import back-ldap/back-meta improvements from HEAD

diff --git a/CHANGES b/CHANGES
index b5dca8ed0c6779fcfef4988d469d5f9596e99eed..18bd0efc0ebb7a3b35445433e15522b72075cb35 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ OpenLDAP 2.3.34 Engineering
        Fixed slapadd LDIF parsing (ITS#4817)
        Fixed slapd syncrepl memory leaks (ITS#4805)
        Fixed slapd-bdb/hdb be_entry_get with aliases/referrals (ITS#4810)
+       Fixed slapd-ldap more response handling bugs (ITS#4782)
        Fixed slapd-ldap C-API code tests (ITS#4808)
        Fixed slapd-monitor NULL printf (ITS#4811)
        Fixed slapo-syncprov presence list (ITS#4813)

diff --git a/servers/slapd/back-ldap/back-ldap.h b/servers/slapd/back-ldap/back-ldap.h
index c248e71e1b6adf29509dd20d53bacc1a8f4e97d8..f47ceea21df1dad011398769712710fe263d8999 100644 (file)
--- a/servers/slapd/back-ldap/back-ldap.h
+++ b/servers/slapd/back-ldap/back-ldap.h
@@ -63,11 +63,11 @@ typedef struct ldapconn_t {
                                                ( -1 - (long)(lc)->lc_conn ) : (lc)->lc_conn->c_connid )
 #ifdef HAVE_TLS
 #define        LDAP_BACK_PCONN_ROOTDN_SET(lc, op) \
-       ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_ROOTDN_TLS : LDAP_BACK_PCONN_ROOTDN))
+       ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? (void *) LDAP_BACK_PCONN_ROOTDN_TLS : (void *) LDAP_BACK_PCONN_ROOTDN))
 #define        LDAP_BACK_PCONN_ANON_SET(lc, op) \
-       ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_ANON_TLS : LDAP_BACK_PCONN_ANON))
+       ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? (void *) LDAP_BACK_PCONN_ANON_TLS : (void *) LDAP_BACK_PCONN_ANON))
 #define        LDAP_BACK_PCONN_BIND_SET(lc, op) \
-       ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_BIND_TLS : LDAP_BACK_PCONN_BIND))
+       ((lc)->lc_conn = (void *)((op)->o_conn->c_is_tls ? (void *) LDAP_BACK_PCONN_BIND_TLS : (void *) LDAP_BACK_PCONN_BIND))
 #else /* ! HAVE_TLS */
 #define        LDAP_BACK_PCONN_ROOTDN_SET(lc, op) \
        ((lc)->lc_conn = (void *)LDAP_BACK_PCONN_ROOTDN)
@@ -288,6 +288,8 @@ typedef struct ldapinfo_t {
 #define        LDAP_BACK_F_CANCEL_MASK         (LDAP_BACK_F_CANCEL_IGNORE|LDAP_BACK_F_CANCEL_EXOP)
 #define        LDAP_BACK_F_CANCEL_MASK2        (LDAP_BACK_F_CANCEL_MASK|LDAP_BACK_F_CANCEL_EXOP_DISCOVER)
 
+#define        LDAP_BACK_F_QUARANTINE          (0x00010000U)
+
 #define        LDAP_BACK_ISSET_F(ff,f)         ( ( (ff) & (f) ) == (f) )
 #define        LDAP_BACK_ISMASK_F(ff,m,f)      ( ( (ff) & (m) ) == (f) )
 
@@ -319,6 +321,8 @@ typedef struct ldapinfo_t {
 #define        LDAP_BACK_CANCEL(li)            LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP )
 #define        LDAP_BACK_CANCEL_DISCOVER(li)   LDAP_BACK_ISMASK( (li), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER )
 
+#define        LDAP_BACK_QUARANTINE(li)        LDAP_BACK_ISSET( (li), LDAP_BACK_F_QUARANTINE )
+
        int                     li_version;
 
