From: Howard Chu <hyc@openldap.org>
Date: Fri, 24 Oct 2003 05:58:42 +0000 (+0000)
Subject: SLAPI fix - no-op when slapi_plugins_used == 0
X-Git-Tag: OPENLDAP_REL_ENG_2_1_MP~490
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=01f7a7466bf70b552b69d6f46380ee139fbfa529;p=openldap

SLAPI fix - no-op when slapi_plugins_used == 0
---

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 17f4459e00..7673e27d12 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -178,8 +178,8 @@ access_allowed(
 	}
 
 #ifdef LDAP_SLAPI
-	ret = slapi_x_access_allowed( op, e, desc, val, access, state );
-	if ( ret == 0 ) {
+	if ( op->o_pb && 
+		!slapi_x_access_allowed( op, e, desc, val, access, state )) {
 		/* ACL plugin denied access */
 		goto done;
 	}
diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index cc18e3fc3c..323fd00bdc 100644
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -231,7 +231,7 @@ do_add( Operation *op, SlapReply *rs )
 	}
 
 #ifdef LDAP_SLAPI
-	initAddPlugin( op, &dn, e, manageDSAit );
+	if ( op->o_pb ) initAddPlugin( op, &dn, e, manageDSAit );
 #endif /* LDAP_SLAPI */
 
 	/*
@@ -290,10 +290,12 @@ do_add( Operation *op, SlapReply *rs )
 			 * Call the preoperation plugin here, because the entry
 			 * will actually contain something.
 			 */
-			rs->sr_err = doPreAddPluginFNs( op );
-			if ( rs->sr_err != LDAP_SUCCESS ) {
-				/* plugin will have sent result */
-				goto done;
+			if ( op->o_pb ) {
+				rs->sr_err = doPreAddPluginFNs( op );
+				if ( rs->sr_err != LDAP_SUCCESS ) {
+					/* plugin will have sent result */
+					goto done;
+				}
 			}
 #endif /* LDAP_SLAPI */
 
@@ -317,10 +319,12 @@ do_add( Operation *op, SlapReply *rs )
 			 * SLAPI_ADD_ENTRY will be empty, but this may be acceptable
 			 * on replicas (for now, it involves the minimum code intrusion).
 			 */
-			rs->sr_err = doPreAddPluginFNs( op );
-			if ( rs->sr_err != LDAP_SUCCESS ) {
-				/* plugin will have sent result */
-				goto done;
+			if ( op->o_pb ) {
+				rs->sr_err = doPreAddPluginFNs( op );
+				if ( rs->sr_err != LDAP_SUCCESS ) {
+					/* plugin will have sent result */
+					goto done;
+				}
 			}
 #endif /* LDAP_SLAPI */
 
@@ -349,10 +353,12 @@ do_add( Operation *op, SlapReply *rs )
 		}
 	} else {
 #ifdef LDAP_SLAPI
-	    rs->sr_err = doPreAddPluginFNs( op );
-	    if ( rs->sr_err != LDAP_SUCCESS ) {
-			/* plugin will have sent result */
-			goto done;
+		if ( op->o_pb ) {
+			rs->sr_err = doPreAddPluginFNs( op );
+			if ( rs->sr_err != LDAP_SUCCESS ) {
+				/* plugin will have sent result */
+				goto done;
+			}
 		}
 #endif
 #ifdef NEW_LOGGING
@@ -366,7 +372,7 @@ do_add( Operation *op, SlapReply *rs )
 	}
 
 #ifdef LDAP_SLAPI
-	doPostAddPluginFNs( op );
+	if ( op->o_pb ) doPostAddPluginFNs( op );
 #endif /* LDAP_SLAPI */
 
 done:
diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index ad58b26b63..8edb10f2d6 100644
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -745,31 +745,29 @@ int
 backend_unbind( Operation *op, SlapReply *rs )
 {
 	int		i;
-#if defined( LDAP_SLAPI )
-	Slapi_PBlock *pb = op->o_pb;
-
-	int     rc;
-	slapi_x_pblock_set_operation( pb, op );
-#endif /* defined( LDAP_SLAPI ) */
 
 	for ( i = 0; i < nbackends; i++ ) {
 #if defined( LDAP_SLAPI )
-		slapi_pblock_set( pb, SLAPI_BACKEND, (void *)&backends[i] );
-		rc = doPluginFNs( &backends[i], SLAPI_PLUGIN_PRE_UNBIND_FN,
-				(Slapi_PBlock *)pb );
-		if ( rc < 0 ) {
-			/*
-			 * A preoperation plugin failure will abort the
-			 * entire operation.
-			 */
+		if ( op->o_pb ) {
+			int rc;
+			if ( i == 0 ) slapi_x_pblock_set_operation( op->o_pb, op );
+			slapi_pblock_set( op->o_pb, SLAPI_BACKEND, (void *)&backends[i] );
+			rc = doPluginFNs( &backends[i], SLAPI_PLUGIN_PRE_UNBIND_FN,
+					(Slapi_PBlock *)op->o_pb );
+			if ( rc < 0 ) {
+				/*
+				 * A preoperation plugin failure will abort the
+				 * entire operation.
+				 */
 #ifdef NEW_LOGGING
-			LDAP_LOG( OPERATION, INFO, "do_bind: Unbind preoperation plugin "
-					"failed\n", 0, 0, 0);
+				LDAP_LOG( OPERATION, INFO, "do_bind: Unbind preoperation plugin "
+						"failed\n", 0, 0, 0);
 #else
-			Debug(LDAP_DEBUG_TRACE, "do_bind: Unbind preoperation plugin "
-					"failed.\n", 0, 0, 0);
+				Debug(LDAP_DEBUG_TRACE, "do_bind: Unbind preoperation plugin "
+						"failed.\n", 0, 0, 0);
 #endif
-			return 0;
+				return 0;
+			}
 		}
 #endif /* defined( LDAP_SLAPI ) */
 
