static int
or_indexer_create (Slapi_PBlock* pb)
{
	auto int rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* failed to initialize */
	auto char* mrOID = NULL;
	auto void* mrOBJECT = NULL;
	if (slapi_pblock_get (pb, SLAPI_PLUGIN_MR_OID, &mrOID) || mrOID == NULL) {
		slapi_log_err(SLAPI_LOG_FILTER, COLLATE_PLUGIN_SUBSYSTEM,
			"or_indexer_create - No OID parameter\n");
	} else {
		auto indexer_t* ix = indexer_create (mrOID);
		auto char* mrTYPE = NULL;
		slapi_pblock_get (pb, SLAPI_PLUGIN_MR_TYPE, &mrTYPE);
		slapi_log_err(SLAPI_LOG_FILTER, "or_indexer_create", "(oid %s; type %s)\n",
			   mrOID, mrTYPE ? mrTYPE : "<NULL>");
		if (ix != NULL) {
			if (ix->ix_index != NULL &&
			!slapi_pblock_set (pb, SLAPI_PLUGIN_OBJECT, ix) &&
			!slapi_pblock_set (pb, SLAPI_PLUGIN_MR_OID, ix->ix_oid) &&
			!slapi_pblock_set (pb, SLAPI_PLUGIN_MR_INDEX_FN, (void*)op_index_entry) &&
			!slapi_pblock_set (pb, SLAPI_PLUGIN_DESTROY_FN, (void*)op_indexer_destroy)) {
				mrOBJECT = ix;
				rc = 0; /* success */
			} else {
				indexer_free (ix);
			}
		} else { /* mrOID does not identify an ordering rule. */
			/* Is it an ordering rule OID with the substring suffix? */
			auto size_t oidlen = strlen (mrOID);
			if (oidlen > 2 && mrOID[oidlen-2] == '.' &&
			atoi (mrOID + oidlen - 1) == SLAPI_OP_SUBSTRING) {
				auto char* or_oid = slapi_ch_strdup (mrOID);
				or_oid [oidlen-2] = '\0';
				ix = indexer_create (or_oid);
				if (ix != NULL) {
					auto ss_indexer_t* ss = (ss_indexer_t*) slapi_ch_malloc (sizeof (ss_indexer_t));
					ss->ss_indexer = ix;
					oidlen = strlen (ix->ix_oid);
					ss->ss_oid = slapi_ch_malloc (oidlen + 3);
					memcpy (ss->ss_oid, ix->ix_oid, oidlen);
					sprintf (ss->ss_oid + oidlen, ".%1i", SLAPI_OP_SUBSTRING);
					if (ix->ix_index != NULL &&
					!slapi_pblock_set (pb, SLAPI_PLUGIN_OBJECT, ss) &&
					!slapi_pblock_set (pb, SLAPI_PLUGIN_MR_OID, ss->ss_oid) &&
					!slapi_pblock_set (pb, SLAPI_PLUGIN_MR_INDEX_FN, (void*)ss_index_entry) &&
					!slapi_pblock_set (pb, SLAPI_PLUGIN_DESTROY_FN, (void*)ss_indexer_destroy)) {
						mrOBJECT = ss;
						rc = 0; /* success */
					} else {
						ss_indexer_free (ss);
					}
				}
				slapi_ch_free((void**)&or_oid);
			}
		}
	}
	slapi_log_err(SLAPI_LOG_FILTER, COLLATE_PLUGIN_SUBSYSTEM,
		"or_indexer_create - (%p) %i\n", mrOBJECT, rc);
	return rc;
}

struct node_fanout *
ipa_topo_connection_fanout_new (char *from, char *to)
{
   struct node_fanout *new_fanout = (struct node_fanout *)
                                    slapi_ch_malloc(sizeof(struct node_fanout));
   struct node_list *targets = (struct node_list *)
                               slapi_ch_malloc(sizeof(struct node_list));
   targets->next = NULL;
   targets->node = slapi_ch_strdup(to);
   new_fanout->next = NULL;
   new_fanout->node = slapi_ch_strdup(from);
   new_fanout->targets = targets;
   new_fanout->visited = 0;
   return new_fanout;
}

char *
slapi_ch_strdup ( const char* s1 )
{
    char* newmem;
    unsigned long	lsize;
	
