]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/connection.c
Use #ifdef, not #if
[openldap] / servers / slapd / connection.c
index dd561602328a963f69f04a9721c31202894e5966..a1ef902c2d4de2ee1f3379595e3fec912544ae36 100644 (file)
@@ -1,6 +1,13 @@
+/* $OpenLDAP$ */
+/*
+ * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
+
 #include "portable.h"
 
 #include <stdio.h>
+#include <limits.h>
 
 #include <ac/socket.h>
 #include <ac/errno.h>
@@ -10,9 +17,6 @@
 
 #include "slap.h"
 
-/* we need LBER internals */
-#include "../../libraries/liblber/lber-int.h"
-
 /* protected by connections_mutex */
 static ldap_pvt_thread_mutex_t connections_mutex;
 static Connection *connections = NULL;
@@ -30,6 +34,20 @@ static unsigned long conn_nextid = 0;
 #define SLAP_C_BINDING                 0x03    /* binding */
 #define SLAP_C_CLOSING                 0x04    /* closing */
 
+const char *
+connection_state2str( int state )
+{
+       switch( state ) {
+       case SLAP_C_INVALID:    return "!";             
+       case SLAP_C_INACTIVE:   return "|";             
+       case SLAP_C_ACTIVE:             return "";                      
+       case SLAP_C_BINDING:    return "B";
+       case SLAP_C_CLOSING:    return "C";                     
+       }
+
+       return "?";
+}
+
 static Connection* connection_get( ber_socket_t s );
 
 static int connection_input( Connection *c );
@@ -37,6 +55,8 @@ static void connection_close( Connection *c );
 
 static int connection_op_activate( Connection *conn, Operation *op );
 static int connection_resched( Connection *conn );
+static void connection_abandon( Connection *conn );
+static void connection_destroy( Connection *c );
 
 struct co_arg {
        Connection      *co_conn;
@@ -63,7 +83,7 @@ int connections_init(void)
 
        if( connections == NULL ) {
                Debug( LDAP_DEBUG_ANY,
-                       "connections_init: allocation (%d*%ld) of connection array failed.\n",
+                       "connections_init: allocation (%d*%ld) of connection array failed\n",
                        dtblsize, (long) sizeof(Connection), 0 );
                return -1;
        }
@@ -96,6 +116,7 @@ int connections_destroy(void)
 
        for ( i = 0; i < dtblsize; i++ ) {
                if( connections[i].c_struct_state != SLAP_C_UNINITIALIZED ) {
+                       ber_sockbuf_free( connections[i].c_sb );
                        ldap_pvt_thread_mutex_destroy( &connections[i].c_mutex );
                        ldap_pvt_thread_mutex_destroy( &connections[i].c_write_mutex );
                        ldap_pvt_thread_cond_destroy( &connections[i].c_write_cv );
@@ -190,9 +211,12 @@ static Connection* connection_get( ber_socket_t s )
 #else
        c = NULL;
        {
-               ber_socket_t i;
+               ber_socket_t i, sd;
 
                for(i=0; i<dtblsize; i++) {
+                       ber_sockbuf_ctrl( connections[i].c_sb,
+                               LBER_SB_OPT_GET_FD, &sd );
+
                        if( connections[i].c_struct_state == SLAP_C_UNINITIALIZED ) {
                                assert( connections[i].c_conn_state == SLAP_C_INVALID );
                                assert( connections[i].c_sb == 0 );
@@ -201,7 +225,7 @@ static Connection* connection_get( ber_socket_t s )
 
                        if( connections[i].c_struct_state == SLAP_C_UNUSED ) {
                                assert( connections[i].c_conn_state == SLAP_C_INVALID );
-                               assert( !ber_pvt_sb_in_use( connections[i].c_sb ) );
+                               assert( sd == AC_SOCKET_INVALID );
                                continue;
                        }
 
