):
       hostport = ldapUrlEscape(self.hostport)
     else:
       hostport = self.hostport
-    return '%s://%s' % (self.urlscheme,hostport)
+    return f'{self.urlscheme}://{hostport}'
 
   def unparse(self):
     """
@@ -361,7 +361,7 @@ def unparse(self):
       hostport = ldapUrlEscape(self.hostport)
     else:
       hostport = self.hostport
-    ldap_url = '%s://%s/%s?%s?%s?%s' % (
+    ldap_url = '{}://{}/{}?{}?{}?{}'.format(
       self.urlscheme,
       hostport,dn,attrs_str,scope_str,filterstr
     )
@@ -395,7 +395,7 @@ def htmlHREF(self,urlPrefix='',hrefText=None,hrefTarget=None):
             raise TypeError("hrefTarget must be str, not "
                             + type(hrefTarget).__name__)
         target = ' target="%s"' % hrefTarget
-    return '<a%s href="%s%s">%s</a>' % (
+    return '<a{} href="{}{}">{}</a>'.format(
         target, urlPrefix, self.unparse(), hrefText
     )
 
@@ -403,7 +403,7 @@ def __str__(self):
     return self.unparse()
 
   def __repr__(self):
-    return '<%s.%s instance at %s: %s>' % (
+    return '<{}.{} instance at {}: {}>'.format(
       self.__class__.__module__,
       self.__class__.__name__,
       hex(id(self)),
@@ -420,7 +420,7 @@ def __getattr__(self,name):
       else:
         return None
     else:
-      raise AttributeError('%s has no attribute %s' % (
+      raise AttributeError('{} has no attribute {}'.format(
         self.__class__.__name__,name
       ))
     return result # __getattr__()
diff --git a/Lib/slapdtest/__init__.py b/Lib/slapdtest/__init__.py
index 1371bef..b57cd44 100644
--- a/Lib/slapdtest/__init__.py
+++ b/Lib/slapdtest/__init__.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 slapdtest - module for spawning test instances of OpenLDAP's slapd server
 
diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 141f459..8dcb713 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 slapdtest - module for spawning test instances of OpenLDAP's slapd server
 
@@ -159,7 +158,7 @@ def combined_logger(
     return new_logger  # end of combined_logger()
 
 
-class SlapdObject(object):
+class SlapdObject:
     """
     Controller class for a slapd instance, OpenLDAP's server.
 
diff --git a/Tests/__init__.py b/Tests/__init__.py
index d654573..ea28d0c 100644
--- a/Tests/__init__.py
+++ b/Tests/__init__.py
@@ -1,11 +1,9 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap
 
 See https://www.python-ldap.org/ for details.
 """
 
-from __future__ import absolute_import
 
 from . import t_bind
 from . import t_cext
diff --git a/Tests/t_cext.py b/Tests/t_cext.py
index c271531..8333b0f 100644
--- a/Tests/t_cext.py
+++ b/Tests/t_cext.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's C wrapper module _ldap
 
@@ -28,7 +27,7 @@ class TestLdapCExtension(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        super(TestLdapCExtension, cls).setUpClass()
+        super().setUpClass()
         # add two initial objects after server was started and is still empty
         suffix_dc = cls.server.suffix.split(',')[0][3:]
         cls.server._log.debug(
@@ -52,14 +51,14 @@ def setUpClass(cls):
         )
 
     def setUp(self):
-        super(TestLdapCExtension, self).setUp()
+        super().setUp()
         self._writesuffix = None
 
     def tearDown(self):
         # cleanup test subtree
         if self._writesuffix is not None:
             self.server.ldapdelete(self._writesuffix, recursive=True)
-        super(TestLdapCExtension, self).tearDown()
+        super().tearDown()
 
     @property
     def writesuffix(self):
@@ -288,7 +287,7 @@ def test_anon_rootdse_search(self):
             '',
             _ldap.SCOPE_BASE,
             '(objectClass=*)',
-            [str('objectClass'), str('namingContexts')],
+            ['objectClass', 'namingContexts'],
         )
         self.assertEqual(type(m), type(0))
         result, pmsg, msgid, ctrls = l.result4(m, _ldap.MSG_ALL, self.timeout)
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index 6878617..aa9a77e 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.cidict
 
