]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-meta/conn.c
refine fix to ITS#4315; apply it to back-meta as well
[openldap] / servers / slapd / back-meta / conn.c
index f1f80d72e379d30bfe73ed59064fcfb4a2198ae5..08fcbea92c0f71447d372c62bda9d01a9079e112 100644 (file)
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2005 The OpenLDAP Foundation.
+ * Copyright 1999-2006 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -52,7 +52,17 @@ meta_back_conn_cmp(
 {
        metaconn_t      *mc1 = ( metaconn_t * )c1;
         metaconn_t     *mc2 = ( metaconn_t * )c2;
+       int             rc;
        
+       /* If local DNs don't match, it is definitely not a match */
+       rc = ber_bvcmp( &mc1->mc_local_ndn, &mc2->mc_local_ndn );
+       if ( rc ) {
+               return rc;
+       }
+
+       /* For shared sessions, conn is NULL. Only explicitly
+        * bound sessions will have non-NULL conn.
+        */
        return SLAP_PTRCMP( mc1->mc_conn, mc2->mc_conn );
 }
 
@@ -70,7 +80,14 @@ meta_back_conn_dup(
        metaconn_t      *mc1 = ( metaconn_t * )c1;
        metaconn_t      *mc2 = ( metaconn_t * )c2;
 
-       return( ( mc1->mc_conn == mc2->mc_conn ) ? -1 : 0 );
+       /* Cannot have more than one shared session with same DN */
+       if ( dn_match( &mc1->mc_local_ndn, &mc2->mc_local_ndn ) &&
+                               mc1->mc_conn == mc2->mc_conn )
+       {
+               return -1;
+       }
+               
+       return 0;
 }
 
 /*
@@ -80,7 +97,8 @@ meta_back_conn_dup(
 static void
 ravl_print( Avlnode *root, int depth )
 {
-       int     i;
+       int             i;
+       metaconn_t      *mc = (metaconn_t *)root->avl_data;
        
        if ( root == 0 ) {
                return;
@@ -92,7 +110,11 @@ ravl_print( Avlnode *root, int depth )
                printf( "    " );
        }
 
-       printf( "c(%d) %d\n", ( ( metaconn_t * )root->avl_data )->mc_conn->c_connid, root->avl_bf );
+       printf( "c(%d%s%s) %d\n",
+               LDAP_BACK_PCONN_ID( mc->mc_conn ),
+               BER_BVISNULL( &mc->mc_local_ndn ) ? "" : ": ",
+               BER_BVISNULL( &mc->mc_local_ndn ) ? "" : mc->mc_local_ndn.bv_val,
+               root->avl_bf );
        
        ravl_print( root->avl_left, depth + 1 );
 }
@@ -141,34 +163,20 @@ metaconn_alloc(
                mc->mc_conns[ i ].msc_ld = NULL;
                BER_BVZERO( &mc->mc_conns[ i ].msc_bound_ndn );
                BER_BVZERO( &mc->mc_conns[ i ].msc_cred );
-               mc->mc_conns[ i ].msc_bound = META_UNBOUND;
+               LDAP_BACK_CONN_ISBOUND_CLEAR( &mc->mc_conns[ i ] );
                mc->mc_conns[ i ].msc_info = mi;
        }
 
-       mc->mc_auth_target = META_BOUND_NONE;
+       BER_BVZERO( &mc->mc_local_ndn );
+       mc->msc_mscflags = 0;
+       mc->mc_authz_target = META_BOUND_NONE;
        ldap_pvt_thread_mutex_init( &mc->mc_mutex );
        mc->mc_refcnt = 1;
+       mc->mc_tainted = 0;
 
        return mc;
 }
 
-/*
- * meta_back_conn_free
- *
- * clears a metaconn
- */
-
-void
-meta_back_conn_free(
-       metaconn_t      *mc )
-{
-       assert( mc != NULL );
-       assert( mc->mc_refcnt == 0 );
-
-       ldap_pvt_thread_mutex_destroy( &mc->mc_mutex );
-       free( mc );
-}
-
 static void
 meta_back_freeconn(
        Operation       *op,
@@ -178,22 +186,13 @@ meta_back_freeconn(
 
        assert( mc != NULL );
 