	/* strdup pukes on NULL strings...bail out now */
	if(NULL == s1)
		return NULL;

	lsize = strlen(s1) + sizeof(unsigned long) + 1;
	newmem = slapi_ch_malloc( lsize );
	sprintf(newmem, "%s", s1);	

	if(!counters_created)
	{
		create_counters();
		counters_created= 1;
	}
    PR_INCREMENT_COUNTER(slapi_ch_counter_strdup);
    PR_INCREMENT_COUNTER(slapi_ch_counter_created);
    PR_INCREMENT_COUNTER(slapi_ch_counter_exist);

    return newmem;
}

char *
slapi_ch_realloc( char *block, unsigned long size )
{
	char	*newmem;
    unsigned long lsize;
	unsigned long origsize;
	char *realblock;
	char *realnewmem;

	if ( block == NULL ) {
		return( slapi_ch_malloc( size ) );
	}

	if (size <= 0) {
		log_negative_alloc_msg( "realloc", "bytes", size );
		return block;
	}

	lsize = size + sizeof(unsigned long);
	if (lsize <= 1024) {
		newmem = slapi_ch_realloc_core( block, lsize );
	} else if (lsize <= 67108864) {
		/* return 2KB ~ 64MB memory to memory pool */
		unsigned long roundup = 1;
		int n = 0;
		while (1) {
			roundup <<= 1;
			n++;
			if (roundup >= lsize) {
				break;
			}
		}
		PR_ASSERT(n >= 11 && n <= 26);
		newmem = (char *)mempool_get(n-11);	/* 11: 2^11 = 2K */
		if (NULL == newmem) {
			newmem = slapi_ch_realloc_core( block, roundup );
		} else {
			realblock = block - sizeof(unsigned long);
			origsize = *(unsigned long *)realblock - sizeof(unsigned long);;
			memcpy(newmem, block, origsize);
			slapi_ch_free_string(&block);
		}
	} else {
		realblock = block - sizeof(unsigned long);
		origsize = *(unsigned long *)realblock - sizeof(unsigned long);;
		newmem = slapi_ch_mmap( size );
		memcpy(newmem, block, origsize);
		realnewmem = newmem - sizeof(unsigned long);
		*(unsigned long *)realnewmem = lsize;
		slapi_ch_free_string(&block);
	}
	if(!counters_created)
	{
		create_counters();
		counters_created= 1;
	}
    PR_INCREMENT_COUNTER(slapi_ch_counter_realloc);

	return( newmem );
}

/*
 * vals - The existing values.
 * addval - The value to add.
 * nvals - The number of existing values.
 * maxvals - The number of elements in the existing values array.
 */
void
bervalarray_add_berval_fast( 
    struct berval	***vals,
    const struct berval	*addval,
    int			nvals,
    int			*maxvals
)
{
    int need = nvals + 2;
	if(need>*maxvals)
	{
	    if (*maxvals==0)
	    {
			*maxvals = 2;
	    }
	    while ( *maxvals < need )
	    {
			*maxvals *= 2;
	    }
		if(*vals==NULL)
		{
			*vals = (struct berval **) slapi_ch_malloc( *maxvals * sizeof(struct berval *));
		}
		else
		{
			*vals = (struct berval **) slapi_ch_realloc( (char *) *vals, *maxvals * sizeof(struct berval *));
		}
	}
	(*vals)[nvals] = ber_bvdup( (struct berval *)addval );
	(*vals)[nvals+1] = NULL;
}

