]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-meta/search.c
happy new year
[openldap] / servers / slapd / back-meta / search.c
index d7d251efe176f11b87378cc9dd3908439c440a61..05d41ed46d87a0998ac061ea1f0119af190ba552 100644 (file)
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2006 The OpenLDAP Foundation.
+ * Copyright 1999-2007 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -28,6 +28,7 @@
 #include <ac/string.h>
 #include <ac/time.h>
 
+#include "lutil.h"
 #include "slap.h"
 #include "../back-ldap/back-ldap.h"
 #include "back-meta.h"
@@ -84,7 +85,8 @@ meta_search_dobind_init(
 
        meta_search_candidate_t retcode;
 
-       Debug( LDAP_DEBUG_TRACE, "%s >>> meta_search_dobind_init[%d]\n", op->o_log_prefix, candidate, 0 );
+       Debug( LDAP_DEBUG_TRACE, "%s >>> meta_search_dobind_init[%d]\n",
+               op->o_log_prefix, candidate, 0 );
 
        /*
         * all the targets are already bound as pseudoroot
@@ -97,45 +99,87 @@ meta_search_dobind_init(
        ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
        if ( LDAP_BACK_CONN_ISBOUND( msc ) || LDAP_BACK_CONN_ISANON( msc ) ) {
                /* already bound (or anonymous) */
+
+#ifdef DEBUG_205
+               char    buf[ SLAP_TEXT_BUFLEN ] = { '\0' };
+               int     bound = 0;
+
+               if ( LDAP_BACK_CONN_ISBOUND( msc ) ) {
+                       bound = 1;
+               }
+
+               snprintf( buf, sizeof( buf ), " mc=%p ld=%p%s DN=\"%s\"",
+                       (void *)mc, (void *)msc->msc_ld,
+                       bound ? " bound" : " anonymous",
+                       bound == 0 ? "" : msc->msc_bound_ndn.bv_val );
+               Debug( LDAP_DEBUG_ANY, "### %s meta_search_dobind_init[%d]%s\n",
+                       op->o_log_prefix, candidate, buf );
+#endif /* DEBUG_205 */
+
                retcode = META_SEARCH_CANDIDATE;
 
-       } else if ( LDAP_BACK_CONN_BINDING( msc ) ) {
+       } else if ( META_BACK_CONN_CREATING( msc ) || LDAP_BACK_CONN_BINDING( msc ) ) {
                /* another thread is binding the target for this conn; wait */
+
+#ifdef DEBUG_205
+               char    buf[ SLAP_TEXT_BUFLEN ] = { '\0' };
+
+               snprintf( buf, sizeof( buf ), " mc=%p ld=%p needbind",
+                       (void *)mc, (void *)msc->msc_ld );
+               Debug( LDAP_DEBUG_ANY, "### %s meta_search_dobind_init[%d]%s\n",
+                       op->o_log_prefix, candidate, buf );
+#endif /* DEBUG_205 */
+
                candidates[ candidate ].sr_msgid = META_MSGID_NEED_BIND;
                retcode = META_SEARCH_NEED_BIND;
 
        } else {
                /* we'll need to bind the target for this conn */
+
+#ifdef DEBUG_205
+               char buf[ SLAP_TEXT_BUFLEN ];
+
+               snprintf( buf, sizeof( buf ), " mc=%p ld=%p binding",
+                       (void *)mc, (void *)msc->msc_ld );
+               Debug( LDAP_DEBUG_ANY, "### %s meta_search_dobind_init[%d]%s\n",
+                       op->o_log_prefix, candidate, buf );
+#endif /* DEBUG_205 */
+
+               if ( msc->msc_ld == NULL ) {
+                       /* for some reason (e.g. because formerly in "binding"
+                        * state, with eventual connection expiration or invalidation)
+                        * it was not initialized as expected */
+
+                       Debug( LDAP_DEBUG_ANY, "%s meta_search_dobind_init[%d] mc=%p ld=NULL\n",
+                               op->o_log_prefix, candidate, (void *)mc );
+
+                       rc = meta_back_init_one_conn( op, rs, *mcp, candidate,
+                               LDAP_BACK_CONN_ISPRIV( *mcp ), LDAP_BACK_DONTSEND, 0 );
+                       switch ( rc ) {
+                       case LDAP_SUCCESS:
+                               assert( msc->msc_ld != NULL );
+                               break;
+
+                       case LDAP_SERVER_DOWN:
+                       case LDAP_UNAVAILABLE:
+                               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+                               goto down;
+       
+                       default:
+                               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+                               goto other;
+                       }
+               }
+
                LDAP_BACK_CONN_BINDING_SET( msc );
        }
+
        ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+
        if ( retcode != META_SEARCH_BINDING ) {
                return retcode;
        }
 