-retry_lock:;
-       switch ( ldap_pvt_thread_mutex_trylock( &mi->mi_conn_mutex ) ) {
-       case LDAP_PVT_THREAD_EBUSY:
-       default:
-               ldap_pvt_thread_yield();
-               goto retry_lock;
-
-       case 0:
-               break;
-       }
+       ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 
        if ( --mc->mc_refcnt == 0 ) {
                meta_back_conn_free( mc );
        }
 
-       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 }
 
 /*
@@ -206,18 +205,35 @@ meta_back_init_one_conn(
        Operation               *op,
        SlapReply               *rs,
        metatarget_t            *mt, 
-       metasingleconn_t        *msc,
+       metaconn_t              *mc,
+       int                     candidate,
+       int                     ispriv,
        ldap_back_send_t        sendok )
 {
-       metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
-       int             vers;
-       dncookie        dc;
+       metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
+       metasingleconn_t        *msc = &mc->mc_conns[ candidate ];
+       int                     vers;
+       dncookie                dc;
+       int                     isauthz = ( candidate == mc->mc_authz_target );
 
        /*
         * Already init'ed
         */
        if ( msc->msc_ld != NULL ) {
-               return rs->sr_err = LDAP_SUCCESS;
+               if ( mt->mt_idle_timeout == 0 ) {
+                       return rs->sr_err = LDAP_SUCCESS;
+               }
+
+               if ( op->o_time > msc->msc_time + mt->mt_idle_timeout ) {
+                       Debug( LDAP_DEBUG_TRACE,
+                               "%s meta_back_init_one_conn[%d]: idle timeout.\n",
+                               op->o_log_prefix, candidate, 0 );
+                       if ( meta_back_retry( op, rs, mc, candidate, sendok ) ) {
+                               return rs->sr_err;
+                       }
+               }
+
+               msc->msc_time = op->o_time;
        }
        
        /*
@@ -256,7 +272,9 @@ meta_back_init_one_conn(
                if ( rs->sr_err == LDAP_SUCCESS ) {
                        LDAPMessage     *res = NULL;
                        int             rc, nretries = mt->mt_nretries;
-                       struct timeval  tv = { 0, 0 };
+                       struct timeval  tv;
+
+                       LDAP_BACK_TV_SET( &tv );
 
 retry:;
                        rc = ldap_result( msc->msc_ld, msgid, LDAP_MSG_ALL, &tv, &res );
@@ -268,8 +286,7 @@ retry:;
                                        if ( nretries > 0 ) {
                                                nretries--;
                                        }
-                                       tv.tv_sec = 0;
-                                       tv.tv_usec = 100000;
+                                       LDAP_BACK_TV_SET( &tv );
                                        goto retry;
                                }
                                rs->sr_err = LDAP_OTHER;
@@ -280,8 +297,15 @@ retry:;
                                rs->sr_err = ldap_parse_extended_result( msc->msc_ld, res,
                                                NULL, &data, 0 );
                                if ( rs->sr_err == LDAP_SUCCESS ) {
-                                       rs->sr_err = ldap_result2error( msc->msc_ld, res, 1 );
+                                       int             err;
+
+                                       rs->sr_err = ldap_parse_result( msc->msc_ld, res,
+                                               &err, NULL, NULL, NULL, NULL, 1 );
                                        res = NULL;
+
+                                       if ( rs->sr_err == LDAP_SUCCESS ) {
+                                               rs->sr_err = err;
+                                       }
                                        