diff --git a/Tests/t_edit.py b/Tests/t_edit.py
index f79ff18..5d8b3f0 100644
--- a/Tests/t_edit.py
+++ b/Tests/t_edit.py
@@ -13,7 +13,7 @@ class EditionTests(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        super(EditionTests, cls).setUpClass()
+        super().setUpClass()
         base = cls.server.suffix
         suffix_dc = base.split(',')[0][3:]
 
diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py
index d62ec71..86d3640 100644
--- a/Tests/t_ldap_dn.py
+++ b/Tests/t_ldap_dn.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.dn
 
diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py
index da96446..313b373 100644
--- a/Tests/t_ldap_filter.py
+++ b/Tests/t_ldap_filter.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.filter
 
diff --git a/Tests/t_ldap_functions.py b/Tests/t_ldap_functions.py
index 45931da..5434a37 100644
--- a/Tests/t_ldap_functions.py
+++ b/Tests/t_ldap_functions.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.functions
 
diff --git a/Tests/t_ldap_modlist.py b/Tests/t_ldap_modlist.py
index 53c80cc..6259624 100644
--- a/Tests/t_ldap_modlist.py
+++ b/Tests/t_ldap_modlist.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.modlist
 
@@ -44,7 +43,7 @@ def test_addModlist(self):
             result_modlist.sort()
             self.assertEqual(
                 test_modlist, result_modlist,
-                'addModlist(%s) returns\n%s\ninstead of\n%s.' % (
+                'addModlist({}) returns\n{}\ninstead of\n{}.'.format(
                     repr(entry),repr(result_modlist),repr(test_modlist)
                 )
             )
@@ -146,7 +145,7 @@ def test_modifyModlist(self):
 
             self.assertEqual(
                 test_modlist, result_modlist,
-                'modifyModlist(%s,%s) returns\n%s\ninstead of\n%s.' % (
+                'modifyModlist({},{}) returns\n{}\ninstead of\n{}.'.format(
                     repr(old_entry),
                     repr(new_entry),
                     repr(result_modlist),
diff --git a/Tests/t_ldap_options.py b/Tests/t_ldap_options.py
index 684fdf7..89f21a4 100644
--- a/Tests/t_ldap_options.py
+++ b/Tests/t_ldap_options.py
@@ -28,7 +28,7 @@
 ]
 
 
-class BaseTestOptions(object):
+class BaseTestOptions:
     """Common tests for getting/setting options
 
     Used in subclasses below
@@ -97,7 +97,7 @@ def _test_controls(self, option):
             # data must be bytes or None
             self.set_option(
                 option,
-                [TEST_CTRL[0][0], TEST_CTRL[0][1], u'data']
+                [TEST_CTRL[0][0], TEST_CTRL[0][1], 'data']
             )
 
     def test_client_controls(self):
diff --git a/Tests/t_ldap_sasl.py b/Tests/t_ldap_sasl.py
index 9cf675a..40ab27e 100644
--- a/Tests/t_ldap_sasl.py
+++ b/Tests/t_ldap_sasl.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.sasl
 
@@ -47,7 +46,7 @@ class TestSasl(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        super(TestSasl, cls).setUpClass()
+        super().setUpClass()
         ldif = LDIF.format(
             suffix=cls.server.suffix,
             rootdn=cls.server.root_dn,
@@ -72,7 +71,7 @@ def test_external_ldapi(self):
         ldap_conn.sasl_interactive_bind_s("", auth)
         self.assertEqual(
             ldap_conn.whoami_s().lower(),
-            "dn:{}".format(self.server.root_dn.lower())
+            f"dn:{self.server.root_dn.lower()}"
         )
 
     @requires_tls()
@@ -89,7 +88,7 @@ def test_external_tlscert(self):
         ldap_conn.sasl_interactive_bind_s("", auth)
         self.assertEqual(
             ldap_conn.whoami_s().lower(),
-            "dn:{}".format(self.certsubject)
+            f"dn:{self.certsubject}"
         )
 
 if __name__ == '__main__':
diff --git a/Tests/t_ldap_schema_subentry.py b/Tests/t_ldap_schema_subentry.py
index e05c957..60a584d 100644
--- a/Tests/t_ldap_schema_subentry.py
+++ b/Tests/t_ldap_schema_subentry.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's class ldap.schema.SubSchema
 
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
index 0890379..20e86ab 100644
--- a/Tests/t_ldap_schema_tokenizer.py
+++ b/Tests/t_ldap_schema_tokenizer.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.schema.tokenizer
 
diff --git a/Tests/t_ldap_syncrepl.py b/Tests/t_ldap_syncrepl.py
index 5110414..6acc82c 100644
--- a/Tests/t_ldap_syncrepl.py
+++ b/Tests/t_ldap_syncrepl.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.syncrepl
 