-       if ( msc->msc_ld == NULL ) {
-               /* for some reason (e.g. because formerly in "binding"
-                * state, with eventual connection expiration or invalidation)
-                * it was not initialized as expected */
-
-               Debug( LDAP_DEBUG_ANY, "%s meta_search_dobind_init[%d] ld=NULL\n",
-                       op->o_log_prefix, candidate, 0 );
-
-               rc = meta_back_init_one_conn( op, rs, *mcp, candidate,
-                       LDAP_BACK_CONN_ISPRIV( *mcp ), LDAP_BACK_DONTSEND );
-               switch ( rc ) {
-               case LDAP_SUCCESS:
-                       assert( msc->msc_ld != NULL );
-                       break;
-
-               case LDAP_SERVER_DOWN:
-                       goto down;
-
-               default:
-                       goto other;
-               }
-       }
-
        /* NOTE: this obsoletes pseudorootdn */
        if ( op->o_conn != NULL &&
                !op->o_do_not_cache &&
@@ -153,7 +197,11 @@ meta_search_dobind_init(
                if ( !BER_BVISNULL( &binddn ) ) {
                        ber_bvreplace( &msc->msc_bound_ndn, &binddn );
                        if ( LDAP_BACK_SAVECRED( mi ) && !BER_BVISNULL( &cred ) ) {
-                               ber_dupbv( &msc->msc_cred, &cred );
+                               if ( !BER_BVISNULL( &msc->msc_cred ) ) {
+                                       memset( msc->msc_cred.bv_val, 0,
+                                               msc->msc_cred.bv_len );
+                               }
+                               ber_bvreplace( &msc->msc_cred, &cred );
                        }
                }
 
@@ -183,8 +231,21 @@ meta_search_dobind_init(
 
        rc = ldap_sasl_bind( msc->msc_ld, binddn.bv_val, LDAP_SASL_SIMPLE, &cred,
                        NULL, NULL, &candidates[ candidate ].sr_msgid );
+
+#ifdef DEBUG_205
+       {
+               char buf[ SLAP_TEXT_BUFLEN ];
+
+               snprintf( buf, sizeof( buf ), "meta_search_dobind_init[%d] mc=%p ld=%p rc=%d",
+                       candidate, (void *)mc, (void *)mc->mc_conns[ candidate ].msc_ld, rc );
+               Debug( LDAP_DEBUG_ANY, "### %s %s\n",
+                       op->o_log_prefix, buf, 0 );
+       }
+#endif /* DEBUG_205 */
+
        switch ( rc ) {
        case LDAP_SUCCESS:
+               assert( candidates[ candidate ].sr_msgid >= 0 );
                META_BINDING_SET( &candidates[ candidate ] );
                return META_SEARCH_BINDING;
 
@@ -193,6 +254,7 @@ down:;
                /* This is the worst thing that could happen:
                 * the search will wait until the retry is over. */
                if ( meta_back_retry( op, rs, mcp, candidate, LDAP_BACK_DONTSEND ) ) {
+                       candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
                        return META_SEARCH_CANDIDATE;
                }
 
@@ -209,18 +271,22 @@ other:;
                rc = slap_map_api2result( rs );
 
                ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
-               LDAP_BACK_CONN_BINDING_CLEAR( msc );
+               meta_clear_one_candidate( op, mc, candidate );
                if ( META_BACK_ONERR_STOP( mi ) ) {
                        LDAP_BACK_CONN_TAINTED_SET( mc );
-                       meta_back_release_conn( op, mc );
+                       meta_back_release_conn_lock( op, mc, 0 );
                        *mcp = NULL;
 
                        retcode = META_SEARCH_ERR;
 
                } else {
-                       candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
+                       if ( META_BACK_ONERR_REPORT( mi ) ) {
+                               candidates[ candidate ].sr_err = rc;
+                       }
+
                        retcode = META_SEARCH_NOT_CANDIDATE;
                }
+               candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
                ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
                break;
        }
@@ -252,32 +318,44 @@ meta_search_dobind_result(
                NULL, NULL, NULL, NULL, 0 );
        if ( rc != LDAP_SUCCESS ) {
                candidates[ candidate ].sr_err = rc;
+
+       } else {
+               rc = slap_map_api2result( &candidates[ candidate ] );
        }
-       rc = slap_map_api2result( &candidates[ candidate ] );
 
        ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
        LDAP_BACK_CONN_BINDING_CLEAR( msc );
        if ( rc != LDAP_SUCCESS ) {
                if ( META_BACK_ONERR_STOP( mi ) ) {
                        LDAP_BACK_CONN_TAINTED_SET( mc );
-                       meta_back_release_conn( op, mc );
+                       meta_clear_one_candidate( op, mc, candidate );
+                       meta_back_release_conn_lock( op, mc, 0 );
                        *mcp = NULL;
                        retcode = META_SEARCH_ERR;
+                       rs->sr_err = rc;
+
+               } else if ( META_BACK_ONERR_REPORT( mi ) ) {
+                       candidates[ candidate ].sr_err = rc;
                }
 
        } else {
                /* FIXME: check if bound as idassert authcDN! */
-               if ( be_isroot( op ) ) {
-                       LDAP_BACK_CONN_ISBOUND_SET( msc );
-               } else {
+               if ( BER_BVISNULL( &msc->msc_bound_ndn )
+                       || BER_BVISEMPTY( &msc->msc_bound_ndn ) )
+               {
                        LDAP_BACK_CONN_ISANON_SET( msc );
+
+               } else {
+                       LDAP_BACK_CONN_ISBOUND_SET( msc );
                }
                retcode = META_SEARCH_CANDIDATE;
        }
-       ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 
+       candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
        META_BINDING_CLEAR( &candidates[ candidate ] );
 
+       ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+
        return retcode;
 }
 
@@ -313,6 +391,10 @@ meta_back_search_start(
                if ( META_BACK_ONERR_STOP( mi ) ) {
                        return META_SEARCH_ERR;
                }
+               if ( META_BACK_ONERR_REPORT( mi ) ) {
+                       candidates[ candidate ].sr_err = LDAP_OTHER;
+               }
+               candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
                return META_SEARCH_NOT_CANDIDATE;
        }
 
