From: Kurt Zeilenga <kurt@openldap.org>
Date: Fri, 28 May 1999 19:33:05 +0000 (+0000)
Subject: Changed lc_conn to be a pointer to a BerElement to aid in state management.
X-Git-Tag: OPENLDAP_REL_ENG_2_BP~491
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=4e5ed2dffc534d0ff0200a03e856838753fa74af;p=openldap

Changed lc_conn to be a pointer to a BerElement to aid in state management.
Added validation to exposed opaque data structures (BerElement, Sockbuf,
and LDAP).  Added macros BER_VALID, SOCKBUF_VALID, LDAP_VALID.
Added ber_pvt_ber_bytes() and ber_pvt_ber_remaining() macros to hide
some ber internals.  These really should be handled by ber_get_option().
---

diff --git a/libraries/liblber/bprint.c b/libraries/liblber/bprint.c
index ca65c82f48..65089649b6 100644
--- a/libraries/liblber/bprint.c
+++ b/libraries/liblber/bprint.c
@@ -170,6 +170,7 @@ ber_log_dump(
 	int inout )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( !ber_log_check( errlvl, loglvl )) {
 		return 0;
@@ -187,6 +188,7 @@ ber_dump(
 	char buf[132];
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	sprintf( buf, "ber_dump: buf 0x%lx, ptr 0x%lx, end 0x%lx\n",
 	    (long) ber->ber_buf,
diff --git a/libraries/liblber/decode.c b/libraries/liblber/decode.c
index 443016fba2..accbc3a44f 100644
--- a/libraries/liblber/decode.c
+++ b/libraries/liblber/decode.c
@@ -39,6 +39,7 @@ ber_get_tag( BerElement *ber )
 	unsigned int	i;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( ber_read( ber, (char *) &xbyte, 1 ) != 1 )
 		return( LBER_DEFAULT );
@@ -77,6 +78,7 @@ ber_skip_tag( BerElement *ber, unsigned long *len )
 
 	assert( ber != NULL );
 	assert( len != NULL );
+	assert( BER_VALID( ber ) );
 
 	/*
 	 * Any ber element looks like this: tag length contents.
@@ -130,6 +132,7 @@ ber_peek_tag(
 	BerElement *ber;
 
 	assert( ber_in != NULL );
+	assert( BER_VALID( ber_in ) );
 
 	ber = ber_dup( ber_in );
 
@@ -137,6 +140,8 @@ ber_peek_tag(
 		return LBER_ERROR;
 	}
 
+	assert( BER_VALID( ber ) );
+
 	tag = ber_skip_tag( ber, len );
 
 	ber_free( ber, 0 );
@@ -153,6 +158,8 @@ ber_getnint( BerElement *ber, long *num, int len )
 	assert( ber != NULL );
 	assert( num != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	/*
 	 * The tag and length have already been stripped off.  We should
 	 * be sitting right before len bytes of 2's complement integer,
@@ -188,6 +195,7 @@ ber_get_int( BerElement *ber, long *num )
 	unsigned long	tag, len;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( (tag = ber_skip_tag( ber, &len )) == LBER_DEFAULT )
 		return( LBER_DEFAULT );
@@ -207,6 +215,7 @@ ber_get_stringb( BerElement *ber, char *buf, unsigned long *len )
 #endif /* STR_TRANSLATION */
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT )
 		return( LBER_DEFAULT );
@@ -249,6 +258,8 @@ ber_get_stringa( BerElement *ber, char **buf )
 	assert( ber != NULL );
 	assert( buf != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) {
 		*buf = NULL;
 		return( LBER_DEFAULT );
@@ -288,6 +299,8 @@ ber_get_stringal( BerElement *ber, struct berval **bv )
 	assert( ber != NULL );
 	assert( bv != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( (tag = ber_skip_tag( ber, &len )) == LBER_DEFAULT ) {
 		*bv = NULL;
 		return( LBER_DEFAULT );
@@ -337,6 +350,8 @@ ber_get_bitstringa( BerElement *ber, char **buf, unsigned long *blen )
 	assert( buf != NULL );
 	assert( blen != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) {
 		*buf = NULL;
 		return( LBER_DEFAULT );
@@ -368,6 +383,7 @@ ber_get_null( BerElement *ber )
 	unsigned long	len, tag;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( (tag = ber_skip_tag( ber, &len )) == LBER_DEFAULT )
 		return( LBER_DEFAULT );
@@ -387,6 +403,8 @@ ber_get_boolean( BerElement *ber, int *boolval )
 	assert( ber != NULL );
 	assert( boolval != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	rc = ber_get_int( ber, &longbool );
 	*boolval = longbool;
 
@@ -422,6 +440,8 @@ ber_next_element( BerElement *ber, unsigned long *len, char *last )
 	assert( len != NULL );
 	assert( last != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( ber->ber_ptr == last ) {
 		return( LBER_DEFAULT );
 	}
@@ -465,6 +485,8 @@ va_dcl
 	assert( ber != NULL );
 	assert( fmt != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	fmt_reset = fmt;
 
 	ber_log_printf( LDAP_DEBUG_TRACE, ber->ber_debug,
@@ -795,6 +817,7 @@ ber_set_string_translators( BerElement *ber, BERTranslateProc encode_proc,
 	BERTranslateProc decode_proc )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
     ber->ber_encode_translate_proc = encode_proc;
     ber->ber_decode_translate_proc = decode_proc;
diff --git a/libraries/liblber/encode.c b/libraries/liblber/encode.c
index da27a60d9b..44e70b06b0 100644
--- a/libraries/liblber/encode.c
+++ b/libraries/liblber/encode.c
@@ -61,6 +61,9 @@ ber_put_tag( BerElement	*ber, unsigned long tag, int nosos )
 	int		taglen;
 	unsigned long	ntag;
 
+	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
+
 	taglen = ber_calc_taglen( tag );
 
 	ntag = AC_HTONL( tag );
@@ -104,6 +107,7 @@ ber_put_len( BerElement *ber, unsigned long len, int nosos )
 	unsigned long	netlen;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	/*
 	 * short len if it's less than 128 - one byte giving the len,
@@ -154,6 +158,7 @@ ber_put_int_or_enum( BerElement *ber, long num, unsigned long tag )
 	long	netnum, mask;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	sign = (num < 0);
 
@@ -204,6 +209,7 @@ int
 ber_put_enum( BerElement *ber, long num, unsigned long tag )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_ENUMERATED;
@@ -215,6 +221,7 @@ int
 ber_put_int( BerElement *ber, long num, unsigned long tag )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_INTEGER;
@@ -237,6 +244,8 @@ ber_put_ostring(
 	assert( ber != NULL );
 	assert( str != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_OCTETSTRING;
 
@@ -281,6 +290,8 @@ ber_put_berval(
 	assert( ber != NULL );
 	assert( bv != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if( bv == NULL ) {
 		return -1;
 	}
@@ -297,6 +308,8 @@ ber_put_string(
 	assert( ber != NULL );
 	assert( str != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	return( ber_put_ostring( ber, str, strlen( str ), tag ));
 }
 
@@ -313,6 +326,8 @@ ber_put_bitstring(
 	assert( ber != NULL );
 	assert( str != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_BITSTRING;
 
@@ -339,6 +354,9 @@ ber_put_null( BerElement *ber, unsigned long tag )
 {
 	int	taglen;
 