@@ -779,8 +777,8 @@ backend_unbind( Operation *op, SlapReply *rs )
 		}
 
 #if defined( LDAP_SLAPI )
-		if ( doPluginFNs( &backends[i], SLAPI_PLUGIN_POST_UNBIND_FN,
-				(Slapi_PBlock *)pb ) < 0 ) {
+		if ( op->o_pb && doPluginFNs( &backends[i], SLAPI_PLUGIN_POST_UNBIND_FN,
+				(Slapi_PBlock *)op->o_pb ) < 0 ) {
 #ifdef NEW_LOGGING
 			LDAP_LOG( OPERATION, INFO, "do_unbind: Unbind postoperation plugins "
 					"failed\n", 0, 0, 0);
diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index b4095cf56b..a500dd37cb 100644
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -45,11 +45,6 @@ do_bind(
 	ber_tag_t tag;
 	Backend *be = NULL;
 
-#ifdef LDAP_SLAPI
-	Slapi_PBlock *pb = op->o_pb;
-	int rc;
-#endif
-
 #ifdef NEW_LOGGING
 	LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", op->o_connid, 0, 0 );
 #else
@@ -357,6 +352,7 @@ do_bind(
 		}
 
 #ifdef LDAP_SLAPI
+#define	pb	op->o_pb
 		/*
 		 * Normally post-operation plugins are called only after the
 		 * backend operation. Because the front-end performs SASL
@@ -364,12 +360,14 @@ do_bind(
 		 * exception to call the post-operation plugins after a
 		 * SASL bind.
 		 */
-		slapi_x_pblock_set_operation( pb, op );
-		slapi_pblock_set( pb, SLAPI_BIND_TARGET, (void *)dn.bv_val );
-		slapi_pblock_set( pb, SLAPI_BIND_METHOD, (void *)method );
-		slapi_pblock_set( pb, SLAPI_BIND_CREDENTIALS, (void *)&op->orb_cred );
-		slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(0) );
-		(void) doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_BIND_FN, pb );
+		if ( pb ) {
+			slapi_x_pblock_set_operation( pb, op );
+			slapi_pblock_set( pb, SLAPI_BIND_TARGET, (void *)dn.bv_val );
+			slapi_pblock_set( pb, SLAPI_BIND_METHOD, (void *)method );
+			slapi_pblock_set( pb, SLAPI_BIND_CREDENTIALS, (void *)&op->orb_cred );
+			slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(0) );
+			(void) doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_BIND_FN, pb );
+		}
 #endif /* LDAP_SLAPI */
 
 		ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
@@ -522,84 +520,87 @@ do_bind(
 	}
 
 #if defined( LDAP_SLAPI )
-	slapi_x_pblock_set_operation( pb, op );
-	slapi_pblock_set( pb, SLAPI_BIND_TARGET, (void *)dn.bv_val );
-	slapi_pblock_set( pb, SLAPI_BIND_METHOD, (void *)method );
-	slapi_pblock_set( pb, SLAPI_BIND_CREDENTIALS, (void *)&op->orb_cred );
-	slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(0) );
-	slapi_pblock_set( pb, SLAPI_CONN_DN, (void *)(0) );
+	if ( pb ) {
+		int rc;
+		slapi_x_pblock_set_operation( pb, op );
+		slapi_pblock_set( pb, SLAPI_BIND_TARGET, (void *)dn.bv_val );
+		slapi_pblock_set( pb, SLAPI_BIND_METHOD, (void *)method );
+		slapi_pblock_set( pb, SLAPI_BIND_CREDENTIALS, (void *)&op->orb_cred );
+		slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(0) );
+		slapi_pblock_set( pb, SLAPI_CONN_DN, (void *)(0) );
 
-	rc = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_BIND_FN, pb );
+		rc = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_BIND_FN, pb );
 
 #ifdef NEW_LOGGING
-	LDAP_LOG( OPERATION, INFO,
-		"do_bind: Bind preoperation plugin returned %d\n",
-		rs->sr_err, 0, 0);
+		LDAP_LOG( OPERATION, INFO,
+			"do_bind: Bind preoperation plugin returned %d\n",
+			rs->sr_err, 0, 0);
 #else
-	Debug(LDAP_DEBUG_TRACE,
-		"do_bind: Bind preoperation plugin returned %d.\n",
-		rs->sr_err, 0, 0);
+		Debug(LDAP_DEBUG_TRACE,
+			"do_bind: Bind preoperation plugin returned %d.\n",
+			rs->sr_err, 0, 0);
 #endif
 
-	switch ( rc ) {
-	case SLAPI_BIND_SUCCESS:
-		/* Continue with backend processing */
-		break;
-	case SLAPI_BIND_FAIL:
-		/* Failure, server sends result */
-		rs->sr_err = LDAP_INVALID_CREDENTIALS;
-		send_ldap_result( op, rs );
-		goto cleanup;
-		break;
-	case SLAPI_BIND_ANONYMOUS:
-		/* SLAPI_BIND_ANONYMOUS is undocumented XXX */
-	default:
-		/* Authoritative, plugin sent result, or no plugins called. */
-		if ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE,
-			(void *)&rs->sr_err) != 0 )
-		{
-			rs->sr_err = LDAP_OTHER;
-		}
+		switch ( rc ) {
+		case SLAPI_BIND_SUCCESS:
+			/* Continue with backend processing */
+			break;
+		case SLAPI_BIND_FAIL:
+			/* Failure, server sends result */
+			rs->sr_err = LDAP_INVALID_CREDENTIALS;
+			send_ldap_result( op, rs );
+			goto cleanup;
+			break;
+		case SLAPI_BIND_ANONYMOUS:
+			/* SLAPI_BIND_ANONYMOUS is undocumented XXX */
+		default:
+			/* Authoritative, plugin sent result, or no plugins called. */
+			if ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE,
+				(void *)&rs->sr_err) != 0 )
+			{
+				rs->sr_err = LDAP_OTHER;
+			}
 
