]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-meta/conn.c
don't lookup rootdn if the password is incorrect (ITS#4004)
[openldap] / servers / slapd / back-meta / conn.c
index 4d4bf13ed4f3198e4cefe563ce8375aaad5dadb9..a0ae2801249fe69e0b607e747dff707e43900006 100644 (file)
@@ -24,6 +24,7 @@
 
 #include <stdio.h>
 
+#include <ac/errno.h>
 #include <ac/socket.h>
 #include <ac/string.h>
 
@@ -121,33 +122,32 @@ myprint( Avlnode *root )
  */
 static metaconn_t *
 metaconn_alloc(
-       int             ntargets )
+               Operation               *op )
 {
+       metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
        metaconn_t      *mc;
+       int             i, ntargets = mi->mi_ntargets;
 
        assert( ntargets > 0 );
 
-       /* malloc once only; leave an extra one for one-past-end */
+       /* malloc all in one */
        mc = ( metaconn_t * )ch_malloc( sizeof( metaconn_t )
-                       + sizeof( metasingleconn_t ) * ( ntargets + 1 ) );
+                       + sizeof( metasingleconn_t ) * ntargets );
        if ( mc == NULL ) {
                return NULL;
        }
 
-       mc->mc_conns = ( metasingleconn_t * )&mc[ 1 ];
-
-       /* FIXME: needed by META_LAST() */
-       mc->mc_conns[ ntargets ].msc_candidate = META_LAST_CONN;
-
-       for ( ; ntargets-- > 0; ) {
-               mc->mc_conns[ ntargets ].msc_ld = NULL;
-               BER_BVZERO( &mc->mc_conns[ ntargets ].msc_bound_ndn );
-               BER_BVZERO( &mc->mc_conns[ ntargets ].msc_cred );
-               mc->mc_conns[ ntargets ].msc_bound = META_UNBOUND;
+       for ( i = 0; i < ntargets; i++ ) {
+               mc->mc_conns[ i ].msc_ld = NULL;
+               BER_BVZERO( &mc->mc_conns[ i ].msc_bound_ndn );
+               BER_BVZERO( &mc->mc_conns[ i ].msc_cred );
+               mc->mc_conns[ i ].msc_bound = META_UNBOUND;
+               mc->mc_conns[ i ].msc_info = mi;
        }
 
        mc->mc_auth_target = META_BOUND_NONE;
        ldap_pvt_thread_mutex_init( &mc->mc_mutex );
+       mc->mc_refcnt = 1;
 
        return mc;
 }
@@ -157,19 +157,36 @@ metaconn_alloc(
  *
  * clears a metaconn
  */
+
 void
 meta_back_conn_free(
        metaconn_t      *mc )
 {
-       if ( mc == NULL ) {
-               return;
-       }
+       assert( mc != NULL );
+       assert( mc->mc_refcnt == 0 );
 
        ldap_pvt_thread_mutex_destroy( &mc->mc_mutex );
-       
        free( mc );
 }
 
+static void
+meta_back_freeconn(
+       Operation       *op,
+       metaconn_t      *mc )
+{
+       metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
+
+       assert( mc != NULL );
+
+       ldap_pvt_thread_mutex_lock( &mi->mi_conn_mutex );
+
+       if ( --mc->mc_refcnt == 0 ) {
+               meta_back_conn_free( mc );
+       }
+
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+}
+
 /*
  * meta_back_init_one_conn
  * 
@@ -191,8 +208,7 @@ meta_back_init_one_conn(
         * Already init'ed
         */
        if ( msc->msc_ld != NULL ) {
-               rs->sr_err = LDAP_SUCCESS;
-               goto error_return;
+               return rs->sr_err = LDAP_SUCCESS;
        }
        