                                        /* FIXME: in case a referral 
                                         * is returned, should we try
@@ -334,11 +358,11 @@ retry:;
        /*
         * Set the network timeout if set
         */
-       if ( mi->mi_network_timeout != 0 ) {
+       if ( mt->mt_network_timeout != 0 ) {
                struct timeval  network_timeout;
 
                network_timeout.tv_usec = 0;
-               network_timeout.tv_sec = mi->mi_network_timeout;
+               network_timeout.tv_sec = mt->mt_network_timeout;
 
                ldap_set_option( msc->msc_ld, LDAP_OPT_NETWORK_TIMEOUT,
                                (void *)&network_timeout );
@@ -347,33 +371,55 @@ retry:;
        /*
         * If the connection DN is not null, an attempt to rewrite it is made
         */
-       if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
-               dc.target = mt;
-               dc.conn = op->o_conn;
-               dc.rs = rs;
-               dc.ctx = "bindDN";
-               
-               /*
-                * Rewrite the bind dn if needed
-                */
-               if ( ldap_back_dn_massage( &dc, &op->o_conn->c_dn,
-                                       &msc->msc_bound_ndn ) )
-               {
-                       goto error_return;
-               }
 
-               /* copy the DN idf needed */
-               if ( msc->msc_bound_ndn.bv_val == op->o_conn->c_dn.bv_val ) {
-                       ber_dupbv( &msc->msc_bound_ndn, &op->o_conn->c_dn );
+       if ( ispriv ) {
+               if ( !BER_BVISNULL( &mt->mt_pseudorootdn ) ) {
+                       ber_dupbv( &msc->msc_bound_ndn, &mt->mt_pseudorootdn );
+                       if ( !BER_BVISNULL( &mt->mt_pseudorootpw ) ) {
+                               ber_dupbv( &msc->msc_cred, &mt->mt_pseudorootpw );
+                       }
+
+               } else {
+                       ber_str2bv( "", 0, 1, &msc->msc_bound_ndn );
                }
 
-               assert( !BER_BVISNULL( &msc->msc_bound_ndn ) );
+               LDAP_BACK_CONN_ISPRIV_SET( msc );
 
        } else {
-               ber_str2bv( "", 0, 1, &msc->msc_bound_ndn );
+               BER_BVZERO( &msc->msc_cred );
+               BER_BVZERO( &msc->msc_bound_ndn );
+               if ( !BER_BVISEMPTY( &op->o_ndn )
+                       && SLAP_IS_AUTHZ_BACKEND( op )
+                       && isauthz )
+               {
+                       dc.target = mt;
+                       dc.conn = op->o_conn;
+                       dc.rs = rs;
+                       dc.ctx = "bindDN";
+               
+                       /*
+                        * Rewrite the bind dn if needed
+                        */
+                       if ( ldap_back_dn_massage( &dc, &op->o_conn->c_dn,
+                                               &msc->msc_bound_ndn ) )
+                       {
+                               ldap_unbind_ext_s( msc->msc_ld, NULL, NULL );
+                               goto error_return;
+                       }
+                       
+                       /* copy the DN idf needed */
+                       if ( msc->msc_bound_ndn.bv_val == op->o_conn->c_dn.bv_val ) {
+                               ber_dupbv( &msc->msc_bound_ndn, &op->o_conn->c_dn );
+                       }
+
+               } else {
+                       ber_str2bv( "", 0, 1, &msc->msc_bound_ndn );
+               }
        }
 
-       msc->msc_bound = META_UNBOUND;
+       assert( !BER_BVISNULL( &msc->msc_bound_ndn ) );
+
+       LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
 
 error_return:;
        if ( rs->sr_err == LDAP_SUCCESS ) {
@@ -382,6 +428,10 @@ error_return:;
                 */
                ( void )rewrite_session_init( mt->mt_rwmap.rwm_rw, op->o_conn );
 
+               if ( mt->mt_idle_timeout ) {
+                       msc->msc_time = op->o_time;
+               }
+
        } else {
                rs->sr_err = slap_map_api2result( rs );
                if ( sendok & LDAP_BACK_SENDERR ) {
@@ -412,29 +462,36 @@ meta_back_retry(
        metasingleconn_t        *msc = &mc->mc_conns[ candidate ];
 
 retry_lock:;
-       switch ( ldap_pvt_thread_mutex_trylock( &mi->mi_conn_mutex ) ) {
-       case LDAP_PVT_THREAD_EBUSY:
-       default:
-               ldap_pvt_thread_yield();
-               goto retry_lock;
-
-       case 0:
-               break;
-       }
+       ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 
        assert( mc->mc_refcnt > 0 );
 
        if ( mc->mc_refcnt == 1 ) {
-               ldap_pvt_thread_mutex_lock( &mc->mc_mutex );
+               char    buf[ SLAP_TEXT_BUFLEN ];
+
+               while ( ldap_pvt_thread_mutex_trylock( &mc->mc_mutex ) ) {
+                       ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+                       ldap_pvt_thread_yield();
+                       goto retry_lock;
+               }
 