        /* cached connections; 
@@ -341,7 +345,6 @@ typedef struct ldapinfo_t {
 #define        LDAP_BACK_FQ_RETRYING   (2)
 
        slap_retry_info_t       li_quarantine;
-#define        LDAP_BACK_QUARANTINE(li)        ( (li)->li_quarantine.ri_num != NULL )
        ldap_pvt_thread_mutex_t li_quarantine_mutex;
        ldap_back_quarantine_f  li_quarantine_f;
        void                    *li_quarantine_p;

diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index b4f4529887a667dfa3410c5f97857f92d89e0b0c..c9d8ecbadbd9791955bbfa99cf748d47012b6cbc 100644 (file)
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -644,6 +644,7 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_
        ldap_pvt_thread_mutex_unlock( &li->li_uri_mutex );
        if ( rs->sr_err != LDAP_SUCCESS ) {
                ldap_unbind_ext( ld, NULL, NULL );
+               rs->sr_text = "Start TLS failed";
                goto error_return;
 
        } else if ( li->li_idle_timeout ) {
@@ -670,10 +671,9 @@ error_return:;
                rs->sr_err = slap_map_api2result( rs );
                if ( sendok & LDAP_BACK_SENDERR ) {
                        if ( rs->sr_text == NULL ) {
-                               rs->sr_text = "ldap_initialize() failed";
+                               rs->sr_text = "Proxy connection initialization failed";
                        }
                        send_ldap_result( op, rs );
-                       rs->sr_text = NULL;
                }
 
        } else {
@@ -726,6 +726,7 @@ ldap_back_getconn(
                if ( dont_retry ) {
                        rs->sr_err = LDAP_UNAVAILABLE;
                        if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+                               rs->sr_text = "Target is quarantined";
                                send_ldap_result( op, rs );
                        }
                        return NULL;
@@ -1019,10 +1020,9 @@ retry_lock:
                                LDAP_BACK_CONN_CACHED_CLEAR( lc );
                                ldap_back_conn_free( lc );
                                rs->sr_err = LDAP_OTHER;
-                               rs->sr_text = "proxy bind collision";
+                               rs->sr_text = "Proxy bind collision";
                                if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
                                        send_ldap_result( op, rs );
-                                       rs->sr_text = NULL;
                                }
                                return NULL;
                        }
@@ -1350,6 +1350,7 @@ retry:;
                                /* lc here must be the regular lc, reset and ready for init */
                                rs->sr_err = ldap_back_prepare_conn( lc, op, rs, sendok );
                                if ( rs->sr_err != LDAP_SUCCESS ) {
+                                       sendok &= ~LDAP_BACK_SENDERR;
                                        lc->lc_refcnt = 0;
                                }
                        }
@@ -1379,6 +1380,7 @@ retry:;
                if ( rs->sr_err != LDAP_SUCCESS &&
                        ( sendok & LDAP_BACK_SENDERR ) )
                {
+                       rs->sr_text = "Internal proxy bind failure";
                        send_ldap_result( op, rs );
                }
 
@@ -1386,7 +1388,7 @@ retry:;
        }
 
        rc = ldap_back_op_result( lc, op, rs, msgid,
-               -1, (sendok|LDAP_BACK_BINDING) );
+               -1, ( sendok | LDAP_BACK_BINDING ) );
        if ( rc == LDAP_SUCCESS ) {
                LDAP_BACK_CONN_ISBOUND_SET( lc );
        }
@@ -1559,8 +1561,23 @@ retry:;
                                if ( sendok & LDAP_BACK_BINDING ) {
                                        ldap_unbind_ext( lc->lc_ld, NULL, NULL );
                                        lc->lc_ld = NULL;
+
+                                       /* let it be used, but taint/delete it so that 
+                                        * no-one else can look it up any further */
+                                       ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
+
+#if LDAP_BACK_PRINT_CONNTREE > 0
+                                       ldap_back_print_conntree( li, ">>> ldap_back_getconn(timeout)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+
+                                       (void)ldap_back_conn_delete( li, lc );
                                        LDAP_BACK_CONN_TAINTED_SET( lc );
 
+#if LDAP_BACK_PRINT_CONNTREE > 0
+                                       ldap_back_print_conntree( li, "<<< ldap_back_getconn(timeout)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+                                       ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
+
                                } else {
                                        (void)ldap_back_cancel( lc, op, rs, msgid, sendok );
                                }
@@ -1636,6 +1653,7 @@ retry:;
                                ldap_back_quarantine( op, rs );
                        }
                        if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+                               if ( rs->sr_text == NULL ) rs->sr_text = "Proxy operation retry failed";
                                send_ldap_result( op, rs );
                        }
                }
@@ -1681,8 +1699,7 @@ int
 ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 {
        ldapinfo_t      *li = (ldapinfo_t *)op->o_bd->be_private;
-       int             rc = 0,
-                       binding;
+       int             rc = 0;
 
        assert( lcp != NULL );
        assert( *lcp != NULL );
@@ -1690,7 +1707,7 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
        ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
 
        if ( (*lcp)->lc_refcnt == 1 ) {
-               binding = LDAP_BACK_CONN_BINDING( *lcp );
+               int binding = LDAP_BACK_CONN_BINDING( *lcp );
 
                ldap_pvt_thread_mutex_lock( &li->li_uri_mutex );
                Debug( LDAP_DEBUG_ANY,
@@ -1739,9 +1756,9 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
                ldap_back_release_conn_lock( li, lcp, 0 );
                assert( *lcp == NULL );
 
