From: Pierangelo Masarati <ando@openldap.org>
Date: Wed, 4 May 2005 23:57:55 +0000 (+0000)
Subject: honor T-F filters (ITS#3706) and lots of cleanup
X-Git-Tag: OPENLDAP_AC_BP~739
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=4d9750afb5eb7c76ec07e064174d53c9de303dd7;p=openldap

honor T-F filters (ITS#3706) and lots of cleanup
---

diff --git a/servers/slapd/back-meta/add.c b/servers/slapd/back-meta/add.c
index 4a5fe57018..a17fdbb24a 100644
--- a/servers/slapd/back-meta/add.c
+++ b/servers/slapd/back-meta/add.c
@@ -43,7 +43,7 @@ meta_back_add( Operation *op, SlapReply *rs )
 	LDAPMod		**attrs;
 	struct berval	mdn = BER_BVNULL, mapped;
 	dncookie	dc;
-	int		msgid, do_retry = 1;
+	int		do_retry = 1;
 
 	Debug(LDAP_DEBUG_ARGS, "==> meta_back_add: %s\n",
 			op->o_req_dn.bv_val, 0, 0 );
@@ -61,7 +61,7 @@ meta_back_add( Operation *op, SlapReply *rs )
 	/*
 	 * Rewrite the add dn, if needed
 	 */
-	dc.rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+	dc.target = &mi->mi_targets[ candidate ];
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 	dc.ctx = "addDN";
@@ -93,7 +93,7 @@ meta_back_add( Operation *op, SlapReply *rs )
 			mapped = a->a_desc->ad_cname;
 
 		} else {
-			ldap_back_map( &mi->mi_targets[ candidate ]->mt_rwmap.rwm_at,
+			ldap_back_map( &mi->mi_targets[ candidate ].mt_rwmap.rwm_at,
 					&a->a_desc->ad_cname, &mapped, BACKLDAP_MAP );
 			if ( BER_BVISNULL( &mapped ) || BER_BVISEMPTY( &mapped ) ) {
 				continue;
@@ -118,11 +118,11 @@ meta_back_add( Operation *op, SlapReply *rs )
 			for ( j = 0; !BER_BVISNULL( &a->a_vals[ j ] ); ) {
 				struct ldapmapping	*mapping;
 
-				ldap_back_mapping( &mi->mi_targets[ candidate ]->mt_rwmap.rwm_oc,
+				ldap_back_mapping( &mi->mi_targets[ candidate ].mt_rwmap.rwm_oc,
 						&a->a_vals[ j ], &mapping, BACKLDAP_MAP );
 
 				if ( mapping == NULL ) {
-					if ( mi->mi_targets[ candidate ]->mt_rwmap.rwm_oc.drop_missing ) {
+					if ( mi->mi_targets[ candidate ].mt_rwmap.rwm_oc.drop_missing ) {
 						continue;
 					}
 					attrs[ i ]->mod_bvalues[ j ] = &a->a_vals[ j ];
diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h
index 7b74ae9230..f3d3a84a94 100644
--- a/servers/slapd/back-meta/back-meta.h
+++ b/servers/slapd/back-meta/back-meta.h
@@ -70,15 +70,15 @@ struct ldaprwmap {
 
 /* Whatever context ldap_back_dn_massage needs... */
 typedef struct dncookie {
-	struct ldaprwmap *rwmap;
+	struct metatarget_t	*target;
 
 #ifdef ENABLE_REWRITE
-	Connection *conn;
-	char *ctx;
-	SlapReply *rs;
+	Connection		*conn;
+	char			*ctx;
+	SlapReply		*rs;
 #else
-	int normalized;
-	int tofrom;
+	int			normalized;
+	int			tofrom;
 #endif
 } dncookie;
 
@@ -156,6 +156,8 @@ ldap_dnattr_result_rewrite(
 
 /* (end of) from back-ldap.h before rwm removal */
 
+struct metainfo_t;
+
 typedef struct metasingleconn_t {
 	int			msc_candidate;
 #define	META_NOT_CANDIDATE	((ber_tag_t)0)
@@ -169,6 +171,8 @@ typedef struct metasingleconn_t {
 #define META_UNBOUND		0
 #define META_BOUND		1
 #define META_ANONYMOUS		2
+
+	struct metainfo_t	*msc_info;
 } metasingleconn_t;
 
 #define META_LAST(msc)		((msc)->msc_candidate == META_LAST_CONN)
@@ -190,8 +194,10 @@ typedef struct metaconn_t {
 
 typedef struct metatarget_t {
 	char			*mt_uri;
+
 	struct berval		mt_psuffix;		/* pretty suffix */
 	struct berval		mt_nsuffix;		/* normalized suffix */
+
 	struct berval		mt_binddn;
 	struct berval		mt_bindpw;
 
@@ -205,6 +211,9 @@ typedef struct metatarget_t {
 #define META_RETRY_DEFAULT	(3)
 
 	struct ldaprwmap	mt_rwmap;
+
+	unsigned		mt_flags;
+	int			mt_version;
 } metatarget_t;
 
 typedef struct metadncache_t {
@@ -223,7 +232,7 @@ typedef struct metainfo_t {
 #define META_DEFAULT_TARGET_NONE	(-1)
 	int			mi_nretries;
 
-	metatarget_t		**mi_targets;
+	metatarget_t		*mi_targets;
 	SlapReply		*mi_candidates;
 
 	metadncache_t		mi_cache;
@@ -237,9 +246,13 @@ typedef struct metainfo_t {
 #define LDAP_BACK_F_NONE		0x00U
 #define LDAP_BACK_F_SAVECRED		0x01U
 #define LDAP_BACK_F_USE_TLS		0x02U
-#define LDAP_BACK_F_TLS_CRITICAL	( 0x04U | LDAP_BACK_F_USE_TLS )
-#define LDAP_BACK_F_CHASE_REFERRALS	0x8U
+#define LDAP_BACK_F_PROPAGATE_TLS	0x04U
+#define LDAP_BACK_F_TLS_CRITICAL	0x08U
+#define LDAP_BACK_F_TLS_MASK		(LDAP_BACK_F_USE_TLS|LDAP_BACK_F_PROPAGATE_TLS|LDAP_BACK_F_TLS_CRITICAL)
+#define LDAP_BACK_F_CHASE_REFERRALS	0x10U
 #endif
+
+	int			mi_version;
 } metainfo_t;
 
 typedef enum meta_op_type {
diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index 8680609763..88bbf72a69 100644
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -115,11 +115,11 @@ meta_back_bind( Operation *op, SlapReply *rs )
 					0, 0, 0 );
 		}
 
-		if ( isroot && !BER_BVISNULL( &mi->mi_targets[ i ]->mt_pseudorootdn ) )
+		if ( isroot && !BER_BVISNULL( &mi->mi_targets[ i ].mt_pseudorootdn ) )
 		{
-			op2.o_req_dn = mi->mi_targets[ i ]->mt_pseudorootdn;
-			op2.o_req_ndn = mi->mi_targets[ i ]->mt_pseudorootdn;
-			op2.orb_cred = mi->mi_targets[ i ]->mt_pseudorootpw;
+			op2.o_req_dn = mi->mi_targets[ i ].mt_pseudorootdn;
+			op2.o_req_ndn = mi->mi_targets[ i ].mt_pseudorootdn;
+			op2.orb_cred = mi->mi_targets[ i ].mt_pseudorootpw;
 			op2.orb_method = LDAP_AUTH_SIMPLE;
 		}
 		