char *tempnam( char *dir, char *pfx )
{
    char	*s;

    if ( dir == NULL ) {
	dir = "/tmp";
    }

/*
 * allocate space for dir + '/' + pfx (up to 5 chars) + 6 trailing 'X's + 0 byte
 */
    if (( s = (char *)slapi_ch_malloc( strlen( dir ) + 14 )) == NULL ) {
	return( NULL );
    }

    strcpy( s, dir );
    strcat( s, "/" );
    if ( pfx != NULL ) {
	strcat( s, pfx );
    }
    strcat( s, "XXXXXX" );
    mktemp( s );

    if ( *s == '\0' ) {
	slapi_ch_free( (void**)&s );
    }

    return( s );
}

void
set_entry_points()
{
    slapdEntryPoints *sep;

    sep = (slapdEntryPoints *) slapi_ch_malloc( sizeof( slapdEntryPoints ));
    sep->sep_ps_wakeup_all = (caddr_t)ps_wakeup_all;
    sep->sep_ps_service = (caddr_t)ps_service_persistent_searches;
    sep->sep_disconnect_server = (caddr_t)disconnect_server;
    sep->sep_slapd_ssl_init = (caddr_t)slapd_ssl_init;
    sep->sep_slapd_ssl_init2 = (caddr_t)slapd_ssl_init2;
    set_dll_entry_points( sep );
   
	/* To apply the nsslapd-counters config value properly,
	   these values are initialized here after config file is read */
	if (config_get_slapi_counters()) {
		ops_initiated = slapi_counter_new();
		ops_completed = slapi_counter_new();
		max_threads_count = slapi_counter_new();
		conns_in_maxthreads = slapi_counter_new();
		g_set_num_entries_sent( slapi_counter_new() );
		g_set_num_bytes_sent( slapi_counter_new() );
	} else {
		ops_initiated = NULL;
		ops_completed = NULL;
		max_threads_count = NULL;
		conns_in_maxthreads = NULL;
		g_set_num_entries_sent( NULL );
		g_set_num_bytes_sent( NULL );
	}
}

NSAPI_PUBLIC int CertMapDLLInitFn(LDAPUDispatchVector_t **table)
{
    *table = (LDAPUDispatchVector_t *)slapi_ch_malloc(sizeof(LDAPUDispatchVector_t));

    if (!*table) return LDAPU_ERR_OUT_OF_MEMORY;

    (*table)->f_ldapu_cert_to_ldap_entry = ldapu_cert_to_ldap_entry;
    (*table)->f_ldapu_set_cert_mapfn = ldapu_set_cert_mapfn;
    (*table)->f_ldapu_get_cert_mapfn = ldapu_get_cert_mapfn;
    (*table)->f_ldapu_set_cert_searchfn = ldapu_set_cert_searchfn;
    (*table)->f_ldapu_get_cert_searchfn = ldapu_get_cert_searchfn;
    (*table)->f_ldapu_set_cert_verifyfn = ldapu_set_cert_verifyfn;
    (*table)->f_ldapu_get_cert_verifyfn = ldapu_get_cert_verifyfn;
    (*table)->f_ldapu_get_cert_subject_dn = ldapu_get_cert_subject_dn;
    (*table)->f_ldapu_get_cert_issuer_dn = ldapu_get_cert_issuer_dn;
    (*table)->f_ldapu_get_cert_ava_val = ldapu_get_cert_ava_val;
    (*table)->f_ldapu_free_cert_ava_val = ldapu_free_cert_ava_val;
    (*table)->f_ldapu_get_cert_der = ldapu_get_cert_der;
    (*table)->f_ldapu_issuer_certinfo = ldapu_issuer_certinfo;
    (*table)->f_ldapu_certmap_info_attrval = ldapu_certmap_info_attrval;
    (*table)->f_ldapu_err2string = ldapu_err2string;
    (*table)->f_ldapu_free_old = ldapu_free_old;
    (*table)->f_ldapu_malloc = ldapu_malloc;
    (*table)->f_ldapu_strdup = ldapu_strdup;
    (*table)->f_ldapu_free = ldapu_free;
    return LDAPU_SUCCESS;
}