-               if ( sendok ) {
+               if ( sendok & LDAP_BACK_SENDERR ) {
                        rs->sr_err = LDAP_UNAVAILABLE;
-                       rs->sr_text = "unable to retry";
+                       rs->sr_text = "Unable to retry";
                        send_ldap_result( op, rs );
                }
        }
@@ -1986,7 +2003,7 @@ ldap_back_proxy_authz_bind(
                                binddn->bv_val, LDAP_SASL_SIMPLE,
                                bindcred, NULL, NULL, &msgid );
                rc = ldap_back_op_result( lc, op, rs, msgid,
-                       -1, (sendok|LDAP_BACK_BINDING) );
+                       -1, ( sendok | LDAP_BACK_BINDING ) );
                break;
 
        default:

diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index 3f68a3294d4da9f1f2fd5a0f04f572d1950fa608..83e842abe6edfa1a4c9d55768d951964f773386e 100644 (file)
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -382,9 +382,7 @@ static slap_cf_aux_table timeout_table[] = {
        { BER_BVC("modrdn="),   SLAP_OP_MODRDN * sizeof( time_t ),      'u', 0, NULL },
        { BER_BVC("modify="),   SLAP_OP_MODIFY * sizeof( time_t ),      'u', 0, NULL },
        { BER_BVC("compare="),  SLAP_OP_COMPARE * sizeof( time_t ),     'u', 0, NULL },
-#if 0  /* uses timelimit instead */
        { BER_BVC("search="),   SLAP_OP_SEARCH * sizeof( time_t ),      'u', 0, NULL },
-#endif
        /* abandon makes little sense */
 #if 0  /* not implemented yet */
        { BER_BVC("extended="), SLAP_OP_EXTENDED * sizeof( time_t ),    'u', 0, NULL },
@@ -1224,6 +1222,7 @@ ldap_back_cf_gen( ConfigArgs *c )
                        slap_retry_info_destroy( &li->li_quarantine );
                        ldap_pvt_thread_mutex_destroy( &li->li_quarantine_mutex );
                        li->li_isquarantined = 0;
+                       li->li_flags &= ~LDAP_BACK_F_QUARANTINE;
                        break;
 
                default:
@@ -1835,6 +1834,7 @@ done_url:;
                        /* give it a chance to retry if the pattern gets reset
                         * via back-config */
                        li->li_isquarantined = 0;
+                       li->li_flags |= LDAP_BACK_F_QUARANTINE;
                }
                break;
 

diff --git a/servers/slapd/back-ldap/search.c b/servers/slapd/back-ldap/search.c
index 75bceebbf8f1c9a0008746f305869379038f4608..3c7c9a342153d97e7bed4244f2aa6095aa327017 100644 (file)
--- a/servers/slapd/back-ldap/search.c
+++ b/servers/slapd/back-ldap/search.c
@@ -256,12 +256,20 @@ retry:
                }
        }
 
+       /* if needed, initialize timeout */
+       if ( li->li_timeout[ SLAP_OP_SEARCH ] ) {
+               if ( tv.tv_sec == 0 || tv.tv_sec > li->li_timeout[ SLAP_OP_SEARCH ] ) {
+                       tv.tv_sec = li->li_timeout[ SLAP_OP_SEARCH ];
+                       tv.tv_usec = 0;
+               }
+       }
+
        /* We pull apart the ber result, stuff it into a slapd entry, and
         * let send_search_entry stuff it back into ber format. Slow & ugly,
         * but this is necessary for version matching, and for ACL processing.
         */
 