-               ldap_unbind_ext_s( msc->msc_ld, NULL, NULL );
-               msc->msc_ld = NULL;
-               msc->msc_bound = 0;
+               snprintf( buf, sizeof( buf ),
+                       "retrying URI=\"%s\" DN=\"%s\"",
+                       mt->mt_uri,
+                       BER_BVISNULL( &msc->msc_bound_ndn ) ?
+                               "" : msc->msc_bound_ndn.bv_val );
+               Debug( LDAP_DEBUG_ANY,
+                       "%s meta_back_retry[%d]: %s.\n",
+                       op->o_log_prefix, candidate, buf );
+
+               meta_clear_one_candidate( msc );
+               LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
 
                ( void )rewrite_session_delete( mt->mt_rwmap.rwm_rw, op->o_conn );
 
                /* mc here must be the regular mc, reset and ready for init */
-               rc = meta_back_init_one_conn( op, rs, mt, msc, sendok );
+               rc = meta_back_init_one_conn( op, rs, mt, mc, candidate,
+                       LDAP_BACK_CONN_ISPRIV( mc ), sendok );
 
                if ( rc == LDAP_SUCCESS ) {
                        rc = meta_back_single_dobind( op, rs, mc, candidate,
@@ -444,7 +501,11 @@ retry_lock:;
                ldap_pvt_thread_mutex_unlock( &mc->mc_mutex );
        }
 
-       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+       if ( rc != LDAP_SUCCESS ) {
+               mc->mc_tainted = 1;
+       }
+
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 
        return rc == LDAP_SUCCESS ? 1 : 0;
 }
@@ -459,7 +520,7 @@ meta_back_conn_cb( Operation *op, SlapReply *rs )
 
        switch ( rs->sr_type ) {
        case REP_SEARCH:
-               ((int *)op->o_callback->sc_private)[0] = (int)op->o_private;
+               ((long *)op->o_callback->sc_private)[0] = (long)op->o_private;
                break;
 
        case REP_SEARCHREF:
@@ -481,7 +542,7 @@ meta_back_get_candidate(
        struct berval   *ndn )
 {
        metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
-       int             candidate;
+       long            candidate;
 
        /*
         * tries to get a unique candidate
@@ -539,6 +600,7 @@ meta_back_get_candidate(
                         * a candidate, try using it (FIXME: YMMV) */
                        if ( mi->mi_defaulttarget != META_DEFAULT_TARGET_NONE
                                && meta_back_is_candidate( &mi->mi_targets[ mi->mi_defaulttarget ].mt_nsuffix,
+                                               mi->mi_targets[ mi->mi_defaulttarget ].mt_scope,
                                                ndn, op->o_tag == LDAP_REQ_SEARCH ? op->ors_scope : LDAP_SCOPE_BASE ) )
                        {
                                candidate = mi->mi_defaulttarget;
@@ -551,11 +613,16 @@ meta_back_get_candidate(
                        }
                        break;
                }
+
+       } else {
+               rs->sr_err = LDAP_SUCCESS;
        }
 
        return candidate;
 }
 
+static void    *meta_back_candidates_dummy;
+
 static void
 meta_back_candidates_keyfree(
        void            *key,
@@ -577,7 +644,7 @@ meta_back_candidates_get( Operation *op )
                void            *data = NULL;
 
                ldap_pvt_thread_pool_getkey( op->o_threadctx,
-                               meta_back_candidates_keyfree, &data, NULL );
+                               &meta_back_candidates_dummy, &data, NULL );
                mc = (metacandidates_t *)data;
 
        } else {
@@ -593,7 +660,7 @@ meta_back_candidates_get( Operation *op )
 