        /*
@@ -216,21 +232,21 @@ meta_back_init_one_conn(
        }
 
 #ifdef HAVE_TLS
-       /* start TLS ("start-tls"/"try-start-tls" statements) */
+       /* start TLS ("tls [try-]{start|propagate}" statement) */
        if ( ( LDAP_BACK_USE_TLS( mi ) || ( op->o_conn->c_is_tls && LDAP_BACK_PROPAGATE_TLS( mi ) ) )
                        && !ldap_is_ldaps_url( mt->mt_uri ) )
        {
 #ifdef SLAP_STARTTLS_ASYNCHRONOUS
                /*
-                * use asynchronous StartTLS
-                * in case, chase referral (not implemented yet)
+                * use asynchronous StartTLS; in case, chase referral
+                * FIXME: OpenLDAP does not return referral on StartTLS yet
                 */
                int             msgid;
 
                rs->sr_err = ldap_start_tls( msc->msc_ld, NULL, NULL, &msgid );
                if ( rs->sr_err == LDAP_SUCCESS ) {
                        LDAPMessage     *res = NULL;
-                       int             rc, retries = 1;
+                       int             rc, nretries = mt->mt_nretries;
                        struct timeval  tv = { 0, 0 };
 
 retry:;
@@ -239,8 +255,10 @@ retry:;
                                rs->sr_err = LDAP_OTHER;
 
                        } else if ( rc == 0 ) {
-                               if ( retries ) {
-                                       retries--;
+                               if ( nretries != 0 ) {
+                                       if ( nretries > 0 ) {
+                                               nretries--;
+                                       }
                                        tv.tv_sec = 0;
                                        tv.tv_usec = 100000;
                                        goto retry;
@@ -317,16 +335,11 @@ retry:;
                                (void *)&network_timeout );
        }
 
-       /*
-        * Sets a cookie for the rewrite session
-        */
-       ( void )rewrite_session_init( mt->mt_rwmap.rwm_rw, op->o_conn );
-
        /*
         * If the connection DN is not null, an attempt to rewrite it is made
         */
        if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
-               dc.rwmap = &mt->mt_rwmap;
+               dc.target = mt;
                dc.conn = op->o_conn;
                dc.rs = rs;
                dc.ctx = "bindDN";
@@ -354,7 +367,13 @@ retry:;
        msc->msc_bound = META_UNBOUND;
 
 error_return:;
-       if ( rs->sr_err != LDAP_SUCCESS ) {
+       if ( rs->sr_err == LDAP_SUCCESS ) {
+               /*
+                * Sets a cookie for the rewrite session
+                */
+               ( void )rewrite_session_init( mt->mt_rwmap.rwm_rw, op->o_conn );
+
+       } else {
                rs->sr_err = slap_map_api2result( rs );
                if ( sendok & LDAP_BACK_SENDERR ) {
                        send_ldap_result( op, rs );
@@ -379,25 +398,40 @@ meta_back_retry(
        ldap_back_send_t        sendok )
 {
        metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
-       metatarget_t            *mt = mi->mi_targets[ candidate ];
-       int                     rc;
+       metatarget_t            *mt = &mi->mi_targets[ candidate ];
+       int                     rc = LDAP_UNAVAILABLE;
        metasingleconn_t        *msc = &mc->mc_conns[ candidate ];
 
-       ldap_pvt_thread_mutex_lock( &mc->mc_mutex );
+retry_lock:;
+       ldap_pvt_thread_mutex_lock( &mi->mi_conn_mutex );
+
+       assert( mc->mc_refcnt > 0 );
 
-       ldap_unbind_ext_s( msc->msc_ld, NULL, NULL );
-        msc->msc_ld = NULL;
-        msc->msc_bound = 0;
+       if ( mc->mc_refcnt == 1 ) {
+               while ( ldap_pvt_thread_mutex_trylock( &mc->mc_mutex ) ) {
+                       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+                       ldap_pvt_thread_yield();
+                       goto retry_lock;
+               }
+
+               ldap_unbind_ext_s( msc->msc_ld, NULL, NULL );
+               msc->msc_ld = NULL;
+               msc->msc_bound = 0;
 
-        /* mc here must be the regular mc, reset and ready for init */
-        rc = meta_back_init_one_conn( op, rs, mt, msc, sendok );
+               ( void )rewrite_session_delete( mt->mt_rwmap.rwm_rw, op->o_conn );
 
-       if ( rc == LDAP_SUCCESS ) {
-               rc = meta_back_single_dobind( op, rs, mc, candidate, sendok,
-                               META_BIND_NRETRIES );
-        }
+               /* mc here must be the regular mc, reset and ready for init */
+               rc = meta_back_init_one_conn( op, rs, mt, msc, sendok );
 