@@ -529,12 +611,15 @@ meta_back_search( Operation *op, SlapReply *rs )
 {
        metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
        metaconn_t      *mc;
-       struct timeval  tv = { 0, 0 };
+       struct timeval  save_tv = { 0, 0 },
+                       tv;
        time_t          stoptime = (time_t)-1;
        int             rc = 0, sres = LDAP_SUCCESS;
        char            *matched = NULL;
        int             last = 0, ncandidates = 0,
-                       initial_candidates = 0, candidate_match = 0;
+                       initial_candidates = 0, candidate_match = 0,
+                       needbind = 0;
+       ldap_back_send_t        sendok = LDAP_BACK_SENDERR;
        long            i;
        dncookie        dc;
        int             is_ok = 0;
@@ -547,7 +632,8 @@ meta_back_search( Operation *op, SlapReply *rs )
         * FIXME: in case of values return filter, we might want
         * to map attrs and maybe rewrite value
         */
-       mc = meta_back_getconn( op, rs, NULL, LDAP_BACK_SENDERR );
+getconn:;
+       mc = meta_back_getconn( op, rs, NULL, sendok );
        if ( !mc ) {
                return rs->sr_err;
        }
@@ -559,8 +645,17 @@ meta_back_search( Operation *op, SlapReply *rs )
         * Inits searches
         */
        for ( i = 0; i < mi->mi_ntargets; i++ ) {
+               /* reset sr_msgid; it is used in most loops
+                * to check if that target is still to be considered */
                candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 
+               /* a target is marked as candidate by meta_back_getconn();
+                * if for any reason (an error, it's over or so) it is
+                * no longer active, sr_msgid is set to META_MSGID_IGNORE
+                * but it remains candidate, which means it has been active
+                * at some point during the operation.  This allows to 
+                * use its response code and more to compute the final
+                * response */
                if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
                        continue;
                }
@@ -581,11 +676,15 @@ meta_back_search( Operation *op, SlapReply *rs )
                switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
                {
                case META_SEARCH_NOT_CANDIDATE:
+                       candidates[ i ].sr_msgid = META_MSGID_IGNORE;
                        break;
 
+               case META_SEARCH_NEED_BIND:
+                       ++needbind;
+                       /* fallthru */
+
                case META_SEARCH_CANDIDATE:
                case META_SEARCH_BINDING:
-               case META_SEARCH_NEED_BIND:
                        candidates[ i ].sr_type = REP_INTERMEDIATE;
                        ++ncandidates;
                        break;
@@ -600,10 +699,46 @@ meta_back_search( Operation *op, SlapReply *rs )
                }
        }
 
+       if ( ncandidates > 0 && needbind == ncandidates ) {
+               /*
+                * give up the second time...
+                *
+                * NOTE: this should not occur the second time, since a fresh
+                * connection has ben created; however, targets may also
+                * need bind because the bind timed out or so.
+                */
+               if ( sendok & LDAP_BACK_BINDING ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "%s meta_back_search: unable to initialize conn\n",
+                               op->o_log_prefix, 0, 0 );
+                       rs->sr_err = LDAP_UNAVAILABLE;
+                       rs->sr_text = "unable to initialize connection to remote targets";
+                       send_ldap_result( op, rs );
+                       rc = -1;
+                       goto finish;
+               }
+
+               /* FIXME: better create a separate connection? */
+               sendok |= LDAP_BACK_BINDING;
+
+#ifdef DEBUG_205
+               Debug( LDAP_DEBUG_ANY, "*** %s drop mc=%p create new connection\n",
+                       op->o_log_prefix, (void *)mc, 0 );
+#endif /* DEBUG_205 */
+
+               meta_back_release_conn( op, mc );
+               mc = NULL;
+
+               needbind = 0;
+               ncandidates = 0;
+
+               goto getconn;
+       }
+
        initial_candidates = ncandidates;
 
        if ( LogTest( LDAP_DEBUG_TRACE ) ) {
-               char    cnd[ BUFSIZ ];
+               char    cnd[ SLAP_TEXT_BUFLEN ];
                int     c;
 
                for ( c = 0; c < mi->mi_ntargets; c++ ) {
@@ -666,7 +801,9 @@ meta_back_search( Operation *op, SlapReply *rs )
         * among the candidates
         */
        for ( rc = 0; ncandidates > 0; ) {
-               int     gotit = 0, doabandon = 0;
+               int     gotit = 0,
+                       doabandon = 0,
+                       alreadybound = ncandidates;
 
                /* check time limit */
                if ( op->ors_tlimit != SLAP_NO_LIMIT
@@ -685,10 +822,12 @@ meta_back_search( Operation *op, SlapReply *rs )
                        metasingleconn_t        *msc = &mc->mc_conns[ i ];
                        LDAPMessage             *res = NULL, *msg;
 