+	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
+
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_NULL;
 
@@ -359,6 +377,7 @@ ber_put_boolean( BerElement *ber, int boolval, unsigned long tag )
 	unsigned char	falseval = 0x00U;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_BOOLEAN;
@@ -384,6 +403,7 @@ ber_start_seqorset( BerElement *ber, unsigned long tag )
 	Seqorset	*new;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( (new = (Seqorset *) calloc( sizeof(Seqorset), 1 ))
 	    == NULLSEQORSET )
@@ -408,6 +428,7 @@ int
 ber_start_seq( BerElement *ber, unsigned long tag )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_SEQUENCE;
@@ -419,6 +440,7 @@ int
 ber_start_set( BerElement *ber, unsigned long tag )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( tag == LBER_DEFAULT )
 		tag = LBER_SET;
@@ -436,6 +458,7 @@ ber_put_seqorset( BerElement *ber )
 	Seqorset	**sos = &ber->ber_sos;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	/*
 	 * If this is the toplevel sequence or set, we need to actually
@@ -548,6 +571,8 @@ int
 ber_put_seq( BerElement *ber )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
+
 	return( ber_put_seqorset( ber ) );
 }
 
@@ -555,6 +580,8 @@ int
 ber_put_set( BerElement *ber )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
+
 	return( ber_put_seqorset( ber ) );
 }
 
@@ -591,6 +618,8 @@ va_dcl
 	assert( ber != NULL );
 	assert( fmt != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	for ( rc = 0; *fmt && rc != -1; fmt++ ) {
 		switch ( *fmt ) {
 		case '!': { /* hook */
diff --git a/libraries/liblber/io.c b/libraries/liblber/io.c
index 8b6304f186..897378399b 100644
--- a/libraries/liblber/io.c
+++ b/libraries/liblber/io.c
@@ -54,6 +54,8 @@ BerRead( Sockbuf *sb, char *buf, long len )
 	assert( sb != NULL );
 	assert( buf != NULL );
 
+	assert( SOCKBUF_VALID( sb ) );
+
 	while ( len > 0 ) {
 		if ( (c = ber_pvt_sb_read( sb, buf, len )) <= 0 ) {
 			if ( nread > 0 )
@@ -76,6 +78,8 @@ ber_read( BerElement *ber, char *buf, unsigned long len )
 	assert( ber != NULL );
 	assert( buf != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	nleft = ber->ber_end - ber->ber_ptr;
 	actuallen = nleft < len ? nleft : len;
 
@@ -96,6 +100,8 @@ ber_write(
 	assert( ber != NULL );
 	assert( buf != NULL );
 
+	assert( BER_VALID( ber ) );
+
 	if ( nosos || ber->ber_sos == NULL ) {
 		if ( ber->ber_ptr + len > ber->ber_end ) {
 			if ( ber_realloc( ber, len ) != 0 )
@@ -127,6 +133,8 @@ ber_realloc( BerElement *ber, unsigned long len )
 	assert( ber != NULL );
 	assert( len > 0 );
 
+	assert( BER_VALID( ber ) );
+
 	have = (ber->ber_end - ber->ber_buf) / EXBUFSIZ;
 	need = (len < EXBUFSIZ ? 1 : (len + (EXBUFSIZ - 1)) / EXBUFSIZ);
 	total = have * EXBUFSIZ + need * EXBUFSIZ;
@@ -167,10 +175,12 @@ void
 ber_free( BerElement *ber, int freebuf )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( freebuf && ber->ber_buf != NULL )
 		free( ber->ber_buf );
 	ber->ber_buf = NULL;
+	ber->ber_valid = LBER_UNINITIALIZED;
 	free( (char *) ber );
 }
 
@@ -182,6 +192,9 @@ ber_flush( Sockbuf *sb, BerElement *ber, int freeit )
 	assert( sb != NULL );
 	assert( ber != NULL );
 
+	assert( SOCKBUF_VALID( ber ) );
+	assert( BER_VALID( ber ) );
+
 	if ( ber->ber_rwptr == NULL ) {
 		ber->ber_rwptr = ber->ber_buf;
 	}
@@ -232,10 +245,12 @@ ber_alloc_t( int options )
 	if ( ber == NULLBER )
 		return( NULLBER );
 
+	ber->ber_valid = LBER_VALID_BERELEMENT;
 	ber->ber_tag = LBER_DEFAULT;
 	ber->ber_options = options;
 	ber->ber_debug = ber_int_debug;
 
+	assert( BER_VALID( ber ) );
 	return( ber );
 }
 
@@ -257,6 +272,7 @@ ber_dup( LDAP_CONST BerElement *ber )
 	BerElement	*new;
 
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( (new = ber_alloc_t( ber->ber_options )) == NULL ) {
 		return( NULL );
@@ -264,6 +280,7 @@ ber_dup( LDAP_CONST BerElement *ber )
 
 	*new = *ber;
 
+	assert( BER_VALID( new ) );
 	return( new );
 }
 
@@ -275,9 +292,12 @@ ber_init_w_nullc( BerElement *ber, int options )
 	assert( ber != NULL );
 
 	(void) memset( (char *)ber, '\0', sizeof( BerElement ));
+	ber->ber_valid = LBER_VALID_BERELEMENT;
 	ber->ber_tag = LBER_DEFAULT;
 	ber->ber_options = (char) options;
 	ber->ber_debug = ber_int_debug;
+
+	assert( BER_VALID( ber ) );
 }
 
 /* New C-API ber_init() */
@@ -362,6 +382,7 @@ void
 ber_reset( BerElement *ber, int was_writing )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ( was_writing ) {
 		ber->ber_end = ber->ber_ptr;
@@ -384,6 +405,7 @@ get_tag( Sockbuf *sb )
 	unsigned int	i;
 
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 
 	if ( ber_pvt_sb_read( sb, (char *) &xbyte, 1 ) != 1 )
 		return( LBER_DEFAULT );
@@ -425,11 +447,12 @@ ber_get_next( Sockbuf *sb, unsigned long *len, BerElement *ber )
 	assert( len != NULL );
 	assert( ber != NULL );
 
-	if ( ber->ber_debug ) {
-		ber_log_printf( LDAP_DEBUG_TRACE, ber->ber_debug,
-			"ber_get_next\n" );
-	}
-	
+	assert( SOCKBUF_VALID( sb ) );
+	assert( BER_VALID( ber ) );
+
+	ber_log_printf( LDAP_DEBUG_TRACE, ber->ber_debug,
+		"ber_get_next\n" );
+
 	/*
 	 * Any ber element looks like this: tag length contents.
 	 * Assuming everything's ok, we return the tag byte (we
@@ -574,11 +597,14 @@ fill_buffer:
 void	ber_clear( BerElement *ber, int freebuf )
 {
 	assert( ber != NULL );
+	assert( BER_VALID( ber ) );
 
 	if ((freebuf) && (ber->ber_buf))
 		free( ber->ber_buf );
 	ber->ber_buf = NULL;
 	ber->ber_rwptr = NULL;
 	ber->ber_end = NULL;
+
+	ber->ber_valid = LBER_UNINITIALIZED;
 }
 
diff --git a/libraries/liblber/lber-int.h b/libraries/liblber/lber-int.h
index 2d5847e204..048df9a49a 100644
--- a/libraries/liblber/lber-int.h
+++ b/libraries/liblber/lber-int.h
@@ -23,20 +23,23 @@
 