-		op->orb_edn.bv_val = NULL;
-		op->orb_edn.bv_len = 0;
+			op->orb_edn.bv_val = NULL;
+			op->orb_edn.bv_len = 0;
 
-		if ( rs->sr_err == LDAP_SUCCESS ) {
-			slapi_pblock_get( pb, SLAPI_CONN_DN, (void *)&op->orb_edn.bv_val );
-			if ( op->orb_edn.bv_val == NULL ) {
-				if ( rc == 1 ) {
-					/* No plugins were called; continue. */
-					break;
+			if ( rs->sr_err == LDAP_SUCCESS ) {
+				slapi_pblock_get( pb, SLAPI_CONN_DN, (void *)&op->orb_edn.bv_val );
+				if ( op->orb_edn.bv_val == NULL ) {
+					if ( rc == 1 ) {
+						/* No plugins were called; continue. */
+						break;
+					}
+				} else {
+					op->orb_edn.bv_len = strlen( op->orb_edn.bv_val );
 				}
-			} else {
-				op->orb_edn.bv_len = strlen( op->orb_edn.bv_val );
-			}
-			rs->sr_err = dnPrettyNormal( NULL, &op->orb_edn,
-				&op->o_req_dn, &op->o_req_ndn, op->o_tmpmemctx );
-			ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
-			ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
-			ber_dupbv(&op->o_conn->c_ndn, &op->o_req_ndn);
-			op->o_tmpfree( op->o_req_dn.bv_val, op->o_tmpmemctx );
-			op->o_req_dn.bv_val = NULL;
-			op->o_req_dn.bv_len = 0;
-			op->o_tmpfree( op->o_req_ndn.bv_val, op->o_tmpmemctx );
-			op->o_req_ndn.bv_val = NULL;
-			op->o_req_ndn.bv_len = 0;
-			if ( op->o_conn->c_dn.bv_len != 0 ) {
-				ber_len_t max = sockbuf_max_incoming_auth;
-				ber_sockbuf_ctrl( op->o_conn->c_sb,
-					LBER_SB_OPT_SET_MAX_INCOMING, &max );
+				rs->sr_err = dnPrettyNormal( NULL, &op->orb_edn,
+					&op->o_req_dn, &op->o_req_ndn, op->o_tmpmemctx );
+				ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
+				ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
+				ber_dupbv(&op->o_conn->c_ndn, &op->o_req_ndn);
+				op->o_tmpfree( op->o_req_dn.bv_val, op->o_tmpmemctx );
+				op->o_req_dn.bv_val = NULL;
+				op->o_req_dn.bv_len = 0;
+				op->o_tmpfree( op->o_req_ndn.bv_val, op->o_tmpmemctx );
+				op->o_req_ndn.bv_val = NULL;
+				op->o_req_ndn.bv_len = 0;
+				if ( op->o_conn->c_dn.bv_len != 0 ) {
+					ber_len_t max = sockbuf_max_incoming_auth;
+					ber_sockbuf_ctrl( op->o_conn->c_sb,
+						LBER_SB_OPT_SET_MAX_INCOMING, &max );
+				}
+				/* log authorization identity */
+				Statslog( LDAP_DEBUG_STATS,
+					"conn=%lu op=%lu BIND dn=\"%s\" mech=simple (SLAPI) ssf=0\n",
+					op->o_connid, op->o_opid,
+					op->o_conn->c_dn.bv_val ? op->o_conn->c_dn.bv_val : "<empty>",
+					0, 0 );
+				ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 			}
-			/* log authorization identity */
-			Statslog( LDAP_DEBUG_STATS,
-				"conn=%lu op=%lu BIND dn=\"%s\" mech=simple (SLAPI) ssf=0\n",
-				op->o_connid, op->o_opid,
-				op->o_conn->c_dn.bv_val ? op->o_conn->c_dn.bv_val : "<empty>",
-				0, 0 );
-			ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
+			goto cleanup;
+			break;
 		}
-		goto cleanup;
-		break;
 	}
 #endif /* defined( LDAP_SLAPI ) */
 
@@ -660,7 +661,7 @@ do_bind(
 	}
 
 #if defined( LDAP_SLAPI )
-	if ( doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_BIND_FN, pb ) < 0 ) {
+	if ( pb && doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_BIND_FN, pb ) < 0 ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( OPERATION, INFO,
 			"do_bind: Bind postoperation plugins failed\n",
diff --git a/servers/slapd/compare.c b/servers/slapd/compare.c
index 7615323a5c..bac553cb1b 100644
--- a/servers/slapd/compare.c
+++ b/servers/slapd/compare.c
@@ -45,10 +45,6 @@ do_compare(
 	AttributeAssertion ava = { NULL, { 0, NULL } };
 	int manageDSAit;
 
-#ifdef LDAP_SLAPI
-	Slapi_PBlock *pb = op->o_pb;
-#endif
-
 	ava.aa_desc = NULL;
 
 #ifdef NEW_LOGGING
@@ -254,30 +250,33 @@ do_compare(
 		ava.aa_desc->ad_cname.bv_val, 0 );
 
