diff --git a/0001-build-adjustments.dif b/0001-build-adjustments.dif
index 750daa2..dc19032 100644
--- a/0001-build-adjustments.dif
+++ b/0001-build-adjustments.dif
@@ -1,15 +1,13 @@
-From 5ea89a18adad1c9e03fc8792dd95a4ad80603025 Mon Sep 17 00:00:00 2001
+From 437222f39c2199913ba818cae0acdebf2283c28f Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Wed, 16 Jun 2010 14:04:07 +0200
-Subject: [PATCH 01/11] build-adjustments
+Subject: build-adjustments
 
 - Adjusted modules path
 - don't use automake macro
 
- 2 files changed, 4 insertions(+), 2 deletions(-)
-
 diff --git a/build/top.mk b/build/top.mk
-index 0794173..eb4c825 100644
+index 66ac3bf..f09e0c3 100644
 --- a/build/top.mk
 +++ b/build/top.mk
 @@ -40,7 +40,7 @@ libdir = @libdir@
@@ -22,7 +20,7 @@ index 0794173..eb4c825 100644
  sharedstatedir = @sharedstatedir@
  sysconfdir = @sysconfdir@$(ldap_subdir)
 diff --git a/configure.in b/configure.in
-index ba05a5a..e658b81 100644
+index bc98c57..d2ee4a4 100644
 --- a/configure.in
 +++ b/configure.in
 @@ -67,7 +67,9 @@ dnl Determine host platform
@@ -37,5 +35,5 @@ index ba05a5a..e658b81 100644
  AC_SUBST(VERSION)dnl
  AC_DEFINE_UNQUOTED(OPENLDAP_PACKAGE,"$PACKAGE",Package)
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0002-slapd.conf.dif b/0002-slapd.conf.dif
index 70adde1..c76eb2e 100644
--- a/0002-slapd.conf.dif
+++ b/0002-slapd.conf.dif
@@ -1,11 +1,9 @@
-From d9c1061b77eec147e6d1df8b466d4b17b89e6890 Mon Sep 17 00:00:00 2001
+From 7138ae220bf3bdeec9902bbd1de49efc96c3cbc8 Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Wed, 16 Jun 2010 14:05:49 +0200
 Subject: slapd.conf
 
 
- 1 files changed, 33 insertions(+), 17 deletions(-)
-
 diff --git a/servers/slapd/slapd.conf b/servers/slapd/slapd.conf
 index 4938b85..9caf292 100644
 --- a/servers/slapd/slapd.conf
@@ -95,5 +93,5 @@ index 4938b85..9caf292 100644
  # Indices to maintain
  index	objectClass	eq
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0003-LDAPI-socket-location.dif b/0003-LDAPI-socket-location.dif
index 1e4a3d6..496846b 100644
--- a/0003-LDAPI-socket-location.dif
+++ b/0003-LDAPI-socket-location.dif
@@ -1,13 +1,11 @@
-From 82e121e47976ba0058733976b1c5428a6ee33c31 Mon Sep 17 00:00:00 2001
+From 54d04b4c4a7d644a619d32f543167b9b7576b8f3 Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Wed, 16 Jun 2010 14:06:42 +0200
 Subject: LDAPI socket location
 
 
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
 diff --git a/include/ldap_defaults.h b/include/ldap_defaults.h
-index 3e0d4b2..5235339 100644
+index 426d7f6..9a21f98 100644
 --- a/include/ldap_defaults.h
 +++ b/include/ldap_defaults.h
 @@ -39,7 +39,7 @@
@@ -20,5 +18,5 @@ index 3e0d4b2..5235339 100644
  /*
   * SLAPD DEFINITIONS
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0004-libldap-use-gethostbyname_r.dif b/0004-libldap-use-gethostbyname_r.dif
index d93e054..633f3f9 100644
--- a/0004-libldap-use-gethostbyname_r.dif
+++ b/0004-libldap-use-gethostbyname_r.dif
@@ -1,13 +1,11 @@
-From 21d21f0d9aed8876722748ef8ba92f75dbcdc771 Mon Sep 17 00:00:00 2001
+From 479d8ec0b9652a533d0c13df88f0c667336eeb0f Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Wed, 16 Jun 2010 14:08:03 +0200
 Subject: libldap use gethostbyname_r
 
 
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
 diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c
-index 0704f9a..50a3389 100644
+index d2b4ae8..3180d74 100644
 --- a/libraries/libldap/util-int.c
 +++ b/libraries/libldap/util-int.c
 @@ -52,7 +52,7 @@ extern int h_errno;
@@ -19,7 +17,7 @@ index 0704f9a..50a3389 100644
  # undef HAVE_GETHOSTBYADDR_R
  
  #else
-@@ -330,7 +330,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod)
+@@ -312,7 +312,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod)
  #define BUFSTART (1024-32)
  #define BUFMAX (32*1024-32)
  
@@ -29,5 +27,5 @@ index 0704f9a..50a3389 100644
  
  #if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R))
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0005-pie-compile.dif b/0005-pie-compile.dif
index 504dd29..ad7a751 100644
--- a/0005-pie-compile.dif
+++ b/0005-pie-compile.dif
@@ -1,13 +1,11 @@
-From 0067c67787f5ce93c90f60d51e01c769c918520c Mon Sep 17 00:00:00 2001
+From 225d98a5ff2354929374ac9e0f1c01b3a4380451 Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Fri, 12 Nov 2010 09:39:11 +0100
 Subject: pie compile
 