+                       /* if msgid is invalid, don't ldap_result() */
                        if ( candidates[ i ].sr_msgid == META_MSGID_IGNORE ) {
                                continue;
                        }
 
+                       /* if target still needs bind, retry */
                        if ( candidates[ i ].sr_msgid == META_MSGID_NEED_BIND ) {
                                meta_search_candidate_t retcode;
 
@@ -699,17 +838,11 @@ meta_back_search( Operation *op, SlapReply *rs )
                                        op->o_log_prefix, i, retcode );
 
                                switch ( retcode ) {
-                               case META_SEARCH_BINDING:
                                case META_SEARCH_NEED_BIND:
-                                       break;
+                                       alreadybound--;
+                                       /* fallthru */
 
-                               case META_SEARCH_NOT_CANDIDATE:
-                                       /*
-                                        * When no candidates are left,
-                                        * the outer cycle finishes
-                                        */
-                                       candidates[ i ].sr_msgid = META_MSGID_IGNORE;
-                                       --ncandidates;
+                               case META_SEARCH_BINDING:
                                        break;
 
                                case META_SEARCH_ERR:
@@ -720,6 +853,19 @@ meta_back_search( Operation *op, SlapReply *rs )
                                                op->o_private = savepriv;
                                                goto finish;
                                        }
+                                       if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                               candidates[ i ].sr_err = rs->sr_err;
+                                       }
+                                       /* fallthru */
+
+                               case META_SEARCH_NOT_CANDIDATE:
+                                       /*
+                                        * When no candidates are left,
+                                        * the outer cycle finishes
+                                        */
+                                       candidates[ i ].sr_msgid = META_MSGID_IGNORE;
+                                       assert( ncandidates > 0 );
+                                       --ncandidates;
                                        break;
 
                                case META_SEARCH_CANDIDATE:
@@ -727,14 +873,10 @@ meta_back_search( Operation *op, SlapReply *rs )
                                        switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
                                        {
                                        case META_SEARCH_CANDIDATE:
+                                               assert( candidates[ i ].sr_msgid >= 0 );
                                                break;
 
-                                               /* means that failed but onerr == continue */
-                                       case META_SEARCH_NOT_CANDIDATE:
                                        case META_SEARCH_ERR:
-                                               candidates[ i ].sr_msgid = META_MSGID_IGNORE;
-                                               --ncandidates;
-
                                                if ( META_BACK_ONERR_STOP( mi ) ) {
                                                        savepriv = op->o_private;
                                                        op->o_private = (void *)i;
@@ -742,6 +884,17 @@ meta_back_search( Operation *op, SlapReply *rs )
                                                        op->o_private = savepriv;
                                                        goto finish;
                                                }
+                                               if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                                       candidates[ i ].sr_err = rs->sr_err;
+                                               }
+                                               /* fallthru */
+
+                                       case META_SEARCH_NOT_CANDIDATE:
+                                               /* means that meta_back_search_start()
+                                                * failed but onerr == continue */
+                                               candidates[ i ].sr_msgid = META_MSGID_IGNORE;
+                                               assert( ncandidates > 0 );
+                                               --ncandidates;
                                                break;
 
                                        default:
@@ -763,6 +916,24 @@ meta_back_search( Operation *op, SlapReply *rs )
                        if ( op->o_abandon ) {
                                break;
                        }
+
+#ifdef DEBUG_205
+                       if ( msc->msc_ld == NULL ) {
+                               char    buf[ SLAP_TEXT_BUFLEN ];
+
+                               ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+                               snprintf( buf, sizeof( buf ),
+                                       "%s meta_back_search[%ld] mc=%p msgid=%d%s%s%s\n",
+                                       op->o_log_prefix, (long)i, (void *)mc,
+                                       candidates[ i ].sr_msgid,
+                                       META_IS_BINDING( &candidates[ i ] ) ? " binding" : "",
+                                       LDAP_BACK_CONN_BINDING( &mc->mc_conns[ i ] ) ? " connbinding" : "",
+                                       META_BACK_CONN_CREATING( &mc->mc_conns[ i ] ) ? " conncreating" : "" );
+                               ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
+                                       
+                               Debug( LDAP_DEBUG_ANY, "!!! %s\n", buf, 0, 0 );
+                       }
+#endif /* DEBUG_205 */
                        