 #if defined( LDAP_SLAPI )
-	slapi_x_pblock_set_operation( pb, op );
-	slapi_pblock_set( pb, SLAPI_COMPARE_TARGET, (void *)dn.bv_val );
-	slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
-	slapi_pblock_set( pb, SLAPI_COMPARE_TYPE, (void *)desc.bv_val );
-	slapi_pblock_set( pb, SLAPI_COMPARE_VALUE, (void *)&value );
-
-	rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_COMPARE_FN, pb );
-	if ( rs->sr_err < 0 ) {
-		/*
-		 * A preoperation plugin failure will abort the
-		 * entire operation.
-		 */
+#define	pb	op->o_pb
+	if ( pb ) {
+		slapi_x_pblock_set_operation( pb, op );
+		slapi_pblock_set( pb, SLAPI_COMPARE_TARGET, (void *)dn.bv_val );
+		slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
+		slapi_pblock_set( pb, SLAPI_COMPARE_TYPE, (void *)desc.bv_val );
+		slapi_pblock_set( pb, SLAPI_COMPARE_VALUE, (void *)&value );
+
+		rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_COMPARE_FN, pb );
+		if ( rs->sr_err < 0 ) {
+			/*
+			 * A preoperation plugin failure will abort the
+			 * entire operation.
+			 */
 #ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, "do_compare: compare preoperation plugin "
-				"failed\n", 0, 0, 0);
+			LDAP_LOG( OPERATION, INFO, "do_compare: compare preoperation plugin "
+					"failed\n", 0, 0, 0);
 #else
-		Debug(LDAP_DEBUG_TRACE, "do_compare: compare preoperation plugin "
-				"failed.\n", 0, 0, 0);
+			Debug(LDAP_DEBUG_TRACE, "do_compare: compare preoperation plugin "
+					"failed.\n", 0, 0, 0);
 #endif
-		if ( ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 )  ||
-		     rs->sr_err == LDAP_SUCCESS ) {
-			rs->sr_err = LDAP_OTHER;
+			if ( ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 )  ||
+				 rs->sr_err == LDAP_SUCCESS ) {
+				rs->sr_err = LDAP_OTHER;
+			}
+			goto cleanup;
 		}
-		goto cleanup;
 	}
 #endif /* defined( LDAP_SLAPI ) */
 
@@ -290,7 +289,7 @@ do_compare(
 	}
 
 #if defined( LDAP_SLAPI )
-	if ( doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_COMPARE_FN, pb ) < 0 ) {
+	if ( pb && doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_COMPARE_FN, pb ) < 0 ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( OPERATION, INFO, "do_compare: compare postoperation plugins "
 				"failed\n", 0, 0, 0 );
diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index 52c9e0a601..3245fe986c 100644
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -73,6 +73,10 @@ char   *strtok_quote_ptr;
 
 int use_reverse_lookup = 0;
 
+#ifdef LDAP_SLAPI
+int slapi_plugins_used = 0;
+#endif
+
 static char	*fp_getline(FILE *fp, int *lineno);
 static void	fp_getline_init(int *lineno);
 static int	fp_parse_line(int lineno, char *line);
@@ -2404,6 +2408,7 @@ read_config( const char *fname, int depth )
 					!= LDAP_SUCCESS ) {
 				return( 1 );
 			}
+			slapi_plugins_used++;
 
 #else /* !defined( LDAP_SLAPI ) */
 #ifdef NEW_LOGGING
diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c
index 4adf478e25..35543fab40 100644
--- a/servers/slapd/connection.c
+++ b/servers/slapd/connection.c
@@ -39,16 +39,18 @@ static unsigned long conn_nextid = 0;
 #define SLAP_C_ACTIVE			0x02	/* one or more threads */
 #define SLAP_C_BINDING			0x03	/* binding */
 #define SLAP_C_CLOSING			0x04	/* closing */
+#define SLAP_C_CLIENT			0x05	/* outbound client conn */
 
 const char *
 connection_state2str( int state )
 {
 	switch( state ) {
-	case SLAP_C_INVALID:	return "!";		
-	case SLAP_C_INACTIVE:	return "|";		
-	case SLAP_C_ACTIVE:		return "";			
+	case SLAP_C_INVALID:	return "!";
+	case SLAP_C_INACTIVE:	return "|";
+	case SLAP_C_ACTIVE:		return "";
 	case SLAP_C_BINDING:	return "B";
-	case SLAP_C_CLOSING:	return "C";			
+	case SLAP_C_CLOSING:	return "C";
+	case SLAP_C_CLIENT:		return "L";
 	}
 
 	return "?";
@@ -463,7 +465,9 @@ long connection_init(
 		ldap_pvt_thread_cond_init( &c->c_write_cv );
 
 #ifdef LDAP_SLAPI
-		slapi_x_create_object_extensions( SLAPI_X_EXT_CONNECTION, c );
+		if ( slapi_plugins_used ) {
+			slapi_x_create_object_extensions( SLAPI_X_EXT_CONNECTION, c );
+		}
 #endif
 
 		c->c_struct_state = SLAP_C_UNUSED;
@@ -687,7 +691,9 @@ connection_destroy( Connection *c )
 
 #ifdef LDAP_SLAPI
 	/* call destructors, then constructors; avoids unnecessary allocation */
-	slapi_x_clear_object_extensions( SLAPI_X_EXT_CONNECTION, c );
+	if ( slapi_plugins_used ) {
+		slapi_x_clear_object_extensions( SLAPI_X_EXT_CONNECTION, c );
+	}
 #endif
 }
 
diff --git a/servers/slapd/delete.c b/servers/slapd/delete.c
index 5af628095e..cebb526c04 100644
--- a/servers/slapd/delete.c
+++ b/servers/slapd/delete.c
@@ -40,10 +40,6 @@ do_delete(
 	struct berval dn = { 0, NULL };
 	int manageDSAit;
 
-#ifdef LDAP_SLAPI
-	Slapi_PBlock *pb = op->o_pb;
-#endif
-
 #ifdef NEW_LOGGING
 	LDAP_LOG( OPERATION, ENTRY, 
 		"do_delete: conn %d\n", op->o_connid, 0, 0 );
@@ -158,28 +154,31 @@ do_delete(
 	}
 