@@ -266,7 +265,7 @@ def syncrepl_present(self, uuids, refreshDeletes=False):
             pass
 
 
-class BaseSyncreplTests(object):
+class BaseSyncreplTests:
     """
     This is a test of all the basic Syncrepl operations.  It covers starting a
     search (both types of search), doing the refresh part of the search,
@@ -279,7 +278,7 @@ class BaseSyncreplTests(object):
 
     @classmethod
     def setUpClass(cls):
-        super(BaseSyncreplTests, cls).setUpClass()
+        super().setUpClass()
         # insert some Foo* objects via ldapadd
         cls.server.ldapadd(
             LDIF_TEMPLATE % {
@@ -292,13 +291,13 @@ def setUpClass(cls):
         )
 
     def setUp(self):
-        super(BaseSyncreplTests, self).setUp()
+        super().setUp()
         self.tester = None
         self.suffix = None
 
     def tearDown(self):
         self.tester.unbind_s()
-        super(BaseSyncreplTests, self).tearDown()
+        super().tearDown()
 
     def create_client(self):
         raise NotImplementedError
@@ -433,7 +432,7 @@ def test_refreshAndPersist_cancelled(self):
 
 class TestSyncrepl(BaseSyncreplTests, SlapdTestCase):
     def setUp(self):
-        super(TestSyncrepl, self).setUp()
+        super().setUp()
         self.tester = SyncreplClient(
             self.server.ldap_uri,
             self.server.root_dn,
diff --git a/Tests/t_ldapobject.py b/Tests/t_ldapobject.py
index 6d44ff1..e54bbfd 100644
--- a/Tests/t_ldapobject.py
+++ b/Tests/t_ldapobject.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldap.ldapobject
 
@@ -91,7 +90,7 @@ class Test00_SimpleLDAPObject(SlapdTestCase):
 
     @classmethod
     def setUpClass(cls):
-        super(Test00_SimpleLDAPObject, cls).setUpClass()
+        super().setUpClass()
         # insert some Foo* objects via ldapadd
         cls.server.ldapadd(
             LDIF_TEMPLATE % {
@@ -297,11 +296,11 @@ def test_search_subschema(self):
         self.assertEqual(
             sorted(subschema),
             [
-                u'attributeTypes',
-                u'ldapSyntaxes',
-                u'matchingRuleUse',
-                u'matchingRules',
-                u'objectClasses'
+                'attributeTypes',
+                'ldapSyntaxes',
+                'matchingRuleUse',
+                'matchingRules',
+                'objectClasses'
             ]
         )
 
@@ -318,7 +317,7 @@ def test004_enotconn(self):
             info = ldap_err.args[0]['info']
             expected_info = os.strerror(errno.ENOTCONN)
             if info != expected_info:
-                self.fail("expected info=%r, got %r" % (expected_info, info))
+                self.fail(f"expected info={expected_info!r}, got {info!r}")
         else:
             self.fail("expected SERVER_DOWN, got %r" % r)
 
@@ -360,10 +359,10 @@ def assertIsSubclass(self, cls, other):
     def test_simple_bind_noarg(self):
         l = self.ldap_object_class(self.server.ldap_uri)
         l.simple_bind_s()
-        self.assertEqual(l.whoami_s(), u'')
+        self.assertEqual(l.whoami_s(), '')
         l = self.ldap_object_class(self.server.ldap_uri)
         l.simple_bind_s(None, None)
-        self.assertEqual(l.whoami_s(), u'')
+        self.assertEqual(l.whoami_s(), '')
 