-       for ( rc = 0; rc != -1; rc = ldap_result( lc->lc_ld, msgid, LDAP_MSG_ONE, &tv, &res ) )
+       for ( rc = -2; rc != -1; rc = ldap_result( lc->lc_ld, msgid, LDAP_MSG_ONE, &tv, &res ) )
        {
                /* check for abandon */
                if ( op->o_abandon || LDAP_BACK_CONN_ABANDON( lc ) ) {
@@ -273,10 +281,23 @@ retry:
                        goto finish;
                }
 
-               if ( rc == 0 ) {
-                       LDAP_BACK_TV_SET( &tv );
+               if ( rc == 0 || rc == -2 ) {
                        ldap_pvt_thread_yield();
 
+                       /* check timeout */
+                       if ( li->li_timeout[ SLAP_OP_SEARCH ] ) {
+                               if ( rc == 0 ) {
+                                       (void)ldap_back_cancel( lc, op, rs, msgid, LDAP_BACK_DONTSEND );
+                                       rs->sr_text = "Operation timed out";
+                                       rc = rs->sr_err = op->o_protocol >= LDAP_VERSION3 ?
+                                               LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
+                                       goto finish;
+                               }
+
+                       } else {
+                               LDAP_BACK_TV_SET( &tv );
+                       }
+
                        /* check time limit */
                        if ( op->ors_tlimit != SLAP_NO_LIMIT
                                        && slap_get_time() > stoptime )
@@ -451,6 +472,14 @@ retry:
                        rc = 0;
                        break;
                }
+
+               /* if needed, restore timeout */
+               if ( li->li_timeout[ SLAP_OP_SEARCH ] ) {
+                       if ( tv.tv_sec == 0 || tv.tv_sec > li->li_timeout[ SLAP_OP_SEARCH ] ) {
+                               tv.tv_sec = li->li_timeout[ SLAP_OP_SEARCH ];
+                               tv.tv_usec = 0;
+                       }
+               }
        }
 
        if ( rc == -1 && dont_retry == 0 ) {

diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h
index 4841e1e69fa28230c21696abb080c30ce6ad3bb1..a45b2fc869814cb8db9b70843d7e983443e347c3 100644 (file)
--- a/servers/slapd/back-meta/back-meta.h
+++ b/servers/slapd/back-meta/back-meta.h
@@ -297,7 +297,6 @@ typedef struct metatarget_t {
        sig_atomic_t            mt_isquarantined;
        slap_retry_info_t       mt_quarantine;
        ldap_pvt_thread_mutex_t mt_quarantine_mutex;
-#define        META_BACK_TGT_QUARANTINE(mt)    ( (mt)->mt_quarantine.ri_num != NULL )
 
        unsigned                mt_flags;
 #define        META_BACK_TGT_ISSET(mt,f)               ( ( (mt)->mt_flags & (f) ) == (f) )
@@ -310,6 +309,7 @@ typedef struct metatarget_t {
 #define        META_BACK_TGT_IGNORE(mt)                META_BACK_TGT_ISMASK( (mt), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_IGNORE )
 #define        META_BACK_TGT_CANCEL(mt)                META_BACK_TGT_ISMASK( (mt), LDAP_BACK_F_CANCEL_MASK, LDAP_BACK_F_CANCEL_EXOP )
 #define        META_BACK_TGT_CANCEL_DISCOVER(mt)       META_BACK_TGT_ISMASK( (mt), LDAP_BACK_F_CANCEL_MASK2, LDAP_BACK_F_CANCEL_EXOP_DISCOVER )
+#define        META_BACK_TGT_QUARANTINE(mt)            META_BACK_TGT_ISSET( (mt), LDAP_BACK_F_QUARANTINE )
 
        int                     mt_version;
        time_t                  mt_network_timeout;
@@ -361,8 +361,6 @@ typedef struct metainfo_t {
 
        /* NOTE: quarantine uses the connection mutex */
        slap_retry_info_t       mi_quarantine;
-
-#define        META_BACK_QUARANTINE(mi)        ( (mi)->mi_quarantine.ri_num != NULL )
        meta_back_quarantine_f  mi_quarantine_f;
        void                    *mi_quarantine_p;
 
@@ -386,6 +384,8 @@ typedef struct metainfo_t {
 #define META_BACK_PROXYAUTHZ_ANON(mi)  LDAP_BACK_ISSET( (mi), META_BACK_F_PROXYAUTHZ_ANON )
 #define META_BACK_PROXYAUTHZ_NOANON(mi)        LDAP_BACK_ISSET( (mi), META_BACK_F_PROXYAUTHZ_NOANON )
 