 #if defined( LDAP_SLAPI )
-	slapi_x_pblock_set_operation( pb, op );
-	slapi_pblock_set( pb, SLAPI_DELETE_TARGET, (void *)dn.bv_val );
-	slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
-
-	rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_DELETE_FN, pb );
-	if ( rs->sr_err < 0 ) {
-		/*
-		 * A preoperation plugin failure will abort the
-		 * entire operation.
-		 */
+#define pb op->o_pb
+	if ( pb ) {
+		slapi_x_pblock_set_operation( pb, op );
+		slapi_pblock_set( pb, SLAPI_DELETE_TARGET, (void *)dn.bv_val );
+		slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
+
+		rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_DELETE_FN, pb );
+		if ( rs->sr_err < 0 ) {
+			/*
+			 * A preoperation plugin failure will abort the
+			 * entire operation.
+			 */
 #ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, "do_delete: delete preoperation plugin "
-				"failed\n", 0, 0, 0 );
+			LDAP_LOG( OPERATION, INFO, "do_delete: delete preoperation plugin "
+					"failed\n", 0, 0, 0 );
 #else
-		Debug (LDAP_DEBUG_TRACE, "do_delete: delete preoperation plugin failed.\n",
-				0, 0, 0);
+			Debug (LDAP_DEBUG_TRACE, "do_delete: delete preoperation plugin failed.\n",
+					0, 0, 0);
 #endif
-		if ( ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 )  ||
-		     rs->sr_err == LDAP_SUCCESS ) {
-			rs->sr_err = LDAP_OTHER;
+			if ( ( slapi_pblock_get( pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 )  ||
+				 rs->sr_err == LDAP_SUCCESS ) {
+				rs->sr_err = LDAP_OTHER;
+			}
+			goto cleanup;
 		}
-		goto cleanup;
 	}
 #endif /* defined( LDAP_SLAPI ) */
 
@@ -245,7 +244,7 @@ do_delete(
 	}
 
 #if defined( LDAP_SLAPI )
-	if ( doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_DELETE_FN, pb ) < 0) {
+	if ( pb && doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_DELETE_FN, pb ) < 0) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( OPERATION, INFO, "do_delete: delete postoperation plugins "
 				"failed\n", 0, 0, 0 );
diff --git a/servers/slapd/modify.c b/servers/slapd/modify.c
index 89a818fd33..a120a3690a 100644
--- a/servers/slapd/modify.c
+++ b/servers/slapd/modify.c
@@ -47,7 +47,6 @@ do_modify(
 #endif
 #ifdef LDAP_SLAPI
 	LDAPMod		**modv = NULL;
-	Slapi_PBlock *pb = op->o_pb;
 #endif
 	int manageDSAit;
 	int increment = 0;
@@ -383,44 +382,47 @@ do_modify(
 	}
 
 #if defined( LDAP_SLAPI )
-	slapi_x_pblock_set_operation( pb, op );
-	slapi_pblock_set( pb, SLAPI_MODIFY_TARGET, (void *)dn.bv_val );
-	slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
-	modv = slapi_x_modifications2ldapmods( &modlist );
-	slapi_pblock_set( pb, SLAPI_MODIFY_MODS, (void *)modv );
-
-	rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_MODIFY_FN, pb );
-	if ( rs->sr_err < 0 ) {
-		/*
-		 * A preoperation plugin failure will abort the
-		 * entire operation.
-		 */
+#define pb	op->o_pb
+	if ( pb ) {
+		slapi_x_pblock_set_operation( pb, op );
+		slapi_pblock_set( pb, SLAPI_MODIFY_TARGET, (void *)dn.bv_val );
+		slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
+		modv = slapi_x_modifications2ldapmods( &modlist );
+		slapi_pblock_set( pb, SLAPI_MODIFY_MODS, (void *)modv );
+
+		rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_MODIFY_FN, pb );
+		if ( rs->sr_err < 0 ) {
+			/*
+			 * A preoperation plugin failure will abort the
+			 * entire operation.
+			 */
 #ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, "do_modify: modify preoperation plugin "
-				"failed\n", 0, 0, 0 );
+			LDAP_LOG( OPERATION, INFO, "do_modify: modify preoperation plugin "
+					"failed\n", 0, 0, 0 );
 #else
-		Debug(LDAP_DEBUG_TRACE, "do_modify: modify preoperation plugin failed.\n",
-				0, 0, 0);
+			Debug(LDAP_DEBUG_TRACE, "do_modify: modify preoperation plugin failed.\n",
+					0, 0, 0);
 #endif
-		if ( ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 )  ||
-		     rs->sr_err == LDAP_SUCCESS ) {
-			rs->sr_err = LDAP_OTHER;
+			if ( ( slapi_pblock_get( op->o_pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 )  ||
+				 rs->sr_err == LDAP_SUCCESS ) {
+				rs->sr_err = LDAP_OTHER;
+			}
+			slapi_x_free_ldapmods( modv );
+			modv = NULL;
+			goto cleanup;
 		}
-		slapi_x_free_ldapmods( modv );
-		modv = NULL;
-		goto cleanup;
-	}
 
-	/*
-	 * It's possible that the preoperation plugin changed the
-	 * modification array, so we need to convert it back to
-	 * a Modification list.
-	 *
-	 * Calling slapi_x_modifications2ldapmods() destroyed modlist so
-	 * we don't need to free it.
-	 */
-	slapi_pblock_get( pb, SLAPI_MODIFY_MODS, (void **)&modv );
-	modlist = slapi_x_ldapmods2modifications( modv );
+		/*
+		 * It's possible that the preoperation plugin changed the
+		 * modification array, so we need to convert it back to
+		 * a Modification list.
+		 *
+		 * Calling slapi_x_modifications2ldapmods() destroyed modlist so
+		 * we don't need to free it.
+		 */
+		slapi_pblock_get( pb, SLAPI_MODIFY_MODS, (void **)&modv );
+		modlist = slapi_x_ldapmods2modifications( modv );
+	}
 
 	/*
 	 * NB: it is valid for the plugin to return no modifications
@@ -532,7 +534,7 @@ do_modify(
 #if defined( LDAP_SLAPI )
 	} /* modlist != NULL */
 