@@ -209,7 +233,7 @@ static Connection* connection_get( ber_socket_t s )
                         * so don't assert details here.
                         */
 
-                       if( ber_pvt_sb_get_desc( connections[i].c_sb ) == s ) {
+                       if( sd == s ) {
                                c = &connections[i];
                                break;
                        }
@@ -218,17 +242,20 @@ static Connection* connection_get( ber_socket_t s )
 #endif
 
        if( c != NULL ) {
+               ber_socket_t    sd;
+
                ldap_pvt_thread_mutex_lock( &c->c_mutex );
 
+               ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_GET_FD, &sd );
                if( c->c_struct_state != SLAP_C_USED ) {
                        /* connection must have been closed due to resched */
 
                        assert( c->c_conn_state == SLAP_C_INVALID );
-                       assert( !ber_pvt_sb_in_use( c->c_sb ) );
+                       assert( sd == AC_SOCKET_INVALID );
 
                        Debug( LDAP_DEBUG_TRACE,
-                               "connection_get(%d): connection not used.\n",
-                               s, c->c_connid, 0 );
+                               "connection_get(%d): connection not used\n",
+                               s, 0, 0 );
 
                        ldap_pvt_thread_mutex_unlock( &c->c_mutex );
                        return NULL;
@@ -242,7 +269,7 @@ static Connection* connection_get( ber_socket_t s )
 
                assert( c->c_struct_state == SLAP_C_USED );
                assert( c->c_conn_state != SLAP_C_INVALID );
-               assert( ber_pvt_sb_in_use( c->c_sb ) );
+               assert( sd != AC_SOCKET_INVALID );
 
        c->c_activitytime = slap_get_time();
        }
@@ -257,13 +284,25 @@ static void connection_return( Connection *c )
 
 long connection_init(
        ber_socket_t s,
-       const char* name,
-       const char* addr)
+       const char* url,
+       const char* dnsname,
+       const char* peername,
+       const char* sockname,
+       int use_tls )
 {
        unsigned long id;
        Connection *c;
+
        assert( connections != NULL );
 
+       assert( dnsname != NULL );
+       assert( peername != NULL );
+       assert( sockname != NULL );
+
+#ifndef HAVE_TLS
+       assert( !use_tls );
+#endif
+
        if( s == AC_SOCKET_INVALID ) {
         Debug( LDAP_DEBUG_ANY,
                        "connection_init(%ld): invalid.\n",
@@ -288,26 +327,32 @@ long connection_init(
                c = NULL;
 
         for( i=0; i < dtblsize; i++) {
+               ber_socket_t    sd;
+
             if( connections[i].c_struct_state == SLAP_C_UNINITIALIZED ) {
                 assert( connections[i].c_sb == 0 );
                 c = &connections[i];
                 break;
             }
 
+                       sd = AC_SOCKET_INVALID;
+                       if (connections[i].c_sb != NULL)
+                       ber_sockbuf_ctrl( connections[i].c_sb, LBER_SB_OPT_GET_FD, &sd );
+           
             if( connections[i].c_struct_state == SLAP_C_UNUSED ) {
-                assert( !ber_pvt_sb_in_use( connections[i].c_sb ));
+                assert( sd == AC_SOCKET_INVALID );
                 c = &connections[i];
                 break;
             }
 
             assert( connections[i].c_struct_state == SLAP_C_USED );
             assert( connections[i].c_conn_state != SLAP_C_INVALID );
-            assert( ber_pvt_sb_in_use( connections[i].c_sb ));
+            assert( sd != AC_SOCKET_INVALID );
         }
 
         if( c == NULL ) {
                Debug( LDAP_DEBUG_ANY,
-                               "connection_init(%d): connection table full (%d/%d).\n",
+                               "connection_init(%d): connection table full (%d/%d)\n",
                                s, i, dtblsize);
             ldap_pvt_thread_mutex_unlock( &connections_mutex );
             return -1;
@@ -316,18 +361,27 @@ long connection_init(
 #endif
 