 LDAP_BEGIN_DECL
 
-extern int ber_int_debug;
-#define ber_log_printf ber_pvt_log_printf
-
 struct lber_options {
-	short		lbo_item_type;
-#define LBER_ITEM_BERELEMENT 1
-#define LBER_ITEM_SOCKBUF 2
-	short		lbo_options;
-	int			lbo_debug;
+	short lbo_valid;
+#define LBER_UNINITIALIZED		0x0
+#define LBER_INITIALIZED		0x1
+#define LBER_VALID_BERELEMENT	0x2
+#define LBER_VALID_SOCKBUF		0x3
+
+	unsigned short lbo_options;
+	int lbo_debug;
 };
 
+extern struct lber_options ber_int_options;
+#define ber_int_debug ber_int_options.lbo_debug
+
 struct berelement {
 	struct		lber_options ber_opts;
-#define ber_item_type	ber_opts.lbo_item_type
+#define ber_valid		ber_opts.lbo_valid
 #define ber_options		ber_opts.lbo_options
 #define ber_debug		ber_opts.lbo_debug
 
@@ -54,8 +57,12 @@ struct berelement {
 	BERTranslateProc ber_encode_translate_proc;
 	BERTranslateProc ber_decode_translate_proc;
 };
+#define BER_VALID(ber)	((ber)->ber_valid==LBER_VALID_BERELEMENT)
 #define NULLBER	((BerElement *) 0)
 
+#define ber_pvt_ber_bytes(ber)		((ber)->ber_ptr - (ber)->ber_buf)
+#define ber_pvt_ber_remaining(ber)	((ber)->ber_end - (ber)->ber_ptr)
+
 struct sockbuf;
 
 struct sockbuf_io {
@@ -88,21 +95,13 @@ typedef struct sockbuf_io Sockbuf_IO;
 typedef struct sockbuf_sec Sockbuf_Sec;
 typedef struct sockbuf_buf Sockbuf_Buf;
 
-#define	ber_pvt_sb_get_desc( sb ) ((sb)->sb_sd)
-#define ber_pvt_sb_set_desc( sb, val ) ((sb)->sb_sd =(val))
-#define ber_pvt_sb_in_use( sb ) ((sb)->sb_sd!=-1)
+extern Sockbuf_IO ber_pvt_sb_io_tcp;
+extern Sockbuf_IO ber_pvt_sb_io_udp;
 
-#ifdef USE_SASL
-#define ber_pvt_sb_data_ready( sb ) \
-(((sb)->sb_buf_ready) || ((sb)->sb_trans_ready) || ((sb)->sb_sec_ready))
-#else
-#define ber_pvt_sb_data_ready( sb ) \
-(((sb)->sb_buf_ready) || ((sb)->sb_trans_ready))
-#endif
 
 struct sockbuf {
 	struct lber_options sb_opts;
-#define	sb_item_type	sb_opts.lbo_item_type
+#define	sb_valid		sb_opts.lbo_valid
 #define	sb_options		sb_opts.lbo_options
 #define	sb_debug		sb_opts.lbo_debug
 
@@ -138,6 +137,21 @@ struct sockbuf {
 	long		sb_sec_prev_len;
 #endif   
 };
+#define SOCKBUF_VALID(ber)	((sb)->sb_valid==LBER_VALID_SOCKBUF)
+
+/* these should be internal ie: ber_int_* */
+#define	ber_pvt_sb_get_desc( sb ) ((sb)->sb_sd)
+#define ber_pvt_sb_set_desc( sb, val ) ((sb)->sb_sd =(val))
+
+#define ber_pvt_sb_in_use( sb ) ((sb)->sb_sd!=-1)
+
+#ifdef USE_SASL
+#define ber_pvt_sb_data_ready( sb ) \
+(((sb)->sb_buf_ready) || ((sb)->sb_trans_ready) || ((sb)->sb_sec_ready))
+#else
+#define ber_pvt_sb_data_ready( sb ) \
+(((sb)->sb_buf_ready) || ((sb)->sb_trans_ready))
+#endif
 
 #define READBUFSIZ	8192
 
@@ -154,6 +168,8 @@ struct seqorset {
 /*
  * bprint.c
  */
+#define ber_log_printf ber_pvt_log_printf
+
 LDAP_F( int )
 ber_log_bprint LDAP_P((
 	int errlvl,
@@ -176,6 +192,8 @@ ber_log_sos_dump LDAP_P((
 
 /* sockbuf.c */
 
+/* these should be ber_int*() functions */
+
 LDAP_F( int )
 ber_pvt_sb_init LDAP_P(( Sockbuf *sb ));
 
@@ -217,7 +235,5 @@ ber_pvt_sb_udp_set_dst LDAP_P((Sockbuf *sb, void *addr ));
 LDAP_F(	void * )
 ber_pvt_sb_udp_get_src LDAP_P((Sockbuf *sb ));
 
-extern Sockbuf_IO ber_pvt_sb_io_tcp;
-extern Sockbuf_IO ber_pvt_sb_io_udp;
 
 #endif /* _LBER_INT_H */
diff --git a/libraries/liblber/options.c b/libraries/liblber/options.c
index c5f37812ba..0da332e8e7 100644
--- a/libraries/liblber/options.c
+++ b/libraries/liblber/options.c
@@ -8,7 +8,8 @@
 
 #include "lber-int.h"
 
-int ber_int_debug = 0;
+struct lber_options ber_int_options = {
+	LBER_UNINITIALIZED, 0, 0 };
 
 int
 ber_get_option(
@@ -38,10 +39,12 @@ ber_get_option(
 
 	switch(option) {
 	case LBER_OPT_BER_OPTIONS:
+		assert( BER_VALID( ber ) );
 		* (int *) outvalue = ber->ber_options;
 		return LBER_OPT_SUCCESS;
 
 	case LBER_OPT_BER_DEBUG:
+		assert( BER_VALID( ber ) );
 		* (int *) outvalue = ber->ber_debug;
 		return LBER_OPT_SUCCESS;
 
@@ -85,10 +88,12 @@ ber_set_option(
 
 	switch(option) {
 	case LBER_OPT_BER_OPTIONS:
+		assert( BER_VALID( ber ) );
 		ber->ber_options = * (int *) invalue;
 		return LBER_OPT_SUCCESS;
 
 	case LBER_OPT_BER_DEBUG:
+		assert( BER_VALID( ber ) );
 		ber->ber_debug = * (int *) invalue;
 		return LBER_OPT_SUCCESS;
 
diff --git a/libraries/liblber/sockbuf.c b/libraries/liblber/sockbuf.c
index af6bbaef40..cda495202a 100644
--- a/libraries/liblber/sockbuf.c
+++ b/libraries/liblber/sockbuf.c
@@ -58,6 +58,7 @@ static void
 update_status( Sockbuf *sb )
 {
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 
    sb->sb_buf_ready = (sb->sb_buf.buf_ptr < sb->sb_buf.buf_end);
 #ifdef USE_SASL   
@@ -77,6 +78,7 @@ status_is_ok( Sockbuf *sb )
 #endif
 
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 
 	obr = sb->sb_buf_ready;
 #ifdef USE_SASL
@@ -177,6 +179,7 @@ sockbuf_sec_release( Sockbuf *sb, char *buf, long len )
    
     assert( buf != NULL );
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 
    assert( sb->sb_sec );
    assert( sb->sb_sec->sbs_release );
@@ -257,6 +260,8 @@ sockbuf_sec_protect( Sockbuf *sb, char *buf, long len )
    assert( buf != NULL );
 
    assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
+
    assert( sb->sb_sec_out.buf_end == 0 );
    assert( sb->sb_sec_out.buf_ptr == 0 );
    