static struct berval*
ss_filter_key (indexer_t* ix, struct berval* val)
{
    struct berval* key = (struct berval*) slapi_ch_calloc (1, sizeof(struct berval));
    if (val->bv_len > 0) {
	struct berval** keys = NULL;
	auto struct berval* vals[2];
	vals[0] = val;
	vals[1] = NULL;
	keys = ix->ix_index (ix, vals, NULL);
	if (keys && keys[0]) {
	    /* why +1 in the len?  you need the +1 to old the trailing NULL,
	       to guard against someone accidentally doing a strcmp or
	       other str function, but a bvcmp is going to use the bv_len
	       which includes the trailing NULL which the value being
	       compared against might not have - not only are bervals
	       not guaranteed to be properly NULL terminated, but they
	       also contain binary data - see slapi_ber_bvcpy() */
	    key->bv_len = keys[0]->bv_len + 1;
	    key->bv_val = slapi_ch_malloc (key->bv_len);
	    memcpy (key->bv_val, keys[0]->bv_val, keys[0]->bv_len);
	    key->bv_val[key->bv_len-1] = '\0';
	}
    }
    return key;
}

struct node_fanout *
ipa_topo_connection_fanout_extend (struct node_fanout *fanout_in, char *from, char *to)
{
    struct node_fanout *cursor;
    if (fanout_in == NULL) {
        /* init fanout */
        return ipa_topo_connection_fanout_new(from,to);
    }
    /* extend existing fanout struct */
    cursor = fanout_in;
    while (cursor) {
        if (strcasecmp(cursor->node, from) == 0) break;
        cursor = cursor->next;
    }
    if (cursor) {
        struct node_list *target = (struct node_list *)
                                   slapi_ch_malloc(sizeof(struct node_list));
        target->next = cursor->targets;
        target->node = slapi_ch_strdup(to);
        cursor->targets = target;
        return fanout_in;
    } else {
        cursor = ipa_topo_connection_fanout_new(from,to);
        cursor->next = fanout_in;
        return cursor;
    }
}

/* returns a berval value as a null terminated string */
static char *strdupbv(struct berval *bv)
{
	char *str = slapi_ch_malloc(bv->bv_len+1);
	memcpy(str, bv->bv_val, bv->bv_len);
	str[bv->bv_len] = 0;
	return str;
}

int slapi_rdn_add( Slapi_RDN *rdn, const char *type, const char *value )
{
	char *s;
	size_t len;

	len = strlen(type) + 1 + strlen( value );
	if ( !BER_BVISEMPTY( &rdn->bv ) ) {
		len += 1 + rdn->bv.bv_len;
	}

	s = slapi_ch_malloc( len + 1 );

	if ( BER_BVISEMPTY( &rdn->bv ) ) {
		snprintf( s, len + 1, "%s=%s", type, value );
	} else {
		snprintf( s, len + 1, "%s=%s+%s", type, value, rdn->bv.bv_val );
	}

	slapi_rdn_done( rdn );

	rdn->bv.bv_len = len;
	rdn->bv.bv_val = s;