     assert( c != NULL );
-    assert( c->c_struct_state != SLAP_C_USED );
-    assert( c->c_conn_state == SLAP_C_INVALID );
 
     if( c->c_struct_state == SLAP_C_UNINITIALIZED ) {
+               c->c_authmech = NULL;
         c->c_dn = NULL;
         c->c_cdn = NULL;
-        c->c_client_name = NULL;
-        c->c_client_addr = NULL;
+
+               c->c_listener_url = NULL;
+               c->c_peer_domain = NULL;
+        c->c_peer_name = NULL;
+        c->c_sock_name = NULL;
+
         c->c_ops = NULL;
         c->c_pending_ops = NULL;
 
+               c->c_sasl_bind_mech = NULL;
+#ifdef HAVE_CYRUS_SASL
+               c->c_sasl_bind_context = NULL;
+#endif
+
         c->c_sb = ber_sockbuf_alloc( );
+               c->c_currentber = NULL;
 
         /* should check status of thread calls */
         ldap_pvt_thread_mutex_init( &c->c_mutex );
@@ -340,15 +394,25 @@ long connection_init(
     ldap_pvt_thread_mutex_lock( &c->c_mutex );
 
     assert( c->c_struct_state == SLAP_C_UNUSED );
+       assert( c->c_authmech == NULL );
     assert(    c->c_dn == NULL );
     assert(    c->c_cdn == NULL );
-    assert( c->c_client_name == NULL );
-    assert( c->c_client_addr == NULL );
+    assert( c->c_listener_url == NULL );
+    assert( c->c_peer_domain == NULL );
+    assert( c->c_peer_name == NULL );
+    assert( c->c_sock_name == NULL );
     assert( c->c_ops == NULL );
     assert( c->c_pending_ops == NULL );
+       assert( c->c_sasl_bind_mech == NULL );
+#ifdef HAVE_CYRUS_SASL
+       assert( c->c_sasl_bind_context == NULL );
+#endif
+       assert( c->c_currentber == NULL );
 
-    c->c_client_name = ch_strdup( name == NULL ? "" : name );
-    c->c_client_addr = ch_strdup( addr );
+       c->c_listener_url = ch_strdup( url  );
+       c->c_peer_domain = ch_strdup( dnsname  );
+    c->c_peer_name = ch_strdup( peername  );
+    c->c_sock_name = ch_strdup( sockname );
 
     c->c_n_ops_received = 0;
     c->c_n_ops_executing = 0;
@@ -359,15 +423,22 @@ long connection_init(
        c->c_n_read = 0;
        c->c_n_write = 0;
 
-    c->c_activitytime = c->c_starttime = slap_get_time();
+       /* assume LDAPv3 until bind */
+       c->c_protocol = LDAP_VERSION3;
 
-    ber_pvt_sb_set_desc( c->c_sb, s );
-    ber_pvt_sb_set_io( c->c_sb, &ber_pvt_sb_io_tcp, NULL );
+    c->c_activitytime = c->c_starttime = slap_get_time();
 
-    if( ber_pvt_sb_set_nonblock( c->c_sb, 1 ) < 0 ) {
+    ber_sockbuf_add_io( c->c_sb, &ber_sockbuf_io_tcp, LBER_SBIOD_LEVEL_PROVIDER,
+       (void *)&s );
+    ber_sockbuf_add_io( c->c_sb, &ber_sockbuf_io_readahead,
+       LBER_SBIOD_LEVEL_PROVIDER, NULL );
+#ifdef LDAP_DEBUG
+    ber_sockbuf_add_io( c->c_sb, &ber_sockbuf_io_debug, INT_MAX, NULL );
+#endif
+    if( ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_SET_NONBLOCK, (void *)1 ) < 0 ) {
         Debug( LDAP_DEBUG_ANY,
-            "connection_init(%d, %s, %s): set nonblocking failed\n",
-            s, c->c_client_name, c->c_client_addr);
+            "connection_init(%d, %s): set nonblocking failed\n",
+            s, c->c_peer_name,0 );
     }
 
     id = c->c_connid = conn_nextid++;
@@ -375,6 +446,16 @@ long connection_init(
     c->c_conn_state = SLAP_C_INACTIVE;
     c->c_struct_state = SLAP_C_USED;
 