@@ -303,6 +308,7 @@ sockbuf_copy_out( Sockbuf *sb, char **buf, long len )
    assert( buf != NULL );
 
    assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
    assert( status_is_ok(sb) );
 
    if (blen) {
@@ -346,6 +352,7 @@ Sockbuf *ber_sockbuf_alloc_fd( int fd )
 void ber_sockbuf_free( Sockbuf *sb )
 {
 	assert(sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
 	ber_pvt_sb_destroy( sb );
 	free(sb);
 }
@@ -358,6 +365,7 @@ ber_pvt_sb_read( Sockbuf *sb, void *buf_arg, long len )
    
    assert( buf_arg != NULL );
    assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
    assert( status_is_ok(sb) );
 #if 0
    /* breaks slapd :-< */
@@ -518,6 +526,7 @@ long sockbuf_do_write( Sockbuf *sb )
    long to_go;
 
    assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 
    to_go = sb->sb_sec_out.buf_end - sb->sb_sec_out.buf_ptr;
    assert( to_go > 0 );
@@ -544,6 +553,10 @@ long ber_pvt_sb_write( Sockbuf *sb, void *buf, long len_arg )
 {
    long ret;
    long len = len_arg;
+
+	assert( buf != NULL );
+	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
    assert( status_is_ok(sb) );
 #if 0
    /* unfortunately breaks slapd */
@@ -603,6 +616,7 @@ int ber_pvt_sb_close( Sockbuf *sb )
    int ret;
 
    assert( sb != NULL );
+   assert( SOCKBUF_VALID( sb ) );
    assert( sb->sb_io );
    assert( sb->sb_io->sbi_close );
    assert( status_is_ok(sb) );
@@ -617,6 +631,7 @@ int ber_pvt_sb_close( Sockbuf *sb )
 int ber_pvt_sb_set_readahead( Sockbuf *sb, int rh )
 {
    assert( sb != NULL );
+   assert( SOCKBUF_VALID( sb ) );
    assert( status_is_ok(sb) );
    sb->sb_read_ahead = (rh!=0);
    return 0;
@@ -627,6 +642,7 @@ int ber_pvt_sb_set_readahead( Sockbuf *sb, int rh )
 int ber_pvt_sb_set_nonblock( Sockbuf *sb, int nb )
 {
    assert( sb != NULL );
+   assert( SOCKBUF_VALID( sb ) );
    assert( status_is_ok(sb) );
    if (nb) {
       sb->sb_non_block = 1;
@@ -678,7 +694,7 @@ int ber_pvt_sb_init( Sockbuf *sb )
 {
 	assert( sb != NULL);
 
-   sb->sb_item_type=LBER_ITEM_SOCKBUF;
+   sb->sb_valid=LBER_VALID_SOCKBUF;
    sb->sb_options = 0;
    sb->sb_debug = 0;
    sb->sb_trans_ready = 0;
@@ -702,13 +718,16 @@ int ber_pvt_sb_init( Sockbuf *sb )
    sb->sb_sdata = NULL;
    sb->sb_sec = NULL;
    sb->sb_sec_prev_len = 0;
-#endif   
+#endif 
+   
+   assert( SOCKBUF_VALID( sb ) );
    return 0;
 }
    
 int ber_pvt_sb_destroy( Sockbuf *sb )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID(sb) );
 #ifdef USE_SASL
    ber_pvt_sb_clear_sec(sb);
    sockbuf_buf_destroy( &(sb->sb_sec_buf_in) );
@@ -724,6 +743,7 @@ int ber_pvt_sb_set_sec( Sockbuf *sb, Sockbuf_Sec * sec, void *arg )
 {
    int len;
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( *sb ) );
    if ((sb->sb_sec) || (sec==NULL))
      return -1;
    
@@ -752,6 +772,7 @@ int ber_pvt_sb_set_sec( Sockbuf *sb, Sockbuf_Sec * sec, void *arg )
 int ber_pvt_sb_clear_sec( Sockbuf *sb )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
 
    if (sb->sb_buf.buf_ptr!=0)
      return -1;
@@ -783,6 +804,7 @@ int ber_pvt_sb_clear_sec( Sockbuf *sb )
 int ber_pvt_sb_set_io( Sockbuf *sb, Sockbuf_IO *trans, void *arg )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
    assert( sb->sb_io == &sb_IO_None );
 
    if (trans==NULL)
@@ -799,6 +821,8 @@ int ber_pvt_sb_set_io( Sockbuf *sb, Sockbuf_IO *trans, void *arg )
 int ber_pvt_sb_clear_io( Sockbuf *sb )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
+
    if (sb->sb_io==&sb_IO_None)
      return -1;
    
@@ -820,6 +844,7 @@ static long
 stream_read( Sockbuf *sb, void *buf, long len )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
 
 #if defined(MACOS)
 /*
@@ -862,6 +887,7 @@ static long
 stream_write( Sockbuf *sb, void *buf, long len )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
 
 #if defined(MACOS) 
 /*
@@ -912,6 +938,7 @@ static int
 stream_close( Sockbuf *sb )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
    tcp_close( ber_pvt_sb_get_desc( sb ) );
    return 0;
 }
@@ -939,6 +966,8 @@ static int
 dgram_setup( Sockbuf *sb, void *arg )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
+
    sb->sb_iodata = malloc( sizeof( struct dgram_data ) );
    if (sb->sb_iodata==NULL)
      return -1;
@@ -950,6 +979,8 @@ static int
 dgram_release( Sockbuf *sb )
 {
 	assert( sb != NULL);
+	assert( SOCKBUF_VALID( sb ) );
+
    free( sb->sb_iodata );
    return 0;
 }
@@ -963,6 +994,7 @@ dgram_read( Sockbuf *sb, void *buf, long len )
    struct dgram_data *dd;
    
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 	assert( buf != NULL );
 
    dd = (struct dgram_data *)(sb->sb_iodata);
@@ -992,6 +1024,7 @@ dgram_write( Sockbuf *sb, void *buf, long len )
    struct dgram_data *dd;
    