	return 1;
}

static int
ss_index_entry (Slapi_PBlock* pb)
     /* Compute substring index keys (when writing an entry). */
{
    auto int rc = LDAP_OPERATIONS_ERROR;
    auto size_t substringsLen = 0;
    struct berval** values;
    auto ss_indexer_t* ss = ss_indexer_get (pb);
    auto indexer_t* ix = ss ? ss->ss_indexer : NULL;
    if (ix != NULL && ix->ix_index != NULL &&
	!slapi_pblock_get (pb, SLAPI_PLUGIN_MR_VALUES, &values)) {
	auto struct berval* substrings = NULL;
	auto struct berval** prefixes = NULL;
	auto struct berval** value;
	for (value = values; *value != NULL; ++value) {
	    auto struct berval substring;
	    substring.bv_val = (*value)->bv_val;
	    substring.bv_len = (*value)->bv_len;
	    if (long_enough (&substring, SS_INDEX_LENGTH-1)) {
		auto struct berval* prefix = &ss_index_initial;
		auto size_t offset;
		for (offset = 0; 1; ++offset) {
		    ++substringsLen;
		    substrings = (struct berval*)
		      slapi_ch_realloc ((void*)substrings, substringsLen * sizeof(struct berval));
		    memcpy (&(substrings[substringsLen-1]), &substring, sizeof (struct berval));
		    prefixes = (struct berval**)
		      slapi_ch_realloc ((void*)prefixes, substringsLen * sizeof(struct berval*));
		    prefixes[substringsLen-1] = prefix;

		    if (offset != 0) LDAP_UTF8INC (substring.bv_val);
		    substring.bv_len = (*value)->bv_len - (substring.bv_val - (*value)->bv_val);
		    if (long_enough (&substring, SS_INDEX_LENGTH)) {
			prefix = &ss_index_middle;
		    } else if (long_enough (&substring, SS_INDEX_LENGTH-1)) {
			prefix = &ss_index_final;
		    } else {
			break;
		    }
		}
	    }
	}
	if (substrings != NULL) {
	    auto struct berval** vector = (struct berval**)
	      slapi_ch_malloc ((substringsLen+1) * sizeof(struct berval*));
	    auto size_t i;
	    for (i = 0; i < substringsLen; ++i) vector[i] = &(substrings[i]);
	    vector[substringsLen] = NULL;
	    rc = slapi_pblock_set (pb, SLAPI_PLUGIN_MR_KEYS, ix->ix_index (ix, vector, prefixes));
	    slapi_ch_free((void**)&vector);
	    slapi_ch_free((void**)&substrings);
	    slapi_ch_free((void**)&prefixes);
	}
    }
    slapi_log_err(SLAPI_LOG_FILTER, COLLATE_PLUGIN_SUBSYSTEM,
            "ss_index_entry - (%p) %i %lu substrings\n",
	        (void*)ss, rc, (unsigned long)substringsLen);
    return rc;
}

Slapi_RDN *slapi_rdn_new( void )
{
	Slapi_RDN *rdn;

	rdn = (Slapi_RDN *)slapi_ch_malloc( sizeof(*rdn ));
	slapi_rdn_init( rdn );

	return rdn;
}

static struct berval*
slapi_ch_bvdup0 (struct berval* val)
    /* Return a copy of val, with a 0 byte following the end. */
{
    auto struct berval* result = (struct berval*)
      slapi_ch_malloc (sizeof (struct berval));
    slapi_ber_bvcpy(result, val);
    return result;
}

/*
 * Create a new object.
 * The object is created with refcnt set to 1. The caller implicitly gets
 * a reference to the object, to prevent a race condition where the object
 * is destroyed immediately after contruction.
 * The provided destructor function will be called when all references to
 * the object have been released.
 *
 * Returns a pointer to the new object.
 */
Object *
object_new(void *user_data, FNFree destructor)
{
	Object *o;
	o = (object *)slapi_ch_malloc(sizeof(object));
	o->refcnt = 1;
	o->destructor = destructor;
	o->data = user_data;
	return o;
}

char *
get_timestring(time_t *t)
{
    char	*timebuf;

    if ( (timebuf = slapi_ch_malloc(32)) == NULL )
        return("No memory for get_timestring");
    CTIME(t, timebuf, 32);
    timebuf[strlen(timebuf) - 1] = '\0';	/* strip out return */
    return(timebuf);
}

struct node_list *
node_list_dup (struct node_list *orig)
{
    struct node_list *dup = NULL;
    struct node_list *cursor = orig;
    struct node_list *start_dup = NULL;
    while (cursor) {
        if (dup) {
            dup->next = (struct node_list *)slapi_ch_malloc(sizeof(struct node_list));
            dup = dup->next;
        } else {
            dup = (struct node_list *)slapi_ch_malloc(sizeof(struct node_list));
            start_dup = dup;
        }
        dup->next = NULL;
        dup->node = slapi_ch_strdup(cursor->node);
        cursor = cursor->next;
    }
    return start_dup;
}