+#ifdef HAVE_TLS
+    if ( use_tls ) {
+           c->c_is_tls = 1;
+           c->c_needs_tls_accept = 1;
+    } else {
+           c->c_is_tls = 0;
+           c->c_needs_tls_accept = 0;
+    }
+#endif
+
     ldap_pvt_thread_mutex_unlock( &c->c_mutex );
     ldap_pvt_thread_mutex_unlock( &connections_mutex );
 
@@ -387,6 +468,7 @@ static void
 connection_destroy( Connection *c )
 {
        /* note: connections_mutex should be locked by caller */
+    ber_socket_t       sd;
 
     assert( connections != NULL );
     assert( c != NULL );
@@ -397,9 +479,14 @@ connection_destroy( Connection *c )
     backend_connection_destroy(c);
 
     c->c_protocol = 0;
+    c->c_connid = -1;
 
     c->c_activitytime = c->c_starttime = 0;
 
+       if(c->c_authmech != NULL ) {
+               free(c->c_authmech);
+               c->c_authmech = NULL;
+       }
     if(c->c_dn != NULL) {
         free(c->c_dn);
         c->c_dn = NULL;
@@ -408,27 +495,64 @@ connection_destroy( Connection *c )
                free(c->c_cdn);
                c->c_cdn = NULL;
        }
-       if(c->c_client_name != NULL) {
-               free(c->c_client_name);
-               c->c_client_name = NULL;
+       if(c->c_listener_url != NULL) {
+               free(c->c_listener_url);
+               c->c_listener_url = NULL;
+       }
+       if(c->c_peer_domain != NULL) {
+               free(c->c_peer_domain);
+               c->c_peer_domain = NULL;
+       }
+       if(c->c_peer_name != NULL) {
+#ifdef LDAP_PF_LOCAL
+               /*
+                * If peer was a domain socket, unlink. Mind you,
+                * they may be un-named. Should we leave this to
+                * the client?
+                */
+               if (strncmp(c->c_peer_name, "PATH=", 5) == 0) {
+                       char *path = c->c_peer_name + 5;
+                       if (path != '\0') {
+                               (void)unlink(path);
+                       }
+               }
+#endif /* LDAP_PF_LOCAL */
+               free(c->c_peer_name);
+               c->c_peer_name = NULL;
+       }
+       if(c->c_sock_name != NULL) {
+               free(c->c_sock_name);
+               c->c_sock_name = NULL;
        }
-       if(c->c_client_addr != NULL) {
-               free(c->c_client_addr);
-               c->c_client_addr = NULL;
+
+       c->c_sasl_bind_in_progress = 0;
+       if(c->c_sasl_bind_mech != NULL) {
+               free(c->c_sasl_bind_mech);
+               c->c_sasl_bind_mech = NULL;
+       }
+#ifdef HAVE_CYRUS_SASL
+       if(c->c_sasl_bind_context != NULL ) {
+               sasl_dispose( &c->c_sasl_bind_context );
+               c->c_sasl_bind_context = NULL;
        }
+#endif
 
-       if ( ber_pvt_sb_in_use(c->c_sb) ) {
-               int sd = ber_pvt_sb_get_desc(c->c_sb);
+       if ( c->c_currentber != NULL ) {
+               ber_free( c->c_currentber, 1 );
+               c->c_currentber = NULL;
+       }
 