+#define META_BACK_QUARANTINE(mi)       LDAP_BACK_ISSET( (mi), LDAP_BACK_F_QUARANTINE )
+
        int                     mi_version;
        time_t                  mi_network_timeout;
        time_t                  mi_conn_ttl;

diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index 219bef4442db59ae50b1664daaf3fab498f2528a..f5cb6206a21c96336db255d46989b3b20b84d607 100644 (file)
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -1237,15 +1237,14 @@ meta_back_proxy_authz_cred(
                                        send_ldap_result( op, rs );
                                }
                                LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
+                               goto done;
 
-                       } else {
-                               rs->sr_err = LDAP_SUCCESS;
-                               *binddn = slap_empty_bv;
-                               *bindcred = slap_empty_bv;
-                               break;
                        }
 
-                       goto done;
+                       rs->sr_err = LDAP_SUCCESS;
+                       *binddn = slap_empty_bv;
+                       *bindcred = slap_empty_bv;
+                       break;
 
                } else if ( mt->mt_idassert_authz && !be_isroot( op ) ) {
                        struct berval authcDN;
@@ -1264,15 +1263,13 @@ meta_back_proxy_authz_cred(
                                                send_ldap_result( op, rs );
                                        }
                                        LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
-
-                               } else {
-                                       rs->sr_err = LDAP_SUCCESS;
-                                       *binddn = slap_empty_bv;
-                                       *bindcred = slap_empty_bv;
-                                       break;
+                                       goto done;
                                }
 
-                               goto done;
+                               rs->sr_err = LDAP_SUCCESS;
+                               *binddn = slap_empty_bv;
+                               *bindcred = slap_empty_bv;
+                               break;
                        }
                }
 

diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c
index 56ca9dcc6f7e8505e3436b7945f674d22dae1e16..6a00b5a99ae3450f1a0fed022ba76a27cf11f9ff 100644 (file)
--- a/servers/slapd/back-meta/config.c
+++ b/servers/slapd/back-meta/config.c
@@ -973,10 +973,8 @@ meta_back_db_config(
                                        t = &tv[ SLAP_OP_MODIFY ];
                                } else if ( strncasecmp( argv[ c ], "compare", len ) == 0 ) {
                                        t = &tv[ SLAP_OP_COMPARE ];
-#if 0                          /* uses timelimit instead */
                                } else if ( strncasecmp( argv[ c ], "search", len ) == 0 ) {
                                        t = &tv[ SLAP_OP_SEARCH ];
-#endif
                                /* abandon makes little sense */
 #if 0                          /* not implemented yet */
                                } else if ( strncasecmp( argv[ c ], "extended", len ) == 0 ) {
@@ -1230,6 +1228,13 @@ idassert-authzFrom       "dn:<rootdn>"
                                fname, lineno, buf );
                        return 1;
                }
+
+               if ( mi->mi_ntargets ) {
+                       mi->mi_flags |= LDAP_BACK_F_QUARANTINE;
+
+               } else {
+                       mi->mi_targets[ mi->mi_ntargets - 1 ]->mt_flags |= LDAP_BACK_F_QUARANTINE;
+               }
        
        /* dn massaging */
        } else if ( strcasecmp( argv[ 0 ], "suffixmassage" ) == 0 ) {

diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index 6c2ff11abcc5dd2449c85a584c0703a1d12d8587..8a585948dccce13f844f96dc773c97eec655b929 100644 (file)
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -279,28 +279,33 @@ meta_back_init_one_conn(
                slap_retry_info_t       *ri = &mt->mt_quarantine;
                int                     dont_retry = 1;
 