@@ -177,7 +177,7 @@ meta_back_single_bind(
 	int			candidate )
 {
 	metainfo_t		*mi = ( metainfo_t * )op->o_bd->be_private;
-	metatarget_t		*mt = mi->mi_targets[ candidate ];
+	metatarget_t		*mt = &mi->mi_targets[ candidate ];
 	struct berval		mdn = BER_BVNULL;
 	dncookie		dc;
 	metasingleconn_t	*msc = &mc->mc_conns[ candidate ];
@@ -187,7 +187,7 @@ meta_back_single_bind(
 	/*
 	 * Rewrite the bind dn if needed
 	 */
-	dc.rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+	dc.target = &mi->mi_targets[ candidate ];
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 	dc.ctx = "bindDN";
@@ -326,7 +326,7 @@ meta_back_single_dobind(
 	int			nretries )
 {
 	metainfo_t		*mi = ( metainfo_t * )op->o_bd->be_private;
-	metatarget_t		*mt = mi->mi_targets[ candidate ];
+	metatarget_t		*mt = &mi->mi_targets[ candidate ];
 	metasingleconn_t	*msc = &mc->mc_conns[ candidate ];
 	int			rc;
 	struct berval		cred = BER_BVC( "" );
@@ -469,7 +469,7 @@ meta_back_dobind(
 	}
 
 	for ( i = 0, msc = &mc->mc_conns[ 0 ]; !META_LAST( msc ); ++i, ++msc ) {
-		metatarget_t	*mt = mi->mi_targets[ i ];
+		metatarget_t	*mt = &mi->mi_targets[ i ];
 		int		rc;
 
 		/*
diff --git a/servers/slapd/back-meta/candidates.c b/servers/slapd/back-meta/candidates.c
index 882403d0ba..df3e9f63a5 100644
--- a/servers/slapd/back-meta/candidates.c
+++ b/servers/slapd/back-meta/candidates.c
@@ -115,7 +115,7 @@ meta_back_select_unique_candidate(
 	int	i, candidate = META_TARGET_NONE;
 
 	for ( i = 0; i < mi->mi_ntargets; ++i ) {
-		if ( meta_back_is_candidate( &mi->mi_targets[ i ]->mt_nsuffix, ndn, LDAP_SCOPE_BASE ) )
+		if ( meta_back_is_candidate( &mi->mi_targets[ i ].mt_nsuffix, ndn, LDAP_SCOPE_BASE ) )
 		{
 			if ( candidate == META_TARGET_NONE ) {
 				candidate = i;
diff --git a/servers/slapd/back-meta/compare.c b/servers/slapd/back-meta/compare.c
index 04678f5ff5..e447f7a8d1 100644
--- a/servers/slapd/back-meta/compare.c
+++ b/servers/slapd/back-meta/compare.c
@@ -82,7 +82,7 @@ meta_back_compare( Operation *op, SlapReply *rs )
 		/*
 		 * Rewrite the compare dn, if needed
 		 */
-		dc.rwmap = &mi->mi_targets[ i ]->mt_rwmap;
+		dc.target = &mi->mi_targets[ i ];
 
 		switch ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
 		case LDAP_UNWILLING_TO_PERFORM:
@@ -97,7 +97,7 @@ meta_back_compare( Operation *op, SlapReply *rs )
 		 * if attr is objectClass, try to remap the value
 		 */
 		if ( op->orc_ava->aa_desc == slap_schema.si_ad_objectClass ) {
-			ldap_back_map( &mi->mi_targets[ i ]->mt_rwmap.rwm_oc,
+			ldap_back_map( &mi->mi_targets[ i ].mt_rwmap.rwm_oc,
 					&op->orc_ava->aa_value,
 					&mapped_value, BACKLDAP_MAP );
 
@@ -108,7 +108,7 @@ meta_back_compare( Operation *op, SlapReply *rs )
 		 * else try to remap the attribute
 		 */
 		} else {
-			ldap_back_map( &mi->mi_targets[ i ]->mt_rwmap.rwm_at,
+			ldap_back_map( &mi->mi_targets[ i ].mt_rwmap.rwm_at,
 				&op->orc_ava->aa_desc->ad_cname,
 				&mapped_attr, BACKLDAP_MAP );
 			if ( BER_BVISNULL( &mapped_attr ) || mapped_attr.bv_val[0] == '\0' ) {
diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c
index 777eee643c..64f5180b15 100644
--- a/servers/slapd/back-meta/config.c
+++ b/servers/slapd/back-meta/config.c
@@ -34,48 +34,39 @@
 #include "../../../libraries/libldap/ldap-int.h"
 #include "back-meta.h"
 
-static metatarget_t *
-new_target( void )
+static int
+new_target( 
+	metatarget_t	*mt )
 {
-	metatarget_t *mt;
-        struct ldapmapping *mapping;
+        struct ldapmapping	*mapping;
+	char			*rargv[ 3 ];
 
-	mt = ch_malloc( sizeof( metatarget_t ) );
-	if ( mt == NULL ) {
-		return NULL;
-	}
 	memset( mt, 0, sizeof( metatarget_t ) );
 
 	mt->mt_rwmap.rwm_rw = rewrite_info_init( REWRITE_MODE_USE_DEFAULT );
 	if ( mt->mt_rwmap.rwm_rw == NULL ) {
-		free( mt );
-                return NULL;
+                return -1;
 	}
 
-	{
-		char	*rargv[3];
 
-		/*
-		 * the filter rewrite as a string must be disabled
-		 * by default; it can be re-enabled by adding rules;
-		 * this creates an empty rewriteContext
-		 */
-		rargv[ 0 ] = "rewriteContext";
-		rargv[ 1 ] = "searchFilter";
-		rargv[ 2 ] = NULL;
-		rewrite_parse( mt->mt_rwmap.rwm_rw, "<suffix massage>", 
-				1, 2, rargv );
-
-		rargv[ 0 ] = "rewriteContext";
-		rargv[ 1 ] = "default";
-		rargv[ 2 ] = NULL;
-		rewrite_parse( mt->mt_rwmap.rwm_rw, "<suffix massage>", 
-				1, 2, rargv );
-	}
+	/*
+	 * the filter rewrite as a string must be disabled
+	 * by default; it can be re-enabled by adding rules;
+	 * this creates an empty rewriteContext
+	 */
+	rargv[ 0 ] = "rewriteContext";
+	rargv[ 1 ] = "searchFilter";
+	rargv[ 2 ] = NULL;
+	rewrite_parse( mt->mt_rwmap.rwm_rw, "<suffix massage>", 1, 2, rargv );
+
+	rargv[ 0 ] = "rewriteContext";
+	rargv[ 1 ] = "default";
+	rargv[ 2 ] = NULL;
+	rewrite_parse( mt->mt_rwmap.rwm_rw, "<suffix massage>", 1, 2, rargv );
 
 	ldap_back_map_init( &mt->mt_rwmap.rwm_at, &mapping );
 
-	return mt;
+	return 0;
 }
 
 int
@@ -116,8 +107,8 @@ meta_back_db_config(
 		
 		++mi->mi_ntargets;
 
-		mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets, 
-			sizeof( metatarget_t * ) * mi->mi_ntargets );
+		mi->mi_targets = ( metatarget_t * )ch_realloc( mi->mi_targets, 
+			sizeof( metatarget_t ) * mi->mi_ntargets );
 		if ( mi->mi_targets == NULL ) {
 			fprintf( stderr,
 	"%s: line %d: out of memory while storing server name"
@@ -126,7 +117,7 @@ meta_back_db_config(
 			return 1;
 		}
 