 
- 7 files changed, 15 insertions(+), 3 deletions(-)
-
 diff --git a/build/top.mk b/build/top.mk
-index eb4c825..6339d63 100644
+index f09e0c3..3cb54c7 100644
 --- a/build/top.mk
 +++ b/build/top.mk
 @@ -107,7 +107,7 @@ LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)
@@ -38,7 +36,7 @@ index eb4c825..6339d63 100644
  LIBS = $(XLIBS) $(XXLIBS) $(AC_LIBS) $(XXXLIBS)
  
 diff --git a/servers/slapd/back-bdb/Makefile.in b/servers/slapd/back-bdb/Makefile.in
-index f44dab2..8123c72 100644
+index 93dc9a6..7172e70 100644
 --- a/servers/slapd/back-bdb/Makefile.in
 +++ b/servers/slapd/back-bdb/Makefile.in
 @@ -33,6 +33,8 @@ LDAP_LIBDIR= ../../../libraries
@@ -51,7 +49,7 @@ index f44dab2..8123c72 100644
  MOD_DEFS = $(@BUILD_BDB@_DEFS)
  MOD_LIBS = $(BDB_LIBS)
 diff --git a/servers/slapd/back-hdb/Makefile.in b/servers/slapd/back-hdb/Makefile.in
-index 5d8381c..59bea01 100644
+index 8f6236b..1d5ba5f 100644
 --- a/servers/slapd/back-hdb/Makefile.in
 +++ b/servers/slapd/back-hdb/Makefile.in
 @@ -37,6 +37,8 @@ LDAP_LIBDIR= ../../../libraries
@@ -64,7 +62,7 @@ index 5d8381c..59bea01 100644
  MOD_DEFS = $(@BUILD_HDB@_DEFS)
  MOD_LIBS = $(BDB_LIBS)
 diff --git a/servers/slapd/back-ldap/Makefile.in b/servers/slapd/back-ldap/Makefile.in
-index 64a4af8..6b093c3 100644
+index 418447f..8d42e72 100644
 --- a/servers/slapd/back-ldap/Makefile.in
 +++ b/servers/slapd/back-ldap/Makefile.in
 @@ -26,6 +26,8 @@ LDAP_LIBDIR= ../../../libraries
@@ -77,7 +75,7 @@ index 64a4af8..6b093c3 100644
  MOD_DEFS = $(@BUILD_LDAP@_DEFS)
  
 diff --git a/servers/slapd/back-ldif/Makefile.in b/servers/slapd/back-ldif/Makefile.in
-index 29450ae..450caf2 100644
+index a8b5a96..12fbaab 100644
 --- a/servers/slapd/back-ldif/Makefile.in
 +++ b/servers/slapd/back-ldif/Makefile.in
 @@ -22,6 +22,8 @@ LDAP_LIBDIR= ../../../libraries
@@ -90,7 +88,7 @@ index 29450ae..450caf2 100644
  MOD_DEFS = $(yes_DEFS)
  
 diff --git a/servers/slapd/back-monitor/Makefile.in b/servers/slapd/back-monitor/Makefile.in
-index 6005b2d..f4fd287 100644
+index ddb474a..61e51b8 100644
 --- a/servers/slapd/back-monitor/Makefile.in
 +++ b/servers/slapd/back-monitor/Makefile.in
 @@ -30,6 +30,8 @@ LDAP_LIBDIR= ../../../libraries
@@ -103,7 +101,7 @@ index 6005b2d..f4fd287 100644
  MOD_DEFS = $(@BUILD_MONITOR@_DEFS)
  
 diff --git a/servers/slapd/back-relay/Makefile.in b/servers/slapd/back-relay/Makefile.in
-index a408f34..012cd07 100644
+index f93a84c..a35dd83 100644
 --- a/servers/slapd/back-relay/Makefile.in
 +++ b/servers/slapd/back-relay/Makefile.in
 @@ -22,6 +22,8 @@ LDAP_LIBDIR= ../../../libraries
@@ -116,5 +114,5 @@ index a408f34..012cd07 100644
  MOD_DEFS = $(@BUILD_RELAY@_DEFS)
  
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0006-assorted-fixes-for-back-config-DELETE-support.dif b/0006-assorted-fixes-for-back-config-DELETE-support.dif
index 44f9946..6bc812c 100644
--- a/0006-assorted-fixes-for-back-config-DELETE-support.dif
+++ b/0006-assorted-fixes-for-back-config-DELETE-support.dif
@@ -1,16 +1,14 @@
-From a998fdc90747f222d261e714ea7e757ad0345f56 Mon Sep 17 00:00:00 2001
+From 6479c8a2980e1a430861df162011780e675fc888 Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Wed, 16 Jun 2010 14:08:56 +0200
 Subject: assorted fixes for back-config DELETE support
 