-	if ( doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_MODIFY_FN, pb ) < 0 ) {
+	if ( pb && doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_MODIFY_FN, pb ) < 0 ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( OPERATION, INFO, "do_modify: modify postoperation plugins "
 				"failed\n", 0, 0, 0 );
diff --git a/servers/slapd/modrdn.c b/servers/slapd/modrdn.c
index 0d27035499..f63aca9d56 100644
--- a/servers/slapd/modrdn.c
+++ b/servers/slapd/modrdn.c
@@ -60,10 +60,6 @@ do_modrdn(
 	ber_len_t	length;
 	int manageDSAit;
 
-#ifdef LDAP_SLAPI
-	Slapi_PBlock *pb = op->o_pb;
-#endif
-
 #ifdef NEW_LOGGING
 	LDAP_LOG( OPERATION, ENTRY, "do_modrdn: begin\n", 0, 0, 0 );
 #else
@@ -315,32 +311,35 @@ do_modrdn(
 	}
 
 #if defined( LDAP_SLAPI )
-	slapi_x_pblock_set_operation( pb, op );
-	slapi_pblock_set( pb, SLAPI_MODRDN_TARGET, (void *)dn.bv_val );
-	slapi_pblock_set( pb, SLAPI_MODRDN_NEWRDN, (void *)newrdn.bv_val );
-	slapi_pblock_set( pb, SLAPI_MODRDN_NEWSUPERIOR,
-			(void *)newSuperior.bv_val );
-	slapi_pblock_set( pb, SLAPI_MODRDN_DELOLDRDN, (void *)deloldrdn );
-	slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
-
-	rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_MODRDN_FN, pb );
-	if ( rs->sr_err < 0 ) {
-		/*
-		 * A preoperation plugin failure will abort the
-		 * entire operation.
-		 */
+#define	pb	op->o_pb
+	if ( pb ) {
+		slapi_x_pblock_set_operation( pb, op );
+		slapi_pblock_set( pb, SLAPI_MODRDN_TARGET, (void *)dn.bv_val );
+		slapi_pblock_set( pb, SLAPI_MODRDN_NEWRDN, (void *)newrdn.bv_val );
+		slapi_pblock_set( pb, SLAPI_MODRDN_NEWSUPERIOR,
+				(void *)newSuperior.bv_val );
+		slapi_pblock_set( pb, SLAPI_MODRDN_DELOLDRDN, (void *)deloldrdn );
+		slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)manageDSAit );
+
+		rs->sr_err = doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_MODRDN_FN, pb );
+		if ( rs->sr_err < 0 ) {
+			/*
+			 * A preoperation plugin failure will abort the
+			 * entire operation.
+			 */
 #ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, "do_modrdn: modrdn preoperation plugin "
-				"failed\n", 0, 0, 0 );
+			LDAP_LOG( OPERATION, INFO, "do_modrdn: modrdn preoperation plugin "
+					"failed\n", 0, 0, 0 );
 #else
-		Debug(LDAP_DEBUG_TRACE, "do_modrdn: modrdn preoperation plugin "
-				"failed.\n", 0, 0, 0);
+			Debug(LDAP_DEBUG_TRACE, "do_modrdn: modrdn preoperation plugin "
+					"failed.\n", 0, 0, 0);
 #endif
-		if ( ( slapi_pblock_get( pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 ) ||
-		     rs->sr_err == LDAP_SUCCESS ) {
-			rs->sr_err = LDAP_OTHER;
+			if ( ( slapi_pblock_get( pb, SLAPI_RESULT_CODE, (void *)&rs->sr_err ) != 0 ) ||
+				 rs->sr_err == LDAP_SUCCESS ) {
+				rs->sr_err = LDAP_OTHER;
+			}
+			goto cleanup;
 		}
-		goto cleanup;
 	}
 #endif /* defined( LDAP_SLAPI ) */
 
@@ -399,7 +398,7 @@ do_modrdn(
 	}
 
 #if defined( LDAP_SLAPI )
-	if ( doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_MODRDN_FN, pb ) < 0 ) {
+	if ( pb && doPluginFNs( op->o_bd, SLAPI_PLUGIN_POST_MODRDN_FN, pb ) < 0 ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( OPERATION, INFO, "do_modrdn: modrdn postoperation plugins "
 				"failed\n", 0, 0, 0 );
diff --git a/servers/slapd/operation.c b/servers/slapd/operation.c
index cb08e60eee..c144c19cfc 100644
--- a/servers/slapd/operation.c
+++ b/servers/slapd/operation.c
@@ -81,8 +81,8 @@ slap_op_free( Operation *op )
 #if defined( LDAP_SLAPI )
 	if ( op->o_pb != NULL ) {
 		slapi_pblock_destroy( (Slapi_PBlock *)op->o_pb );
+		slapi_x_free_object_extensions( SLAPI_X_EXT_OPERATION, op );
 	}
-	slapi_x_free_object_extensions( SLAPI_X_EXT_OPERATION, op );
 #endif /* defined( LDAP_SLAPI ) */
 
 	memset( op, 0, sizeof(Operation) );
@@ -119,8 +119,10 @@ slap_op_alloc(
 	op->o_res_ber = NULL;
 
 #if defined( LDAP_SLAPI )
-	op->o_pb = slapi_pblock_new();
-	slapi_x_create_object_extensions( SLAPI_X_EXT_OPERATION, op );
+	if ( slapi_plugins_used ) {
+		op->o_pb = slapi_pblock_new();
+		slapi_x_create_object_extensions( SLAPI_X_EXT_OPERATION, op );
+	}
 #endif /* defined( LDAP_SLAPI ) */
 
 	return( op );
diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index 930ef949d5..5e9184c230 100644
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -304,6 +304,9 @@ LDAP_SLAPD_F (int) get_supported_controls LDAP_P (( char ***ctrloidsp, slap_mask
 LDAP_SLAPD_F (int) read_config LDAP_P(( const char *fname, int depth ));
 LDAP_SLAPD_F (void) config_destroy LDAP_P ((void));
 LDAP_SLAPD_F (char **) str2clist LDAP_P(( char ***, char *, const char * ));
+#ifdef LDAP_SLAPI
+LDAP_SLAPD_V (int) slapi_plugins_used;
+#endif
 