-       ldap_pvt_thread_mutex_unlock( &mc->mc_mutex );
+               if ( rc == LDAP_SUCCESS ) {
+                       rc = meta_back_single_dobind( op, rs, mc, candidate,
+                                       sendok, mt->mt_nretries, 0 );
+               }
+
+               ldap_pvt_thread_mutex_unlock( &mc->mc_mutex );
+       }
+
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
 
        return rc == LDAP_SUCCESS ? 1 : 0;
 }
@@ -491,7 +525,8 @@ meta_back_get_candidate(
                         * and a default target is defined, and it is
                         * a candidate, try using it (FIXME: YMMV) */
                        if ( mi->mi_defaulttarget != META_DEFAULT_TARGET_NONE
-                               && meta_back_is_candidate( &mi->mi_targets[ mi->mi_defaulttarget ]->mt_nsuffix,
+                               && meta_back_is_candidate( &mi->mi_targets[ mi->mi_defaulttarget ].mt_nsuffix,
+                                               mi->mi_targets[ mi->mi_defaulttarget ].mt_scope,
                                                ndn, op->o_tag == LDAP_REQ_SEARCH ? op->ors_scope : LDAP_SCOPE_BASE ) )
                        {
                                candidate = mi->mi_defaulttarget;
@@ -504,45 +539,69 @@ meta_back_get_candidate(
                        }
                        break;
                }
+
+       } else {
+               rs->sr_err = LDAP_SUCCESS;
        }
 
        return candidate;
 }
 
+static void    *meta_back_candidates_dummy;
+
 static void
-meta_back_candidate_keyfree(
+meta_back_candidates_keyfree(
        void            *key,
        void            *data )
 {
+       metacandidates_t        *mc = (metacandidates_t *)data;
+
+       ber_memfree_x( mc->mc_candidates, NULL );
        ber_memfree_x( data, NULL );
 }
 
 SlapReply *
 meta_back_candidates_get( Operation *op )
 {
-       metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
-       void            *data = NULL;
+       metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
+       metacandidates_t        *mc;
 
        if ( op->o_threadctx ) {
+               void            *data = NULL;
+
                ldap_pvt_thread_pool_getkey( op->o_threadctx,
-                               meta_back_candidate_keyfree, &data, NULL );
+                               &meta_back_candidates_dummy, &data, NULL );
+               mc = (metacandidates_t *)data;
+
        } else {
-               data = (void *)mi->mi_candidates;
+               mc = mi->mi_candidates;
        }
 
-       if ( data == NULL ) {
-               data = ber_memalloc( sizeof( SlapReply ) * mi->mi_ntargets );
+       if ( mc == NULL ) {
+               mc = ch_calloc( sizeof( metacandidates_t ), 1 );
+               mc->mc_ntargets = mi->mi_ntargets;
+               mc->mc_candidates = ch_calloc( sizeof( SlapReply ), mc->mc_ntargets );
                if ( op->o_threadctx ) {
+                       void            *data = NULL;
+
+                       data = (void *)mc;
                        ldap_pvt_thread_pool_setkey( op->o_threadctx,
-                                       meta_back_candidate_keyfree, data,
-                                       meta_back_candidate_keyfree );
+                                       &meta_back_candidates_dummy, data,
+                                       meta_back_candidates_keyfree );
 
                } else {
-                       mi->mi_candidates = (SlapReply *)data;
+                       mi->mi_candidates = mc;
                }
+
+       } else if ( mc->mc_ntargets < mi->mi_ntargets ) {
+               /* NOTE: in the future, may want to allow back-config
+                * to add/remove targets from back-meta... */
+               mc->mc_ntargets = mi->mi_ntargets;
+               mc->mc_candidates = ch_realloc( mc->mc_candidates,
+                               sizeof( SlapReply ) * mc->mc_ntargets );
        }
 