 
- 1 files changed, 16 insertions(+), 2 deletions(-)
-
 diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
-index 8626f21..4ec085f 100644
+index 5f8ae10..507dd5a 100644
 --- a/servers/slapd/bconfig.c
 +++ b/servers/slapd/bconfig.c
-@@ -5924,13 +5924,26 @@ config_back_delete( Operation *op, SlapReply *rs )
+@@ -5958,13 +5958,26 @@ config_back_delete( Operation *op, SlapReply *rs )
  		rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
  	} else if ( op->o_abandon ) {
  		rs->sr_err = SLAPD_ABANDON;
@@ -39,7 +37,7 @@ index 8626f21..4ec085f 100644
  
  		/* remove CfEntryInfo from the siblings list */
  		if ( ce->ce_parent->ce_kids == ce ) {
-@@ -5992,6 +6005,7 @@ config_back_delete( Operation *op, SlapReply *rs )
+@@ -6026,6 +6039,7 @@ config_back_delete( Operation *op, SlapReply *rs )
  #else
  	rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
  #endif /* SLAP_CONFIG_DELETE */
@@ -48,5 +46,5 @@ index 8626f21..4ec085f 100644
  	return rs->sr_err;
  }
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0007-No-Build-date-and-time-in-binaries.dif b/0007-No-Build-date-and-time-in-binaries.dif
index 19fcc27..44244f3 100644
--- a/0007-No-Build-date-and-time-in-binaries.dif
+++ b/0007-No-Build-date-and-time-in-binaries.dif
@@ -1,15 +1,13 @@
-From 6a15b4e4d5ae00b11317443a0ed96a7e38692735 Mon Sep 17 00:00:00 2001
+From 97e44c92dbf4665526259a2987861624b1766ce1 Mon Sep 17 00:00:00 2001
 From: Cristian Rodriguez <cristian.rodriguez@opensuse.org>
 Date: Tue, 5 Oct 2010 13:59:40 +0200
-Subject: [PATCH 7/7] No Build date and time in binaries
+Subject: No Build date and time in binaries
 
 This avoids build-compare failures and unhelpful rebuilds/republishes in
 the openSUSE buildservice.
 
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
 diff --git a/build/mkversion b/build/mkversion
-index 22943d7..60e8381 100755
+index 5c020b8..0160ab1 100755
 --- a/build/mkversion
 +++ b/build/mkversion
 @@ -50,7 +50,7 @@ if test $# != 1 ; then
@@ -31,5 +29,5 @@ index 22943d7..60e8381 100755
  
  __EOF__
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0008-Recover-on-DB-version-change.dif b/0008-Recover-on-DB-version-change.dif
index 8e7f4ec..c450634 100644
--- a/0008-Recover-on-DB-version-change.dif
+++ b/0008-Recover-on-DB-version-change.dif
@@ -1,15 +1,13 @@
-From 62ea7479d3cfe72cb3780ac4ab9cf5942c408406 Mon Sep 17 00:00:00 2001
+From ab2b1f77bef1ab284db3f0975cff3fe7b0057b15 Mon Sep 17 00:00:00 2001
 From: Ralf Haferkamp <rhafer@suse.de>
 Date: Tue, 5 Oct 2010 14:20:22 +0200
-Subject: [PATCH 8/8] Recover on DB version change
+Subject: Recover on DB version change
 
 If the libdb Version changed try to recover the database. Note: This will
 only succeed if only the format of transaction logs changed.
 
- 1 files changed, 7 insertions(+), 0 deletions(-)
-
 diff --git a/servers/slapd/back-bdb/init.c b/servers/slapd/back-bdb/init.c
-index 9bb1024..aa8cac3 100644
+index 526fee8..a9f7c5a 100644
 --- a/servers/slapd/back-bdb/init.c
 +++ b/servers/slapd/back-bdb/init.c
 @@ -330,6 +330,13 @@ shm_retry:
@@ -27,5 +25,5 @@ index 9bb1024..aa8cac3 100644
  		/* Regular open failed, probably a missing shm environment.
  		 * Start over, do a recovery.
 -- 
-1.7.1
+1.7.3.4
 