-               if ( mt->mt_isquarantined == LDAP_BACK_FQ_YES ) {
-                       dont_retry = ( ri->ri_num[ ri->ri_idx ] == SLAP_RETRYNUM_TAIL
-                               || slap_get_time() < ri->ri_last + ri->ri_interval[ ri->ri_idx ] );
-                       if ( !dont_retry ) {
-                               if ( StatslogTest( LDAP_DEBUG_ANY ) ) {
-                                       char    buf[ SLAP_TEXT_BUFLEN ];
-
-                                       snprintf( buf, sizeof( buf ),
-                                               "meta_back_init_one_conn[%d]: quarantine "
-                                               "retry block #%d try #%d",
-                                               candidate, ri->ri_idx, ri->ri_count );
-                                       Debug( LDAP_DEBUG_ANY, "%s %s.\n",
-                                               op->o_log_prefix, buf, 0 );
+               if ( mt->mt_quarantine.ri_interval ) {
+                       ldap_pvt_thread_mutex_lock( &mt->mt_quarantine_mutex );
+                       if ( mt->mt_isquarantined == LDAP_BACK_FQ_YES ) {
+                               dont_retry = ( ri->ri_num[ ri->ri_idx ] == SLAP_RETRYNUM_TAIL
+                                       || slap_get_time() < ri->ri_last + ri->ri_interval[ ri->ri_idx ] );
+                               if ( !dont_retry ) {
+                                       if ( StatslogTest( LDAP_DEBUG_ANY ) ) {
+                                               char    buf[ SLAP_TEXT_BUFLEN ];
+
+                                               snprintf( buf, sizeof( buf ),
+                                                       "meta_back_init_one_conn[%d]: quarantine "
+                                                       "retry block #%d try #%d",
+                                                       candidate, ri->ri_idx, ri->ri_count );
+                                               Debug( LDAP_DEBUG_ANY, "%s %s.\n",
+                                                       op->o_log_prefix, buf, 0 );
+                                       }
                                }
 
                                mt->mt_isquarantined = LDAP_BACK_FQ_RETRYING;
                        }
+                       ldap_pvt_thread_mutex_unlock( &mt->mt_quarantine_mutex );
                }
 
                if ( dont_retry ) {
                        rs->sr_err = LDAP_UNAVAILABLE;
                        if ( op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+                               rs->sr_text = "Target is quarantined";
                                send_ldap_result( op, rs );
                        }
                        return rs->sr_err;
@@ -336,6 +341,7 @@ retry_lock:;
 
                /* sounds more appropriate */
                rs->sr_err = LDAP_BUSY;
+               rs->sr_text = "No connections to target are available";
                do_return = 1;
 
        } else if ( META_BACK_CONN_INITED( msc ) ) {
@@ -355,7 +361,10 @@ retry_lock:;
        }
 
        if ( do_return ) {
-               if ( rs->sr_err != LDAP_SUCCESS && op->o_conn && ( sendok & LDAP_BACK_SENDERR ) ) {
+               if ( rs->sr_err != LDAP_SUCCESS
+                       && op->o_conn
+                       && ( sendok & LDAP_BACK_SENDERR ) )
+               {
                        send_ldap_result( op, rs );
                }
 
@@ -398,8 +407,10 @@ retry_lock:;
 
 #ifdef HAVE_TLS
        /* start TLS ("tls [try-]{start|propagate}" statement) */
-       if ( ( LDAP_BACK_USE_TLS( mi ) || ( op->o_conn->c_is_tls && LDAP_BACK_PROPAGATE_TLS( mi ) ) )
-                       && !is_ldaps )
+       if ( ( LDAP_BACK_USE_TLS( mi )
+               || ( op->o_conn->c_is_tls
+                       && LDAP_BACK_PROPAGATE_TLS( mi ) ) )
+               && !is_ldaps )
        {
 #ifdef SLAP_STARTTLS_ASYNCHRONOUS
                /*
@@ -446,14 +457,14 @@ retry:;
                                struct berval   *data = NULL;
 
                                /* NOTE: right now, data is unused, so don't get it */
-                               rs->sr_err = ldap_parse_extended_result( msc->msc_ld, res,
-                                               NULL, NULL /* &data */ , 0 );
+                               rs->sr_err = ldap_parse_extended_result( msc->msc_ld,
+                                       res, NULL, NULL /* &data */ , 0 );
                                if ( rs->sr_err == LDAP_SUCCESS ) {
                                        int             err;
 
                                        /* FIXME: matched? referrals? response controls? */
-                                       rs->sr_err = ldap_parse_result( msc->msc_ld, res,
-                                               &err, NULL, NULL, NULL, NULL, 1 );
+                                       rs->sr_err = ldap_parse_result( msc->msc_ld,
+                                               res, &err, NULL, NULL, NULL, NULL, 1 );
                                        res = NULL;
 
                                        if ( rs->sr_err == LDAP_SUCCESS ) {
@@ -470,14 +481,12 @@ retry:;
                                        } else if ( rs->sr_err == LDAP_REFERRAL ) {
                                                /* FIXME: LDAP_OPERATIONS_ERROR? */
                                                rs->sr_err = LDAP_OTHER;
-                                               rs->sr_text = "unwilling to chase referral returned by Start TLS exop";
+                                               rs->sr_text = "Unwilling to chase referral "
+                                                       "returned by Start TLS exop";
                                        }
 