     def _check_byteswarning(self, warning, expected_message):
         self.assertIs(warning.category, ldap.LDAPBytesWarning)
@@ -401,16 +400,16 @@ def test_multiple_starttls(self):
     def test_dse(self):
         dse = self._ldap_conn.read_rootdse_s()
         self.assertIsInstance(dse, dict)
-        self.assertEqual(dse[u'supportedLDAPVersion'], [b'3'])
+        self.assertEqual(dse['supportedLDAPVersion'], [b'3'])
         keys = set(dse)
         # SASL info may be missing in restricted build environments
-        keys.discard(u'supportedSASLMechanisms')
+        keys.discard('supportedSASLMechanisms')
         self.assertEqual(
             keys,
-            {u'configContext', u'entryDN', u'namingContexts', u'objectClass',
-             u'structuralObjectClass', u'subschemaSubentry',
-             u'supportedControl', u'supportedExtension', u'supportedFeatures',
-             u'supportedLDAPVersion'}
+            {'configContext', 'entryDN', 'namingContexts', 'objectClass',
+             'structuralObjectClass', 'subschemaSubentry',
+             'supportedControl', 'supportedExtension', 'supportedFeatures',
+             'supportedLDAPVersion'}
         )
         self.assertEqual(
             self._ldap_conn.get_naming_contexts(),
@@ -542,20 +541,20 @@ def test103_reconnect_get_state(self):
         self.assertEqual(
             l1.__getstate__(),
             {
-                str('_last_bind'): (
+                '_last_bind': (
                     'simple_bind_s',
                     (bind_dn, 'user1_pw'),
                     {}
                 ),
-                str('_options'): [(17, 3)],
-                str('_reconnects_done'): 0,
-                str('_retry_delay'): 60.0,
-                str('_retry_max'): 1,
-                str('_start_tls'): 0,
-                str('_trace_level'): ldap._trace_level,
-                str('_trace_stack_limit'): 5,
-                str('_uri'): self.server.ldap_uri,
-                str('timeout'): -1,
+                '_options': [(17, 3)],
+                '_reconnects_done': 0,
+                '_retry_delay': 60.0,
+                '_retry_max': 1,
+                '_start_tls': 0,
+                '_trace_level': ldap._trace_level,
+                '_trace_stack_limit': 5,
+                '_uri': self.server.ldap_uri,
+                'timeout': -1,
             },
         )
 
@@ -595,14 +594,14 @@ def _open_ldap_conn(self, who=None, cred=None, **kwargs):
         self._sock = socket.create_connection(
             (self.server.hostname, self.server.port)
         )
-        return super(Test03_SimpleLDAPObjectWithFileno, self)._open_ldap_conn(
+        return super()._open_ldap_conn(
             who=who, cred=cred, fileno=self._sock.fileno(), **kwargs
         )
 
     def tearDown(self):
         self._sock.close()
         del self._sock
-        super(Test03_SimpleLDAPObjectWithFileno, self).tearDown()
+        super().tearDown()
 
     def reset_connection(self):
         self._sock.close()
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 398dc89..4e7744b 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldapurl
 
@@ -160,7 +159,7 @@ def test_ldapurl(self):
             ldap_url_obj = LDAPUrl(ldapUrl=ldap_url_str)
             self.assertEqual(
                 ldap_url_obj, test_ldap_url_obj,
-                'Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
+                'Attributes of LDAPUrl({}) are:\n{}\ninstead of:\n{}'.format(
                     repr(ldap_url_str),
                     repr(ldap_url_obj),
                     repr(test_ldap_url_obj),
@@ -170,7 +169,7 @@ def test_ldapurl(self):
             unparsed_ldap_url_obj = LDAPUrl(ldapUrl=unparsed_ldap_url_str)
             self.assertEqual(
                 unparsed_ldap_url_obj, test_ldap_url_obj,
-                'Attributes of LDAPUrl(%s) are:\n%s\ninstead of:\n%s' % (
+                'Attributes of LDAPUrl({}) are:\n{}\ninstead of:\n{}'.format(
                     repr(unparsed_ldap_url_str),
                     repr(unparsed_ldap_url_obj),
                     repr(test_ldap_url_obj),
diff --git a/Tests/t_ldif.py b/Tests/t_ldif.py
index 254e68d..2f9ed67 100644
--- a/Tests/t_ldif.py
+++ b/Tests/t_ldif.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """
 Automatic tests for python-ldap's module ldif
 

From 2647f59dfd25b4bed1cc69ead0b9dce7a59dcf4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi.rivard@aquilenet.fr>
Date: Fri, 13 Nov 2020 22:19:26 +0100
Subject: [PATCH 862/868] Removed some python2-only code from SlapdObject

https://github.com/python-ldap/python-ldap/pull/391
---
 Lib/slapdtest/_slapdtest.py | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/Lib/slapdtest/_slapdtest.py b/Lib/slapdtest/_slapdtest.py
index 8dcb713..3684111 100644
--- a/Lib/slapdtest/_slapdtest.py
+++ b/Lib/slapdtest/_slapdtest.py
@@ -461,15 +461,7 @@ def stop(self):
             self._proc.terminate()
             self.wait()
         self._cleanup_rundir()
-        if hasattr(atexit, 'unregister'):
-            # Python 3
-            atexit.unregister(self.stop)
-        elif hasattr(atexit, '_exithandlers'):
-            # Python 2, can be None during process shutdown
-            try:
-                atexit._exithandlers.remove(self.stop)
-            except ValueError:
-                pass
+        atexit.unregister(self.stop)
 
     def restart(self):
         """