-       return (SlapReply *)data;
+       return mc->mc_candidates;
 }
 
 /*
@@ -586,11 +645,14 @@ meta_back_getconn(
        ldap_back_send_t        sendok )
 {
        metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
-       metaconn_t      *mc, mc_curr;
+       metaconn_t      *mc = NULL,
+                       mc_curr = { 0 };
        int             cached = META_TARGET_NONE,
                        i = META_TARGET_NONE,
                        err = LDAP_SUCCESS,
-                       new_conn = 0;
+                       new_conn = 0,
+                       ncandidates = 0;
+
 
        meta_op_type    op_type = META_OP_REQUIRE_SINGLE;
        int             parent = 0,
@@ -605,6 +667,9 @@ meta_back_getconn(
        ldap_pvt_thread_mutex_lock( &mi->mi_conn_mutex );
        mc = (metaconn_t *)avl_find( mi->mi_conntree, 
                (caddr_t)&mc_curr, meta_back_conn_cmp );
+       if ( mc ) {
+               mc->mc_refcnt++;
+       }
        ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
 
        switch ( op->o_tag ) {
@@ -653,8 +718,8 @@ meta_back_getconn(
        if ( op_type == META_OP_REQUIRE_ALL ) {
 
                /* Looks like we didn't get a bind. Open a new session... */
-               if ( !mc ) {
-                       mc = metaconn_alloc( mi->mi_ntargets );
+               if ( mc == NULL ) {
+                       mc = metaconn_alloc( op );
                        mc->mc_conn = op->o_conn;
                        new_conn = 1;
                }
@@ -665,10 +730,13 @@ meta_back_getconn(
                         * The target is activated; if needed, it is
                         * also init'd
                         */
-                       int lerr = meta_back_init_one_conn( op, rs, mi->mi_targets[ i ],
-                                       &mc->mc_conns[ i ], sendok );
-                       if ( lerr == LDAP_SUCCESS ) {
+                       candidates[ i ].sr_err =
+                               meta_back_init_one_conn( op, rs,
+                                               &mi->mi_targets[ i ],
+                                               &mc->mc_conns[ i ], sendok );
+                       if ( candidates[ i ].sr_err == LDAP_SUCCESS ) {
                                candidates[ i ].sr_tag = META_CANDIDATE;
+                               ncandidates++;
                                
                        } else {
                                
@@ -678,10 +746,34 @@ meta_back_getconn(
                                 * be tried?
                                 */
                                candidates[ i ].sr_tag = META_NOT_CANDIDATE;
-                               err = lerr;
+                               err = candidates[ i ].sr_err;
                                continue;
                        }
                }
+
+               if ( ncandidates == 0 ) {
+                       if ( new_conn ) {
+                               meta_back_freeconn( op, mc );
+
+                       } else {
+                               meta_back_release_conn( op, mc );
+                       }
+
+                       rs->sr_err = LDAP_NO_SUCH_OBJECT;
+                       rs->sr_text = "Unable to select valid candidates";
+
+                       if ( sendok & LDAP_BACK_SENDERR ) {
+                               if ( rs->sr_err == LDAP_NO_SUCH_OBJECT ) {
+                                       rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
+                               }
+                               send_ldap_result( op, rs );
+                               rs->sr_text = NULL;
+                               rs->sr_matched = NULL;
+                       }
+
+                       return NULL;
+               }
+
                goto done;
        }
        
@@ -711,41 +803,62 @@ meta_back_getconn(
                        }
        
                        if ( rs->sr_err != LDAP_SUCCESS ) {
+                               if ( mc != NULL ) {
+                                       meta_back_release_conn( op, mc );
+                               }
+
                                if ( sendok & LDAP_BACK_SENDERR ) {
+                                       if ( rs->sr_err == LDAP_NO_SUCH_OBJECT ) {
+                                               rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
+                                       }
                                        send_ldap_result( op, rs );
                                        rs->sr_text = NULL;
+                                       rs->sr_matched = NULL;
                                }
+                       
                                return NULL;
                        }
                }
 
                if ( newparent && meta_back_get_candidate( op, rs, op->orr_nnewSup ) != i )
                {
+                       if ( mc != NULL ) {
+                               meta_back_release_conn( op, mc );
+                       }
+
                        rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                        rs->sr_text = "cross-target rename not supported";
                        if ( sendok & LDAP_BACK_SENDERR ) {
                                send_ldap_result( op, rs );
                                rs->sr_text = NULL;
                        }
+
                        return NULL;
                }
 
-               Debug( LDAP_DEBUG_CACHE,
+               Debug( LDAP_DEBUG_TRACE,
        "==>meta_back_getconn: got target %d for ndn=\"%s\" from cache\n",
                                i, op->o_req_ndn.bv_val, 0 );
 