-		if ( ( mi->mi_targets[ i ] = new_target() ) == NULL ) {
+		if ( new_target( &mi->mi_targets[ i ] ) != 0 ) {
 			fprintf( stderr,
 	"%s: line %d: unable to init server"
 	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
@@ -134,7 +125,9 @@ meta_back_db_config(
 			return 1;
 		}
 
-		mi->mi_targets[ i ]->mt_nretries = mi->mi_nretries;
+		mi->mi_targets[ i ].mt_nretries = mi->mi_nretries;
+		mi->mi_targets[ i ].mt_flags = mi->flags;
+		mi->mi_targets[ i ].mt_version = mi->mi_version;
 
 		/*
 		 * uri MUST be legal!
@@ -164,8 +157,8 @@ meta_back_db_config(
 		dn.bv_val = ludp->lud_dn;
 		dn.bv_len = strlen( ludp->lud_dn );
 
-		rc = dnPrettyNormal( NULL, &dn, &mi->mi_targets[ i ]->mt_psuffix,
-			&mi->mi_targets[ i ]->mt_nsuffix, NULL );
+		rc = dnPrettyNormal( NULL, &dn, &mi->mi_targets[ i ].mt_psuffix,
+			&mi->mi_targets[ i ].mt_nsuffix, NULL );
 		if( rc != LDAP_SUCCESS ) {
 			fprintf( stderr, "%s: line %d: "
 					"target '%s' DN is invalid\n",
@@ -191,9 +184,9 @@ meta_back_db_config(
 			}
 		}
 
-		mi->mi_targets[ i ]->mt_uri = ldap_url_list2urls( ludp );
+		mi->mi_targets[ i ].mt_uri = ldap_url_list2urls( ludp );
 		ldap_free_urllist( ludp );
-		if ( mi->mi_targets[ i ]->mt_uri == NULL) {
+		if ( mi->mi_targets[ i ].mt_uri == NULL) {
 			fprintf( stderr, "%s: line %d: no memory?\n",
 					fname, lineno );
 			return( 1 );
@@ -203,7 +196,7 @@ meta_back_db_config(
 		 * uri MUST be a branch of suffix!
 		 */
 #if 0 /* too strict a constraint */
-		if ( select_backend( &mi->mi_targets[ i ]->suffix, 0, 0 ) != be ) {
+		if ( select_backend( &mi->mi_targets[ i ].suffix, 0, 0 ) != be ) {
 			fprintf( stderr,
 	"%s: line %d: <naming context> of URI does not refer to current backend"
 	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
@@ -214,7 +207,7 @@ meta_back_db_config(
 		/*
 		 * uri MUST be a branch of a suffix!
 		 */
-		if ( select_backend( &mi->mi_targets[ i ]->mt_nsuffix, 0, 0 ) == NULL ) {
+		if ( select_backend( &mi->mi_targets[ i ].mt_nsuffix, 0, 0 ) == NULL ) {
 			fprintf( stderr,
 	"%s: line %d: <naming context> of URI does not resolve to a backend"
 	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
@@ -223,31 +216,6 @@ meta_back_db_config(
 		}
 #endif
 
-#if 0
-		/*
-		 * uri MUST not be used by other URIs!
-		 *
-		 * FIXME: this limitation may be removed,
-		 * or worked out, at least, in some manner
-		 */
-		for ( j = 0; j < i-1; j++ ) {
-			if ( dn_match( &mi->mi_targets[ i ]->suffix,
-					&mi->mi_targets[ j ]->suffix ) ) {
-				fprintf( stderr,
-	"%s: line %d: naming context \"%s\" already used"
-	" in \"uri <protocol>://<server>[:port]/<naming context>\" line\n",
-					fname, lineno, last+1 );
-				return 1;
-			}
-		}
-#endif
-
-#if 0
-		fprintf(stderr, "%s: line %d: URI \"%s\", suffix \"%s\"\n",
-			fname, lineno, mi->mi_targets[ i ]->uri, 
-			mi->mi_targets[ i ]->psuffix.bv_val );
-#endif
-		
 	/* default target directive */
 	} else if ( strcasecmp( argv[ 0 ], "default-target" ) == 0 ) {
 		int 		i = mi->mi_ntargets - 1;
@@ -342,7 +310,7 @@ meta_back_db_config(
 
 		dn.bv_val = argv[ 1 ];
 		dn.bv_len = strlen( argv[ 1 ] );
-		if ( dnNormalize( 0, NULL, NULL, &dn, &mi->mi_targets[ i ]->mt_binddn,
+		if ( dnNormalize( 0, NULL, NULL, &dn, &mi->mi_targets[ i ].mt_binddn,
 			NULL ) != LDAP_SUCCESS )
 		{
 			fprintf( stderr, "%s: line %d: "
@@ -379,10 +347,10 @@ meta_back_db_config(
 			/* FIXME: some day we'll need to throw an error */
 		}
 
-		ber_str2bv( argv[ 1 ], 0L, 1, &mi->mi_targets[ i ]->mt_bindpw );
+		ber_str2bv( argv[ 1 ], 0L, 1, &mi->mi_targets[ i ].mt_bindpw );
 		
 	/* save bind creds for referral rebinds? */
-	} else if ( strcasecmp( argv[0], "rebind-as-user" ) == 0 ) {
+	} else if ( strcasecmp( argv[ 0 ], "rebind-as-user" ) == 0 ) {
 		if (argc != 1) {
 			fprintf( stderr,
 	"%s: line %d: rebind-as-user takes no arguments\n",
@@ -392,71 +360,97 @@ meta_back_db_config(
 
 		mi->flags |= LDAP_BACK_F_SAVECRED;
 
-	} else if ( strcasecmp( argv[0], "chase-referrals" ) == 0 ) {
-		if ( argc != 1 ) {
+	} else if ( strcasecmp( argv[ 0 ], "chase-referrals" ) == 0 ) {
+		unsigned	*flagsp = mi->mi_ntargets ?
+				&mi->mi_targets[ mi->mi_ntargets - 1 ].mt_flags
+				: &mi->flags;
+
+		if ( argc != 2 ) {
 			fprintf( stderr,
-	"%s: line %d: \"chase-referrals\" takes no arguments\n",
+	"%s: line %d: \"chase-referrals\" needs 1 argument.\n",
 					fname, lineno );
 			return( 1 );
 		}
 
-		mi->flags |= LDAP_BACK_F_CHASE_REFERRALS;
+		/* this is the default; we add it because the default might change... */
+		if ( strcasecmp( argv[ 1 ], "yes" ) == 0 ) {
+			*flagsp |= LDAP_BACK_F_CHASE_REFERRALS;
+
+		} else if ( strcasecmp( argv[ 1 ], "no" ) == 0 ) {
+			*flagsp &= ~LDAP_BACK_F_CHASE_REFERRALS;
 
-	} else if ( strcasecmp( argv[0], "dont-chase-referrals" ) == 0 ) {
-		if ( argc != 1 ) {
+		} else {
 			fprintf( stderr,
-	"%s: line %d: \"dont-chase-referrals\" takes no arguments\n",
-					fname, lineno );
+		"%s: line %d: \"chase-referrals {yes|no}\": unknown argument \"%s\".\n",
+					fname, lineno, argv[ 1 ] );
 			return( 1 );
 		}
+	
+	} else if ( strcasecmp( argv[ 0 ], "tls" ) == 0 ) {
+		unsigned	*flagsp = mi->mi_ntargets ?
+				&mi->mi_targets[ mi->mi_ntargets - 1 ].mt_flags
+				: &mi->flags;
 