From c2e045de99aa5dd3e626c0dcad62282436a61015 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Fri, 6 Nov 2020 17:14:37 +0100
Subject: [PATCH 863/868] Add missing cidict.copy() method

The copy() method vanished when cidict was re-implemented on top of
MutableMapping abstract base class.

See: commit 2a2cef38feb7f259ea6b5735a6ce3e46812e217d
Fixes: https://github.com/python-ldap/python-ldap/issues/387
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 Lib/ldap/cidict.py |  8 ++++++++
 Tests/t_cidict.py  | 13 +++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/Lib/ldap/cidict.py b/Lib/ldap/cidict.py
index a5ac29e..ac19bd7 100644
--- a/Lib/ldap/cidict.py
+++ b/Lib/ldap/cidict.py
@@ -53,6 +53,14 @@ def clear(self):
         self._keys.clear()
         self._data.clear()
 
+    def copy(self):
+        inst = self.__class__.__new__(self.__class__)
+        inst._data = self._data.copy()
+        inst._keys = self._keys.copy()
+        return inst
+
+    __copy__ = copy
+
     # Backwards compatibility
 
     def has_key(self, key):
diff --git a/Tests/t_cidict.py b/Tests/t_cidict.py
index aa9a77e..97146ec 100644
--- a/Tests/t_cidict.py
+++ b/Tests/t_cidict.py
@@ -71,6 +71,19 @@ def test_cidict_data(self):
         assert data == {'a': 1, 'b': 2}
         self.assertEqual(len(w), 1)
 
+    def test_copy(self):
+        cix1 = ldap.cidict.cidict(
+            {"a": 1, "B": 2}
+        )
+        cix2 = cix1.copy()
+        self.assertEqual(cix1, cix2)
+        cix1["c"] = 3
+        self.assertNotIn("c", cix2)
+        cix2["C"] = 4
+        self.assertNotEqual(cix1, cix2)
+        self.assertEqual(list(cix1.keys()), ["a", "B", "c"])
+        self.assertEqual(list(cix2.keys()), ["a", "B", "C"])
+
 
 if __name__ == '__main__':
     unittest.main()

From a66dcc36aa28b120bb5341f934be9bf8de7e21d7 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Sun, 1 Nov 2020 08:08:23 -0800
Subject: [PATCH 864/868] Tidy up Travis configuration

- Use the Python 3.9 release rather than '*-dev'
- Drop 'sudo' configuration as it is deprecated
- Drop 'dist: xenial' configuration, it is now the default

https://blog.travis-ci.com/2018-11-19-required-linux-infrastructure-migration
---
 .travis.yml | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 17d46bf..95cc148 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,8 +1,6 @@
 language: python
 group: travis_latest
 
-sudo: false
-
 cache: pip
 
 addons:
@@ -35,22 +33,16 @@ matrix:
         - TOXENV=py37
         - CFLAGS_std="-std=c99"
         - WITH_GCOV=1
-      dist: xenial
-      sudo: true
     - python: 3.8
       env:
         - TOXENV=py38
         - CFLAGS_std="-std=c99"
         - WITH_GCOV=1
-      dist: xenial
-      sudo: true
-    - python: 3.9-dev
+    - python: 3.9
       env:
         - TOXENV=py39
         - CFLAGS_std="-std=c99"
         - WITH_GCOV=1
-      dist: xenial
-      sudo: true
     - python: 3.6
       env:
         - TOXENV=py3-nosasltls

From 0ef617548176a89cbb7fa2ee7f748920e10fb5bf Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Sat, 14 Nov 2020 13:05:35 +0100
Subject: [PATCH 865/868] LDAPUrl now treats urlscheme cases insensitive

https://github.com/python-ldap/python-ldap/pull/347

Fixes: https://github.com/python-ldap/python-ldap/issues/280
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Co-authored-by: David Mulder <dmulder@suse.com>
---
 Doc/reference/ldapurl.rst |  5 +++++
 Lib/ldapurl.py            | 15 ++++-----------
 Tests/t_ldapurl.py        | 30 ++++++++++++++++++++++++++++--
 3 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/Doc/reference/ldapurl.rst b/Doc/reference/ldapurl.rst
index de86de7..eb2106b 100644
--- a/Doc/reference/ldapurl.rst
+++ b/Doc/reference/ldapurl.rst
@@ -65,6 +65,11 @@ A :py:class:`LDAPUrl` object represents a complete LDAP URL.
 .. autoclass:: ldapurl.LDAPUrl
    :members:
 