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 	assert( buf != NULL );
 
    dd = (struct dgram_data *)(sb->sb_iodata);
@@ -1019,6 +1052,7 @@ static int
 dgram_close( Sockbuf *sb )
 {
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
 
 	tcp_close( ber_pvt_sb_get_desc(sb) );
 	return 0;
@@ -1037,6 +1071,7 @@ int ber_pvt_sb_udp_set_dst(Sockbuf *sb, void *addr )
 {
    struct dgram_data *dd;
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
    assert( sb->sb_io == &ber_pvt_sb_io_udp );
    dd = (struct dgram_data *) (sb->sb_iodata);
    memcpy( &(dd->dst), addr, sizeof( struct sockaddr ) );
@@ -1046,7 +1081,9 @@ int ber_pvt_sb_udp_set_dst(Sockbuf *sb, void *addr )
 void *ber_pvt_sb_udp_get_src( Sockbuf *sb )
 {
    struct dgram_data *dd;
+
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
    assert( sb->sb_io == &ber_pvt_sb_io_udp );
    dd = (struct dgram_data *) (sb->sb_iodata);
    return &(dd->src);
@@ -1064,6 +1101,8 @@ static long
 have_no_read( Sockbuf *sb, void *buf, long len )
 {
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
+
    ber_log_printf( LDAP_DEBUG_ANY, ber_int_debug,
 		   "warning: reading from uninitialized sockbuf\n");
    errno =  EBADF;
@@ -1074,6 +1113,8 @@ static long
 have_no_write( Sockbuf *sb, void *buf, long len )
 {
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
+
    ber_log_printf( LDAP_DEBUG_ANY, ber_int_debug,
 		   "warning: writing to uninitialized sockbuf\n");
    errno =  EBADF;
@@ -1084,6 +1125,8 @@ static int
 have_no_close( Sockbuf *sb )
 {   
 	assert( sb != NULL );
+	assert( SOCKBUF_VALID( sb ) );
+
    assert( 0 );
    return -1;
 }
diff --git a/libraries/libldap/controls.c b/libraries/libldap/controls.c
index 8d6130c2e1..9f049c178d 100644
--- a/libraries/libldap/controls.c
+++ b/libraries/libldap/controls.c
@@ -112,7 +112,7 @@ int ldap_int_get_controls LDAP_P((
 
 	*ctrls = NULL;
 
-	len = ber->ber_end - ber->ber_ptr;
+	len = ber_pvt_ber_remaining(ber);
 
 	if( len == 0) {
 		/* no controls */
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index 8c22855fd8..0b26ef5867 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -15,12 +15,11 @@
 #include "ldap-int.h"
 #include "ldapconfig.h"
 
-struct ldapoptions openldap_ldap_global_options = { LDAP_DEBUG_NONE };  
+struct ldapoptions ldap_int_global_options =
+	{ LDAP_UNINITIALIZED, LDAP_DEBUG_NONE };  
 
 #undef gopts
-#define gopts openldap_ldap_global_options
-
-int	openldap_ldap_initialized = 0;
+#define gopts ldap_int_global_options
 
 #define ATTR_NONE	0
 #define ATTR_BOOL	1
@@ -284,9 +283,9 @@ static void openldap_ldap_init_w_env(const char *prefix)
 	}
 }
 
-void openldap_ldap_initialize( void )
+void ldap_int_initialize( void )
 {
-	if ( openldap_ldap_initialized ) {
+	if ( gopts.ldo_valid == LDAP_INITIALIZED ) {
 		return;
 	}
 
@@ -308,7 +307,7 @@ void openldap_ldap_initialize( void )
 
 	LDAP_BOOL_SET(&gopts, LDAP_BOOL_REFERRALS);
 
-	openldap_ldap_initialized = 1;
+	gopts.ldo_valid = LDAP_INITIALIZED;
 
 	if( getenv("LDAPNOINIT") != NULL ) {
 		return;
diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
index fee3266cc9..1935ee0f0f 100644
--- a/libraries/libldap/ldap-int.h
+++ b/libraries/libldap/ldap-int.h
@@ -18,7 +18,7 @@
 
 #include "../liblber/lber-int.h"
 
-#define ldap_debug	(openldap_ldap_global_options.ldo_debug)
+#define ldap_debug	(ldap_int_global_options.ldo_debug)
 #undef Debug
 #define Debug( level, fmt, arg1, arg2, arg3 ) \
 	ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) )
@@ -81,6 +81,11 @@ struct ldapmsg {
  * which have global defaults.
  */
 struct ldapoptions {
+	short ldo_valid;
+#define LDAP_UNINITIALIZED	0x0
+#define LDAP_INITIALIZED	0x1
+#define LDAP_VALID_SESSION	0x2
+
 	int		ldo_debug;
 
 	int		ldo_version;	/* version to connect at */
@@ -92,8 +97,11 @@ struct ldapoptions {
 	char*	ldo_defbase;
 	char*	ldo_defhost;
 
+#ifdef LDAP_CONNECTIONLESS
 	int		ldo_cldaptries;	/* connectionless search retry count */
 	int		ldo_cldaptimeout;/* time between retries */
+#endif
+
 	int		ldo_refhoplimit;	/* limit on referral nesting */
 
 	/* LDAPv3 server and client controls */
@@ -128,7 +136,7 @@ typedef struct ldap_conn {
 	LDAPServer		*lconn_server;
 	char			*lconn_krbinstance;
 	struct ldap_conn	*lconn_next;
-	BerElement		lconn_ber;/* ber receiving on this conn. */
+	BerElement		*lconn_ber;/* ber receiving on this conn. */
 } LDAPConn;
 
 
@@ -189,6 +197,9 @@ struct ldap {
 
 	struct ldapoptions ld_options;
 
+#define ld_valid		ld_options.ldo_valid
+#define ld_debug		ld_options.ldo_debug
+
 #define ld_deref		ld_options.ldo_deref
 #define ld_timelimit	ld_options.ldo_timelimit
 #define ld_sizelimit	ld_options.ldo_sizelimit
@@ -226,6 +237,7 @@ struct ldap {
 
 	LDAPCache	*ld_cache;	/* non-null if cache is initialized */
 	/* stuff used by connectionless searches. */
+
    	char		*ld_cldapdn;	/* DN used in connectionless search */
 	int		ld_cldapnaddr; /* number of addresses */
    	void		**ld_cldapaddrs;/* addresses to send request to */
@@ -241,13 +253,14 @@ struct ldap {
 				char **passwdp, int *authmethodp, int freeit );
 				/* routine to get info needed for re-bind */
 };
+#define LDAP_VALID(ld)	( (ld)->ld_valid == LDAP_VALID_SESSION )
 
 /*
  * in init.c
  */
-extern int openldap_ldap_initialized;
-extern struct ldapoptions openldap_ldap_global_options;
-void openldap_ldap_initialize LDAP_P((void));
+
+extern struct ldapoptions ldap_int_global_options;
+void ldap_int_initialize LDAP_P((void));
 
 
 /*
diff --git a/libraries/libldap/libldap.dsp b/libraries/libldap/libldap.dsp
index 0b90aa04e3..5910a3c4cb 100644
--- a/libraries/libldap/libldap.dsp
+++ b/libraries/libldap/libldap.dsp
@@ -243,6 +243,10 @@ SOURCE=..\..\include\ldap_pvt.h
 # End Source File
 # Begin Source File
 
+SOURCE=..\..\include\ldap_schema.h
+# End Source File
+# Begin Source File
+
 SOURCE=..\..\include\ldapconfig.h
 # End Source File
 # Begin Source File
@@ -287,6 +291,10 @@ SOURCE=.\sbind.c
 # End Source File
 # Begin Source File
 
+SOURCE=.\schema.c
+# End Source File
+# Begin Source File
+
 SOURCE=.\search.c
 # End Source File
 # Begin Source File
diff --git a/libraries/libldap/open.c b/libraries/libldap/open.c
index 5149af1df6..31733292fa 100644
--- a/libraries/libldap/open.c
+++ b/libraries/libldap/open.c
@@ -85,8 +85,8 @@ ldap_init( LDAP_CONST char *defhost, int defport )
 {
 	LDAP			*ld;
 
-	if(!openldap_ldap_initialized) {
-		openldap_ldap_initialize();
+	if( ldap_int_global_options.ldo_valid != LDAP_INITIALIZED ) {
+		ldap_int_initialize();
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "ldap_init\n", 0, 0, 0 );
@@ -135,9 +135,11 @@ ldap_init( LDAP_CONST char *defhost, int defport )
 	}
    