+       ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_GET_FD, &sd );
+       if ( sd != AC_SOCKET_INVALID ) {
                slapd_remove( sd, 0 );
-               ber_pvt_sb_close( c->c_sb );
 
                Statslog( LDAP_DEBUG_STATS,
-                   "conn=%d fd=%d closed.\n",
+                   "conn=%ld fd=%d closed\n",
                        c->c_connid, sd, 0, 0, 0 );
        }
 
-       ber_pvt_sb_destroy( c->c_sb );
+       ber_sockbuf_free( c->c_sb );
+       c->c_sb = ber_sockbuf_alloc( );
 
     c->c_conn_state = SLAP_C_INVALID;
     c->c_struct_state = SLAP_C_UNUSED;
@@ -449,6 +573,27 @@ int connection_state_closing( Connection *c )
        return state == SLAP_C_CLOSING;
 }
 
+static void connection_abandon( Connection *c )
+{
+       /* c_mutex must be locked by caller */
+
+       Operation *o;
+
+       for( o = c->c_ops; o != NULL; o = o->o_next ) {
+               ldap_pvt_thread_mutex_lock( &o->o_abandonmutex );
+               o->o_abandon = 1;
+               ldap_pvt_thread_mutex_unlock( &o->o_abandonmutex );
+       }
+
+       /* remove pending operations */
+       for( o = slap_op_pop( &c->c_pending_ops );
+               o != NULL;
+               o = slap_op_pop( &c->c_pending_ops ) )
+       {
+               slap_op_free( o );
+       }
+}
+
 void connection_closing( Connection *c )
 {
        assert( connections != NULL );
@@ -459,43 +604,32 @@ void connection_closing( Connection *c )
        /* c_mutex must be locked by caller */
 
        if( c->c_conn_state != SLAP_C_CLOSING ) {
-               Operation *o;
+               ber_socket_t    sd;
 
+               ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_GET_FD, &sd );
                Debug( LDAP_DEBUG_TRACE,
-                       "connection_closing: readying conn=%ld sd=%d for close.\n",
-                       c->c_connid, ber_pvt_sb_get_desc( c->c_sb ), 0 );
+                       "connection_closing: readying conn=%ld sd=%d for close\n",
+                       c->c_connid, sd, 0 );
 
                /* update state to closing */
                c->c_conn_state = SLAP_C_CLOSING;
 
                /* don't listen on this port anymore */
-               slapd_clr_read( ber_pvt_sb_get_desc( c->c_sb ), 1 );
-
-               /* shutdown I/O -- not yet implemented */
+               slapd_clr_read( sd, 1 );
 
                /* abandon active operations */
-               for( o = c->c_ops; o != NULL; o = o->o_next ) {
-                       ldap_pvt_thread_mutex_lock( &o->o_abandonmutex );
-                       o->o_abandon = 1;
-                       ldap_pvt_thread_mutex_unlock( &o->o_abandonmutex );
-               }
-
-               /* remove pending operations */
-               for( o = slap_op_pop( &c->c_pending_ops );
-                       o != NULL;
-                       o = slap_op_pop( &c->c_pending_ops ) )
-               {
-                       slap_op_free( o );
-               }
+               connection_abandon( c );
 
                /* wake write blocked operations */
-               slapd_clr_write( ber_pvt_sb_get_desc(c->c_sb), 1 );
+               slapd_clr_write( sd, 1 );
                ldap_pvt_thread_cond_signal( &c->c_write_cv );
        }
 }
 
 static void connection_close( Connection *c )
 {
+       ber_socket_t    sd;
+
        assert( connections != NULL );
        assert( c != NULL );
        assert( c->c_struct_state == SLAP_C_USED );
@@ -503,16 +637,17 @@ static void connection_close( Connection *c )
 