diff --git a/0009-List-static-overlays-backends-when-with-VVV.dif b/0009-List-static-overlays-backends-when-with-VVV.dif
deleted file mode 100644
index 396a5a8..0000000
--- a/0009-List-static-overlays-backends-when-with-VVV.dif
+++ /dev/null
@@ -1,57 +0,0 @@
-From 79ebaf1aab14b130ef980f593afb9ac6f9bfeb06 Mon Sep 17 00:00:00 2001
-From: Ralf Haferkamp <rhafer@suse.de>
-Date: Tue, 9 Nov 2010 16:26:24 +0100
-Subject: [PATCH 09/11] List static overlays/backends when with -VVV
-
-
- 1 files changed, 20 insertions(+), 1 deletions(-)
-
-diff --git a/servers/slapd/main.c b/servers/slapd/main.c
-index 6990e91..0cb0de1 100644
---- a/servers/slapd/main.c
-+++ b/servers/slapd/main.c
-@@ -99,6 +99,9 @@ const char Versionstr[] =
- 	OPENLDAP_PACKAGE " " OPENLDAP_VERSION " Standalone LDAP Server (slapd)";
- #endif
- 
-+extern OverlayInit slap_oinfo[];
-+extern BackendInfo slap_binfo[];
-+
- #define	CHECK_NONE	0x00
- #define	CHECK_CONFIG	0x01
- #define	CHECK_LOGLEVEL	0x02
-@@ -340,7 +343,8 @@ usage( char *name )
- #if defined(HAVE_SETUID) && defined(HAVE_SETGID)
- 		"\t-u user\t\tUser (id or name) to run as\n"
- #endif
--		"\t-V\t\tprint version info (-VV only)\n"
-+		"\t-V\t\tprint version info (-VV exit afterwards, -VVV print\n"
-+		"\t\t\tinfo about static overlays and backends)\n"
-     );
- }
- 
-@@ -684,6 +688,21 @@ unhandled_option:;
- 
- 	if ( version ) {
- 		fprintf( stderr, "%s\n", Versionstr );
-+		if ( version > 2 ) {
-+			if ( slap_oinfo[0].ov_type ) {
-+				fprintf( stderr, "Included static overlays:\n");
-+				for ( i= 0 ; slap_oinfo[i].ov_type; i++ ) {
-+					fprintf( stderr, "    %s\n", slap_oinfo[i].ov_type );
-+				}
-+			}
-+			if ( slap_binfo[0].bi_type ) {
-+				fprintf( stderr, "Included static backends:\n");
-+				for ( i= 0 ; slap_binfo[i].bi_type; i++ ) {
-+					fprintf( stderr, "    %s\n", slap_binfo[i].bi_type );
-+				}
-+			}
-+		}
-+
- 		if ( version > 1 ) goto stop;
- 	}
- 
--- 
-1.7.1
-
diff --git a/0009-unregister_supported_control-backport.dif b/0009-unregister_supported_control-backport.dif
new file mode 100644
index 0000000..820efb5
--- /dev/null
+++ b/0009-unregister_supported_control-backport.dif
@@ -0,0 +1,141 @@
+From c07b502530f87626e53400c36d6468f8348f863b Mon Sep 17 00:00:00 2001
+From: ralf <ralf>
+Date: Wed, 30 Jun 2010 10:38:01 +0000
+Subject: unregister_supported_control() backport
+
+The fix for bnc#648479/ITS#6647 makes use of this call
+
+Original log-message:
+new call unregister_supported_control(), will be
+needed for cn=config delete support
+
+Also included: use be_ctrls[cid] for counting the number of overlay
+instances that have registered the control for a specific BackendDB to make
+sure that the control is unregistered only after the last instance calls
+overlay_unregister_control().
+
+diff --git a/servers/slapd/backover.c b/servers/slapd/backover.c
+index e3a6b7c..4e86bfb 100644
+--- a/servers/slapd/backover.c
++++ b/servers/slapd/backover.c
+@@ -1074,14 +1074,22 @@ overlay_register_control( BackendDB *be, const char *oid )
+ 				gotit = 1;
+ 			}
+ 
+-			bd->be_ctrls[ cid ] = 1;
++			/* overlays can be instanciated multiple times, use
++			 * be_ctrls[ cid ] as an instance counter, so that the
++			 * overlay's controls are only really disabled after the
++			 * last instance called overlay_register_control() */
++			bd->be_ctrls[ cid ]++;
+ 			bd->be_ctrls[ SLAP_MAX_CIDS ] = 1;
+ 		}
+ 
+ 	}
+ 	
+ 	if ( !gotit ) {
+-		be->bd_self->be_ctrls[ cid ] = 1;
++		/* overlays can be instanciated multiple times, use
++		 * be_ctrls[ cid ] as an instance counter, so that the
++		 * overlay's controls are only really unregistered after the
++		 * last instance called overlay_register_control() */
++		be->bd_self->be_ctrls[ cid ]++;
+ 		be->bd_self->be_ctrls[ SLAP_MAX_CIDS ] = 1;
+ 	}
+ 
+@@ -1089,6 +1097,34 @@ overlay_register_control( BackendDB *be, const char *oid )
+ }
+ 
+ void
++overlay_unregister_control( BackendDB *be, const char *oid )
++{
++	int		gotit = 0;
++	int		cid;
++
++	if ( slap_find_control_id( oid, &cid ) == LDAP_CONTROL_NOT_FOUND ) {
++		return;
++	}
++
++	if ( SLAP_ISGLOBALOVERLAY( be ) ) {
++		BackendDB *bd;
++
++		/* remove from all backends... */
++		LDAP_STAILQ_FOREACH( bd, &backendDB, be_next ) {
++			if ( bd == be->bd_self ) {
++				gotit = 1;
++			}
++
++			bd->be_ctrls[ cid ]--;
++		}
++	}
++
++	if ( !gotit ) {
++		be->bd_self->be_ctrls[ cid ]--;
++	}
++}
++
++void
+ overlay_destroy_one( BackendDB *be, slap_overinst *on )
+ {
+ 	slap_overinfo *oi = on->on_info;
+diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
+index 96df34e..8d079c5 100644
+--- a/servers/slapd/controls.c
++++ b/servers/slapd/controls.c
+@@ -344,6 +344,38 @@ register_supported_control2(const char *controloid,
+ 	return LDAP_SUCCESS;
+ }
+ 
++#ifdef SLAP_CONFIG_DELETE
++int
++unregister_supported_control( const char *controloid )
++{
++	struct slap_control *sc;
++	int i;
++
++	if ( controloid == NULL || (sc = find_ctrl( controloid )) == NULL ){
++		return -1;
++	}
++
++	for ( i = 0; slap_known_controls[ i ]; i++ ) {
++		if ( strcmp( controloid, slap_known_controls[ i ] ) == 0 ) {
++			do {
++				slap_known_controls[ i ] = slap_known_controls[ i+1 ];
++			} while ( slap_known_controls[ i++ ] );
++			num_known_controls--;
++			break;
++		}
++	}
++
++	LDAP_SLIST_REMOVE(&controls_list, sc, slap_control, sc_next);
++	ch_free( sc->sc_oid );
++	if ( sc->sc_extendedopsbv != NULL ) {
++		ber_bvarray_free( sc->sc_extendedopsbv );
++	}