-               /* Retries searching for a metaconn in the avl tree */
-               mc_curr.mc_conn = op->o_conn;
-               ldap_pvt_thread_mutex_lock( &mi->mi_conn_mutex );
-               mc = (metaconn_t *)avl_find( mi->mi_conntree, 
-                       (caddr_t)&mc_curr, meta_back_conn_cmp );
-               ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+               if ( mc == NULL ) {
+                       /* Retries searching for a metaconn in the avl tree
+                        * the reason is that the connection might have been
+                        * created by meta_back_get_candidate() */
+                       mc_curr.mc_conn = op->o_conn;
+                       ldap_pvt_thread_mutex_lock( &mi->mi_conn_mutex );
+                       mc = (metaconn_t *)avl_find( mi->mi_conntree, 
+                               (caddr_t)&mc_curr, meta_back_conn_cmp );
+                       if ( mc != NULL ) {
+                               mc->mc_refcnt++;
+                       }
+                       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
 
-               /* Looks like we didn't get a bind. Open a new session... */
-               if ( !mc ) {
-                       mc = metaconn_alloc( mi->mi_ntargets );
-                       mc->mc_conn = op->o_conn;
-                       new_conn = 1;
+                       /* Looks like we didn't get a bind. Open a new session... */
+                       if ( mc == NULL ) {
+                               mc = metaconn_alloc( op );
+                               mc->mc_conn = op->o_conn;
+                               new_conn = 1;
+                       }
                }
 
                /*
@@ -758,13 +871,9 @@ meta_back_getconn(
                 * also init'd. In case of error, meta_back_init_one_conn
                 * sends the appropriate result.
                 */
-               err = meta_back_init_one_conn( op, rs, mi->mi_targets[ i ],
+               err = meta_back_init_one_conn( op, rs, &mi->mi_targets[ i ],
                                &mc->mc_conns[ i ], sendok );
-               if ( err == LDAP_SUCCESS ) {
-                       candidates[ i ].sr_tag = META_CANDIDATE;
-
-               } else {
-               
+               if ( err != LDAP_SUCCESS ) {
                        /*
                         * FIXME: in case one target cannot
                         * be init'd, should the other ones
@@ -772,12 +881,19 @@ meta_back_getconn(
                         */
                        candidates[ i ].sr_tag = META_NOT_CANDIDATE;
                        if ( new_conn ) {
-                               ( void )meta_clear_one_candidate( &mc->mc_conns[ i ] );
-                               meta_back_conn_free( mc );
+                               (void)meta_clear_one_candidate( &mc->mc_conns[ i ] );
+                               meta_back_freeconn( op, mc );
+
+                       } else {
+                               meta_back_release_conn( op, mc );
                        }
                        return NULL;
                }
 
+               candidates[ i ].sr_err = LDAP_SUCCESS;
+               candidates[ i ].sr_tag = META_CANDIDATE;
+               ncandidates++;
+
                if ( candidate ) {
                        *candidate = i;
                }
@@ -788,15 +904,16 @@ meta_back_getconn(
        } else {
 
                /* Looks like we didn't get a bind. Open a new session... */
-               if ( !mc ) {
-                       mc = metaconn_alloc( mi->mi_ntargets );
+               if ( mc == NULL ) {
+                       mc = metaconn_alloc( op );
                        mc->mc_conn = op->o_conn;
                        new_conn = 1;
                }
 
                for ( i = 0; i < mi->mi_ntargets; i++ ) {
                        if ( i == cached 
-                               || meta_back_is_candidate( &mi->mi_targets[ i ]->mt_nsuffix,
+                               || meta_back_is_candidate( &mi->mi_targets[ i ].mt_nsuffix,
+                                               mi->mi_targets[ i ].mt_scope,
                                                &op->o_req_ndn, LDAP_SCOPE_SUBTREE ) )
                        {
 
@@ -805,10 +922,15 @@ meta_back_getconn(
                                 * also init'd
                                 */
                                int lerr = meta_back_init_one_conn( op, rs,
-                                               mi->mi_targets[ i ],
+                                               &mi->mi_targets[ i ],
                                                &mc->mc_conns[ i ], sendok );
                                if ( lerr == LDAP_SUCCESS ) {
                                        candidates[ i ].sr_tag = META_CANDIDATE;
+                                       candidates[ i ].sr_err = LDAP_SUCCESS;
+                                       ncandidates++;
+
+                                       Debug( LDAP_DEBUG_TRACE, "%s: meta_back_init_one_conn(%d)\n",
+                                               op->o_log_prefix, i, 0 );
 