        /* note: connections_mutex and c_mutex should be locked by caller */
 
+       ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_GET_FD, &sd );
        if( c->c_ops != NULL ) {
                Debug( LDAP_DEBUG_TRACE,
-                       "connection_close: deferring conn=%ld sd=%d.\n",
-                       c->c_connid, ber_pvt_sb_get_desc( c->c_sb ), 0 );
+                       "connection_close: deferring conn=%ld sd=%d\n",
+                       c->c_connid, sd, 0 );
 
                return;
        }
 
-       Debug( LDAP_DEBUG_TRACE, "connection_close: conn=%ld sd=%d.\n",
-               c->c_connid, ber_pvt_sb_get_desc( c->c_sb ), 0 );
+       Debug( LDAP_DEBUG_TRACE, "connection_close: conn=%ld sd=%d\n",
+               c->c_connid, sd, 0 );
 
        connection_destroy( c );
 }
@@ -602,6 +737,7 @@ void connection_done( Connection *c )
 static void *
 connection_operation( void *arg_v )
 {
+       int rc;
        struct co_arg   *arg = arg_v;
        ber_tag_t tag = arg->co_op->o_tag;
        Connection *conn = arg->co_conn;
@@ -610,49 +746,70 @@ connection_operation( void *arg_v )
        num_ops_initiated++;
        ldap_pvt_thread_mutex_unlock( &num_ops_mutex );
 
+       if( conn->c_sasl_bind_in_progress && tag != LDAP_REQ_BIND ) {
+               Debug( LDAP_DEBUG_ANY, "connection_operation: "
+                       "error: SASL bind in progress (tag=%ld).\n",
+                       (long) tag, 0, 0 );
+               send_ldap_result( conn, arg->co_op,
+                       rc = LDAP_OPERATIONS_ERROR,
+                       NULL, "SASL bind in progress", NULL, NULL );
+               goto operations_error;
+       }
+
        switch ( tag ) {
        case LDAP_REQ_BIND:
-               do_bind( conn, arg->co_op );
+               rc = do_bind( conn, arg->co_op );
                break;
 
        case LDAP_REQ_UNBIND:
-               do_unbind( conn, arg->co_op );
+               rc = do_unbind( conn, arg->co_op );
                break;
 
        case LDAP_REQ_ADD:
-               do_add( conn, arg->co_op );
+               rc = do_add( conn, arg->co_op );
                break;
 
        case LDAP_REQ_DELETE:
-               do_delete( conn, arg->co_op );
+               rc = do_delete( conn, arg->co_op );
                break;
 
        case LDAP_REQ_MODRDN:
-               do_modrdn( conn, arg->co_op );
+               rc = do_modrdn( conn, arg->co_op );
                break;
 
        case LDAP_REQ_MODIFY:
-               do_modify( conn, arg->co_op );
+               rc = do_modify( conn, arg->co_op );
                break;
 
        case LDAP_REQ_COMPARE:
-               do_compare( conn, arg->co_op );
+               rc = do_compare( conn, arg->co_op );
                break;
 
        case LDAP_REQ_SEARCH:
-               do_search( conn, arg->co_op );
+               rc = do_search( conn, arg->co_op );
                break;
 
        case LDAP_REQ_ABANDON:
-               do_abandon( conn, arg->co_op );
+               rc = do_abandon( conn, arg->co_op );
+               break;
+
+       case LDAP_REQ_EXTENDED:
+               rc = do_extended( conn, arg->co_op );
                break;
 
        default:
-               Debug( LDAP_DEBUG_ANY, "unknown request 0x%lx\n",
-                   arg->co_op->o_tag, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "unknown LDAP request 0x%lx\n",
+                   tag, 0, 0 );
+               arg->co_op->o_tag = LBER_ERROR;
+               send_ldap_disconnect( conn, arg->co_op,
+                       LDAP_PROTOCOL_ERROR, "unknown LDAP request" );
+               rc = -1;
                break;
        }
 