++	ch_free( sc );
++
++	return 0;
++}
++#endif /* SLAP_CONFIG_DELETE */
++
+ /*
+  * One-time initialization of internal controls.
+  */
+diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
+index 494d201..9ed6901 100644
+--- a/servers/slapd/proto-slap.h
++++ b/servers/slapd/proto-slap.h
+@@ -656,6 +656,10 @@ LDAP_SLAPD_F (int) register_supported_control2 LDAP_P((
+ 	int *controlcid ));
+ #define register_supported_control(oid, mask, exops, fn, cid) \
+ 	register_supported_control2((oid), (mask), (exops), (fn), 0, (cid))
++#ifdef SLAP_CONFIG_DELETE
++LDAP_SLAPD_F (int) unregister_supported_control LDAP_P((
++	const char* controloid ));
++#endif /* SLAP_CONFIG_DELETE */
+ LDAP_SLAPD_F (int) slap_controls_init LDAP_P ((void));
+ LDAP_SLAPD_F (void) controls_destroy LDAP_P ((void));
+ LDAP_SLAPD_F (int) controls_root_dse_info LDAP_P ((Entry *e));
+-- 
+1.7.3.4
+
diff --git a/0010-Fix-exposure-of-SSS-VLV-controls-ITS-6647.dif b/0010-Fix-exposure-of-SSS-VLV-controls-ITS-6647.dif
new file mode 100644
index 0000000..ff8e1a0
--- /dev/null
+++ b/0010-Fix-exposure-of-SSS-VLV-controls-ITS-6647.dif
@@ -0,0 +1,46 @@
+From 297c178d36f1e09f1112e97cb139b9843a53ef7c Mon Sep 17 00:00:00 2001
+From: ralf <ralf>
+Date: Fri, 22 Jan 2010 17:01:25 +0000
+Subject: Fix exposure of SSS/VLV controls (ITS#6647)
+
+Fixes bnc#648479
+
+Contains the following upstream commits:
+
+- Unregister VLV control as well when last overlay instance
+  is removed (additional fix for ITS#6647)
+
+diff --git a/servers/slapd/overlays/sssvlv.c b/servers/slapd/overlays/sssvlv.c
+index ab52b3a..93d98b5 100644
+--- a/servers/slapd/overlays/sssvlv.c
++++ b/servers/slapd/overlays/sssvlv.c
+@@ -1276,6 +1276,10 @@ static int sssvlv_db_init(
+ 		if ( rc != LDAP_SUCCESS ) {
+ 			Debug( LDAP_DEBUG_ANY, "Failed to register VLV Request control '%s' (%d)\n",
+ 				LDAP_CONTROL_VLVREQUEST, rc, 0 );
++#ifdef SLAP_CONFIG_DELETE
++			overlay_unregister_control( be, LDAP_CONTROL_SORTREQUEST );
++			unregister_supported_control( LDAP_CONTROL_SORTREQUEST );
++#endif /* SLAP_CONFIG_DELETE */
+ 			return rc;
+ 		}
+ 	}
+@@ -1311,6 +1315,15 @@ static int sssvlv_db_destroy(
+ 		ldap_pvt_thread_mutex_destroy( &sort_conns_mutex );
+ 	}
+ 
++#ifdef SLAP_CONFIG_DELETE
++	overlay_unregister_control( be, LDAP_CONTROL_SORTREQUEST );
++	overlay_unregister_control( be, LDAP_CONTROL_VLVREQUEST );
++	if ( ov_count == 0 ) {
++		unregister_supported_control( LDAP_CONTROL_SORTREQUEST );
++		unregister_supported_control( LDAP_CONTROL_VLVREQUEST );
++	}
++#endif /* SLAP_CONFIG_DELETE */
++
+ 	if ( si ) {
+ 		ch_free( si );
+ 		on->on_bi.bi_private = NULL;
+-- 
+1.7.3.4
+
diff --git a/openldap-2.4.23.tar.bz2 b/openldap-2.4.23.tar.bz2
deleted file mode 100644
index 1ab37f7..0000000
--- a/openldap-2.4.23.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:56349b44f6219fa305e9ebaffd6f2c2c57e3229a1f1c850f6fc5f6ba4e06c03a
-size 4223407
diff --git a/openldap-2.4.24.tar.bz2 b/openldap-2.4.24.tar.bz2
new file mode 100644
index 0000000..54796ef
--- /dev/null
+++ b/openldap-2.4.24.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a0ca02bf15fc03e02aeb0168bf24b2c17d947b955e39e785fef91829eef6bd13
+size 4227463
diff --git a/openldap2-client.changes b/openldap2-client.changes
index 44c8bf7..ad5ff78 100644
--- a/openldap2-client.changes
+++ b/openldap2-client.changes
@@ -1,3 +1,42 @@
+-------------------------------------------------------------------
+Mon Feb 14 11:09:36 UTC 2011 - rhafer@suse.de
+
+- Updated to 2.4.24, important changes:
+  * Added libldap_r,libldap formal concurrency API (ITS#6625,ITS#5421)
+  * Added slapadd attribute value checking (ITS#6592)
+  * Added slapcat continue mode for problematic DBs (ITS#6482)
+  * Added slapd syncrepl suffixmassage support (ITS#6781)
+  * Fixed liblber to not close invalid sockets (ITS#6585)
+  * Fixed libldap referral chasing (ITS#6602)
+  * Fixed libldap leak when chasing referrals (ITS#6744)
+  * Fixed slapd acl parsing overflow (ITS#6611)
+  * Fixed slapd acl when resuming parsing (ITS#6804)
+  * Fixed slapd default config acls with overlays (ITS#6822)
+  * Fixed slapd config leak with olcDbDirectory (ITS#6634)
+  * Fixed slapd when first acl is value dependent (ITS#6693)
+  * Fixed slapd-bdb slapadd -q with glued dbs (ITS#6794)
+  * Fixed slapo-ppolicy don't update opattrs on consumers (ITS#6608)
+  * Fixed slapo-ppolicy to allow userPassword deletion (ITS#6620)
+  * Fixed slapo-syncprov to send error if consumer is newer (ITS#6606)
+  * Fixed slapo-syncprov filter race condition (ITS#6708)
+  * Fixed slapo-syncprov active mod race (ITS#6709)
+  * Fixed slapo-syncprov to refresh if context is dirty (ITS#6710)
+  * Fixed slapo-syncprov CSN updates to all replicas (ITS#6718)
+  * Fixed slapo-syncprov sessionlog ordering (ITS#6716)
+  * Fixed slapo-syncprov sessionlog with adds (ITS#6503)
+  * Fixed slapo-syncprov mutex (ITS#6438)
+  * Fixed slapo-syncprov mincsn check with MMR (ITS#6717)
+  * Fixed slapo-syncprov control leak (ITS#6795)
+  * Fixed slapo-syncprov error codes (ITS#6812)
+  * For a comprehensive list of changes please consult the CHANGES
+    file
+- removed unneeded openSUSE 11.0 specifc patch
+
+-------------------------------------------------------------------
+Tue Feb  1 10:08:06 UTC 2011 - rhafer@suse.de
+
+- slapadd -q could crash for glued bdb/hdb databases
+
 -------------------------------------------------------------------
 Wed Jan 19 15:05:27 UTC 2011 - rhafer@suse.de
 