                        /*
                         * FIXME: handle time limit as well?
@@ -771,6 +942,7 @@ meta_back_search( Operation *op, SlapReply *rs )
                         * get a LDAP_TIMELIMIT_EXCEEDED from
                         * one of them ...
                         */
+                       tv = save_tv;
                        rc = ldap_result( msc->msc_ld, candidates[ i ].sr_msgid,
                                        LDAP_MSG_RECEIVED, &tv, &res );
                        switch ( rc ) {
@@ -790,7 +962,8 @@ really_bad:;
                                                switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
                                                {
                                                case META_SEARCH_CANDIDATE:
-                                                       break;
+                                                       /* get back into business... */
+                                                       continue;
 
                                                        /* means that failed but onerr == continue */
                                                case META_SEARCH_NOT_CANDIDATE:
@@ -804,6 +977,9 @@ really_bad:;
                                                                op->o_private = savepriv;
                                                                goto finish;
                                                        }
+                                                       if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                                               candidates[ i ].sr_err = rs->sr_err;
+                                                       }
                                                        break;
 
                                                case META_SEARCH_BINDING:
@@ -811,6 +987,8 @@ really_bad:;
                                                        assert( 0 );
 
                                                default:
+                                                       /* unrecoverable error */
+                                                       candidates[ i ].sr_msgid = META_MSGID_IGNORE;
                                                        rc = rs->sr_err = LDAP_OTHER;
                                                        goto finish;
                                                }
@@ -823,6 +1001,9 @@ really_bad:;
                                                op->o_private = savepriv;
                                                goto finish;
                                        }
+                                       if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                               candidates[ i ].sr_err = rs->sr_err;
+                                       }
                                }
 
                                /*
@@ -830,6 +1011,7 @@ really_bad:;
                                 * the outer cycle finishes
                                 */
                                candidates[ i ].sr_msgid = META_MSGID_IGNORE;
+                               assert( ncandidates > 0 );
                                --ncandidates;
                                rs->sr_err = candidates[ i ].sr_err;
                                continue;
@@ -883,8 +1065,8 @@ really_bad:;
 
                                        /* don't wait any longer... */
                                        gotit = 1;
-                                       tv.tv_sec = 0;
-                                       tv.tv_usec = 0;
+                                       save_tv.tv_sec = 0;
+                                       save_tv.tv_usec = 0;
 
                                } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
                                        char            **references = NULL;
@@ -916,6 +1098,7 @@ really_bad:;
 #endif /* ! ENABLE_REWRITE */
 
                                        /* FIXME: merge all and return at the end */
+       
                                        for ( cnt = 0; references[ cnt ]; cnt++ )
                                                ;
        
@@ -977,7 +1160,7 @@ really_bad:;
                                                0 );
                                        if ( rs->sr_err != LDAP_SUCCESS ) {
                                                ldap_get_option( msc->msc_ld,
-                                                       LDAP_OPT_RESULT_CODE,
+                                                       LDAP_OPT_ERROR_NUMBER,
                                                        &rs->sr_err );
                                                sres = slap_map_api2result( rs );
                                                candidates[ i ].sr_type = REP_RESULT;
@@ -1098,6 +1281,9 @@ really_bad:;
                                                        res = NULL;
                                                        goto finish;
                                                }
+                                               if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                                       candidates[ i ].sr_err = rs->sr_err;
+                                               }
                                                break;
        
                                        default:
@@ -1110,6 +1296,9 @@ really_bad:;
                                                        res = NULL;
                                                        goto finish;
                                                }
+                                               if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                                       candidates[ i ].sr_err = rs->sr_err;
+                                               }
                                                break;
                                        }
        