 /*
  * connection.c
diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index 3beff2f438..d05dd42132 100644
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -371,9 +371,11 @@ send_ldap_response(
 	}
 
 #ifdef LDAP_SLAPI
-	slapi_pblock_set( op->o_pb, SLAPI_RESULT_CODE, (void *)rs->sr_err );
-	slapi_pblock_set( op->o_pb, SLAPI_RESULT_MATCHED, (void *)rs->sr_matched );
-	slapi_pblock_set( op->o_pb, SLAPI_RESULT_TEXT, (void *)rs->sr_text );
+	if ( op->o_pb ) {
+		slapi_pblock_set( op->o_pb, SLAPI_RESULT_CODE, (void *)rs->sr_err );
+		slapi_pblock_set( op->o_pb, SLAPI_RESULT_MATCHED, (void *)rs->sr_matched );
+		slapi_pblock_set( op->o_pb, SLAPI_RESULT_TEXT, (void *)rs->sr_text );
+	}
 #endif /* LDAP_SLAPI */
 
 	ldap_pvt_thread_mutex_lock( &num_sent_mutex );
@@ -493,12 +495,14 @@ slap_send_ldap_result( Operation *op, SlapReply *rs )
 	 * should just set SLAPI_RESULT_CODE rather than sending a
 	 * result if they wish to change the result.
 	 */
-	slapi_x_pblock_set_operation( op->o_pb, op );
-	slapi_pblock_set( op->o_pb, SLAPI_RESULT_CODE, (void *)rs->sr_err );
-	slapi_pblock_set( op->o_pb, SLAPI_RESULT_TEXT, (void *)rs->sr_text );
-	slapi_pblock_set( op->o_pb, SLAPI_RESULT_MATCHED, (void *)rs->sr_matched );
+	if ( op->o_pb ) {
+		slapi_x_pblock_set_operation( op->o_pb, op );
+		slapi_pblock_set( op->o_pb, SLAPI_RESULT_CODE, (void *)rs->sr_err );
+		slapi_pblock_set( op->o_pb, SLAPI_RESULT_TEXT, (void *)rs->sr_text );
+		slapi_pblock_set( op->o_pb, SLAPI_RESULT_MATCHED, (void *)rs->sr_matched );
 
-	(void) doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_RESULT_FN, op->o_pb );
+		(void) doPluginFNs( op->o_bd, SLAPI_PLUGIN_PRE_RESULT_FN, op->o_pb );
+	}
 #endif /* LDAP_SLAPI */
 
 	if ( op->o_protocol < LDAP_VERSION3 ) {
@@ -1069,38 +1073,40 @@ slap_send_search_entry( Operation *op, SlapReply *rs )
 	 * First, setup the computed attribute context that is
 	 * passed to all plugins.
 	 */
-	ctx.cac_pb = op->o_pb;
-	ctx.cac_attrs = rs->sr_attrs;
-	ctx.cac_attrsonly = op->ors_attrsonly;
-	ctx.cac_userattrs = userattrs;
-	ctx.cac_opattrs = opattrs;
-	ctx.cac_acl_state = acl_state;
-	ctx.cac_private = (void *)ber;
+	if ( op->o_pb ) {
+		ctx.cac_pb = op->o_pb;
+		ctx.cac_attrs = rs->sr_attrs;
+		ctx.cac_attrsonly = op->ors_attrsonly;
+		ctx.cac_userattrs = userattrs;
+		ctx.cac_opattrs = opattrs;
+		ctx.cac_acl_state = acl_state;
+		ctx.cac_private = (void *)ber;
 
-	/*
-	 * For each client requested attribute, call the plugins.
-	 */
-	if ( rs->sr_attrs != NULL ) {
-		for ( anp = rs->sr_attrs; anp->an_name.bv_val != NULL; anp++ ) {
-			rc = compute_evaluator( &ctx, anp->an_name.bv_val,
-				rs->sr_entry, slapi_x_compute_output_ber );
-			if ( rc == 1 ) {
-				break;
-			}
-		}
-	} else {
 		/*
-		 * Technically we shouldn't be returning operational attributes
-		 * when the user requested only user attributes. We'll let the
-		 * plugin decide whether to be naughty or not.
+		 * For each client requested attribute, call the plugins.
 		 */
-		rc = compute_evaluator( &ctx, "*",
-			rs->sr_entry, slapi_x_compute_output_ber );
-	}
-	if ( rc == 1 ) {
-		if ( op->o_res_ber == NULL ) ber_free_buf( ber );
-		send_ldap_error( op, rs, LDAP_OTHER, "computed attribute error" );
-		goto error_return;
+		if ( rs->sr_attrs != NULL ) {
+			for ( anp = rs->sr_attrs; anp->an_name.bv_val != NULL; anp++ ) {
+				rc = compute_evaluator( &ctx, anp->an_name.bv_val,
+					rs->sr_entry, slapi_x_compute_output_ber );
+				if ( rc == 1 ) {
+					break;
+				}
+			}
+		} else {
+			/*
+			 * Technically we shouldn't be returning operational attributes
+			 * when the user requested only user attributes. We'll let the
+			 * plugin decide whether to be naughty or not.
+			 */
+			rc = compute_evaluator( &ctx, "*",
+				rs->sr_entry, slapi_x_compute_output_ber );
+		}
+		if ( rc == 1 ) {
+			if ( op->o_res_ber == NULL ) ber_free_buf( ber );
+			send_ldap_error( op, rs, LDAP_OTHER, "computed attribute error" );
+			goto error_return;
+		}
 	}
 #endif /* LDAP_SLAPI */
 
diff --git a/servers/slapd/search.c b/servers/slapd/search.c
index 71c8960611..39ca34f4b1 100644
--- a/servers/slapd/search.c
+++ b/servers/slapd/search.c
@@ -245,7 +245,8 @@ do_search(
 
 	manageDSAit = get_manageDSAit( op );
 