 	/* copy the global options */
-	memcpy(&ld->ld_options, &openldap_ldap_global_options,
+	memcpy(&ld->ld_options, &ldap_int_global_options,
 		sizeof(ld->ld_options));
 
+	ld->ld_valid = LDAP_VALID_SESSION;
+
 	/* but not pointers to malloc'ed items */
 	ld->ld_options.ldo_defbase = NULL;
 	ld->ld_options.ldo_defhost = NULL;
@@ -148,7 +150,7 @@ ldap_init( LDAP_CONST char *defhost, int defport )
 		ld->ld_options.ldo_defhost = strdup( defhost );
 	} else {
 		ld->ld_options.ldo_defhost = strdup(
-			openldap_ldap_global_options.ldo_defhost);
+			ldap_int_global_options.ldo_defhost);
 	}
 
 	if ( ld->ld_options.ldo_defhost == NULL ) {
@@ -157,9 +159,9 @@ ldap_init( LDAP_CONST char *defhost, int defport )
 		return( NULL );
 	}
 
-	if ( openldap_ldap_global_options.ldo_defbase != NULL ) {
+	if ( ldap_int_global_options.ldo_defbase != NULL ) {
 		ld->ld_options.ldo_defbase = strdup(
-			openldap_ldap_global_options.ldo_defbase);
+			ldap_int_global_options.ldo_defbase);
 	}
 
 	if (( ld->ld_selectinfo = ldap_new_select_info()) == NULL ) {
diff --git a/libraries/libldap/options.c b/libraries/libldap/options.c
index 5831264e45..92ebced841 100644
--- a/libraries/libldap/options.c
+++ b/libraries/libldap/options.c
@@ -83,18 +83,25 @@ ldap_get_option(
 {
 	struct ldapoptions *lo;
 
-	if(!openldap_ldap_initialized) {
-		openldap_ldap_initialize();
+	if( ldap_int_global_options.ldo_valid != LDAP_INITIALIZED ) {
+		ldap_int_initialize();
 	}
 
 	if(outvalue == NULL) {
 		/* no place to get to */
-		return -1;
+		return LDAP_OPT_ERROR;
 	}
 
 	if(ld == NULL) {
-		lo = &openldap_ldap_global_options;
+		lo = &ldap_int_global_options;
+
 	} else {
+		assert( LDAP_VALID( ld ) );
+
+		if( !LDAP_VALID( ld ) ) {
+			return LDAP_OPT_ERROR;
+		}
+
 		lo = &ld->ld_options;
 	}
 
@@ -104,13 +111,13 @@ ldap_get_option(
 
 			if(info == NULL) {
 				/* outvalue must point to an apiinfo structure */
-				return -1;
+				return LDAP_OPT_ERROR;
 			}
 
 			if(info->ldapai_info_version != LDAP_API_INFO_VERSION) {
 				/* api info version mismatch */
 				info->ldapai_info_version = LDAP_API_INFO_VERSION;
-				return -1;
+				return LDAP_OPT_ERROR;
 			}
 
 			info->ldapai_api_version = LDAP_API_VERSION;
@@ -135,7 +142,7 @@ ldap_get_option(
 			info->ldapai_vendor_name = strdup(LDAP_VENDOR_NAME);
 			info->ldapai_vendor_version = LDAP_VENDOR_VERSION;
 
-			return 0;
+			return LDAP_OPT_SUCCESS;
 		} break;
 
 	case LDAP_OPT_DESC:
@@ -145,34 +152,34 @@ ldap_get_option(
 		} 
 
 		* (int *) outvalue = ber_pvt_sb_get_desc( &(ld->ld_sb) );
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_DEREF:
 		* (int *) outvalue = lo->ldo_deref;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_SIZELIMIT:
 		* (int *) outvalue = lo->ldo_sizelimit;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_TIMELIMIT:
 		* (int *) outvalue = lo->ldo_timelimit;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_REFERRALS:
 		* (int *) outvalue = (LDAP_BOOL_GET(lo, LDAP_BOOL_REFERRALS) ==
 				      LDAP_OPT_ON);
-		return 0;
+		return LDAP_OPT_SUCCESS;
 		
 	case LDAP_OPT_RESTART:
 		* (int *) outvalue = (LDAP_BOOL_GET(lo, LDAP_BOOL_RESTART) ==
 				      LDAP_OPT_ON);
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_DNS:	/* LDAPv2 */
 		* (int *) outvalue = (LDAP_BOOL_GET(lo, LDAP_BOOL_DNS) ==
 				      LDAP_OPT_ON);
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_PROTOCOL_VERSION:
 		if ((ld != NULL) && ld->ld_version) {
@@ -180,19 +187,19 @@ ldap_get_option(
 		} else { 
 			* (int *) outvalue = lo->ldo_version;
 		}
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_SERVER_CONTROLS:
 		* (LDAPControl ***) outvalue =
 			ldap_controls_dup( lo->ldo_sctrls );
 
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_CLIENT_CONTROLS:
 		* (LDAPControl ***) outvalue =
 			ldap_controls_dup( lo->ldo_cctrls );
 
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_HOST_NAME:
 		/*
@@ -202,7 +209,7 @@ ldap_get_option(
 		 */
 
 		* (char **) outvalue = strdup(lo->ldo_defhost);
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_ERROR_NUMBER:
 		if(ld == NULL) {
@@ -210,7 +217,7 @@ ldap_get_option(
 			break;
 		} 
 		* (int *) outvalue = ld->ld_errno;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_ERROR_STRING:
 		if(ld == NULL) {
@@ -229,7 +236,7 @@ ldap_get_option(
 			* (char **) outvalue = strdup(ld->ld_error);
 		}
 
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
         case LDAP_OPT_MATCH_STRING:
 		if(ld == NULL) {
@@ -254,21 +261,21 @@ ldap_get_option(
 			LDAPAPIFeatureInfo *info = (LDAPAPIFeatureInfo *) outvalue;
 			int i;
 
-			if(info == NULL) return -1;
+			if(info == NULL) return LDAP_OPT_ERROR;
 
 			if(info->ldapaif_info_version != LDAP_FEATURE_INFO_VERSION) {
 				/* api info version mismatch */
 				info->ldapaif_info_version = LDAP_FEATURE_INFO_VERSION;
-				return -1;
+				return LDAP_OPT_ERROR;
 			}
 
-			if(info->ldapaif_name == NULL) return -1;
+			if(info->ldapaif_name == NULL) return LDAP_OPT_ERROR;
 
 			for(i=0; features[i].ldapaif_name != NULL; i++) {
 				if(!strcmp(info->ldapaif_name, features[i].ldapaif_name)) {
 					info->ldapaif_version =
 						features[i].ldapaif_version;
-					return 0;
+					return LDAP_OPT_SUCCESS;
 				}
 			}
 		}
@@ -276,14 +283,14 @@ ldap_get_option(
 
 	case LDAP_OPT_DEBUG_LEVEL:
 		* (int *) outvalue = lo->ldo_debug;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	default:
 		/* bad param */
 		break;
 	}
 
-	return -1;
+	return LDAP_OPT_ERROR;
 }
 
 int
@@ -294,13 +301,20 @@ ldap_set_option(
 {
 	struct ldapoptions *lo;
 