                                        if ( data ) {
-                                               if ( data->bv_val ) {
-                                                       ber_memfree( data->bv_val );
-                                               }
-                                               ber_memfree( data );
+                                               ber_bvfree( data );
                                        }
                                }
 
@@ -501,12 +510,16 @@ retry:;
                 * of misconfiguration, but also when used in the chain 
                 * overlay, where the "uri" can be parsed out of a referral */
                if ( rs->sr_err == LDAP_SERVER_DOWN
-                               || ( rs->sr_err != LDAP_SUCCESS && LDAP_BACK_TLS_CRITICAL( mi ) ) )
+                       || ( rs->sr_err != LDAP_SUCCESS
+                               && LDAP_BACK_TLS_CRITICAL( mi ) ) )
                {
 
 #ifdef DEBUG_205
-                       Debug( LDAP_DEBUG_ANY, "### %s meta_back_init_one_conn(TLS) ldap_unbind_ext[%d] ld=%p\n",
-                               op->o_log_prefix, candidate, (void *)msc->msc_ld );
+                       Debug( LDAP_DEBUG_ANY,
+                               "### %s meta_back_init_one_conn(TLS) "
+                               "ldap_unbind_ext[%d] ld=%p\n",
+                               op->o_log_prefix, candidate,
+                               (void *)msc->msc_ld );
 #endif /* DEBUG_205 */
 
                        /* need to trash a failed Start TLS */
@@ -575,8 +588,11 @@ retry:;
                        {
 
 #ifdef DEBUG_205
-                               Debug( LDAP_DEBUG_ANY, "### %s meta_back_init_one_conn(rewrite) ldap_unbind_ext[%d] ld=%p\n",
-                                       op->o_log_prefix, candidate, (void *)msc->msc_ld );
+                               Debug( LDAP_DEBUG_ANY,
+                                       "### %s meta_back_init_one_conn(rewrite) "
+                                       "ldap_unbind_ext[%d] ld=%p\n",
+                                       op->o_log_prefix, candidate,
+                                       (void *)msc->msc_ld );
 #endif /* DEBUG_205 */
 
                                /* need to trash a connection not fully established */
@@ -618,7 +634,6 @@ error_return:;
                rs->sr_err = slap_map_api2result( rs );
                if ( sendok & LDAP_BACK_SENDERR ) {
                        send_ldap_result( op, rs );
-                       rs->sr_text = NULL;
                }
        }
 
@@ -771,7 +786,7 @@ meta_back_retry(
 
                if ( sendok & LDAP_BACK_SENDERR ) {
                        rs->sr_err = rc;
-                       rs->sr_text = NULL;
+                       rs->sr_text = "Unable to retry";
                        send_ldap_result( op, rs );
                }
        }
@@ -830,7 +845,7 @@ meta_back_get_candidate(
         */
        if ( candidate == META_TARGET_NONE ) {
                rs->sr_err = LDAP_NO_SUCH_OBJECT;
-               rs->sr_text = "no suitable candidate target found";
+               rs->sr_text = "No suitable candidate target found";
 
        } else if ( candidate == META_TARGET_MULTIPLE ) {
                Filter          f = { 0 };
@@ -883,7 +898,7 @@ meta_back_get_candidate(
 
                        } else {
                                rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
-                               rs->sr_text = "cannot select unique candidate target";
+                               rs->sr_text = "Unable to select unique candidate target";
                        }
                        break;
                }
@@ -1259,7 +1274,6 @@ retry_lock:;
                                        rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
                                }
                                send_ldap_result( op, rs );
-                               rs->sr_text = NULL;
                                rs->sr_matched = NULL;
                        }
 
@@ -1307,7 +1321,6 @@ retry_lock:;
                                                rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
                                        }
                                        send_ldap_result( op, rs );
-                                       rs->sr_text = NULL;
                                        rs->sr_matched = NULL;
                                }
                        
@@ -1322,10 +1335,9 @@ retry_lock:;
                        }
 
                        rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
-                       rs->sr_text = "cross-target rename not supported";
+                       rs->sr_text = "Cross-target rename not supported";
                        if ( sendok & LDAP_BACK_SENDERR ) {
                                send_ldap_result( op, rs );
-                               rs->sr_text = NULL;
                        }
 