                        data = (void *)mc;
                        ldap_pvt_thread_pool_setkey( op->o_threadctx,
-                                       meta_back_candidates_keyfree, data,
+                                       &meta_back_candidates_dummy, data,
                                        meta_back_candidates_keyfree );
 
                } else {
@@ -669,24 +736,50 @@ meta_back_getconn(
 
        SlapReply       *candidates = meta_back_candidates_get( op );
 
-       /* Searches for a metaconn in the avl tree */
-       mc_curr.mc_conn = op->o_conn;
-retry_lock:;
-       switch ( ldap_pvt_thread_mutex_trylock( &mi->mi_conn_mutex ) ) {
-       case LDAP_PVT_THREAD_EBUSY:
-       default:
-               ldap_pvt_thread_yield();
-               goto retry_lock;
+       /* Internal searches are privileged and shared. So is root. */
+       /* FIXME: there seem to be concurrency issues */
+       if ( op->o_do_not_cache || be_isroot( op ) ) {
+               mc_curr.mc_local_ndn = op->o_bd->be_rootndn;
+               LDAP_BACK_CONN_ISPRIV_SET( &mc_curr );
+               mc_curr.mc_conn = LDAP_BACK_PCONN_SET( op );
 
-       case 0:
-               break;
+       } else {
+               mc_curr.mc_local_ndn = op->o_ndn;
+
+               /* Explicit binds must not be shared */
+               if ( op->o_tag == LDAP_REQ_BIND || SLAP_IS_AUTHZ_BACKEND( op ) ) {
+                       mc_curr.mc_conn = op->o_conn;
+       
+               } else {
+                       mc_curr.mc_conn = LDAP_BACK_PCONN_SET( op );
+               }
        }
-       mc = (metaconn_t *)avl_find( mi->mi_conntree, 
-               (caddr_t)&mc_curr, meta_back_conn_cmp );
-       if ( mc ) {
-               mc->mc_refcnt++;
+
+       /* Explicit Bind requests always get their own conn */
+       if ( !( sendok & LDAP_BACK_BINDING ) ) {
+               /* Searches for a metaconn in the avl tree */
+retry_lock:
+               ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+               mc = (metaconn_t *)avl_find( mi->mi_conninfo.lai_tree, 
+                       (caddr_t)&mc_curr, meta_back_conn_cmp );
+               if ( mc ) {
+                       if ( mc->mc_tainted ) {
+                               rs->sr_err = LDAP_UNAVAILABLE;
+                               rs->sr_text = "remote server unavailable";
+                               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+                               return NULL;
+                       }
+                       
+                       /* Don't reuse connections while they're still binding */
+                       if ( LDAP_BACK_CONN_BINDING( mc ) ) {
+                               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+                               ldap_pvt_thread_yield();
+                               goto retry_lock;
+                       }
+                       mc->mc_refcnt++;
+               }
+               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
        }
-       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
 
        switch ( op->o_tag ) {
        case LDAP_REQ_ADD:
@@ -736,22 +829,28 @@ retry_lock:;
                /* Looks like we didn't get a bind. Open a new session... */
                if ( mc == NULL ) {
                        mc = metaconn_alloc( op );
-                       mc->mc_conn = op->o_conn;
+                       mc->mc_conn = mc_curr.mc_conn;
+                       ber_dupbv( &mc->mc_local_ndn, &mc_curr.mc_local_ndn );
                        new_conn = 1;
+                       if ( sendok & LDAP_BACK_BINDING ) {
+                               LDAP_BACK_CONN_BINDING_SET( mc );
+                       }
                }
 
                for ( i = 0; i < mi->mi_ntargets; i++ ) {
+                       metatarget_t            *mt = &mi->mi_targets[ i ];
 
                        /*
                         * The target is activated; if needed, it is
                         * also init'd
                         */
-                       int lerr = meta_back_init_one_conn( op, rs, &mi->mi_targets[ i ],
-                                       &mc->mc_conns[ i ], sendok );
-                       if ( lerr == LDAP_SUCCESS ) {
+                       candidates[ i ].sr_err = meta_back_init_one_conn( op,
+                               rs, mt, mc, i,
+                               LDAP_BACK_CONN_ISPRIV( &mc_curr ), sendok );
+                       if ( candidates[ i ].sr_err == LDAP_SUCCESS ) {
                                candidates[ i ].sr_tag = META_CANDIDATE;
                                ncandidates++;
-                               
+       
                        } else {
                                