-	if(!openldap_ldap_initialized) {
-		openldap_ldap_initialize();
+	if( ldap_int_global_options.ldo_valid != LDAP_INITIALIZED ) {
+		ldap_int_initialize();
 	}
 
 	if(ld == NULL) {
-		lo = &openldap_ldap_global_options;
+		lo = &ldap_int_global_options;
+
 	} else {
+		assert( LDAP_VALID( ld ) );
+
+		if( !LDAP_VALID( ld ) ) {
+			return LDAP_OPT_ERROR;
+		}
+
 		lo = &ld->ld_options;
 	}
 
@@ -311,7 +325,7 @@ ldap_set_option(
 		} else {
 			LDAP_BOOL_CLR(lo, LDAP_BOOL_REFERRALS);
 		}
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_RESTART:
 		if(invalue == LDAP_OPT_ON) {
@@ -319,12 +333,12 @@ ldap_set_option(
 		} else {
 			LDAP_BOOL_CLR(lo, LDAP_BOOL_RESTART);
 		}
-		return 0;
+		return LDAP_OPT_SUCCESS;
 	}
 
 	if(invalue == NULL) {
 		/* no place to set from */
-		return -1;
+		return LDAP_OPT_ERROR;
 	}
 
 	switch(option) {
@@ -335,15 +349,15 @@ ldap_set_option(
 
 	case LDAP_OPT_DEREF:
 		lo->ldo_deref = * (int *) invalue;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_SIZELIMIT:
 		lo->ldo_sizelimit = * (int *) invalue;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_TIMELIMIT:
 		lo->ldo_timelimit = * (int *) invalue;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_PROTOCOL_VERSION: {
 			int vers = * (int *) invalue;
@@ -352,7 +366,7 @@ ldap_set_option(
 				break;
 			}
 			ld->ld_version = vers;
-		} return 0;
+		} return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_SERVER_CONTROLS: {
 			LDAPControl **controls = (LDAPControl **) invalue;
@@ -361,7 +375,7 @@ ldap_set_option(
 
 			if( controls == NULL || *controls == NULL ) {
 				lo->ldo_sctrls = NULL;
-				return 0;
+				return LDAP_OPT_SUCCESS;
 			}
 				
 			lo->ldo_sctrls =
@@ -371,7 +385,7 @@ ldap_set_option(
 				/* memory allocation error ? */
 				break;
 			}
-		} return 0;
+		} return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_CLIENT_CONTROLS: {
 			LDAPControl **controls = (LDAPControl **) invalue;
@@ -380,7 +394,7 @@ ldap_set_option(
 
 			if( controls == NULL || *controls == NULL ) {
 				lo->ldo_cctrls = NULL;
-				return 0;
+				return LDAP_OPT_SUCCESS;
 			}
 				
 			lo->ldo_cctrls =
@@ -390,7 +404,7 @@ ldap_set_option(
 				/* memory allocation error ? */
 				break;
 			}
-		} return 0;
+		} return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_HOST_NAME: {
 			char* host = (char *) invalue;
@@ -402,7 +416,7 @@ ldap_set_option(
 
 			if(host != NULL) {
 				lo->ldo_defhost = strdup(host);
-				return 0;
+				return LDAP_OPT_SUCCESS;
 			}
 
 			if(ld == NULL) {
@@ -418,9 +432,9 @@ ldap_set_option(
 				 *   updated to the current global default
 				 */
 				lo->ldo_defhost = strdup(
-					openldap_ldap_global_options.ldo_defhost);
+					ldap_int_global_options.ldo_defhost);
 			}
-		} return 0;
+		} return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_ERROR_NUMBER: {
 			int err = * (int *) invalue;
@@ -431,7 +445,7 @@ ldap_set_option(
 			}
 
 			ld->ld_errno = err;
-		} return 0;
+		} return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_ERROR_STRING: {
 			char* err = (char *) invalue;
@@ -446,7 +460,7 @@ ldap_set_option(
 			}
 
 			ld->ld_error = strdup(err);
-		} return 0;
+		} return LDAP_OPT_SUCCESS;
 
 	case LDAP_OPT_API_FEATURE_INFO:
 		/* read-only */
@@ -454,11 +468,11 @@ ldap_set_option(
 
 	case LDAP_OPT_DEBUG_LEVEL:
 		lo->ldo_debug = * (int *) invalue;
-		return 0;
+		return LDAP_OPT_SUCCESS;
 
 	default:
 		/* bad param */
 		break;
 	}
-	return -1;
+	return LDAP_OPT_ERROR;
 }
diff --git a/libraries/libldap/request.c b/libraries/libldap/request.c
index 7699c01236..4adda201bb 100644
--- a/libraries/libldap/request.c
+++ b/libraries/libldap/request.c
@@ -418,7 +418,9 @@ ldap_free_connection( LDAP *ld, LDAPConn *lc, int force, int unbind )
 			}
 			ldap_close_connection( lc->lconn_sb );
 		   	ber_pvt_sb_destroy( lc->lconn_sb );
-			ber_clear( &lc->lconn_ber, 1 );
+			if( lc->lconn_ber != NULL ) {
+				ber_free( lc->lconn_ber, 1 );
+			}
 		}
 		prevlc = NULL;
 		for ( tmplc = ld->ld_conns; tmplc != NULL;
@@ -709,7 +711,7 @@ ldap_chase_referrals( LDAP *ld, LDAPRequest *lr, char **errstrp, int *hadrefp )
 				*ports++ = '\0';
 				srv->lsrv_port = atoi( ports );
 			} else {
-				srv->lsrv_port = openldap_ldap_global_options.ldo_defport;
+				srv->lsrv_port = ldap_int_global_options.ldo_defport;
 			}
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_DNS
 		} else {
diff --git a/libraries/libldap/result.c b/libraries/libldap/result.c
index 90e9e69b65..88ba5c9583 100644
--- a/libraries/libldap/result.c
+++ b/libraries/libldap/result.c
@@ -258,14 +258,18 @@ try_read1msg( LDAP *ld, int msgid, int all, Sockbuf *sb,
 	assert( ld != NULL );
 	assert( lc != NULL );
 	
-	ber = &lc->lconn_ber;
-
 	Debug( LDAP_DEBUG_TRACE, "read1msg\n", 0, 0, 0 );
 
-#if 0
-	ber_init_w_nullc( &ber, 0 );
-	ldap_set_ber_options( ld, &ber );
-#endif
+    if ( lc->lconn_ber == NULLBER ) {
+		lc->lconn_ber = ldap_alloc_ber_with_options(ld);
+
+		if( lc->lconn_ber == NULL ) {
+			return -1;
+		}
+    }
+
+	ber = lc->lconn_ber;
+	assert( BER_VALID (ber) );
 
 	/* get the next message */
 	errno = 0;
@@ -289,15 +293,22 @@ try_read1msg( LDAP *ld, int msgid, int all, Sockbuf *sb,
 		return -1;
 	}
 
+	/*
+     * We read a complete message.
+	 * The connection should no longer need this ber.
+	 */
+    lc->lconn_ber = NULLBER;
+
 	/* message id */
 	if ( ber_get_int( ber, &id ) == LBER_ERROR ) {
+		ber_free( ber, 1 );
 		ld->ld_errno = LDAP_DECODING_ERROR;
 		return( -1 );
 	}
 