                        return NULL;
@@ -1503,7 +1515,6 @@ retry_lock2:;
                                        if ( META_BACK_ONERR_STOP( mi ) ) {
                                                if ( sendok & LDAP_BACK_SENDERR ) {
                                                        send_ldap_result( op, rs );
-                                                       rs->sr_text = NULL;
                                                }
                                                if ( new_conn ) {
                                                        mc->mc_refcnt = 0;
@@ -1516,7 +1527,6 @@ retry_lock2:;
                                                return NULL;
                                        }
 
-                                       rs->sr_text = NULL;
                                        continue;
                                }
 
@@ -1546,7 +1556,6 @@ retry_lock2:;
                                        rs->sr_matched = op->o_bd->be_suffix[ 0 ].bv_val;
                                }
                                send_ldap_result( op, rs );
-                               rs->sr_text = NULL;
                                rs->sr_matched = NULL;
                        }
 
@@ -1632,10 +1641,9 @@ done:;
                                meta_back_conn_free( mc );
 
                                rs->sr_err = LDAP_OTHER;
-                               rs->sr_text = "proxy bind collision";
+                               rs->sr_text = "Proxy bind collision";
                                if ( sendok & LDAP_BACK_SENDERR ) {
                                        send_ldap_result( op, rs );
-                                       rs->sr_text = NULL;
                                }
                                return NULL;
                        }
@@ -1698,6 +1706,7 @@ meta_back_release_conn_lock(
                        tmpmc = avl_delete( &mi->mi_conninfo.lai_tree,
                                ( caddr_t )mc, meta_back_conndnmc_cmp );
 
+                       /* Overparanoid, but useful... */
                        assert( tmpmc == NULL || tmpmc == mc );
                }
 

diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c
index 184d798ef8d9b3907d24ca36ad29be3a10407713..86efcbeea7e6613dcca87b055b52b19c54d5bc32 100644 (file)
--- a/servers/slapd/back-meta/search.c
+++ b/servers/slapd/back-meta/search.c
@@ -649,7 +649,9 @@ meta_back_search( Operation *op, SlapReply *rs )
        metaconn_t      *mc;
        struct timeval  save_tv = { 0, 0 },
                        tv;
-       time_t          stoptime = (time_t)-1;
+       time_t          stoptime = (time_t)(-1),
+                       lastres_time = slap_get_time(),
+                       timeout = 0;
        int             rc = 0, sres = LDAP_SUCCESS;
        char            *matched = NULL;
        int             last = 0, ncandidates = 0,
@@ -700,6 +702,13 @@ getconn:;
                candidates[ i ].sr_text = NULL;
                candidates[ i ].sr_ref = NULL;
                candidates[ i ].sr_ctrls = NULL;
+
+               /* get largest timeout among candidates */
+               if ( mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ]
+                       && mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ] > timeout )
+               {
+                       timeout = mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ];
+               }
        }
 
        for ( i = 0; i < mi->mi_ntargets; i++ ) {
@@ -844,6 +853,22 @@ getconn:;
                int     gotit = 0,
                        doabandon = 0,
                        alreadybound = ncandidates;
+               time_t  curr_time = 0;
+
+               /* check timeout */
+               if ( timeout && lastres_time > 0
+                       && ( slap_get_time() - lastres_time ) > timeout )
+               {
+                       doabandon = 1;
+                       rs->sr_text = "Operation timed out";
+                       rc = rs->sr_err = op->o_protocol >= LDAP_VERSION3 ?
+                               LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
+                       savepriv = op->o_private;
+                       op->o_private = (void *)i;
+                       send_ldap_result( op, rs );
+                       op->o_private = savepriv;
+                       goto finish;
+               }
 
                /* check time limit */
                if ( op->ors_tlimit != SLAP_NO_LIMIT
@@ -1051,9 +1076,11 @@ really_bad:;
                                continue;
 
                        default:
+                               lastres_time = slap_get_time();
+
                                /* only touch when activity actually took place... */
-                               if ( mi->mi_idle_timeout != 0 && msc->msc_time < op->o_time ) {
-                                       msc->msc_time = op->o_time;
+                               if ( mi->mi_idle_timeout != 0 && msc->msc_time < lastres_time ) {
+                                       msc->msc_time = lastres_time;
                                }
                                break;
                        }