+       if( rc == SLAPD_DISCONNECT ) tag = LBER_ERROR;
+
+operations_error:
        ldap_pvt_thread_mutex_lock( &num_ops_mutex );
        num_ops_completed++;
        ldap_pvt_thread_mutex_unlock( &num_ops_mutex );
@@ -670,12 +827,16 @@ connection_operation( void *arg_v )
        arg = NULL;
 
        switch( tag ) {
+       case LBER_ERROR:
        case LDAP_REQ_UNBIND:
                /* c_mutex is locked */
                connection_closing( conn );
                break;
 
        case LDAP_REQ_BIND:
+               conn->c_sasl_bind_in_progress =
+                       rc == LDAP_SASL_BIND_IN_PROGRESS ? 1 : 0;
+
                if( conn->c_conn_state == SLAP_C_BINDING) {
                        conn->c_conn_state = SLAP_C_ACTIVE;
                }
@@ -733,14 +894,53 @@ int connection_read(ber_socket_t s)
                "connection_read(%d): checking for input on id=%ld\n",
                s, c->c_connid, 0 );
 
+#ifdef HAVE_TLS
+       if ( c->c_is_tls && c->c_needs_tls_accept ) {
+               rc = ldap_pvt_tls_accept( c->c_sb, NULL );
+               if ( rc < 0 ) {
+                       struct timeval tv;
+                       fd_set rfd;
+
+                       Debug( LDAP_DEBUG_TRACE,
+                              "connection_read(%d): TLS accept error error=%d id=%ld, closing\n",
+                              s, rc, c->c_connid );
+
+                       c->c_needs_tls_accept = 0;
+                       /* connections_mutex and c_mutex are locked */
+                       connection_closing( c );
+
+                       /* Drain input before close, to allow SSL error codes
+                        * to propagate to client. */
+                       FD_ZERO(&rfd);
+                       FD_SET(s, &rfd);
+                       for (rc=1; rc>0;)
+                       {
+                           tv.tv_sec = 1;
+                           tv.tv_usec = 0;
+                           rc = select(s+1, &rfd, NULL, NULL, &tv);
+                           if (rc == 1)
+                               ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_DRAIN,
+                                   NULL);
+                       }
+                       connection_close( c );
+               } else if ( rc == 0 ) {
+                       c->c_needs_tls_accept = 0;
+               }
+               connection_return( c );
+               ldap_pvt_thread_mutex_unlock( &connections_mutex );
+               return 0;
+       }
+#endif
+
 #define CONNECTION_INPUT_LOOP 1
 
 #ifdef DATA_READY_LOOP
-       while(!rc && ber_pvt_sb_data_ready(&c->c_sb))
+       while( !rc && ber_sockbuf_ctrl( c->c_sb, LBER_SB_DATA_READY, NULL ) )
 #elif CONNECTION_INPUT_LOOP
        while(!rc)
 #endif
        {
+               /* How do we do this without getting into a busy loop ? */
                rc = connection_input( c );
        }
 
@@ -754,6 +954,10 @@ int connection_read(ber_socket_t s)
                connection_close( c );
        }
 
+       if ( ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_NEEDS_READ, NULL ) )
+               slapd_set_read( s, 1 );
+       if ( ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_NEEDS_WRITE, NULL ) )
+               slapd_set_write( s, 1 );
        connection_return( c );
        ldap_pvt_thread_mutex_unlock( &connections_mutex );
        return 0;
@@ -781,15 +985,13 @@ connection_input(
            != LDAP_TAG_MESSAGE )
        {
                int err = errno;
+               ber_socket_t    sd;
+
+               ber_sockbuf_ctrl( conn->c_sb, LBER_SB_OPT_GET_FD, &sd );
 