                                /*
@@ -760,7 +859,7 @@ retry_lock:;
                                 * be tried?
                                 */
                                candidates[ i ].sr_tag = META_NOT_CANDIDATE;
-                               err = lerr;
+                               err = candidates[ i ].sr_err;
                                continue;
                        }
                }
@@ -799,7 +898,10 @@ retry_lock:;
        }
 
        if ( op_type == META_OP_REQUIRE_SINGLE ) {
-               int     j;
+               metatarget_t            *mt = NULL;
+               metasingleconn_t        *msc = NULL;
+
+               int                     j;
 
                for ( j = 0; j < mi->mi_ntargets; j++ ) {
                        candidates[ j ].sr_tag = META_NOT_CANDIDATE;
@@ -817,6 +919,10 @@ retry_lock:;
                        }
        
                        if ( rs->sr_err != LDAP_SUCCESS ) {
+                               if ( mc != NULL ) {
+                                       meta_back_release_conn( op, mc );
+                               }
+
                                if ( sendok & LDAP_BACK_SENDERR ) {
                                        if ( rs->sr_err == LDAP_NO_SUCH_OBJECT ) {
                                                rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
@@ -825,52 +931,54 @@ retry_lock:;
                                        rs->sr_text = NULL;
                                        rs->sr_matched = NULL;
                                }
+                       
                                return NULL;
                        }
                }
 
                if ( newparent && meta_back_get_candidate( op, rs, op->orr_nnewSup ) != i )
                {
+                       if ( mc != NULL ) {
+                               meta_back_release_conn( op, mc );
+                       }
+
                        rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                        rs->sr_text = "cross-target rename not supported";
                        if ( sendok & LDAP_BACK_SENDERR ) {
                                send_ldap_result( op, rs );
                                rs->sr_text = NULL;
                        }
+
                        return NULL;
                }
 
                Debug( LDAP_DEBUG_TRACE,
-       "==>meta_back_getconn: got target %d for ndn=\"%s\" from cache\n",
+       "==>meta_back_getconn: got target=%d for ndn=\"%s\" from cache\n",
                                i, op->o_req_ndn.bv_val, 0 );
 
                if ( mc == NULL ) {
                        /* Retries searching for a metaconn in the avl tree
                         * the reason is that the connection might have been
                         * created by meta_back_get_candidate() */
-                       mc_curr.mc_conn = op->o_conn;
-retry_lock2:;
-                       switch ( ldap_pvt_thread_mutex_trylock( &mi->mi_conn_mutex ) ) {
-                       case LDAP_PVT_THREAD_EBUSY:
-                       default:
-                               ldap_pvt_thread_yield();
-                               goto retry_lock2;
-
-                       case 0:
-                               break;
-                       }
-                       mc = (metaconn_t *)avl_find( mi->mi_conntree, 
-                               (caddr_t)&mc_curr, meta_back_conn_cmp );
-                       if ( mc != NULL ) {
-                               mc->mc_refcnt++;
+                       if ( !( sendok & LDAP_BACK_BINDING ) ) {
+                               ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+                               mc = (metaconn_t *)avl_find( mi->mi_conninfo.lai_tree, 
+                                       (caddr_t)&mc_curr, meta_back_conn_cmp );
+                               if ( mc != NULL ) {
+                                       mc->mc_refcnt++;
+                               }
+                               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
                        }
-                       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
 
                        /* Looks like we didn't get a bind. Open a new session... */
                        if ( mc == NULL ) {
                                mc = metaconn_alloc( op );
-                               mc->mc_conn = op->o_conn;
+                               mc->mc_conn = mc_curr.mc_conn;
+                               ber_dupbv( &mc->mc_local_ndn, &mc_curr.mc_local_ndn );
                                new_conn = 1;
+                               if ( sendok & LDAP_BACK_BINDING ) {
+                                       LDAP_BACK_CONN_BINDING_SET( mc );
+                               }
                        }
                }
 