diff --git a/openldap2-client.spec b/openldap2-client.spec
index f89b8c1..c1957f3 100644
--- a/openldap2-client.spec
+++ b/openldap2-client.spec
@@ -1,5 +1,5 @@
 #
-# spec file for package openldap2-client
+# spec file for package openldap2
 #
 # Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany.
 #
@@ -19,12 +19,12 @@
 
 %define run_test_suite 1
 
-Name:           openldap2-client
+Name:         openldap2-client
 BuildRequires:  cyrus-sasl-devel libopenssl-devel
 %if %sles_version == 9 || %sles_version == 10
 BuildRequires:  -libopenssl-devel -pwdutils openssl-devel
 %endif
-Version:        2.4.23
+Version:        2.4.24
 Release:        6
 Url:            http://www.openldap.org
 License:        BSD3c(or similar) ; openldap 2.8
@@ -33,11 +33,11 @@ BuildRequires:  db-devel openslp-devel tcpd-devel unixODBC-devel
 %if %sles_version == 9 || %sles_version == 10
 BuildRequires:  -db-devel libdb-4_5-devel
 %endif
-Group:          Productivity/Networking/LDAP/Clients
+Group:          Productivity/Networking/LDAP/Servers
 Conflicts:      openldap
 Requires:       libldap-2_4-2 = %{version}
 PreReq:         %insserv_prereq %fillup_prereq /usr/sbin/useradd /usr/sbin/groupadd /usr/bin/grep
-Summary:        The OpenLDAP commandline client tools
+Summary:        The OpenLDAP Server
 %else
 Group:          Productivity/Networking/LDAP/Clients
 Conflicts:      openldap-client
@@ -62,9 +62,9 @@ Patch5:         0005-pie-compile.dif
 Patch6:         0006-assorted-fixes-for-back-config-DELETE-support.dif
 Patch7:         0007-No-Build-date-and-time-in-binaries.dif
 Patch8:         0008-Recover-on-DB-version-change.dif
-Patch9:         0009-List-static-overlays-backends-when-with-VVV.dif
+Patch9:         0009-unregister_supported_control-backport.dif
+Patch10:        0010-Fix-exposure-of-SSS-VLV-controls-ITS-6647.dif
 Patch100:       openldap-2.3.37.dif
-Patch200:       slapd_getaddrinfo_dupl.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 %if "%{name}" == "openldap2"
 