 	/* if it's been abandoned, toss it */
 	if ( ldap_abandoned( ld, (int)id ) ) {
-		ber_clear( ber, 1 );	/* gack! */
+		ber_free( ber, 1 );
 		return( -2 );	/* continue looking */
 	}
 
@@ -305,21 +316,23 @@ try_read1msg( LDAP *ld, int msgid, int all, Sockbuf *sb,
 		Debug( LDAP_DEBUG_ANY,
 		    "no request for response with msgid %ld (tossing)\n",
 		    id, 0, 0 );
-		ber_clear( ber, 1 );	/* gack! */
+		ber_free( ber, 1 );
 		return( -2 );	/* continue looking */
 	}
-	Debug( LDAP_DEBUG_TRACE, "ldap_read: %s msgid %ld, original id %d\n",
-	    ( tag == LDAP_RES_SEARCH_ENTRY ) ? "entry" : 
-		( tag == LDAP_RES_SEARCH_REFERENCE ) ? "reference" : "result",
-		id, lr->lr_origid );
-	id = lr->lr_origid;
 
 	/* the message type */
 	if ( (tag = ber_peek_tag( ber, &len )) == LBER_ERROR ) {
 		ld->ld_errno = LDAP_DECODING_ERROR;
+		ber_free( ber, 1 );
 		return( -1 );
 	}
 
+	Debug( LDAP_DEBUG_TRACE, "ldap_read: %s msgid %ld, original id %d\n",
+	    ( tag == LDAP_RES_SEARCH_ENTRY ) ? "entry" : 
+		( tag == LDAP_RES_SEARCH_REFERENCE ) ? "reference" : "result",
+		id, lr->lr_origid );
+
+	id = lr->lr_origid;
 	refer_cnt = 0;
 	hadref = simple_request = 0;
 	rc = -2;	/* default is to keep looking (no response found) */
@@ -362,7 +375,8 @@ Debug( LDAP_DEBUG_TRACE,
 		    "read1msg:  %d new referrals\n", refer_cnt, 0, 0 );
 
 		if ( refer_cnt != 0 ) {	/* chasing referrals */
-			ber_clear( ber, 1 );	/* gack! */
+			ber_free( ber, 1 );
+			ber = NULL;
 			if ( refer_cnt < 0 ) {
 				return( -1 );	/* fatal error */
 			}
@@ -373,7 +387,8 @@ Debug( LDAP_DEBUG_TRACE,
 				simple_request = ( hadref ? 0 : 1 );
 			} else {
 				/* request with referrals or child request */
-				ber_clear( ber, 1 );	/* gack! */
+				ber_free( ber, 1 );
+				ber = NULL;
 			}
 
 			while ( lr->lr_parent != NULL ) {
@@ -395,7 +410,8 @@ Debug( LDAP_DEBUG_TRACE,
 lr->lr_res_errno, lr->lr_res_error ? lr->lr_res_error : "",
 lr->lr_res_matched ? lr->lr_res_matched : "" );
 				if ( !simple_request ) {
-					ber_clear( ber, 1 ); /* gack! */
+					ber_free( ber, 1 );
+					ber = NULL;
 					if ( build_result_ber( ld, ber, lr )
 					    == LBER_ERROR ) {
 						ld->ld_errno = LDAP_NO_MEMORY;
@@ -412,7 +428,7 @@ lr->lr_res_matched ? lr->lr_res_matched : "" );
 		}
 	}
 
-	if ( ber->ber_buf == NULL ) {
+	if ( ber == NULL ) {
 		return( rc );
 	}
 
@@ -424,8 +440,7 @@ lr->lr_res_matched ? lr->lr_res_matched : "" );
 	}
 	new->lm_msgid = (int)id;
 	new->lm_msgtype = tag;
-	new->lm_ber = ber_dup( ber );
-	ber_clear( ber, 0 ); /* don't kill buffer */
+	new->lm_ber = ber;
 
 #ifndef LDAP_NOCACHE
 		if ( ld->ld_cache != NULL ) {
diff --git a/libraries/libldap/sbind.c b/libraries/libldap/sbind.c
index d52ea2909c..63a4d8acfc 100644
--- a/libraries/libldap/sbind.c
+++ b/libraries/libldap/sbind.c
@@ -59,6 +59,8 @@ ldap_simple_bind( LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *passwd )
 		return( -1 );
 	}
 
+	assert( BER_VALID( ber ) );
+
 	/* fill it in */
 	if ( ber_printf( ber, "{it{ists}}", ++ld->ld_msgid, LDAP_REQ_BIND,
 	    ld->ld_version, dn, LDAP_AUTH_SIMPLE, passwd ) == -1 ) {
diff --git a/libraries/libldap/schema.c b/libraries/libldap/schema.c
index 3722c16a9d..f363d3fe04 100644
--- a/libraries/libldap/schema.c
+++ b/libraries/libldap/schema.c
@@ -8,15 +8,15 @@
 
 #include "portable.h"
 
+#include <stdio.h>
+#include <stdlib.h>
+
 #include <ac/ctype.h>
 #include <ac/string.h>
-#ifdef HAVE_MALLOC_H
-#include <malloc.h>
-#endif
+
 #include <lber.h>
 #include <ldap.h>
 #include <ldap_schema.h>
-#include <stdio.h>
 
 /*
  * When pretty printing the entities we will be appending to a buffer.
diff --git a/libraries/libldap/url.c b/libraries/libldap/url.c
index ed6f8a889e..f61eb49d13 100644
--- a/libraries/libldap/url.c
+++ b/libraries/libldap/url.c
@@ -283,7 +283,7 @@ ldap_url_search( LDAP *ld, LDAP_CONST char *url, int attrsonly )
 			err = -1;
 		} else {
 			if ( ludp->lud_port == 0 ) {
-				srv->lsrv_port = openldap_ldap_global_options.ldo_defport;
+				srv->lsrv_port = ldap_int_global_options.ldo_defport;
 			} else {
 				srv->lsrv_port = ludp->lud_port;
 			}
diff --git a/servers/slapd/back-ldbm/modify.c b/servers/slapd/back-ldbm/modify.c
index e9460b1a20..756ceaeada 100644
--- a/servers/slapd/back-ldbm/modify.c
+++ b/servers/slapd/back-ldbm/modify.c
@@ -213,7 +213,6 @@ ldbm_back_modify(
 	struct ldbminfo	*li = (struct ldbminfo *) be->be_private;
 	char		*matched;
 	Entry		*e;
-	int		err;
 
 	Debug(LDAP_DEBUG_ARGS, "ldbm_back_modify:\n", 0, 0, 0);
 
@@ -234,8 +233,6 @@ ldbm_back_modify(
 
 	}
 
-
-
 	/* change the entry itself */
 	if ( id2entry_add( be, e ) != 0 ) {
 		send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR, NULL, NULL );
diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index d73acf27cf..1726dd3b84 100644
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -94,7 +94,7 @@ send_ldap_result2(
 	ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 
 	/* write the pdu */
-	bytes = ber->ber_ptr - ber->ber_buf;
+	bytes = ber_pvt_ber_bytes( ber );
 
 	while ( 1 ) {
 		int err;
@@ -329,7 +329,7 @@ send_search_entry(
 		return( 1 );
 	}
 
-	bytes = ber->ber_ptr - ber->ber_buf;
+	bytes = ber_pvt_ber_bytes( ber );
 
 	/* write only one pdu at a time - wait til it's our turn */
 	ldap_pvt_thread_mutex_lock( &conn->c_write_mutex );