-	if ( op->ors_scope == LDAP_SCOPE_BASE ) {
+	/* fake while loop to allow breaking out */
+	while ( op->ors_scope == LDAP_SCOPE_BASE ) {
 		Entry *entry = NULL;
 
 		if ( op->o_req_ndn.bv_len == 0 ) {
@@ -262,16 +263,15 @@ do_search(
 			}
 
 #ifdef LDAP_SLAPI
-			attrs = anlist2charray( op, op->ors_attrs );
-			initSearchPlugin( op, attrs, manageDSAit );
-			rs->sr_err = doPreSearchPluginFNs( op );
-			if ( rs->sr_err == LDAP_SUCCESS ) {
+			if ( op->o_pb ) {
+				attrs = anlist2charray( op, op->ors_attrs );
+				initSearchPlugin( op, attrs, manageDSAit );
+				rs->sr_err = doPreSearchPluginFNs( op );
+				if ( rs->sr_err ) break;
 				doSearchRewriteFNs( op );
-#endif /* LDAP_SLAPI */
-			rs->sr_err = root_dse_info( op->o_conn, &entry, &rs->sr_text );
-#ifdef LDAP_SLAPI
 			}
 #endif /* LDAP_SLAPI */
+			rs->sr_err = root_dse_info( op->o_conn, &entry, &rs->sr_text );
 
 		} else if ( bvmatch( &op->o_req_ndn, &global_schemandn ) ) {
 			/* check restrictions */
@@ -281,22 +281,21 @@ do_search(
 			}
 
 #ifdef LDAP_SLAPI
-			attrs = anlist2charray( op, op->ors_attrs );
-			initSearchPlugin( op, attrs, manageDSAit );
-			rs->sr_err = doPreSearchPluginFNs( op );
-			if ( rs->sr_err == LDAP_SUCCESS ) {
+			if ( op->o_pb ) {
+				attrs = anlist2charray( op, op->ors_attrs );
+				initSearchPlugin( op, attrs, manageDSAit );
+				rs->sr_err = doPreSearchPluginFNs( op );
+				if ( rs->sr_err ) break;
 				doSearchRewriteFNs( op );
-#endif /* LDAP_SLAPI */
-			rs->sr_err = schema_info( &entry, &rs->sr_text );
-#ifdef LDAP_SLAPI
 			}
 #endif /* LDAP_SLAPI */
+			rs->sr_err = schema_info( &entry, &rs->sr_text );
 		}
 
 		if( rs->sr_err != LDAP_SUCCESS ) {
 			send_ldap_result( op, rs );
 #ifdef LDAP_SLAPI
-			doPostSearchPluginFNs( op );
+			if ( op->o_pb ) doPostSearchPluginFNs( op );
 #endif /* LDAP_SLAPI */
 			goto return_results;
 
@@ -314,10 +313,11 @@ do_search(
 			rs->sr_err = LDAP_SUCCESS;
 			send_ldap_result( op, rs );
 #ifdef LDAP_SLAPI
-			doPostSearchPluginFNs( op );
+			if ( op->o_pb ) doPostSearchPluginFNs( op );
 #endif /* LDAP_SLAPI */
 			goto return_results;
 		}
+		break;
 	}
 
 	if( !op->o_req_ndn.bv_len && default_search_nbase.bv_len ) {
@@ -372,14 +372,16 @@ do_search(
 	}
 
 #ifdef LDAP_SLAPI
-	attrs = anlist2charray( op, op->ors_attrs );
-	initSearchPlugin( op, attrs, manageDSAit );
-	rs->sr_err = doPreSearchPluginFNs( op );
-	if ( rs->sr_err != LDAP_SUCCESS ) {
-		goto return_results;
-	}
+	if ( op->o_pb ) {
+		attrs = anlist2charray( op, op->ors_attrs );
+		initSearchPlugin( op, attrs, manageDSAit );
+		rs->sr_err = doPreSearchPluginFNs( op );
+		if ( rs->sr_err != LDAP_SUCCESS ) {
+			goto return_results;
+		}
 
-	doSearchRewriteFNs( op );
+		doSearchRewriteFNs( op );
+	}
 #endif /* LDAP_SLAPI */
 
 	/* actually do the search and send the result(s) */
@@ -391,7 +393,7 @@ do_search(
 	}
 
 #ifdef LDAP_SLAPI
-	doPostSearchPluginFNs( op );
+	if ( op->o_pb ) doPostSearchPluginFNs( op );
 #endif /* LDAP_SLAPI */
 
 return_results:;
diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
index 8167f73bed..33fdeecf27 100644
--- a/servers/slapd/syncrepl.c
+++ b/servers/slapd/syncrepl.c
@@ -398,8 +398,10 @@ do_syncrepl(
 	op.o_conn = &conn;
 	op.o_connid = op.o_conn->c_connid;
 #if defined( LDAP_SLAPI )
-	op.o_pb = slapi_pblock_new();
-	slapi_x_create_object_extensions( SLAPI_X_EXT_OPERATION, &op );
+	if ( slapi_plugins_used ) {
+		op.o_pb = slapi_pblock_new();
+		slapi_x_create_object_extensions( SLAPI_X_EXT_OPERATION, &op );
+	}
 #endif /* defined( LDAP_SLAPI ) */
 
 	/* get syncrepl cookie of shadow replica from subentry */