                Debug( LDAP_DEBUG_TRACE,
-                       "ber_get_next on fd %d failed errno %d (%s)\n",
-                       ber_pvt_sb_get_desc( conn->c_sb ), err,
-                       err > -1 && err < sys_nerr ?  sys_errlist[err] : "unknown" );
-               Debug( LDAP_DEBUG_TRACE,
-                       "\t*** got %ld of %lu so far\n",
-                       (long)(conn->c_currentber->ber_rwptr - conn->c_currentber->ber_buf),
-                       conn->c_currentber->ber_len, 0 );
+                       "ber_get_next on fd %d failed errno=%d (%s)\n",
+                       sd, err, sock_errstr(err) );
 
                if ( err != EWOULDBLOCK && err != EAGAIN ) {
                        /* log, close and send error */
@@ -821,6 +1023,11 @@ connection_input(
                return -1;
        }
 
+       if(tag == LDAP_REQ_BIND) {
+               /* immediately abandon all exiting operations upon BIND */
+               connection_abandon( conn );
+       }
+
        op = slap_op_alloc( ber, msgid, tag, conn->c_n_ops_received++ );
 
        if ( conn->c_conn_state == SLAP_C_BINDING
@@ -852,11 +1059,16 @@ connection_resched( Connection *conn )
        Operation *op;
 
        if( conn->c_conn_state == SLAP_C_CLOSING ) {
+               ber_socket_t    sd;
+
+               ber_sockbuf_ctrl( conn->c_sb, LBER_SB_OPT_GET_FD, &sd );
                Debug( LDAP_DEBUG_TRACE,
-                       "connection_resched: attempting closing conn=%ld sd=%d.\n",
-                       conn->c_connid, ber_pvt_sb_get_desc( conn->c_sb ), 0 );
+                       "connection_resched: attempting closing conn=%ld sd=%d\n",
+                       conn->c_connid, sd, 0 );
 
+               ldap_pvt_thread_mutex_lock( &connections_mutex );
                connection_close( conn );
+               ldap_pvt_thread_mutex_unlock( &connections_mutex );
                return 0;
        }
 
@@ -891,6 +1103,10 @@ static int connection_op_activate( Connection *conn, Operation *op )
        int status;
        ber_tag_t tag = op->o_tag;
 
+       if(tag == LDAP_REQ_BIND) {
+               conn->c_conn_state = SLAP_C_BINDING;
+       }
+
        if ( conn->c_dn != NULL ) {
                tmpdn = ch_strdup( conn->c_dn );
        } else {
@@ -902,17 +1118,19 @@ static int connection_op_activate( Connection *conn, Operation *op )
        arg->co_op = op;
 
        arg->co_op->o_dn = ch_strdup( tmpdn != NULL ? tmpdn : "" );
-       arg->co_op->o_ndn = dn_normalize_case( ch_strdup( arg->co_op->o_dn ) );
+       arg->co_op->o_ndn = ch_strdup( arg->co_op->o_dn );
+       (void) dn_normalize( arg->co_op->o_ndn );
 
        arg->co_op->o_protocol = conn->c_protocol;
+       arg->co_op->o_connid = conn->c_connid;
 
+       arg->co_op->o_authtype = conn->c_authtype;
+       arg->co_op->o_authmech = conn->c_authmech != NULL
+               ?  ch_strdup( conn->c_authmech ) : NULL;
+       
        slap_op_add( &conn->c_ops, arg->co_op );
 
-       if(tag == LDAP_REQ_BIND) {
-               conn->c_conn_state = SLAP_C_BINDING;
-       }
-
-       if ( tmpdn != NULL ) {
+       if( tmpdn != NULL ) {
                free( tmpdn );
        }
 
@@ -961,6 +1179,10 @@ int connection_write(ber_socket_t s)
 
        ldap_pvt_thread_cond_signal( &c->c_write_cv );
 
+       if ( ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_NEEDS_READ, NULL ) )
+               slapd_set_read( s, 1 );
+       if ( ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_NEEDS_WRITE, NULL ) )
+               slapd_set_write( s, 1 );
        connection_return( c );
        ldap_pvt_thread_mutex_unlock( &connections_mutex );
        return 0;