+   .. versionchanged:: 3.4.0
+
+      The urlscheme is now case insensitive and always converted to lower
+      case. ``LDAP://localhost`` is equivalent to ``ldap://localhost``.
+
 
 LDAP URL extensions
 ^^^^^^^^^^^^^^^^^^^
diff --git a/Lib/ldapurl.py b/Lib/ldapurl.py
index cf3b6a3..820f3d8 100644
--- a/Lib/ldapurl.py
+++ b/Lib/ldapurl.py
@@ -48,14 +48,9 @@
 
 
 def isLDAPUrl(s):
+  """Returns True if s is a LDAP URL, else False
   """
-  Returns 1 if s is a LDAP URL, 0 else
-  """
-  s_lower = s.lower()
-  return \
-    s_lower.startswith('ldap://') or \
-    s_lower.startswith('ldaps://') or \
-    s_lower.startswith('ldapi://')
+  return s.lower().startswith(('ldap://', 'ldaps://', 'ldapi://'))
 
 
 def ldapUrlEscape(s):
@@ -235,7 +230,7 @@ def __init__(
     extensions=None,
     who=None,cred=None
   ):
-    self.urlscheme=urlscheme
+    self.urlscheme=urlscheme.lower()
     self.hostport=hostport
     self.dn=dn
     self.attrs=attrs
@@ -270,9 +265,7 @@ def _parse(self,ldap_url):
     if not isLDAPUrl(ldap_url):
       raise ValueError('Value %s for ldap_url does not seem to be a LDAP URL.' % (repr(ldap_url)))
     scheme,rest = ldap_url.split('://',1)
-    self.urlscheme = scheme.strip()
-    if not self.urlscheme in ['ldap','ldaps','ldapi']:
-      raise ValueError('LDAP URL contains unsupported URL scheme %s.' % (self.urlscheme))
+    self.urlscheme = scheme.lower()
     slash_pos = rest.find('/')
     qemark_pos = rest.find('?')
     if (slash_pos==-1) and (qemark_pos==-1):
diff --git a/Tests/t_ldapurl.py b/Tests/t_ldapurl.py
index 4e7744b..f9c7209 100644
--- a/Tests/t_ldapurl.py
+++ b/Tests/t_ldapurl.py
@@ -33,18 +33,23 @@ class TestIsLDAPUrl(unittest.TestCase):
         'ldap://host.com:6666/o=University%20of%20Michigan,':1,
         'ldap://ldap.itd.umich.edu/c=GB?objectClass?one':1,
         'ldap://ldap.question.com/o=Question%3f,c=US?mail':1,
-        'ldap://ldap.netscape.com/o=Babsco,c=US??(int=%5c00%5c00%5c00%5c04)':1,
+        'ldap://ldap.netscape.com/o=Babsco,c=US???(int=%5c00%5c00%5c00%5c04)':1,
         'ldap:///??sub??bindname=cn=Manager%2co=Foo':1,
         'ldap:///??sub??!bindname=cn=Manager%2co=Foo':1,
         # More examples from various sources
         'ldap://ldap.nameflow.net:1389/c%3dDE':1,
         'ldap://root.openldap.org/dc=openldap,dc=org':1,
-        'ldap://root.openldap.org/dc=openldap,dc=org':1,
+        'ldaps://root.openldap.org/dc=openldap,dc=org':1,
         'ldap://x500.mh.se/o=Mitthogskolan,c=se????1.2.752.58.10.2=T.61':1,
         'ldp://root.openldap.org/dc=openldap,dc=org':0,
         'ldap://localhost:1389/ou%3DUnstructured%20testing%20tree%2Cdc%3Dstroeder%2Cdc%3Dcom??one':1,
         'ldaps://ldap.example.com/c%3dDE':1,
         'ldapi:///dc=stroeder,dc=de????x-saslmech=EXTERNAL':1,
+        'LDAP://localhost': True,
+        'LDAPS://localhost': True,
+        'LDAPI://%2Frun%2Fldap.sock': True,
+        ' ldap://space.example': False,
+        'ldap ://space.example': False,
     }
 