-		mi->flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
-
-	} else if ( strncasecmp( argv[0], "tls-", STRLENOF( "tls-" ) ) == 0 ) {
+		if ( argc != 2 ) {
+			fprintf( stderr,
+		"%s: line %d: \"tls <what>\" needs 1 argument.\n",
+					fname, lineno );
+			return( 1 );
+		}
 
-		/* start tls */
-		if ( strcasecmp( argv[0], "tls-start" ) == 0 ) {
-			if ( argc != 1 ) {
-				fprintf( stderr,
-		"%s: line %d: tls-start takes no arguments\n",
-						fname, lineno );
-				return( 1 );
-			}
-			mi->flags |= ( LDAP_BACK_F_USE_TLS | LDAP_BACK_F_TLS_CRITICAL );
+		/* start */
+		if ( strcasecmp( argv[ 1 ], "start" ) == 0 ) {
+			*flagsp |= ( LDAP_BACK_F_USE_TLS | LDAP_BACK_F_TLS_CRITICAL );
 	
 		/* try start tls */
-		} else if ( strcasecmp( argv[0], "tls-try-start" ) == 0 ) {
-			if ( argc != 1 ) {
-				fprintf( stderr,
-		"%s: line %d: tls-try-start takes no arguments\n",
-						fname, lineno );
-				return( 1 );
-			}
-			mi->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
-			mi->flags |= LDAP_BACK_F_USE_TLS;
+		} else if ( strcasecmp( argv[ 1 ], "try-start" ) == 0 ) {
+			*flagsp &= ~LDAP_BACK_F_TLS_CRITICAL;
+			*flagsp |= LDAP_BACK_F_USE_TLS;
 	
 		/* propagate start tls */
-		} else if ( strcasecmp( argv[0], "tls-propagate" ) == 0 ) {
-			if ( argc != 1 ) {
-				fprintf( stderr,
-		"%s: line %d: tls-propagate takes no arguments\n",
-						fname, lineno );
-				return( 1 );
-			}
-			mi->flags |= ( LDAP_BACK_F_PROPAGATE_TLS | LDAP_BACK_F_TLS_CRITICAL );
+		} else if ( strcasecmp( argv[ 1 ], "propagate" ) == 0 ) {
+			*flagsp |= ( LDAP_BACK_F_PROPAGATE_TLS | LDAP_BACK_F_TLS_CRITICAL );
 		
 		/* try start tls */
-		} else if ( strcasecmp( argv[0], "tls-try-propagate" ) == 0 ) {
-			if ( argc != 1 ) {
-				fprintf( stderr,
-		"%s: line %d: tls-try-propagate takes no arguments\n",
-						fname, lineno );
-				return( 1 );
-			}
-			mi->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
-			mi->flags |= LDAP_BACK_F_PROPAGATE_TLS;
+		} else if ( strcasecmp( argv[ 1 ], "try-propagate" ) == 0 ) {
+			*flagsp &= ~LDAP_BACK_F_TLS_CRITICAL;
+			*flagsp |= LDAP_BACK_F_PROPAGATE_TLS;
+
+		} else {
+			fprintf( stderr,
+		"%s: line %d: \"tls <what>\": unknown argument \"%s\".\n",
+					fname, lineno, argv[ 1 ] );
+			return( 1 );
 		}
-	
+
+	} else if ( strcasecmp( argv[ 0 ], "t-f-support" ) == 0 ) {
+		unsigned	*flagsp = mi->mi_ntargets ?
+				&mi->mi_targets[ mi->mi_ntargets - 1 ].mt_flags
+				: &mi->flags;
+
+		if ( argc != 2 ) {
+			fprintf( stderr,
+		"%s: line %d: \"t-f-support {no|yes|discover}\" needs 1 argument.\n",
+					fname, lineno );
+			return( 1 );
+		}
+
+		if ( strcasecmp( argv[ 1 ], "no" ) == 0 ) {
+			*flagsp &= ~(LDAP_BACK_F_SUPPORT_T_F|LDAP_BACK_F_SUPPORT_T_F_DISCOVER);
+
+		} else if ( strcasecmp( argv[ 1 ], "yes" ) == 0 ) {
+			*flagsp |= LDAP_BACK_F_SUPPORT_T_F;
+
+		} else if ( strcasecmp( argv[ 1 ], "discover" ) == 0 ) {
+			*flagsp |= LDAP_BACK_F_SUPPORT_T_F_DISCOVER;
+
+		} else {
+			fprintf( stderr,
+	"%s: line %d: unknown value \"%s\" for \"t-f-support {no|yes|discover}\".\n",
+				fname, lineno, argv[ 1 ] );
+			return 1;
+		}
+
 	/* name to use as pseudo-root dn */
 	} else if ( strcasecmp( argv[ 0 ], "pseudorootdn" ) == 0 ) {
 		int 		i = mi->mi_ntargets - 1;
@@ -479,7 +473,7 @@ meta_back_db_config(
 		dn.bv_val = argv[ 1 ];
 		dn.bv_len = strlen( argv[ 1 ] );
 		if ( dnNormalize( 0, NULL, NULL, &dn,
-			&mi->mi_targets[ i ]->mt_pseudorootdn, NULL ) != LDAP_SUCCESS )
+			&mi->mi_targets[ i ].mt_pseudorootdn, NULL ) != LDAP_SUCCESS )
 		{
 			fprintf( stderr, "%s: line %d: "
 					"pseudoroot DN '%s' is invalid\n",
@@ -504,7 +498,7 @@ meta_back_db_config(
 			    fname, lineno );
 			return 1;
 		}
-		ber_str2bv( argv[ 1 ], 0L, 1, &mi->mi_targets[ i ]->mt_pseudorootpw );
+		ber_str2bv( argv[ 1 ], 0L, 1, &mi->mi_targets[ i ].mt_pseudorootpw );
 	
 	/* dn massaging */
 	} else if ( strcasecmp( argv[ 0 ], "suffixmassage" ) == 0 ) {
@@ -589,7 +583,7 @@ meta_back_db_config(
 		 * FIXME: no extra rewrite capabilities should be added
 		 * to the database
 		 */
-	 	return suffix_massage_config( mi->mi_targets[ i ]->mt_rwmap.rwm_rw,
+	 	return suffix_massage_config( mi->mi_targets[ i ].mt_rwmap.rwm_rw,
 				&pvnc, &nvnc, &prnc, &nrnc );
 		
 	/* rewrite stuff ... */
@@ -603,7 +597,7 @@ meta_back_db_config(
 			return 1;
 		}
 		
- 		return rewrite_parse( mi->mi_targets[ i ]->mt_rwmap.rwm_rw,
+ 		return rewrite_parse( mi->mi_targets[ i ].mt_rwmap.rwm_rw,
 				fname, lineno, argc, argv );
 
 	/* objectclass/attribute mapping */
@@ -617,8 +611,8 @@ meta_back_db_config(
 			return 1;
 		}
 
-		return ldap_back_map_config( &mi->mi_targets[ i ]->mt_rwmap.rwm_oc, 
-				&mi->mi_targets[ i ]->mt_rwmap.rwm_at,
+		return ldap_back_map_config( &mi->mi_targets[ i ].mt_rwmap.rwm_oc, 
+				&mi->mi_targets[ i ].mt_rwmap.rwm_at,
 				fname, lineno, argc, argv );
 
 	} else if ( strcasecmp( argv[ 0 ], "nretries" ) == 0 ) {
@@ -654,7 +648,7 @@ meta_back_db_config(
 			mi->mi_nretries = nretries;
 
 		} else {
-			mi->mi_targets[ i ]->mt_nretries = nretries;
+			mi->mi_targets[ i ].mt_nretries = nretries;
 		}
 