@@ -1151,6 +1340,9 @@ really_bad:;
                                                        res = NULL;
                                                        goto finish;
                                                }
+                                               if ( META_BACK_ONERR_REPORT( mi ) ) {
+                                                       candidates[ i ].sr_err = rs->sr_err;
+                                               }
                                                break;
        
                                        default:
@@ -1178,9 +1370,19 @@ really_bad:;
                                                ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
                                                if ( LDAP_BACK_CONN_BINDING( &mc->mc_conns[ i ] ) ) {
                                                        /* if still binding, destroy */
-                                                       ldap_unbind_ext( mc->mc_conns[ i ].msc_ld, NULL, NULL );
-                                                       mc->mc_conns[ i ].msc_ld = NULL;
-                                                       LDAP_BACK_CONN_BINDING_CLEAR( &mc->mc_conns[ i ] );
+
+#ifdef DEBUG_205
+                                                       char buf[ SLAP_TEXT_BUFLEN ];
+
+                                                       snprintf( buf, sizeof( buf), "%s meta_back_search(abandon) "
+                                                               "ldap_unbind_ext[%ld] mc=%p ld=%p",
+                                                               op->o_log_prefix, i, (void *)mc,
+                                                               (void *)mc->mc_conns[i].msc_ld );
+
+                                                       Debug( LDAP_DEBUG_ANY, "### %s\n", buf, 0, 0 );
+#endif /* DEBUG_205 */
+
+                                                       meta_clear_one_candidate( op, mc, i );
                                                }
                                                ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
                                                META_BINDING_CLEAR( &candidates[ i ] );
@@ -1192,6 +1394,8 @@ really_bad:;
                                        }
 
                                        candidates[ i ].sr_msgid = META_MSGID_IGNORE;
+                                       assert( ncandidates > 0 );
+                                       --ncandidates;
                                }
                        }
 
@@ -1204,12 +1408,52 @@ really_bad:;
 
                /* if no entry was found during this loop,
                 * set a minimal timeout */
-               if ( gotit == 0 ) {
-                       /* make the entire wait last
-                        * LDAP_BACK_RESULT_UTIMEOUT at worst */
-                       tv.tv_sec = 0;
-                       tv.tv_usec = LDAP_BACK_RESULT_UTIMEOUT/initial_candidates;
-                       ldap_pvt_thread_yield();
+               if ( ncandidates > 0 && gotit == 0 ) {
+                       if ( save_tv.tv_sec == 0 && save_tv.tv_usec == 0 ) {
+                               save_tv.tv_usec = LDAP_BACK_RESULT_UTIMEOUT/initial_candidates;
+
+                               /* arbitrarily limit to something between 1 and 2 minutes */
+                       } else if ( ( stoptime == -1 && save_tv.tv_sec < 60 )
+                               || save_tv.tv_sec < ( stoptime - slap_get_time() ) / ( 2 * ncandidates ) )
+                       {
+                               /* double the timeout */
+                               lutil_timermul( &save_tv, 2, &save_tv );
+                       }
+
+#if 0
+                       if ( LogTest( LDAP_DEBUG_TRACE ) ) {
+                               char    buf[ SLAP_TEXT_BUFLEN ];
+
+                               snprintf( buf, sizeof( buf ), "%s %ld.%06ld %d/%d mc=%p",
+                                       op->o_log_prefix, save_tv.tv_sec, save_tv.tv_usec,
+                                       ncandidates, initial_candidates, mc );
+                               Debug( LDAP_DEBUG_TRACE, "### %s\n", buf, 0, 0 );
+                               for ( i = 0; i < mi->mi_ntargets; i++ ) {
+                                       if ( candidates[ i ].sr_msgid == META_MSGID_IGNORE ) {
+                                               continue;
+                                       }
+                       
+                                       snprintf( buf, sizeof( buf ), "[%ld] ld=%p%s%s\n",
+                                               i,
+                                               mc->mc_conns[ i ].msc_ld,
+                                               ( candidates[ i ].sr_msgid == META_MSGID_NEED_BIND ) ?  " needbind" : "",
+                                               META_IS_BINDING( &candidates[ i ] ) ? " binding" : "" );
+                                       Debug( LDAP_DEBUG_TRACE, "###    %s\n", buf, 0, 0 );
+                               }
+                       }
+#endif
+
+                       if ( alreadybound == 0 ) {
+#if 0
+                               Debug( LDAP_DEBUG_TRACE, "### %s select(%ld.%06ld)\n",
+                                       op->o_log_prefix, save_tv.tv_sec, save_tv.tv_usec );
+#endif
+                               tv = save_tv;
+                               (void)select( 0, NULL, NULL, NULL, &tv );
+
+                       } else {
+                               ldap_pvt_thread_yield();
+                       }
                }
        }
 