     def test_isLDAPUrl(self):
@@ -56,6 +61,11 @@ def test_isLDAPUrl(self):
                     ldap_url, result, expected,
                 )
             )
+            if expected:
+                LDAPUrl(ldapUrl=ldap_url)
+            else:
+                with self.assertRaises(ValueError):
+                    LDAPUrl(ldapUrl=ldap_url)
 
 
 class TestParseLDAPUrl(unittest.TestCase):
@@ -144,6 +154,22 @@ class TestParseLDAPUrl(unittest.TestCase):
             dn='dc=stroeder,dc=com',
         ),
     ),
+    (
+        'LDAPS://localhost:12345/dc=stroeder,dc=com',
+        LDAPUrl(
+            urlscheme='ldaps',
+            hostport='localhost:12345',
+            dn='dc=stroeder,dc=com',
+        ),
+    ),
+    (
+        'ldaps://localhost:12345/dc=stroeder,dc=com',
+        LDAPUrl(
+            urlscheme='LDAPS',
+            hostport='localhost:12345',
+            dn='dc=stroeder,dc=com',
+        ),
+    ),
     (
         'ldapi://%2ftmp%2fopenldap2-1389/dc=stroeder,dc=com',
         LDAPUrl(

From 4993d4ade24faceb3321f85f5e69a8b83c4f77f4 Mon Sep 17 00:00:00 2001
From: Florian Best <spaceone@users.noreply.github.com>
Date: Fri, 4 Dec 2020 15:09:00 +0100
Subject: [PATCH 866/868] Do not decode attribute values of post read control

Fixes: https://github.com/python-ldap/python-ldap/issues/399

https://github.com/python-ldap/python-ldap/pull/400
---
 Doc/reference/ldap-controls.rst    |  3 +++
 Lib/ldap/controls/readentry.py     |  2 +-
 Tests/t_ldap_controls_readentry.py | 28 ++++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 Tests/t_ldap_controls_readentry.py

diff --git a/Doc/reference/ldap-controls.rst b/Doc/reference/ldap-controls.rst
index 1520b24..999eaa9 100644
--- a/Doc/reference/ldap-controls.rst
+++ b/Doc/reference/ldap-controls.rst
@@ -197,6 +197,9 @@ search.
 
    :rfc:`4527` - Lightweight Directory Access Protocol (LDAP): Read Entry Controls
 
+.. versionchanged:: 4.0
+   The attribute values of the entry now consists of `bytes` instead of ISO8859-1 decoded `str`.
+
 
 .. autoclass:: ldap.controls.readentry.ReadEntryControl
    :members:
diff --git a/Lib/ldap/controls/readentry.py b/Lib/ldap/controls/readentry.py
index c5db424..7b2a7e8 100644
--- a/Lib/ldap/controls/readentry.py
+++ b/Lib/ldap/controls/readentry.py
@@ -42,7 +42,7 @@ def decodeControlValue(self,encodedControlValue):
     self.dn = str(decodedEntry[0])
     self.entry = {}
     for attr in decodedEntry[1]:
-      self.entry[str(attr[0])] = [ str(attr_value) for attr_value in attr[1] ]
+      self.entry[str(attr[0])] = [ bytes(attr_value) for attr_value in attr[1] ]
 
 
 class PreReadControl(ReadEntryControl):
diff --git a/Tests/t_ldap_controls_readentry.py b/Tests/t_ldap_controls_readentry.py
new file mode 100644
index 0000000..313a790
--- /dev/null
+++ b/Tests/t_ldap_controls_readentry.py
@@ -0,0 +1,28 @@
+import os
+import unittest
+
+# Switch off processing .ldaprc or ldap.conf before importing _ldap
+os.environ['LDAPNOINIT'] = '1'
+
+from ldap.controls import readentry  # noqa: E402
+
+
+PRC_ENC = b'db\x04)uid=Administrator,cn=users,l=school,l=dev0503\x04\tentryUUID1&\x04$5d96cc2c-8e13-103a-8ca5-2f74868e0e44'
+PRC_DEC = b'0\x0b\x04\tentryUUID'
+
+
+class TestLibldapControls(unittest.TestCase):
+
+    def test_pagedresults_encode(self):
+        pr = readentry.PostReadControl(True, ['entryUUID'])
+        self.assertEqual(pr.encodeControlValue(), PRC_DEC)
+
+    def test_readentry_decode(self):
+        pr = readentry.PostReadControl(True, ['entryUUID'])
+        pr.decodeControlValue(PRC_ENC)
+        self.assertIsInstance(pr.dn, str)
+        self.assertEqual(pr.entry, {'entryUUID': [b'5d96cc2c-8e13-103a-8ca5-2f74868e0e44']})
+
+
+if __name__ == '__main__':
+    unittest.main()