@@ -80,14 +80,6 @@ Authors:
 --------
     The OpenLDAP Project <project@openldap.org>
 
-This package contains the OpenLDAP client utilities.
-
-
-Authors:
---------
-    The OpenLDAP Project <project@openldap.org>
-
-
 %package      -n openldap2-back-perl
 License:        BSD3c(or similar) ; openldap 2.8
 Summary:        OpenLDAP Perl Back-End
@@ -163,17 +155,6 @@ Authors:
 %else
 
 %description
-The Lightweight Directory Access Protocol (LDAP) is used to access
-online directory services. It runs directly over TCP and can be used to
-access a stand-alone LDAP directory service or to access a directory
-service that has an X.500 back-end.
-
-
-
-Authors:
---------
-    The OpenLDAP Project <project@openldap.org>
-
 This package contains the OpenLDAP client utilities.
 
 
@@ -239,9 +220,7 @@ Authors:
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
-%if %suse_version == 1100
-%patch200 -p1
-%endif
+%patch10 -p1
 cp %{SOURCE5} .
 cp %{SOURCE6} .
 cd ../openldap-2.3.37
diff --git a/openldap2.changes b/openldap2.changes
index 44c8bf7..ad5ff78 100644
--- a/openldap2.changes
+++ b/openldap2.changes
@@ -1,3 +1,42 @@
+-------------------------------------------------------------------
+Mon Feb 14 11:09:36 UTC 2011 - rhafer@suse.de
+
+- Updated to 2.4.24, important changes:
+  * Added libldap_r,libldap formal concurrency API (ITS#6625,ITS#5421)
+  * Added slapadd attribute value checking (ITS#6592)
+  * Added slapcat continue mode for problematic DBs (ITS#6482)
+  * Added slapd syncrepl suffixmassage support (ITS#6781)
+  * Fixed liblber to not close invalid sockets (ITS#6585)
+  * Fixed libldap referral chasing (ITS#6602)
+  * Fixed libldap leak when chasing referrals (ITS#6744)
+  * Fixed slapd acl parsing overflow (ITS#6611)
+  * Fixed slapd acl when resuming parsing (ITS#6804)
+  * Fixed slapd default config acls with overlays (ITS#6822)
+  * Fixed slapd config leak with olcDbDirectory (ITS#6634)
+  * Fixed slapd when first acl is value dependent (ITS#6693)
+  * Fixed slapd-bdb slapadd -q with glued dbs (ITS#6794)
+  * Fixed slapo-ppolicy don't update opattrs on consumers (ITS#6608)
+  * Fixed slapo-ppolicy to allow userPassword deletion (ITS#6620)
+  * Fixed slapo-syncprov to send error if consumer is newer (ITS#6606)
+  * Fixed slapo-syncprov filter race condition (ITS#6708)
+  * Fixed slapo-syncprov active mod race (ITS#6709)
+  * Fixed slapo-syncprov to refresh if context is dirty (ITS#6710)
+  * Fixed slapo-syncprov CSN updates to all replicas (ITS#6718)
+  * Fixed slapo-syncprov sessionlog ordering (ITS#6716)
+  * Fixed slapo-syncprov sessionlog with adds (ITS#6503)
+  * Fixed slapo-syncprov mutex (ITS#6438)
+  * Fixed slapo-syncprov mincsn check with MMR (ITS#6717)
+  * Fixed slapo-syncprov control leak (ITS#6795)
+  * Fixed slapo-syncprov error codes (ITS#6812)
+  * For a comprehensive list of changes please consult the CHANGES
+    file
+- removed unneeded openSUSE 11.0 specifc patch
+
+-------------------------------------------------------------------
+Tue Feb  1 10:08:06 UTC 2011 - rhafer@suse.de
+
+- slapadd -q could crash for glued bdb/hdb databases
+
 -------------------------------------------------------------------
 Wed Jan 19 15:05:27 UTC 2011 - rhafer@suse.de
 
diff --git a/openldap2.spec b/openldap2.spec
index 2b9563c..3f7df63 100644
--- a/openldap2.spec
+++ b/openldap2.spec
@@ -24,7 +24,7 @@ BuildRequires:  cyrus-sasl-devel libopenssl-devel
 %if %sles_version == 9 || %sles_version == 10
 BuildRequires:  -libopenssl-devel -pwdutils openssl-devel
 %endif
-Version:        2.4.23
+Version:        2.4.24
 Release:        6
 Url:            http://www.openldap.org
 License:        BSD3c(or similar) ; openldap 2.8
@@ -33,11 +33,11 @@ BuildRequires:  db-devel openslp-devel tcpd-devel unixODBC-devel
 %if %sles_version == 9 || %sles_version == 10
 BuildRequires:  -db-devel libdb-4_5-devel
 %endif
-Group:          Productivity/Networking/LDAP/Clients
+Group:          Productivity/Networking/LDAP/Servers
 Conflicts:      openldap
 Requires:       libldap-2_4-2 = %{version}
 PreReq:         %insserv_prereq %fillup_prereq /usr/sbin/useradd /usr/sbin/groupadd /usr/bin/grep
-Summary:        The OpenLDAP commandline client tools
+Summary:        The OpenLDAP Server
 %else
 Group:          Productivity/Networking/LDAP/Clients
 Conflicts:      openldap-client
@@ -62,9 +62,9 @@ Patch5:         0005-pie-compile.dif
 Patch6:         0006-assorted-fixes-for-back-config-DELETE-support.dif
 Patch7:         0007-No-Build-date-and-time-in-binaries.dif
 Patch8:         0008-Recover-on-DB-version-change.dif
-Patch9:         0009-List-static-overlays-backends-when-with-VVV.dif
+Patch9:         0009-unregister_supported_control-backport.dif
+Patch10:        0010-Fix-exposure-of-SSS-VLV-controls-ITS-6647.dif
 Patch100:       openldap-2.3.37.dif
-Patch200:       slapd_getaddrinfo_dupl.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 %if "%{name}" == "openldap2"
 