@@ -1295,8 +1539,8 @@ really_bad:;
 
 #if 0
        {
-               char    buf[BUFSIZ];
-               char    cnd[BUFSIZ];
+               char    buf[ SLAP_TEXT_BUFLEN ];
+               char    cnd[ SLAP_TEXT_BUFLEN ];
                int     i;
 
                for ( i = 0; i < mi->mi_ntargets; i++ ) {
@@ -1318,14 +1562,35 @@ really_bad:;
        /*
         * In case we returned at least one entry, we return LDAP_SUCCESS
         * otherwise, the latter error code we got
-        *
-        * FIXME: we should handle error codes and return the more 
-        * important/reasonable
         */
 
-       if ( sres == LDAP_SUCCESS && rs->sr_v2ref ) {
-               sres = LDAP_REFERRAL;
+       if ( sres == LDAP_SUCCESS ) {
+               if ( rs->sr_v2ref ) {
+                       sres = LDAP_REFERRAL;
+               }
+
+               if ( META_BACK_ONERR_REPORT( mi ) ) {
+                       /*
+                        * Report errors, if any
+                        *
+                        * FIXME: we should handle error codes and return the more 
+                        * important/reasonable
+                        */
+                       for ( i = 0; i < mi->mi_ntargets; i++ ) {
+                               if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
+                                       continue;
+                               }
+
+                               if ( candidates[ i ].sr_err != LDAP_SUCCESS
+                                       && candidates[ i ].sr_err != LDAP_NO_SUCH_OBJECT )
+                               {
+                                       sres = candidates[ i ].sr_err;
+                                       break;
+                               }
+                       }
+               }
        }
+
        rs->sr_err = sres;
        rs->sr_matched = matched;
        rs->sr_ref = ( sres == LDAP_REFERRAL ? rs->sr_v2ref : NULL );
@@ -1351,14 +1616,17 @@ finish:;
                if ( mc && META_IS_BINDING( &candidates[ i ] ) ) {
                        ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
                        if ( LDAP_BACK_CONN_BINDING( &mc->mc_conns[ i ] ) ) {
-                               LDAP_BACK_CONN_BINDING_CLEAR( &mc->mc_conns[ i ] );
-
                                assert( candidates[ i ].sr_msgid >= 0 );
                                assert( mc->mc_conns[ i ].msc_ld != NULL );
 
+#ifdef DEBUG_205
+                               Debug( LDAP_DEBUG_ANY, "### %s meta_back_search(cleanup) "
+                                       "ldap_unbind_ext[%ld] ld=%p\n",
+                                       op->o_log_prefix, i, (void *)mc->mc_conns[i].msc_ld );
+#endif /* DEBUG_205 */
+
                                /* if still binding, destroy */
-                               ldap_unbind_ext( mc->mc_conns[ i ].msc_ld, NULL, NULL );
-                               mc->mc_conns[ i ].msc_ld = NULL;
+                               meta_clear_one_candidate( op, mc, i );
                        }
                        ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
                        META_BINDING_CLEAR( &candidates[ i ] );