From 7dfa21a1631adb3a7c7c142f7c5d5a152f9403b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi.rivard@aquilenet.fr>
Date: Fri, 4 Dec 2020 15:20:14 +0100
Subject: [PATCH 867/868] Improve ppolicy documentation

https://github.com/python-ldap/python-ldap/pull/397
---
 Doc/conf.py                     |  1 +
 Doc/reference/ldap-controls.rst | 13 +++++++++++++
 Lib/ldap/controls/ppolicy.py    | 20 +++++++++++++++++---
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 0fa396b..30f2730 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -33,6 +33,7 @@
 extensions = [
     'sphinx.ext.autodoc',
     'sphinx.ext.intersphinx',
+    'sphinx.ext.napoleon',
 ]
 
 try:
diff --git a/Doc/reference/ldap-controls.rst b/Doc/reference/ldap-controls.rst
index 999eaa9..37d7c1b 100644
--- a/Doc/reference/ldap-controls.rst
+++ b/Doc/reference/ldap-controls.rst
@@ -209,3 +209,16 @@ search.
 
 .. autoclass:: ldap.controls.readentry.PostReadControl
    :members:
+
+
+:py:mod:`ldap.controls.ppolicy` Password Policy Control
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. seealso::
+   `draft-behera-ldap-password-policy <https://tools.ietf.org/html/draft-behera-ldap-password-policy>`_
+
+.. py:module:: ldap.controls.ppolicy
+   :synopsis: passworld policies
+
+.. autoclass:: ldap.controls.ppolicy.PasswordPolicyControl
+   :members:
diff --git a/Lib/ldap/controls/ppolicy.py b/Lib/ldap/controls/ppolicy.py
index ebc456a..da7586f 100644
--- a/Lib/ldap/controls/ppolicy.py
+++ b/Lib/ldap/controls/ppolicy.py
@@ -62,17 +62,31 @@ class PasswordPolicyResponseValue(univ.Sequence):
 
 
 class PasswordPolicyControl(ValueLessRequestControl,ResponseControl):
+  """
+  Indicates the errors and warnings about the password policy.
+
+  Attributes
+  ----------
+
+  timeBeforeExpiration : int
+      The time before the password expires.
+
+  graceAuthNsRemaining : int
+      The number of grace authentications remaining.
+
+  error: int
+      The password and authentication errors.
+  """
   controlType = '1.3.6.1.4.1.42.2.27.8.5.1'
 
   def __init__(self,criticality=False):
     self.criticality = criticality
-
-  def decodeControlValue(self,encodedControlValue):
-    ppolicyValue,_ = decoder.decode(encodedControlValue,asn1Spec=PasswordPolicyResponseValue())
     self.timeBeforeExpiration = None
     self.graceAuthNsRemaining = None
     self.error = None
 
+  def decodeControlValue(self,encodedControlValue):
+    ppolicyValue,_ = decoder.decode(encodedControlValue,asn1Spec=PasswordPolicyResponseValue())
     warning = ppolicyValue.getComponentByName('warning')
     if warning.hasValue():
       if 'timeBeforeExpiration' in warning:

From 2fb97af1e025a95d1ea86b9aeac6235358e52278 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi.rivard@aquilenet.fr>
Date: Tue, 15 Dec 2020 11:09:32 +0100
Subject: [PATCH 868/868] Remove the outdated documentation copyright year

https://github.com/python-ldap/python-ldap/pull/398
---
 Doc/conf.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Doc/conf.py b/Doc/conf.py
index 30f2730..b883736 100644
--- a/Doc/conf.py
+++ b/Doc/conf.py
@@ -10,6 +10,7 @@
 # All configuration values have a default value; values that are commented out
 # serve to show the default value.
 
+import datetime
 import sys
 import os
 
@@ -54,7 +55,7 @@
 
 # General substitutions.
 project = 'python-ldap'
-copyright = '2008-2017, python-ldap project team'
+copyright = 'python-ldap project team'
 
 # The default replacements for |version| and |release|, also used in various
 # other places throughout the built documents.