/*
  Converts UNIX time to generalized time.  For example:
  1154981577 -> "20060807211257Z"
*/
char*
epochtimeToGentime( time_t epochtime ) {
    char *gentimestr;
    struct tm t;

    gmtime_r( &epochtime, &t );
    gentimestr = slapi_ch_malloc( 20 );
    /* Format is YYYYmmddHHMMSSZ (15+1 chars) */
    strftime( gentimestr, 16, "%Y%m%d%H%M%SZ", &t );

    return( gentimestr );
}

static int
or_filter_index (Slapi_PBlock* pb)
    /* Return an indexer and values that accelerate the given filter. */
{
    auto or_filter_t* or = or_filter_get (pb);
    auto int rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION;
    auto IFP mrINDEX_FN = NULL;
    auto struct berval** mrVALUES = NULL;
    auto char* mrOID = NULL;
    auto int mrQUERY_OPERATOR;
    if (or && or->or_indexer && or->or_indexer->ix_index) {
	switch (or->or_op) {
	  case SLAPI_OP_LESS:
	  case SLAPI_OP_LESS_OR_EQUAL:
	  case SLAPI_OP_EQUAL:
	  case SLAPI_OP_GREATER_OR_EQUAL:
	  case SLAPI_OP_GREATER:
	    mrINDEX_FN = op_index_search;	
	    mrVALUES = or->or_values;
	    mrOID = or->or_indexer->ix_oid;
	    mrQUERY_OPERATOR = or->or_op;
	    break;
	  case SLAPI_OP_SUBSTRING:
	    if (ss_indexable (or->or_values)) {	
		if (or->or_oid == NULL) {
		    auto const size_t len = strlen (or->or_indexer->ix_oid);
		    or->or_oid = slapi_ch_malloc (len + 3);
		    memcpy (or->or_oid, or->or_indexer->ix_oid, len);
		    sprintf (or->or_oid + len, ".%1i", SLAPI_OP_SUBSTRING);
		}
		mrINDEX_FN = ss_index_search;
		mrVALUES = ss_one_value;
		mrOID = or->or_oid;
		mrQUERY_OPERATOR = SLAPI_OP_EQUAL;
	    }
	    break;
	  default: /* unsupported operator */
	    break;
	}
    }
    if (mrINDEX_FN != NULL &&
	!(rc = slapi_pblock_set (pb, SLAPI_PLUGIN_OBJECT, or)) &&
	!(rc = slapi_pblock_set (pb, SLAPI_PLUGIN_MR_TYPE, or->or_type)) &&
	!(rc = slapi_pblock_set (pb, SLAPI_PLUGIN_MR_INDEX_FN, (void*)mrINDEX_FN)) &&
	!(rc = slapi_pblock_set (pb, SLAPI_PLUGIN_MR_VALUES, mrVALUES)) &&
	!(rc = slapi_pblock_set (pb, SLAPI_PLUGIN_MR_OID, mrOID))) {
	rc = slapi_pblock_set (pb, SLAPI_PLUGIN_MR_QUERY_OPERATOR, &mrQUERY_OPERATOR);
    }
    slapi_log_err(SLAPI_LOG_FILTER, COLLATE_PLUGIN_SUBSYSTEM,
            "or_filter_index - (%p) %i\n",
	        (void*)(or ? or->or_indexer : NULL), rc);
    return rc;
}