                                } else {
                                
@@ -817,7 +939,11 @@ meta_back_getconn(
                                         * be init'd, should the other ones
                                         * be tried?
                                         */
-                                       candidates[ i ].sr_tag = META_NOT_CANDIDATE;
+                                       if ( new_conn ) {
+                                               ( void )meta_clear_one_candidate( &mc->mc_conns[ i ] );
+                                       }
+                                       /* leave the target candidate, but record the error for later use */
+                                       candidates[ i ].sr_err = lerr;
                                        err = lerr;
 
                                        Debug( LDAP_DEBUG_ANY, "%s: meta_back_init_one_conn(%d) failed: %d\n",
@@ -827,9 +953,35 @@ meta_back_getconn(
                                }
 
                        } else {
+                               if ( new_conn ) {
+                                       ( void )meta_clear_one_candidate( &mc->mc_conns[ i ] );
+                               }
                                candidates[ i ].sr_tag = META_NOT_CANDIDATE;
                        }
                }
+
+               if ( ncandidates == 0 ) {
+                       if ( new_conn ) {
+                               meta_back_freeconn( op, mc );
+
+                       } else {
+                               meta_back_release_conn( op, mc );
+                       }
+
+                       rs->sr_err = LDAP_NO_SUCH_OBJECT;
+                       rs->sr_text = "Unable to select valid candidates";
+
+                       if ( sendok & LDAP_BACK_SENDERR ) {
+                               if ( rs->sr_err == LDAP_NO_SUCH_OBJECT ) {
+                                       rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
+                               }
+                               send_ldap_result( op, rs );
+                               rs->sr_text = NULL;
+                               rs->sr_matched = NULL;
+                       }
+
+                       return NULL;
+               }
        }
 
 done:;
@@ -854,20 +1006,18 @@ done:;
 
                /*
                 * Err could be -1 in case a duplicate metaconn is inserted
+                *
+                * FIXME: what if the same client issues more than one
+                * asynchronous operations?
                 */
-               if ( err == 0 ) {
-                       Debug( LDAP_DEBUG_TRACE,
-                               "%s meta_back_getconn: conn %ld inserted\n",
-                               op->o_log_prefix, mc->mc_conn->c_connid, 0 );
-
-               } else {
-                       Debug( LDAP_DEBUG_TRACE,
-                               "%s meta_back_getconn: conn %ld insert failed\n",
-                               op->o_log_prefix, mc->mc_conn->c_connid, 0 );
+               if ( err != 0 ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "%s meta_back_getconn: candidates=%d conn=%ld insert failed\n",
+                               op->o_log_prefix, ncandidates, mc->mc_conn->c_connid );
                
                        rs->sr_err = LDAP_OTHER;
                        rs->sr_text = "Internal server error";
-                       meta_back_conn_free( mc );
+                       meta_back_freeconn( op, mc );
                        if ( sendok & LDAP_BACK_SENDERR ) {
                                send_ldap_result( op, rs );
                                rs->sr_text = NULL;
@@ -875,12 +1025,30 @@ done:;
                        return NULL;
                }
 
+               Debug( LDAP_DEBUG_TRACE,
+                       "%s meta_back_getconn: candidates=%d conn=%ld inserted\n",
+                       op->o_log_prefix, ncandidates, mc->mc_conn->c_connid );
+
        } else {
                Debug( LDAP_DEBUG_TRACE,
-                       "%s meta_back_getconn: conn %ld fetched\n",
-                       op->o_log_prefix, mc->mc_conn->c_connid, 0 );
+                       "%s meta_back_getconn: candidates=%d conn=%ld fetched\n",
+                       op->o_log_prefix, ncandidates, mc->mc_conn->c_connid );
        }
        
        return mc;
 }
 
+void
+meta_back_release_conn(
+               Operation               *op,
+       metaconn_t              *mc )
+{
+       metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
+
+       assert( mc != NULL );
+
+       ldap_pvt_thread_mutex_lock( &mi->mi_conn_mutex );
+       assert( mc->mc_refcnt > 0 );
+       mc->mc_refcnt--;
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conn_mutex );
+}