 	/* anything else */
@@ -685,11 +679,11 @@ ldap_back_map_config(
 		return 1;
 	}
 
-	if ( strcasecmp( argv[1], "objectclass" ) == 0 ) {
+	if ( strcasecmp( argv[ 1 ], "objectclass" ) == 0 ) {
 		map = oc_map;
 		is_oc = 1;
 
-	} else if ( strcasecmp( argv[1], "attribute" ) == 0 ) {
+	} else if ( strcasecmp( argv[ 1 ], "attribute" ) == 0 ) {
 		map = at_map;
 
 	} else {
@@ -700,20 +694,20 @@ ldap_back_map_config(
 		return 1;
 	}
 
-	if ( strcmp( argv[2], "*" ) == 0 ) {
-		if ( argc < 4 || strcmp( argv[3], "*" ) == 0 ) {
+	if ( strcmp( argv[ 2 ], "*" ) == 0 ) {
+		if ( argc < 4 || strcmp( argv[ 3 ], "*" ) == 0 ) {
 			map->drop_missing = ( argc < 4 );
 			return 0;
 		}
-		src = dst = argv[3];
+		src = dst = argv[ 3 ];
 
 	} else if ( argc < 4 ) {
 		src = "";
-		dst = argv[2];
+		dst = argv[ 2 ];
 
 	} else {
-		src = argv[2];
-		dst = ( strcmp( argv[3], "*" ) == 0 ? src : argv[3] );
+		src = argv[ 2 ];
+		dst = ( strcmp( argv[ 3 ], "*" ) == 0 ? src : argv[ 3 ] );
 	}
 
 	if ( ( map == at_map )
@@ -735,14 +729,14 @@ ldap_back_map_config(
 	}
 	ber_str2bv( src, 0, 1, &mapping->src );
 	ber_str2bv( dst, 0, 1, &mapping->dst );
-	mapping[1].src = mapping->dst;
-	mapping[1].dst = mapping->src;
+	mapping[ 1 ].src = mapping->dst;
+	mapping[ 1 ].dst = mapping->src;
 
 	/*
 	 * schema check
 	 */
 	if ( is_oc ) {
-		if ( src[0] != '\0' ) {
+		if ( src[ 0 ] != '\0' ) {
 			if ( oc_bvfind( &mapping->src ) == NULL ) {
 				fprintf( stderr,
 	"%s: line %d: warning, source objectClass '%s' "
@@ -767,7 +761,7 @@ ldap_back_map_config(
 		const char		*text = NULL;
 		AttributeDescription	*ad = NULL;
 
-		if ( src[0] != '\0' ) {
+		if ( src[ 0 ] != '\0' ) {
 			rc = slap_bv2ad( &mapping->src, &ad, &text );
 			if ( rc != LDAP_SUCCESS ) {
 				fprintf( stderr,
@@ -793,8 +787,8 @@ ldap_back_map_config(
 		}
 	}
 
-	if ( (src[0] != '\0' && avl_find( map->map, (caddr_t)mapping, mapping_cmp ) != NULL)
-			|| avl_find( map->remap, (caddr_t)&mapping[1], mapping_cmp ) != NULL)
+	if ( (src[ 0 ] != '\0' && avl_find( map->map, (caddr_t)mapping, mapping_cmp ) != NULL)
+			|| avl_find( map->remap, (caddr_t)&mapping[ 1 ], mapping_cmp ) != NULL)
 	{
 		fprintf( stderr,
 			"%s: line %d: duplicate mapping found (ignored)\n",
@@ -802,11 +796,11 @@ ldap_back_map_config(
 		goto error_return;
 	}
 
-	if ( src[0] != '\0' ) {
+	if ( src[ 0 ] != '\0' ) {
 		avl_insert( &map->map, (caddr_t)mapping,
 					mapping_cmp, mapping_dup );
 	}
-	avl_insert( &map->remap, (caddr_t)&mapping[1],
+	avl_insert( &map->remap, (caddr_t)&mapping[ 1 ],
 				mapping_cmp, mapping_dup );
 
 	return 0;
diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index ebf63df839..138b820068 100644
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -121,9 +121,11 @@ myprint( Avlnode *root )
  */
 static metaconn_t *
 metaconn_alloc(
-	int		ntargets )
+       	Operation 		*op )
 {
+	metainfo_t	*mi = ( metainfo_t * )op->o_bd->be_private;
 	metaconn_t	*mc;
+	int		ntargets = mi->mi_ntargets;
 
 	assert( ntargets > 0 );
 
@@ -144,6 +146,7 @@ metaconn_alloc(
 		BER_BVZERO( &mc->mc_conns[ ntargets ].msc_bound_ndn );
 		BER_BVZERO( &mc->mc_conns[ ntargets ].msc_cred );
 		mc->mc_conns[ ntargets ].msc_bound = META_UNBOUND;
+		mc->mc_conns[ ntargets ].msc_info = mi;
 	}
 
 	mc->mc_auth_target = META_BOUND_NONE;
@@ -328,7 +331,7 @@ retry:;
 	 * If the connection DN is not null, an attempt to rewrite it is made
 	 */
 	if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
-		dc.rwmap = &mt->mt_rwmap;
+		dc.target = mt;
 		dc.conn = op->o_conn;
 		dc.rs = rs;
 		dc.ctx = "bindDN";
@@ -381,7 +384,7 @@ meta_back_retry(
 	ldap_back_send_t	sendok )
 {
 	metainfo_t		*mi = ( metainfo_t * )op->o_bd->be_private;
-	metatarget_t		*mt = mi->mi_targets[ candidate ];
+	metatarget_t		*mt = &mi->mi_targets[ candidate ];
 	int			rc;
 	metasingleconn_t	*msc = &mc->mc_conns[ candidate ];
 
@@ -493,7 +496,7 @@ meta_back_get_candidate(
 			 * and a default target is defined, and it is
 			 * a candidate, try using it (FIXME: YMMV) */
 			if ( mi->mi_defaulttarget != META_DEFAULT_TARGET_NONE
-				&& meta_back_is_candidate( &mi->mi_targets[ mi->mi_defaulttarget ]->mt_nsuffix,
+				&& meta_back_is_candidate( &mi->mi_targets[ mi->mi_defaulttarget ].mt_nsuffix,
 						ndn, op->o_tag == LDAP_REQ_SEARCH ? op->ors_scope : LDAP_SCOPE_BASE ) )
 			{
 				candidate = mi->mi_defaulttarget;
@@ -656,7 +659,7 @@ meta_back_getconn(
 
 		/* Looks like we didn't get a bind. Open a new session... */
 		if ( !mc ) {
-			mc = metaconn_alloc( mi->mi_ntargets );
+			mc = metaconn_alloc( op );
 			mc->mc_conn = op->o_conn;
 			new_conn = 1;
 		}
@@ -667,7 +670,7 @@ meta_back_getconn(
 			 * The target is activated; if needed, it is
 			 * also init'd
 			 */
-			int lerr = meta_back_init_one_conn( op, rs, mi->mi_targets[ i ],
+			int lerr = meta_back_init_one_conn( op, rs, &mi->mi_targets[ i ],
 					&mc->mc_conns[ i ], sendok );
 			if ( lerr == LDAP_SUCCESS ) {
 				candidates[ i ].sr_tag = META_CANDIDATE;
@@ -745,7 +748,7 @@ meta_back_getconn(
 