@@ -220,9 +220,7 @@ Authors:
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
-%if %suse_version == 1100
-%patch200 -p1
-%endif
+%patch10 -p1
 cp %{SOURCE5} .
 cp %{SOURCE6} .
 cd ../openldap-2.3.37
diff --git a/slapd_getaddrinfo_dupl.dif b/slapd_getaddrinfo_dupl.dif
deleted file mode 100644
index 6b9591b..0000000
--- a/slapd_getaddrinfo_dupl.dif
+++ /dev/null
@@ -1,102 +0,0 @@
-Index: openldap-2.4.7/servers/slapd/daemon.c
-===================================================================
---- openldap-2.4.7.orig/servers/slapd/daemon.c
-+++ openldap-2.4.7/servers/slapd/daemon.c
-@@ -1120,7 +1120,8 @@ slap_get_listener_addresses(
- 	{
- #ifdef HAVE_GETADDRINFO
- 		struct addrinfo hints, *res, *sai;
--		int n, err;
-+		struct sockaddr **sap2;
-+		int n, err, cmpres;
- 		char serv[7];
- 
- 		memset( &hints, '\0', sizeof(hints) );
-@@ -1146,43 +1147,60 @@ slap_get_listener_addresses(
- 		*sap = NULL;
- 
- 		for ( sai=res; sai; sai=sai->ai_next ) {
-+			cmpres=1;
- 			if( sai->ai_addr == NULL ) {
- 				Debug( LDAP_DEBUG_ANY, "slap_get_listener_addresses: "
- 					"getaddrinfo ai_addr is NULL?\n", 0, 0, 0 );
- 				freeaddrinfo(res);
- 				goto errexit;
- 			}
--
--			switch (sai->ai_family) {
--#  ifdef LDAP_PF_INET6
--			case AF_INET6:
--				*sap = ch_malloc(sizeof(struct sockaddr_in6));
--				if (*sap == NULL) {
--					freeaddrinfo(res);
--					goto errexit;
-+			/* check for duplicates */
-+			for ( sap2 = *sal; sap && *sap2; sap2++ ){
-+				if ( sai->ai_family == (*sap2)->sa_family ) {
-+					if (sai->ai_family == AF_INET6) {
-+						cmpres = memcmp(sai->ai_addr, *sap2, 
-+								sizeof(struct sockaddr_in6));
-+					} else if (sai->ai_family == AF_INET) {
-+						cmpres = memcmp(sai->ai_addr, *sap2, 
-+								sizeof(struct sockaddr_in));
-+					}
-+					if (! cmpres ){
-+						break;
-+					}
- 				}
--				*(struct sockaddr_in6 *)*sap =
--					*((struct sockaddr_in6 *)sai->ai_addr);
--				break;
-+			}
-+			if (cmpres){
-+				switch (sai->ai_family) {
-+#  ifdef LDAP_PF_INET6
-+				case AF_INET6:
-+					*sap = ch_malloc(sizeof(struct sockaddr_in6));
-+					if (*sap == NULL) {
-+						freeaddrinfo(res);
-+						goto errexit;
-+					}
-+					*(struct sockaddr_in6 *)*sap =
-+						*((struct sockaddr_in6 *)sai->ai_addr);
-+					break;
- #  endif /* LDAP_PF_INET6 */
--			case AF_INET:
--				*sap = ch_malloc(sizeof(struct sockaddr_in));
--				if (*sap == NULL) {
--					freeaddrinfo(res);
--					goto errexit;
-+				case AF_INET:
-+					*sap = ch_malloc(sizeof(struct sockaddr_in));
-+					if (*sap == NULL) {
-+						freeaddrinfo(res);
-+						goto errexit;
-+					}
-+					*(struct sockaddr_in *)*sap =
-+						*((struct sockaddr_in *)sai->ai_addr);
-+					break;
-+				default:
-+					*sap = NULL;
-+					break;
- 				}
--				*(struct sockaddr_in *)*sap =
--					*((struct sockaddr_in *)sai->ai_addr);
--				break;
--			default:
--				*sap = NULL;
--				break;
--			}
- 
--			if (*sap != NULL) {
--				(*sap)->sa_family = sai->ai_family;
--				sap++;
--				*sap = NULL;
-+				if (*sap != NULL) {
-+					(*sap)->sa_family = sai->ai_family;
-+					sap++;
-+					*sap = NULL;
-+				}
- 			}
- 		}
-