@@ -879,13 +987,16 @@ retry_lock2:;
                 */
                ( void )meta_clear_unused_candidates( op, i );
 
+               mt = &mi->mi_targets[ i ];
+               msc = &mc->mc_conns[ i ];
+
                /*
                 * The target is activated; if needed, it is
                 * also init'd. In case of error, meta_back_init_one_conn
                 * sends the appropriate result.
                 */
-               err = meta_back_init_one_conn( op, rs, &mi->mi_targets[ i ],
-                               &mc->mc_conns[ i ], sendok );
+               err = meta_back_init_one_conn( op, rs, mt, mc, i,
+                       LDAP_BACK_CONN_ISPRIV( &mc_curr ), sendok );
                if ( err != LDAP_SUCCESS ) {
                        /*
                         * FIXME: in case one target cannot
@@ -894,7 +1005,7 @@ retry_lock2:;
                         */
                        candidates[ i ].sr_tag = META_NOT_CANDIDATE;
                        if ( new_conn ) {
-                               (void)meta_clear_one_candidate( &mc->mc_conns[ i ] );
+                               (void)meta_clear_one_candidate( msc );
                                meta_back_freeconn( op, mc );
 
                        } else {
@@ -903,6 +1014,7 @@ retry_lock2:;
                        return NULL;
                }
 
+               candidates[ i ].sr_err = LDAP_SUCCESS;
                candidates[ i ].sr_tag = META_CANDIDATE;
                ncandidates++;
 
@@ -918,14 +1030,23 @@ retry_lock2:;
                /* Looks like we didn't get a bind. Open a new session... */
                if ( mc == NULL ) {
                        mc = metaconn_alloc( op );
-                       mc->mc_conn = op->o_conn;
+                       mc->mc_conn = mc_curr.mc_conn;
+                       ber_dupbv( &mc->mc_local_ndn, &mc_curr.mc_local_ndn );
                        new_conn = 1;
+                       if ( sendok & LDAP_BACK_BINDING ) {
+                               LDAP_BACK_CONN_BINDING_SET( mc );
+                       }
                }
 
                for ( i = 0; i < mi->mi_ntargets; i++ ) {
+                       metatarget_t            *mt = &mi->mi_targets[ i ];
+                       metasingleconn_t        *msc = &mc->mc_conns[ i ];
+
                        if ( i == cached 
-                               || meta_back_is_candidate( &mi->mi_targets[ i ].mt_nsuffix,
-                                               &op->o_req_ndn, LDAP_SCOPE_SUBTREE ) )
+                               || meta_back_is_candidate( &mt->mt_nsuffix,
+                                               mt->mt_scope,
+                                               &op->o_req_ndn,
+                                               LDAP_SCOPE_SUBTREE ) )
                        {
 
                                /*
@@ -933,13 +1054,15 @@ retry_lock2:;
                                 * also init'd
                                 */
                                int lerr = meta_back_init_one_conn( op, rs,
-                                               &mi->mi_targets[ i ],
-                                               &mc->mc_conns[ i ], sendok );
+                                               mt, mc, i,
+                                               LDAP_BACK_CONN_ISPRIV( &mc_curr ),
+                                               sendok );
                                if ( lerr == LDAP_SUCCESS ) {
                                        candidates[ i ].sr_tag = META_CANDIDATE;
+                                       candidates[ i ].sr_err = LDAP_SUCCESS;
                                        ncandidates++;
 
-                                       Debug( LDAP_DEBUG_TRACE, "%s: meta_back_init_one_conn(%d)\n",
+                                       Debug( LDAP_DEBUG_TRACE, "%s: meta_back_getconn[%d]\n",
                                                op->o_log_prefix, i, 0 );
 
                                } else {
@@ -950,12 +1073,13 @@ retry_lock2:;
                                         * be tried?
                                         */
                                        if ( new_conn ) {
-                                               ( void )meta_clear_one_candidate( &mc->mc_conns[ i ] );
+                                               ( void )meta_clear_one_candidate( msc );
                                        }
-                                       candidates[ i ].sr_tag = META_NOT_CANDIDATE;
+                                       /* leave the target candidate, but record the error for later use */
+                                       candidates[ i ].sr_err = lerr;
                                        err = lerr;
 