 		/* Looks like we didn't get a bind. Open a new session... */
 		if ( !mc ) {
-			mc = metaconn_alloc( mi->mi_ntargets );
+			mc = metaconn_alloc( op );
 			mc->mc_conn = op->o_conn;
 			new_conn = 1;
 		}
@@ -760,7 +763,7 @@ meta_back_getconn(
 		 * also init'd. In case of error, meta_back_init_one_conn
 		 * sends the appropriate result.
 		 */
-		err = meta_back_init_one_conn( op, rs, mi->mi_targets[ i ],
+		err = meta_back_init_one_conn( op, rs, &mi->mi_targets[ i ],
 				&mc->mc_conns[ i ], sendok );
 		if ( err == LDAP_SUCCESS ) {
 			candidates[ i ].sr_tag = META_CANDIDATE;
@@ -793,14 +796,14 @@ meta_back_getconn(
 
 		/* Looks like we didn't get a bind. Open a new session... */
 		if ( !mc ) {
-			mc = metaconn_alloc( mi->mi_ntargets );
+			mc = metaconn_alloc( op );
 			mc->mc_conn = op->o_conn;
 			new_conn = 1;
 		}
 
 		for ( i = 0; i < mi->mi_ntargets; i++ ) {
 			if ( i == cached 
-				|| meta_back_is_candidate( &mi->mi_targets[ i ]->mt_nsuffix,
+				|| meta_back_is_candidate( &mi->mi_targets[ i ].mt_nsuffix,
 						&op->o_req_ndn, LDAP_SCOPE_SUBTREE ) )
 			{
 
@@ -809,7 +812,7 @@ meta_back_getconn(
 				 * also init'd
 				 */
 				int lerr = meta_back_init_one_conn( op, rs,
-						mi->mi_targets[ i ],
+						&mi->mi_targets[ i ],
 						&mc->mc_conns[ i ], sendok );
 				if ( lerr == LDAP_SUCCESS ) {
 					candidates[ i ].sr_tag = META_CANDIDATE;
diff --git a/servers/slapd/back-meta/delete.c b/servers/slapd/back-meta/delete.c
index e2e60623de..94d9a330d8 100644
--- a/servers/slapd/back-meta/delete.c
+++ b/servers/slapd/back-meta/delete.c
@@ -39,7 +39,7 @@ meta_back_delete( Operation *op, SlapReply *rs )
 	int		candidate = -1;
 	struct berval	mdn = BER_BVNULL;
 	dncookie	dc;
-	int		msgid, do_retry = 1;
+	int		do_retry = 1;
 
 	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
 	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
@@ -51,7 +51,7 @@ meta_back_delete( Operation *op, SlapReply *rs )
 	/*
 	 * Rewrite the compare dn, if needed
 	 */
-	dc.rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+	dc.target = &mi->mi_targets[ candidate ];
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 	dc.ctx = "deleteDN";
diff --git a/servers/slapd/back-meta/init.c b/servers/slapd/back-meta/init.c
index b7cacb6243..6628be9fd9 100644
--- a/servers/slapd/back-meta/init.c
+++ b/servers/slapd/back-meta/init.c
@@ -45,7 +45,7 @@ meta_back_initialize(
 
 	bi->bi_db_init = meta_back_db_init;
 	bi->bi_db_config = meta_back_db_config;
-	bi->bi_db_open = 0;
+	bi->bi_db_open = meta_back_db_open;
 	bi->bi_db_close = 0;
 	bi->bi_db_destroy = meta_back_db_destroy;
 
@@ -92,12 +92,35 @@ meta_back_db_init(
 
 	/* safe default */
 	mi->mi_nretries = META_RETRY_DEFAULT;
+	mi->mi_version = LDAP_VERSION3;
 	
 	be->be_private = mi;
 
 	return 0;
 }
 
+int
+meta_back_db_open(
+	Backend		*be )
+{
+	metainfo_t	*mi = (metainfo_t *)be->be_private;
+
+	int		i, rc;
+
+	for ( i = 0; i < mi->mi_ntargets; i++ ) {
+		if ( mi->mi_targets[ i ].mt_flags & LDAP_BACK_F_SUPPORT_T_F_DISCOVER ) {
+			mi->mi_targets[ i ].mt_flags &= ~LDAP_BACK_F_SUPPORT_T_F_DISCOVER;
+			rc = ldap_back_discover_t_f_support( mi->mi_targets[ i ].mt_uri,
+					mi->mi_targets[ i ].mt_version );
+			if ( rc == LDAP_COMPARE_TRUE ) {
+				mi->mi_targets[ i ].mt_flags |= LDAP_BACK_F_SUPPORT_T_F;
+			}
+		}
+	}
+
+	return 0;
+}
+
 static void
 conn_free( 
 	void 		*v_mc )
@@ -193,8 +216,7 @@ meta_back_db_destroy(
 		 * least one ...)
 		 */
 		for ( i = 0; i < mi->mi_ntargets; i++ ) {
-			target_free( mi->mi_targets[ i ] );
-			free( mi->mi_targets[ i ] );
+			target_free( &mi->mi_targets[ i ] );
 		}
 
 		free( mi->mi_targets );
diff --git a/servers/slapd/back-meta/map.c b/servers/slapd/back-meta/map.c
index b18288846f..29a1ade97f 100644
--- a/servers/slapd/back-meta/map.c
+++ b/servers/slapd/back-meta/map.c
@@ -206,12 +206,12 @@ map_attr_value(
 	struct berval		vtmp;
 	int			freeval = 0;
 
-	ldap_back_map( &dc->rwmap->rwm_at, &ad->ad_cname, mapped_attr, remap );
+	ldap_back_map( &dc->target->mt_rwmap.rwm_at, &ad->ad_cname, mapped_attr, remap );
 	if ( BER_BVISNULL( mapped_attr ) || BER_BVISEMPTY( mapped_attr ) ) {
 		/*
 		 * FIXME: are we sure we need to search oc_map if at_map fails?
 		 */
-		ldap_back_map( &dc->rwmap->rwm_oc, &ad->ad_cname, mapped_attr, remap );
+		ldap_back_map( &dc->target->mt_rwmap.rwm_oc, &ad->ad_cname, mapped_attr, remap );
 		if ( BER_BVISNULL( mapped_attr ) || BER_BVISEMPTY( mapped_attr ) ) {
 			*mapped_attr = ad->ad_cname;
 		}
@@ -244,7 +244,7 @@ map_attr_value(
 		}
 
 	} else if ( ad == slap_schema.si_ad_objectClass || ad == slap_schema.si_ad_structuralObjectClass ) {
-		ldap_back_map( &dc->rwmap->rwm_oc, value, &vtmp, remap );
+		ldap_back_map( &dc->target->mt_rwmap.rwm_oc, value, &vtmp, remap );
 		if ( BER_BVISNULL( &vtmp ) || BER_BVISEMPTY( &vtmp ) ) {
 			vtmp = *value;
 		}
@@ -276,7 +276,7 @@ ldap_back_int_filter_map_rewrite(
 	ber_len_t	len;
 
 	if ( f == NULL ) {
-		ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
+		ber_str2bv( "No filter!", STRLENOF( "No filter!" ), 1, fstr );
 		return -1;
 	}
 
@@ -454,7 +454,7 @@ ldap_back_int_filter_map_rewrite(
 
 		break;
 