-                                       Debug( LDAP_DEBUG_ANY, "%s: meta_back_init_one_conn(%d) failed: %d\n",
+                                       Debug( LDAP_DEBUG_ANY, "%s: meta_back_getconn[%d] failed: %d\n",
                                                op->o_log_prefix, i, lerr );
 
                                        continue;
@@ -963,7 +1087,7 @@ retry_lock2:;
 
                        } else {
                                if ( new_conn ) {
-                                       ( void )meta_clear_one_candidate( &mc->mc_conns[ i ] );
+                                       ( void )meta_clear_one_candidate( msc );
                                }
                                candidates[ i ].sr_tag = META_NOT_CANDIDATE;
                        }
@@ -1003,24 +1127,15 @@ done:;
                /*
                 * Inserts the newly created metaconn in the avl tree
                 */
-retry_lock3:;
-               switch ( ldap_pvt_thread_mutex_trylock( &mi->mi_conn_mutex ) ) {
-               case LDAP_PVT_THREAD_EBUSY:
-               default:
-                       ldap_pvt_thread_yield();
-                       goto retry_lock3;
-
-               case 0:
-                       break;
-               }
-               err = avl_insert( &mi->mi_conntree, ( caddr_t )mc,
+               ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+               err = avl_insert( &mi->mi_conninfo.lai_tree, ( caddr_t )mc,
                                meta_back_conn_cmp, meta_back_conn_dup );
 
 #if PRINT_CONNTREE > 0
-               myprint( mi->mi_conntree );
+               myprint( mi->mi_conninfo.lai_tree );
 #endif /* PRINT_CONNTREE */
                
-               ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 
                /*
                 * Err could be -1 in case a duplicate metaconn is inserted
@@ -1031,7 +1146,8 @@ retry_lock3:;
                if ( err != 0 ) {
                        Debug( LDAP_DEBUG_ANY,
                                "%s meta_back_getconn: candidates=%d conn=%ld insert failed\n",
-                               op->o_log_prefix, ncandidates, mc->mc_conn->c_connid );
+                               op->o_log_prefix, ncandidates,
+                               LDAP_BACK_PCONN_ID( mc->mc_conn ) );
                
                        rs->sr_err = LDAP_OTHER;
                        rs->sr_text = "Internal server error";
@@ -1045,12 +1161,14 @@ retry_lock3:;
 
                Debug( LDAP_DEBUG_TRACE,
                        "%s meta_back_getconn: candidates=%d conn=%ld inserted\n",
-                       op->o_log_prefix, ncandidates, mc->mc_conn->c_connid );
+                       op->o_log_prefix, ncandidates,
+                       LDAP_BACK_PCONN_ID( mc->mc_conn ) );
 
        } else {
                Debug( LDAP_DEBUG_TRACE,
                        "%s meta_back_getconn: candidates=%d conn=%ld fetched\n",
-                       op->o_log_prefix, ncandidates, mc->mc_conn->c_connid );
+                       op->o_log_prefix, ncandidates,
+                       LDAP_BACK_PCONN_ID( mc->mc_conn ) );
        }
        
        return mc;
@@ -1065,18 +1183,14 @@ meta_back_release_conn(
 
        assert( mc != NULL );
 
-retry_lock:;
-       switch ( ldap_pvt_thread_mutex_trylock( &mi->mi_conn_mutex ) ) {
-       case LDAP_PVT_THREAD_EBUSY:
-       default:
-               ldap_pvt_thread_yield();
-               goto retry_lock;
-
-       case 0:
-               break;
-       }
-
+       ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
        assert( mc->mc_refcnt > 0 );
        mc->mc_refcnt--;
-       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+       LDAP_BACK_CONN_BINDING_CLEAR( mc );
+       if ( mc->mc_refcnt == 0 && mc->mc_tainted ) {
+               (void)avl_delete( &mi->mi_conninfo.lai_tree, ( caddr_t )mc,
+                               meta_back_conn_cmp );
+               meta_back_conn_free( mc );
+       }
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 }