-	case LDAP_FILTER_EXT: {
+	case LDAP_FILTER_EXT:
 		if ( f->f_mr_desc ) {
 			if ( map_attr_value( dc, f->f_mr_desc, &atmp,
 						&f->f_mr_value, &vtmp, remap ) )
@@ -481,19 +481,40 @@ ldap_back_int_filter_map_rewrite(
 			!BER_BVISEMPTY( &f->f_mr_rule_text ) ? f->f_mr_rule_text.bv_val : "",
 			vtmp.bv_val );
 		ber_memfree( vtmp.bv_val );
-		} break;
+		break;
 
 	case SLAPD_FILTER_COMPUTED:
 		switch ( f->f_result ) {
 		case LDAP_COMPARE_FALSE:
-			ber_str2bv( "(?=false)", STRLENOF( "(?=false)" ), 1, fstr );
+			if ( dc->target->mt_flags & LDAP_BACK_F_SUPPORT_T_F ) {
+				ber_str2bv( "(|)", STRLENOF( "(|)" ), 1, fstr );
+
+			} else {
+#if 0
+				ber_str2bv( "(?=false)", STRLENOF( "(?=false)" ), 1, fstr );
+#endif
+				/* better than nothing... */
+				ber_str2bv( "(!(objectClass=*))", STRLENOF( "(!(objectClass=*))" ), 1, fstr );
+			}
 			break;
+
 		case LDAP_COMPARE_TRUE:
-			ber_str2bv( "(?=true)", STRLENOF( "(?=true)" ), 1, fstr );
+			if ( dc->target->mt_flags & LDAP_BACK_F_SUPPORT_T_F ) {
+				ber_str2bv( "(&)", STRLENOF( "(&)" ), 1, fstr );
+
+			} else {
+#if 0
+				ber_str2bv( "(?=true)", STRLENOF( "(?=true)" ), 1, fstr );
+#endif
+				/* better than nothing... */
+				ber_str2bv( "(objectClass=*)", STRLENOF( "(objectClass=*)" ), 1, fstr );
+			}
 			break;
+
 		case SLAPD_COMPARE_UNDEFINED:
 			ber_str2bv( "(?=undefined)", STRLENOF( "(?=undefined)" ), 1, fstr );
 			break;
+
 		default:
 			ber_str2bv( "(?=error)", STRLENOF( "(?=error)" ), 1, fstr );
 			break;
@@ -531,7 +552,7 @@ ldap_back_filter_map_rewrite(
 
 	fdc.ctx = "searchFilter";
 	
-	switch ( rewrite_session( fdc.rwmap->rwm_rw, fdc.ctx,
+	switch ( rewrite_session( fdc.target->mt_rwmap.rwm_rw, fdc.ctx,
 				( !BER_BVISEMPTY( &ftmp ) ? ftmp.bv_val : "" ),
 				fdc.conn, &fstr->bv_val ) )
 	{
diff --git a/servers/slapd/back-meta/modify.c b/servers/slapd/back-meta/modify.c
index a39e63a501..62a041a17f 100644
--- a/servers/slapd/back-meta/modify.c
+++ b/servers/slapd/back-meta/modify.c
@@ -57,7 +57,7 @@ meta_back_modify( Operation *op, SlapReply *rs )
 	/*
 	 * Rewrite the modify dn, if needed
 	 */
-	dc.rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+	dc.target = &mi->mi_targets[ candidate ];
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 	dc.ctx = "modifyDN";
@@ -99,7 +99,7 @@ meta_back_modify( Operation *op, SlapReply *rs )
 			mapped = ml->sml_desc->ad_cname;
 
 		} else {
-			ldap_back_map( &mi->mi_targets[ candidate ]->mt_rwmap.rwm_at,
+			ldap_back_map( &mi->mi_targets[ candidate ].mt_rwmap.rwm_at,
 					&ml->sml_desc->ad_cname, &mapped,
 					BACKLDAP_MAP );
 			if ( BER_BVISNULL( &mapped ) || BER_BVISEMPTY( &mapped ) ) {
@@ -126,11 +126,11 @@ meta_back_modify( Operation *op, SlapReply *rs )
 				for ( j = 0; !BER_BVISNULL( &ml->sml_values[ j ] ); ) {
 					struct ldapmapping	*mapping;
 
-					ldap_back_mapping( &mi->mi_targets[ candidate ]->mt_rwmap.rwm_oc,
+					ldap_back_mapping( &mi->mi_targets[ candidate ].mt_rwmap.rwm_oc,
 							&ml->sml_values[ j ], &mapping, BACKLDAP_MAP );
 
 					if ( mapping == NULL ) {
-						if ( mi->mi_targets[ candidate ]->mt_rwmap.rwm_oc.drop_missing ) {
+						if ( mi->mi_targets[ candidate ].mt_rwmap.rwm_oc.drop_missing ) {
 							continue;
 						}
 						mods[ i ].mod_bvalues[ j ] = &ml->sml_values[ j ];
diff --git a/servers/slapd/back-meta/modrdn.c b/servers/slapd/back-meta/modrdn.c
index 7ffbc555b5..b5396f9b36 100644
--- a/servers/slapd/back-meta/modrdn.c
+++ b/servers/slapd/back-meta/modrdn.c
@@ -40,7 +40,7 @@ meta_back_modrdn( Operation *op, SlapReply *rs )
 	struct berval		mdn = BER_BVNULL,
 				mnewSuperior = BER_BVNULL;
 	dncookie		dc;
-	int			msgid, do_retry = 1;
+	int			do_retry = 1;
 
 	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
 	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
@@ -48,7 +48,7 @@ meta_back_modrdn( Operation *op, SlapReply *rs )
 	}
 
 	assert( mc->mc_conns[ candidate ].msc_ld != NULL );
-		
+
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 
@@ -82,7 +82,7 @@ meta_back_modrdn( Operation *op, SlapReply *rs )
 		/*
 		 * Rewrite the new superior, if defined and required
 	 	 */
-		dc.rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+		dc.target = &mi->mi_targets[ candidate ];
 		dc.ctx = "newSuperiorDN";
 		if ( ldap_back_dn_massage( &dc, op->orr_newSup, &mnewSuperior ) ) {
 			rs->sr_err = LDAP_OTHER;
@@ -93,7 +93,7 @@ meta_back_modrdn( Operation *op, SlapReply *rs )
 	/*
 	 * Rewrite the modrdn dn, if required
 	 */
-	dc.rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+	dc.target = &mi->mi_targets[ candidate ];
 	dc.ctx = "modrDN";
 	if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
 		rs->sr_err = LDAP_OTHER;
diff --git a/servers/slapd/back-meta/proto-meta.h b/servers/slapd/back-meta/proto-meta.h
index 871062e475..5750a8cd82 100644
--- a/servers/slapd/back-meta/proto-meta.h
+++ b/servers/slapd/back-meta/proto-meta.h
@@ -32,6 +32,7 @@ extern BI_close			meta_back_close;
 extern BI_destroy		meta_back_destroy;
 
 extern BI_db_init		meta_back_db_init;
+extern BI_db_open		meta_back_db_open;
 extern BI_db_destroy		meta_back_db_destroy;
 extern BI_db_config		meta_back_db_config;
 
diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c
index e88b7e9162..dca47acb14 100644
--- a/servers/slapd/back-meta/search.c
+++ b/servers/slapd/back-meta/search.c
@@ -76,12 +76,12 @@ meta_back_search_start(
 				( void * )&op->ors_slimit);
 	}
 
-	dc->rwmap = &mi->mi_targets[ candidate ]->mt_rwmap;
+	dc->target = &mi->mi_targets[ candidate ];
 
 	/*
 	 * modifies the base according to the scope, if required
 	 */
-	suffixlen = mi->mi_targets[ candidate ]->mt_nsuffix.bv_len;
+	suffixlen = mi->mi_targets[ candidate ].mt_nsuffix.bv_len;
 	if ( suffixlen > op->o_req_ndn.bv_len ) {
 		switch ( op->ors_scope ) {
 		case LDAP_SCOPE_SUBTREE:
@@ -93,10 +93,10 @@ meta_back_search_start(
 			 * the requested searchBase already passed
 			 * thru the candidate analyzer...
 			 */
-			if ( dnIsSuffix( &mi->mi_targets[ candidate ]->mt_nsuffix,
+			if ( dnIsSuffix( &mi->mi_targets[ candidate ].mt_nsuffix,
 					&op->o_req_ndn ) )
 			{
-				realbase = mi->mi_targets[ candidate ]->mt_nsuffix;
+				realbase = mi->mi_targets[ candidate ].mt_nsuffix;
 
 			} else {
 				/*
@@ -108,17 +108,17 @@ meta_back_search_start(
 
 		case LDAP_SCOPE_ONELEVEL:
 		{
-			struct berval	rdn = mi->mi_targets[ candidate ]->mt_nsuffix;
+			struct berval	rdn = mi->mi_targets[ candidate ].mt_nsuffix;
 			rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
 			if ( dnIsOneLevelRDN( &rdn )
-					&& dnIsSuffix( &mi->mi_targets[ candidate ]->mt_nsuffix, &op->o_req_ndn ) )
+					&& dnIsSuffix( &mi->mi_targets[ candidate ].mt_nsuffix, &op->o_req_ndn ) )
 			{
 				/*
 				 * if there is exactly one level,
 				 * make the target suffix the new
 				 * base, and make scope "base"
 				 */
-				realbase = mi->mi_targets[ candidate ]->mt_nsuffix;
+				realbase = mi->mi_targets[ candidate ].mt_nsuffix;
 				realscope = LDAP_SCOPE_BASE;
 				break;
 			} /* else continue with the next case */
@@ -175,7 +175,7 @@ meta_back_search_start(
 	/*
 	 * Maps required attributes
 	 */
-	rc = ldap_back_map_attrs( &mi->mi_targets[ candidate ]->mt_rwmap.rwm_at,
+	rc = ldap_back_map_attrs( &mi->mi_targets[ candidate ].mt_rwmap.rwm_at,
 			op->ors_attrs, BACKLDAP_MAP, &mapped_attrs );
 	if ( rc != LDAP_SUCCESS ) {
 		/*
@@ -506,7 +506,7 @@ really_bad:;
 							0, 0, &match );
 
 						dc.ctx = "matchedDN";
-						dc.rwmap = &mi->mi_targets[ i ]->mt_rwmap;
+						dc.target = &mi->mi_targets[ i ];
 
 						if ( !ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 							if ( mmatch.bv_val == match.bv_val ) {
@@ -764,7 +764,7 @@ meta_send_entry(
 	/*
 	 * Rewrite the dn of the result, if needed
 	 */
-	dc.rwmap = &mi->mi_targets[ target ]->mt_rwmap;
+	dc.target = &mi->mi_targets[ target ];
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 	dc.ctx = "searchResult";
@@ -801,7 +801,7 @@ meta_send_entry(
 	while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 		int		last = 0;
 
-		ldap_back_map( &mi->mi_targets[ target ]->mt_rwmap.rwm_at, 
+		ldap_back_map( &mi->mi_targets[ target ].mt_rwmap.rwm_at, 
 				&a, &mapped, BACKLDAP_REMAP );
 		if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0' ) {
 			continue;
@@ -859,7 +859,7 @@ meta_send_entry(
 			for ( last = 0; !BER_BVISNULL( &attr->a_vals[ last ] ); ++last );
 
 			for ( bv = attr->a_vals; !BER_BVISNULL( bv ); bv++ ) {
-				ldap_back_map( &mi->mi_targets[ target ]->mt_rwmap.rwm_oc,
+				ldap_back_map( &mi->mi_targets[ target ].mt_rwmap.rwm_oc,
 						bv, &mapped, BACKLDAP_REMAP );
 				if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0') {
 					free( bv->bv_val );
diff --git a/servers/slapd/back-meta/suffixmassage.c b/servers/slapd/back-meta/suffixmassage.c
index 9440912522..244e4666eb 100644
--- a/servers/slapd/back-meta/suffixmassage.c
+++ b/servers/slapd/back-meta/suffixmassage.c
@@ -68,7 +68,7 @@ ldap_back_dn_massage(
 	int		rc = 0;
 	static char	*dmy = "";
 
-	switch ( rewrite_session( dc->rwmap->rwm_rw, dc->ctx,
+	switch ( rewrite_session( dc->target->mt_rwmap.rwm_rw, dc->ctx,
 				( dn->bv_val ? dn->bv_val : dmy ),
 				dc->conn, &res->bv_val ) )
 	{
@@ -133,7 +133,7 @@ ldap_back_dn_massage(
 		res->bv_len = 0;
 		return 0;
 	}
-	if ( dc->rwmap == NULL || dc->rwmap->rwm_suffix_massage == NULL ) {
+	if ( dc->target->mt_rwmap.rwm_suffix_massage == NULL ) {
 		*res = *dn;
 		return 0;
 	}
@@ -152,9 +152,9 @@ ldap_back_dn_massage(
 	}
 
 	for ( i = 0;
-		dc->rwmap->rwm_suffix_massage[i].bv_val != NULL;
+		dc->target->mt_rwmap.rwm_suffix_massage[i].bv_val != NULL;
 		i += 4 ) {
-		int aliasLength = dc->rwmap->rwm_suffix_massage[i+src].bv_len;
+		int aliasLength = dc->target->mt_rwmap.rwm_suffix_massage[i+src].bv_len;
 		int diff = dn->bv_len - aliasLength;
 
 		if ( diff < 0 ) {
@@ -166,11 +166,11 @@ ldap_back_dn_massage(
 			/* At a DN Separator */
 		}
 
-		if ( !strcmp( dc->rwmap->rwm_suffix_massage[i+src].bv_val, &dn->bv_val[diff] ) ) {
-			res->bv_len = diff + dc->rwmap->rwm_suffix_massage[i+dst].bv_len;
+		if ( !strcmp( dc->target->mt_rwmap.rwm_suffix_massage[i+src].bv_val, &dn->bv_val[diff] ) ) {
+			res->bv_len = diff + dc->target->mt_rwmap.rwm_suffix_massage[i+dst].bv_len;
 			res->bv_val = ch_malloc( res->bv_len + 1 );
 			strncpy( res->bv_val, dn->bv_val, diff );
-			strcpy( &res->bv_val[diff], dc->rwmap->rwm_suffix_massage[i+dst].bv_val );
+			strcpy( &res->bv_val[diff], dc->target->mt_rwmap.rwm_suffix_massage[i+dst].bv_val );
 			Debug( LDAP_DEBUG_ARGS,
 				"ldap_back_dn_massage:"
 				" converted \"%s\" to \"%s\"\n",
diff --git a/servers/slapd/back-meta/unbind.c b/servers/slapd/back-meta/unbind.c
index 71f80f7616..97f26bc7db 100644
--- a/servers/slapd/back-meta/unbind.c
+++ b/servers/slapd/back-meta/unbind.c
@@ -67,7 +67,7 @@ meta_back_conn_destroy(
 				continue;
 			}
 
-			rewrite_session_delete( mi->mi_targets[ i ]->mt_rwmap.rwm_rw, conn );
+			rewrite_session_delete( mi->mi_targets[ i ].mt_rwmap.rwm_rw, conn );
 			meta_clear_one_candidate( &mc->mc_conns[ i ] );
 		}
 		meta_back_conn_free( mc );